Dewpoint Online Privacy Policy

Last Revised on September 22, 2019

Welcome to the Privacy Policy (“Privacy Policy”) provided by Dewpoint Therapeutics, Inc. (“Dewpoint,” “we” or “us”). This Privacy Policy describes how we collect, use and disclose information about you (“Information”) related to your use of and access to the online content, applications, services, email newsletters, online events and webinars and tools and features, provided by us, including without limitation, the websites dewpointx.com and condensates.com (collectively, the “Services”).

For purposes of data protection laws, regardless of where you reside, Dewpoint is the controller of that Personal Information (as defined below) you provide to us, or that is collected or processed by or for us. Please read this Privacy Policy carefully. For purposes of this Privacy Policy, “you” and “your” means you as the user of the Services.

1. TYPES OF INFORMATION WE COLLECT

When you use the Services, we may collect Information in the following categories:

• “Personal Information,” which means Information that identifies you (whether directly or indirectly), such as your name, postal address, email address and telephone number.
• “Non-Personal Information,” which means Information that does not directly or indirectly identify, and cannot reasonably be used to identify you. If Non-Personal Information is directly or indirectly associated with Personal Information, this Non-Personal Information is then treated as Personal Information.

The Information we may collect about you is as follows:

• Information you provide when you access or use the Services and each time you interact with the Services or otherwise with us, for example, when you provide us with feedback or contact us with a question or comment.
• Information you provide in public forums through the Services, including using our comment, post or similar functionality.
• Information you provide when you sign up for the Dewpoint Services, including your email address, job title, organization, city and country.
• If you use our Services to apply for a role with Dewpoint, any Information you may provide in the context of the application, for example Information you include in your resume or other Information we ask for.
• Usage, viewing and technical data, including your IP address or device identifier when you use the Services.If you access your account from a mobile device, that mobile device may also provide us with details of your location. Most mobile devices allow you to disable this functionality.
• Information we receive about you from third parties. For example, if you access the Servicesthrough a third party platform or log-in, we may also collect your email address and other Information associated with that third party, and any Information you have made public in connection with that service or which the third party shares with partner services.See also Section 7 “THIRD PARTY WEBSITES AND LINKS” below.

2. HOW WE COLLECT YOUR INFORMATION

• We collect Information you provide to us when you register with us, submit an application for a role with us, input Information into the Services, create user generated content, request informationfrom us, participate in public forums or other activities through the Services, contact us, including using the below information (see Section 14 “How to Contact Us”) or otherwise interact with us or the Services. This Information may include Personal Information you provide such as your name, email address, location and telephone number.
• We collect Information through unique identifiers (such as your IP address).
• We use “cookies” and other technologies to collect data that enable us to better understand and improve the usability, performance and effectiveness of our Services. Cookies are files sent to your browser and stored on your computer. We use cookies to gather general Information about your use of the Services, the files you have designated for backup, the configuration of your computer and your computer’s interaction with the Services, and store this Information in log files. We use this Information to understand traffic on and downloads from our Services, enabling us to improve the Services, provide the best online experience possible and improve our customer service. We use the following types of cookies on our site:
• Strictly necessary cookies – These cookies are essential to provide you with the Services, including use of some features of the Services, such as access to secure areas, transactional pages and secure log-in accounts. Without these cookies certain of the features of the Services you have asked for would not be possible.

• Performance cookies – These cookies collect Information about how you use the Services and are used to improve how the Services work. These cookies allow us to:
  • Better understand visitors to our Services so that we can improve how we present our content;
  • Test different design ideas for particular pages, such as our homepage;
  • Collect information about visitors to our Services such as where they are located and what browsers they are using;
  • Determine the number of unique users of the Services;
  • Improve the Services by measuring any errors that occur; and
  • Conduct research and diagnostics to improve product offerings.

• Functionality cookies – Functionality cookies record information about choices you’ve made and allow us to tailor the Services to you. These cookies mean that when you continue to use or come back to the Services, we can provide you with our Services as you have asked for them to be provided. These cookies allow us to:
  • Show you when you are logged in

• Other technologies- We may also use other Internet technologies, such as web beacons or pixel tags and other similar technologies, to deliveror communicate with cookies and analyze your use of the Services. We also may include web beacons in e-mail messages so that we know when you have opened an email message received from Dewpoint.

Unless you have adjusted your settings so that it will refuse cookies, our Services will place cookies on your devices when you log on to the Services. You may disable cookies by changing the settings on your browser and/or devices. Most browsers will allow you to choose the level of privacy settings you want. This lets you control your cookie settings so that you can:

• See what cookies or other locally stored data you’ve got and delete them on an individual basis;
• Block third party cookies or similar technology;
• Block cookies or similar technology from particular sites;
• Block all cookies or similar technologies from being set; or
• Delete all cookies or similar technologies when you close your browser.

You can also manually delete an individual cookie or all of the cookies using your computer’s or device’s settings. Check your browser’s or device’s help or support menu for further information.

