Legal Policy

Introduction

Effective as of December 20, 2019

Cerus Corporation and our subsidiaries and affiliates (collectively, “Cerus”, “we” or “us”) respect your privacy, and recognize the need for appropriate protection and management of personal information you may share with us. This Privacy Policy describes how we will treat any personal information that we process in connection with the use of this website, http://intercept-usa.com, any other website that we own or control which posts or links to this Privacy Policy, and our products and services. This Privacy Policy also explains the rights and choices available to individuals with respect to their personal information.

We may provide additional privacy notices to individuals at the time we collect their data For example, we provide a specific privacy notice to clinical trial participants that describe our privacy practices in connection with conducting clinical trials. This type of an “in-time” notice will govern how we may process the information you provide at that time.

Individuals located in the European Union should be sure to read the important information provided here.

Collection of Personal Data

We collect personal information in the following ways:

• • Directly from individuals
  • Through our websites and mobile apps
  • From healthcare professionals
  • From contract research organizations and clinical trial investigators
  • From government agencies or public records
  • From third party service providers or business partners
  • From industry and patient groups and associations
  • From social media or other public forums 

We collect the following types of personal information, depending on the nature of our relationship with you and the requirements of applicable laws:

• • Contact information and preferences, such as your name, address, e-mail, telephone number and/or fax number.
  • Biographical and demographic information (such as date of birth, age, and gender)
  • Health and medical information we collect in connection with managing clinical trials, conducting research, and tracking adverse event reports
  • Professional credentials, educational and professional history job title, organization name and institutional affiliations
  • Payment-related information we need to pay for professional services, such as consulting, that individuals may provide to us (such as tax identification number and financial account information)
  • Engagement data, such as information about the programs, conferences and activities in which you have participated, and the agreements you have executed with us
  • Feedback, including from social media posts, in emails, on phone calls, in market research surveys, or in other correspondence with us or our service providers or business partners (such as comments describing support for and experience with Cerus products)

Automatically collected data. We, our service providers, and/or our business partners may automatically log information about you, your computer or your activity on our websites over time and across third-party websites, as described in our Cookies Policy, such as:

• • Device identifiers, including information about the device you are using to connect to our websites, such as your device operating system type and version number, manufacturer and model, device identifier, browser type, screen resolution, IP address, and other device identifiers
  • Online activity data, including browsing history, search history, clickstream data, and other information about your interactions with our websites, applications, social media pages, and email communications

Some Internet browsers may be configured to send "Do Not Track" signals to the online services that you visit. We currently do not respond to do not track signals. To find out more about "Do Not Track," please visit http://www.allaboutdnt.com.

Use of Personal Data

We use this information for one or more of the following purposes:

For our operations
We may use information about you in connection with our ongoing business operations, including to manage our relationship with you, to enable delivery of products and services to you, to respond to your service-related requests and inquiries to our customer service and business teams, to provide you with product and service updates, to enable you to participate in surveys or questionnaires, and to provide you with opportunities to learn about other products, programs, or services that we believe may be of interest to you. We also use your information to improve our website, products and services, marketing, and customer relationships and experiences

To provide you with information
We use your information to respond to your requests and provide information that you have requested from us. We also may send you additional information about other Cerus products and services. For example, when you subscribe to a mailing list, such as for purposes of marketing, investor or educational mailing lists, we use the information you provide to deliver the e-mails you have elected to receive. You will have the ability to opt out of any such communications.

To manage our recruitment process
When you apply for a position at Cerus, you may provide us with personal information such as your name, e-mail address, mailing address, phone number, employment history and any other personal information contained in your resume and correspondence with Cerus. We may use your personal information for employee recruitment purposes and to respond to your requests for information.

To perform and administer clinical trials, research and product-improvement activities
We may use your personal information when necessary to facilitate our clinical trials, research, studies, and related activities that support product improvement, including staffing and managing clinical trials (such as recruiting investigators and participants), tracking and responding to safety and product quality concerns (including product recalls), supporting scientific, educational and volunteer events (such as conferences), and identifying and engaging thought leaders and external experts.

To provide our products and services
We use your personal information as necessary to provide Cerus products and services, including to manage access to our products (such as where access is limited by law), and pay for services individuals may provide to us.

