Introduction

This Privacy Notice describes the ways in which Bifrost Biosystems (“Bifrost”, “we” or “us”) collects and processes information about you that identifies you directly or indirectly (“Personal Information”), either alone or in combination with other information made available to us, through your interactions with us via our website (www.bifrost.bio).

Bifrost is responsible for the processing of your Personal Information as it decides why and how it is processed, thereby acting as the “Data Controller” of such Personal Information. The Privacy Notice covers how we respect your privacy rights with respect to the processing of your Personal Information for the purposes described in this Privacy Notice.

We are committed to the protection of your Personal Information and privacy, as such, we ask you to carefully read this Privacy Notice. By visiting this website, you agree to this Privacy Notice. We may change or update this Privacy Notice from time to time by posting a new privacy notice on this website. Please check this notice occasionally so that you are aware of any changes.

If you access any third-party link from our website, you will need to refer to the privacy policies of such third parties. Bifrost does not endorse and is not responsible for the information or privacy practices of websites or links owned by third parties.

Controllership

Within the scope of this Notice, Bifrost generally acts as a data controller for the Personal Data processed. This means that we alone determine the purpose and means of the processing of your Personal Data.

Personal Data We Collect and Process

Depending on how you interact with us, we may collect and process Personal Information that directly identifies you such as your name, contact details and email address. Personal Information may also include information such as computer or device serial numbers, and IP addresses.

Information that you provide to us voluntarily

• Subscribing to Bifrost Updates
  • When subscribing to be notified of Bifrost news or events, you provide your email address, and optionally, your name, company and phone number. We process and save the Personal Information provided during subscription exclusively to enable you to receive the content you requested to receive. The legal basis for processing your Personal Information is your consent.
• Contact requests and social media
  • For inquiries via one of the contact email addresses listed on our website, you must provide your e-mail address, name, and your message. You may provide your social media profile information including name, email address, contact details, comments and reactions when you interact with us on social media platforms. We process and save the Personal Information provided via email only to process and answer your message. The legal basis for processing your Personal Information is your consent.

Information that is collected automatically

As you navigate through and interact with our website, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

• Cookies
  • A cookie is a small file placed on the hard drive of your computer that saves you the trouble of reentering certain information in some registration areas, helps to deliver content-specific information to you, and tracks which sections of the site are most popular. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of our website. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our website.
  • Our site may use the following types of cookies and tracking technologies for the following purposes:
    • Strictly Necessary Cookies. Strictly necessary cookies are necessary for the website to function and cannot be switched off in our systems. These cookies are usually only set in response to actions made by you that amount to a request for services, such as setting your privacy preferences, logging in, or filling in forms. You can set your browser to block or alert you about these cookies, but blocking these cookies will prevent the site from working. These cookies typically do not store personal data.
    • Functional Cookies.Functional cookies enable our websites to provide enhanced functionality and personalization. They may be set by us or by third party service providers whose services we have added to our pages. If you reject these cookies then some or all of these services may not function properly.
    • Performance Cookies.Performance cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. These cookies help us understand how our sites are being used, such as which sites are the most and least popular and how people navigate around the site. The information collected in these cookies are aggregated, meaning that they do not relate to you personally. Opting out of these cookies will prevent us from knowing when you have visited our site and will prevent us from monitoring site performance. In some cases, these cookies may be sent to our third party service providers to help us manage these analytics.
    • Social Media Cookies.Social media cookies are set by a range of social media services that we have added to the site (such as Facebook, Twitter, LinkedIn) to enable you to share our content with your friends, colleagues, and networks. These cookies are capable of tracking our browser across other sites and building up a profile of your interests. This may impact the content and messages you see on the other websites you visit. If you do not allow these cookies, you may not be able to use or see these sharing tools.
    • Targeting Cookies.Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
    • Web Beacons. A web beacon is a piece of software code on a web page or in an e-mail message that is used to track pages viewed or messages opened. Web beacons tell the web site server information such as the IP address and browser type related to the visitor’s computer. Web beacons may be placed in online advertisements that bring people to our site and on different pages of our site. Web beacons provide us with information on how many times a page is opened, and which information is viewed. Web beacons are also known as internet tags, single-pixel GIFs, clear GIFs, and invisible GIFs.
  • “Do Not Track” Signals
    • Certain web browsers and other programs may be used to signal your preferences to Bifrost about how or whether Bifrost or third parties may collect information about your online activities. Currently, Bifrost does not respond to such signals.
  • We may also collect certain information about you like your IP address, unique device identifiers like Media Access Control (MAC) address, computer type (Windows or Mac), browser type and version, screen resolution, operating system name and version. We may also derive your location information from your IP address. The legal basis for the processing of your Personal Information is our legitimate business interests, including, but not limited to. securing our websites and network systems, to improving our services, diagnosing and troubleshooting technical issues, conducting audits, monitoring our systems and preventing fraud, and developing new or improved products and services.
  • Additionally, some of our websites use Google Analytics, a web analytics service provided by Google, Inc.(“Google”). Google Analytics uses cookies to analyze use patterns and may collect information about your use of the website, including your IP address. More information on Google Analytics can be found here: www.google.com/policies/privacy/partners/. If you would like to opt-out of having your data used by Google Analytics, please use the Google Analytics opt-out available here:https://tools.google.com/dlpage/gaoptout/.
    