To display advertisements
We work with advertising partners to advertise our products and services. These advertisements are delivered by our advertising partners and may be targeted based on your use of our websites, your interactions with us, or your activity elsewhere online. To learn more about your choices in connection with advertisements, visit the Online Advertising section below.

To comply with law
We use your personal information as we believe necessary or appropriate to comply with applicable laws, lawful requests and legal process, such as to respond to subpoenas or requests from government authorities.

To comply with regulatory monitoring and reporting obligations
We use your personal information as we believe necessary or appropriate to comply with regulatory monitoring and reporting obligations, such as those related to adverse events, product complaints, patient safety, and financial disclosures.

With your consent
We will request your consent to use your personal data where required by law, such as where we use certain cookies or similar technologies or would like to send you certain marketing messages. If we request your consent to use your personal data, you have the right to withdraw your consent any time in the manner indicated when we requested the consent or by contacting us as provided below.

To create anonymous, aggregated or de-identified data
We may create anonymous, aggregated or de-identified data from your personal information and other individuals whose personal information we collect. We make personal information into anonymous, aggregated or de-identified data by excluding information that makes the data personally identifiable to you, and use that anonymous data for our lawful business purposes.

For compliance, fraud prevention and safety
We use your personal information as we believe necessary or appropriate to (a) enforce the terms and conditions that govern our websites, mobile apps, products and services; (b) protect our rights, privacy, safety or property, and/or that of you or others; and (c) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.

We will only use your personal data when the law allows us to and for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

Sharing and Disclosure

• • Affiliates. We may disclose your personal information to our subsidiaries and corporate affiliates for purposes consistent with this Privacy Policy.
    
    
  • Service providers. We may provide your personal information to third party vendors and service providers that we engage to assist us with our business activities. For example, we may provide your personal information to an organization in order to complete a service (e.g., shipping an order, sending mailings you have requested), to assist us in reviewing the data or to provide marketing or advertising on our behalf. These companies are authorized to use personal information about you only as necessary to provide these services to us.
    
    
  • Business and advertising partners. We may disclose your personal information to partners with whom we develop or provide products or services, in connection with the development and promotion of such products or services, and to third party advertising companies that collect information about your activity on our websites to help us advertise our products and services. We may also share your personal information with health care professionals, researchers, academics, public health organizations, and publishers for purposes consistent with this Privacy Policy.
    
    
  • Professional advisors. We may also disclose your personal information to professional advisors, such as lawyers, bankers, auditors and insurers, where necessary, in the course of the professional services that they render to us.
    
    
  • Authorities and others. In certain situations, we may disclose your personal information if we believe we are required to do so by law, regulation or other government authority, and as we believe necessary or appropriate to (a) enforce the terms and conditions that govern our websites and services; (b) protect our rights, privacy, safety or property, and/or that of you or others; and (c) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.
    
    
  • Business transferees. We will not sell your personal information to any other company or organization, except we may transfer your personal information to a successor entity upon a merger, consolidation or other corporate reorganization in which Cerus participates or to a purchaser of all or substantially all of Cerus’ assets. You will be notified via e-mail and/or a notice on our website of any change in ownership, and choices you may have regarding your personal information.

Additional Program Terms
In some situations, we may have a separate agreement or relationship with you with respect to a specific type of processing of your data, such as if you participate in a special program, activity, event, or clinical trial. These situations will be governed by specific terms, privacy notices, or consent forms that provide additional information about how we will use your information. We will honor these additional terms with respect to your information and thus, strongly recommend you review the additional terms prior to participating in any programs.

International Transfers
Cerus is headquartered in the United States and has affiliates and service providers in other countries, and your personal information may be transferred to the United States or other locations outside of your state, province, country or other governmental jurisdiction where privacy laws may not be as protective as those in your jurisdiction. Individuals in the European Union should read the important information provided about transfer of personal information outside of the European Economic Area.

Personal Information and Children
Our websites are not directed to children under the age of 13, and we will not knowingly collect personal information through our websites from a minor under the age of 13. If we learn that we have collected personal information directly from a child under the age of 13 through our websites, we will delete that information.

Links to Other Sites
Our websites may include links to other websites that we believe may be of interest to our visitors. We aim to ensure that such websites are of the highest standard. However, Cerus cannot guarantee the standards of every website link it provides or be responsible for the contents of non-Cerus sites. We encourage you to consult the privacy notices of these sites, as we have no control over information that is collected by these third parties, and our Privacy Policy does not cover activities at other websites.

Privacy Policy Updates
We may update this Privacy Policy from time to time. If so, we will post the updated Privacy Policy to this page so users are always aware of what personal information we may collect and how we handle this information. Cerus encourages you to review this Privacy Policy regularly for any changes. Your continued use of our websites will be subject to the then-current Privacy Policy.

Security
We consider the protection of all personal information we receive from our website visitors and others as critical to our corporate mission, and we have reasonable and appropriate security measures to protect against the loss, misuse, alteration or disclosure of your personal information. However, you should be aware that no security safeguards are 100% secure and we cannot guarantee the security of your information.

Your Choices

You may have the following choices regarding your information:

Access, Review, Update Your Information
If you become aware that the information we maintain about you is inaccurate, incomplete, misleading, irrelevant or out of date, or if you would like to request to access or review your information, you may contact us at privacy@cerus.com.

Marketing Communications
To "opt-out" of receiving marketing or promotional emails or communications, you may use the “unsubscribe” feature included in the specific communication, or send an e-mail to privacy@cerus.com with the subject line “Unsubscribe”. You may also email the Investor Relations department at ir@cerus.com with the subject line “Unsubscribe” to request to be removed from the investor relations mailing list. Where you opt-out of receiving marketing or promotional communications, this will not apply to service-related and non-marketing emails.

Cookies
You can generally set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our websites may become inaccessible or not function properly. For more information about the cookies we use, please see our Cookies Policy and Tracking Opt-out Guide.

Online advertising
Some of the business partners that collect information about users’ activities on or through our websites may be members of organizations or programs that provide choices to individuals regarding the use of their browsing behavior for purposes of targeted advertising. Users may opt out of receiving targeted advertising on websites through members of the Network Advertising Initiative by clicking here or the Digital Advertising Alliance by clicking here. Please note that we also may work with companies that offer their own opt-out mechanisms and may not participate in the opt-out mechanisms that we linked above. If you choose to opt-out of targeted advertisements, you will still see advertisements online but they may not be relevant to you. Even if you do choose to opt out, not all companies that serve online behavioral advertising are included in this list, so you may still receive some cookies and tailored advertisements from companies that are not listed.

Choosing not to Share your Personal Information
Where we are required by law to collect your personal information, or where we need your personal information in order to provide you with our products or services, if you do not provide this information when requested (or you later ask to delete it), we may not be able to provide you with our products or services and may need to terminate our relationship with you. We will tell you what information you must provide to us by designating it as required when we request the information or through other appropriate means.

Contact Us
If you have any questions or concerns about our Privacy Policy, or to contact our data protection officer, please contact us at:

Cerus Corporation
Attn: Data Protection Officer
1220 Concord Avenue
Concord, CA US 94520
privacy@cerus.com

Additional Information for European Union Users

Personal information
References to “personal information” in this Privacy Policy are equivalent to “personal data” governed by European data protection legislation. 

Controller and Data Protection Officer
Cerus Corporation is generally the controller of your personal information for purposes of European data protection legislation.  In many cases, Cerus Europe BV will also be a data controller. Cerus Corporation’s EU representative is Cerus Europe BV, which can be reached by post at: Stationsstraat 79-D, 3811 MH Amersfoort, Netherlands, or by email at: customer_services@cerus.com.

Legal bases for processing
We only use your personal information as permitted by law.  We are required to inform you of the legal bases of our processing of your personal information, which are described in the table below.  If you have questions about the legal basis of how we process your personal information, contact us at privacy@cerus.com or at the address provided above. 

Use for new purposes

We may use your personal information for reasons not described in this Privacy Policy where permitted by law and the reason is compatible with the purpose for which we collected it. If we need to use your personal information for an unrelated purpose, we will notify you and explain the applicable legal basis.

Retention
We will only retain your personal information for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymize your personal information (so that it can no longer be associated with you) in which case we may use this information indefinitely without further notice to you.