    We may combine, aggregate, or anonymize Personal Information with data we may collect from or about you from other sources, such as public databases, providers of demographic information, public social media platforms (data made public by you), and other third parties.
    
    We may use your data for our business purposes, including audits, monitoring and prevention of fraud, and for modifying our services.
    
    Also, we may use your Personal Information:
  • if we are required to do so because of an applicable law, requests from public and government authorities (including court order, subpoena, or governmental regulation), even outside your country of residence;
  • if we need to enforce our terms and conditions;
  • when we believe in good faith that the use of Personal Information is necessary to protect legal rights, the security or integrity of this website;
  • to protect your safety or the safety of others;
  • as part of any criminal or other legal investigation or proceeding in your country or in other countries; or,
  • to the extent reasonably necessary for development of or to proceed with the negotiation or completion of a corporate or commercial transaction.

We do not collect Sensitive Personal Information and you are requested to not disclose your Sensitive Personal Information to us unless we specifically ask for it (e.g., national identification card numbers, information related to racial or ethnic origin, political opinions, religion or philosophical beliefs, health, sex life or sexual orientation, criminal background, or trade union membership, or biometric or genetic data for the purpose of uniquely identifying an individual).

Sharing Personal Data with Third Parties

We may transfer Personal Information to third parties who act on our behalf, for further processing in accordance with the purpose(s) for which the data were originally collected or may otherwise be lawfully processed, such as services delivery, or data management. We will not sell, share, or otherwise transfer your personal information to third parties other than those indicated in this Privacy Notice.

In the course of our activities and for the same purposes as those listed in this Privacy Notice, your Personal Information can be accessed by, or transferred to the following categories of recipients on a need-to-know basis to achieve such purposes:

• our personnel;
• our other suppliers and services providers that provide services and products to us;
• our IT systems providers, cloud service providers, database providers and consultants; and
• any third party to whom we assign any of our rights or obligations.

These third parties have contracted with us to only use Personal Information for the agreed upon purpose, and not to sell Personal Information to third parties, and not to disclose it to third parties except as may be permitted by us, as required by law, or as stated in this Privacy Notice.

We may disclose your Personal Information to a third party in the event that the business or a part of it and the customer data connected with it is sold, assigned or transferred, in which case we would require the buyer, assignee or transferee to treat Personal Information in accordance with this Privacy Notice.

Also, we may disclose your Personal Information to a third party if we are required to do so because of an applicable law, requests from public and government authorities (including court order, subpoena, or governmental regulation), even outside your country of residence; if we need to enforce our terms and conditions; when we believe in good faith that the disclosure is necessary to protect legal rights, the security or integrity of this website; to protect your safety or the safety of others; as part of any criminal or other legal investigation or proceeding in your country or in other countries; or to third parties, advisors, and other entities to the extent reasonably necessary for development of or to proceed with the negotiation or completion of a corporate or commercial transaction.