Your rights
European data protection laws give you certain rights regarding your personal information. You may ask us to take the following actions in relation to your personal information that we hold:

• • Access.  Provide you with information about our processing of your personal information and give you access to your personal information.
  • Correct.  Update or correct inaccuracies in your personal information.
  • Delete.  Delete your personal information.
  • Transfer.  Transfer a machine-readable copy of your personal information to you or a third party of your choice.
  • Restrict.  Restrict the processing of your personal information.
  • Object. Object to our reliance on our legitimate interests as the basis of our processing of your personal information. 

You can submit these requests by email to privacy@cerus.com or our postal address provided above.  We may request specific information from you to help us confirm your identity and process your request. Applicable law may require or permit us to decline your request.  If we decline your request, we will tell you why, subject to legal restrictions. If you would like to submit a complaint about our use of your personal information or response to your requests regarding your personal information, you may contact us as described above or submit a complaint to the data protection regulator in your jurisdiction.  You can find your data protection regulator here.  

Cross-Border Data Transfer
Whenever we transfer your personal information out of the EEA to countries not deemed by the European Commission to provide an adequate level of personal information protection, the transfer will be based on safeguards that allow us to conduct the transfer in accordance with the EEA’s data protection laws, such as the specific contracts approved by the European Commission as providing adequate protection of personal information, which are available here. For details, see the European Commission’s website for model contracts for the transfer of personal information to third countries.

Please contact us at privacy@cerus.com or our postal address provided above for further information on the specific mechanism used by us when transferring your personal information out of the EEA.

CERUS CORPORATION NOTICE TO CALIFORNIA RESIDENTS

We are required by the California Consumer Privacy Act of 2018 (“CCPA”) to provide to California residents an explanation of how we collect, use and share their personal Information, and of the rights and choices we offer California residents regarding our handling of such personal information.

Under the CCPA, this Notice to California Residents and the privacy practices and rights it describes do not apply to the information we collect, use or disclose about clinical trial volunteers, candidates, participants and investigators, health care providers, and other individuals who represent businesses that provide services to us or to which we provide our products or services. This is because information about these individuals is governed by clinical trial regulations, California’s Confidentiality of Medical Information Act or the Health Insurance Portability and Accountability Act of 1996, or is subject to the CCPA’s exemption on business contact information.

Personal Information We Collect, Use and Share.

We do not sell personal information. As we explain in this Privacy Policy, we use cookies and other tracking technologies to analyze website traffic and facilitate advertising. If you would like to opt out of our (and our third party advertising partners’) use of cookies and other tracking technologies, please review the information provided in the Cookies Policy and Tracking Opt-out Guide.

In addition to the information in our Privacy Policy, the following chart further describes our privacy practices with respect to individuals whose information is not subject to the above exceptions and is governed by the CCPA, such as our individual investors and consumers who visit our websites.

Please note that we may also disclose all personal information with affiliates, service providers, professional advisors, authorities, and business transferees as described in the “How We Share Personal Information” section of the Privacy Policy.

California Residents’ Privacy Rights

Except as excluded from the scope of this Notice above, the CCPA grants California residents the following rights.

• • Information. You can request information about how we have collected, used and shared and used your personal information during the past 12 months. We have made this this information available to California residents without having to request it by including it in this notice, in the above chart.
  • Access. You can request a copy of the personal information that we maintain about you.
  • Deletion. You can ask us to delete the personal information that we collected or maintain about you.

Please note that the CCPA limits these rights by, for example, prohibiting us from providing certain sensitive information in response to an access request and limiting the circumstances in which we must comply with a deletion request. If we deny your request, we will communicate our decision to you.

You are entitled to exercise the rights described above free from discrimination.

How to Submit a Request
To request access to or deletion of personal information:

• • visit this page to complete a request form
  • call 1-925-288-6048
  • email privacy@cerus.com 

Identity verification 
The CCPA requires us to verify the identity of the individual submitting a request to access or delete personal information before providing a substantive response to the request. We may attempt to verify your identify by asking you to confirm information that we have on file about you or your interactions with us. Where we ask for additional personal information to verify your identity, we will only use it to verify your identity or your authority to make the request on behalf of another consumer.

Authorized agents
California residents can empower an “authorized agent” to submit requests on their behalf. We will require the authorized agent to have written authorization confirming such authority.