Your Personal Information may also be processed, accessed, or stored in other countries. Such countries may offer a different level of protection of Personal Information. If we transfer your Personal Information to external companies in other jurisdictions, we will make sure to protect your Personal Information by applying the level of protection required under applicable data privacy laws by implementing adequate technical and organizational measures. In the event that your Personal Information is transferred to a service provider based in a third country (countries outside the European Union that do not have a level of data protection comparable to the data protection law of the European Union, as determined by a competent data protection authority) and processed there, Bifrost ensures the protection of your Personal Information by means of the current and applicable version of the European Commission’s Standard Contractual Clauses in accordance with applicable law. Should these Standard Contractual Clauses in the future be declared null and void and/or be revised by the European Commission, we will adopt other applicable and/or approved instruments to provide for appropriate safeguards required for the third country transfers and enter into such agreed instruments in a written and legally binding form. If you would like to obtain a copy of the Standard Contractual Clauses, please refer to the Contact Us section.

Your Rights with Respect to Your Personal Data

Whenever we process Personal Information, we take reasonable steps to keep your Personal Information accurate and up-to-date for the purposes for which they were collected. We will provide you with the ability to exercise the following rights under the conditions and within the limits set forth in the law.

• the right to be informed about what personal information we have about you and how we process your Personal Information;
• the right to access your Personal Information as processed by us and, if you believe that any information relating to you is incorrect, obsolete or incomplete, to request its correction or updating;
• the right to request the erasure of your Personal Information or the restriction thereof to specific categories of processing;
• the right to withdraw your consent at any time, without affecting the lawfulness of the processing before such withdrawal;
• the right to object, in whole or in part, to the processing of your Personal Information. With certain exceptions, such as the right to object to your Personal Information being used for research;
• the right to request data portability, (i.e., that the Personal Information you have provided to us be returned to you or transferred to the person of your choice, in a structured, commonly used and machine-readable format without hindrance from us and subject to your confidentiality obligations); and
• the right to object to automated decision-making including profiling resulting in a significant or legal effect, (i.e. you can request an human intervention in any automated decision making process related to processing of your data resulting in a significant or legal effect, and where such processing is not based on your consent, authorized by law or necessary for the performance of a contract). However, we don’t currently make decisions using automated processes that result in significant or legal effects on individual.
• if the GDPR applies to our processing of your Personal Data, you have the right to lodge a complaint with a supervisory authority if you are not satisfied with how we process your Personal Data. Specifically, you can lodge a complaint in the Member State of the European Union of your habitual residence, place of work, or the alleged violation of the GDPR.

Privacy of Children

Our website is not directed at children. We do not knowingly collect any personal information about children under the age of 13 on our website or for the purposes mentioned in this Privacy Notice. If Personal Information about children has been mistakenly provided to us and you would like to request that such Personal Information be removed, please refer to our Contact us section.

Safeguards Protecting Your Personal Information

We have implemented appropriate technical and organizational measures designed to provide an adequate level of security and confidentiality to your Personal Information. The purpose of these measures is to protect Personal Information against accidental or unlawful destruction or alteration, accidental loss, unauthorized disclosure or access and against other unlawful forms of processing.

Retention of Your Personal Data

We will only retain your Personal Information for as long as necessary to fulfil the purpose for which it was collected. The criteria used to determine our retention periods include the length of time we have an ongoing relationship with you, whether there is a legal obligation to which we are subject, or whether retention is advisable considering our legal position (such as in regard to the enforcement of the site Terms of Use, applicable statutes of limitations, litigation or regulatory investigations).

Changes to this Notice

We review our Privacy Notice regularly and update it as and when required. The last version of the Notice was updated on December 6, 2023.

Contact us

If you have a question or a concern about the processing of your Personal Information or want to exercise your rights, please contact us at info@bifrost.bio or write to the following address:

Bifrost Biosystems, Inc.
Attn: Compliance Department
22 Flintlock Rd.
Lexington, MA 02420

Please allow up to four weeks for us to reply.