Deleting cookies or similar technologies means that any preference settings you have made on a website will be lost. If you have set your preferences to opt out of cookies, this setting will be lost too, as that information is stored in a cookie. Remember that if you disable cookies it is likely to affect how the Services work and you may not be able to access or use certain features of the Services. We do not recommend turning all cookies or similar technologies off when using our Services as we cannot guarantee that your experience on our Services will be as good as it could otherwise be.

If you want to reduce your settings at any time (for example, if you accept all cookies, but later decide you do not want a certain type of cookie) you’ll need to use your browser settings to remove any third party cookies or similar technologies dropped on your previous visit.

Do Not Track (DNT) is a privacy preference that users can set in some web browsers, allowing users to opt out of tracking by websites and online services. Dewpoint and the Services do not recognize DNT. Please note that flash cookies operate differently than browser cookies and cookie management tools available may not remove flash cookies.

• We use Google Analytics, which is a web analytics tool that helps us understand how users engage with the Services. We do not have access to, nor control over, third parties’ use of cookies or other tracking technologies. Like many tools, Google Analytics uses first-party cookies to track user interactions, as in our case, where they are used to collect information about how users use our Services. This information is used to compile reports and to help us improve our Services. The reports disclose website trends without identifying individual visitors. For more information on Google Analytics, see here: https://policies.google.com/technologies/partner-sites. You can opt out of Google Analytics without affecting how you visit our Services – for more information on opting out of being tracked by Google Analytics across all websites you use, visit this Google page: https://tools.google.com/dlpage/gaoptout.

3. USE OF YOUR INFORMATION BY DEWPOINT

It is in our legitimate interests to process your Personal Data to provide effective services and useful content to you. We may also in certain circumstances process your Personal Information because it is necessary pursuant to a contract with you or where you have given your consent to such processing.

The ways in which wemay use your Information include the following:

• To provide you with the Services and other services you request.
• To administer your Condensates Account.
• To communicate with you about your account and send you details or updates about features of the Servicesor changes to our policies and respond to your questions.
• To send you newsletters and other communications provided you have consented to receive these.
• To create anonymized and aggregated data sets that may be used for a variety of functions, including research, internal analysis, analytics or other functions.
• To monitor and analyze the Servicesusage and trends and otherwise measure the effectiveness of the Services.
• To personalize content and experiences and advertising.
• To solicit feedback
• To optimize or improve the content, services and features of the Services or otherwise provide technical support.
• To personalize and improve the Servicesand user experiences, to increase the functionality and user friendliness of the Servicesor to deliver content or features that match user profiles or interests.
• To ensure consistency with local law and choices and controls that may be available to you.
• To detect, investigate and prevent activities that may violate our policies or be illegal.

4. SHARING YOUR INFORMATION WITH OTHER COMPANIES

We will share your Personal Informationoutside Dewpoint in the following limited circumstances:

• When you allow us to share your Personal Information with another company (i.e., directing us to share your Personal Information with third-party sites or platforms, such as social networking sites). If you use third-party sites or platforms made available through the Services (e.g., Google or Linkedin logon), those third parties will have access to your data to the extent that you have authorized their access. Please consult Section 7 “THIRD PARTY WEBSITES AND LINKS” below and the third party’s privacy policyfor additional information.
• When we contract or partner with a third party to provide services on our behalf, which we do for Servicesdevelopment and maintenance, analytics, job ads and candidate tracking. The third parties we may make use of include AWS, Google, Mailchimp, Mandril, Zapier, and Greenhouse. We require all third parties to process your data as permitted by applicable data protection laws.
• In connection with the sale of a business (including merger, acquisition, or sale of all or a material portion of its assets, change in corporate control or insolvency or bankruptcy proceedings).
• To enforce our terms of service or rules; to ensure the safety and security of our users and third parties; to protect our rights and property and the rights and property of our users and third parties; or to comply with legal process, including judicial warrant, rule, order or subpoenaor in other cases if we believe in good faith that disclosure is required by law or regulation.

In addition, we may share Non-Personal Information and anonymized and aggregated data sets with third parties, alone or in combination with the Non-Personal Information of other users.

5. PUBLIC VENUES AND SEMI PUBLIC VENUES OF THE SERVICES

If you use a message board, comment function, conversation pages, blogs, social community environments, profile pages or other public or semi-public venue or forums of the Services, you will be identified on those venues by the username you submit.

6. YOUR CONTROLS AND CHOICES

We provide you the ability to exercise certain controls and choices regarding our collection, use and sharing of your Information. Your controls and choices include:

• You may change your choices for alerts and newsletters.
• You may correct, update and delete your registration account.
• You may request access to the Personal Information we hold about you and that we amend or delete it.

You may exercise your controls and choices, or request access to your Personal Information, by contacting us using the contact information provided in Section 14 or following instructions provided in communications sent to you. In relation to EU privacy rights, see Section 13, below. Please be aware that if you do not allow us to collect Personal Information from you, we may not be able to deliver certain services to you and some of our services may not be able to take account of your interests and preferences. If you have questions regarding the specific Personal Information about you that we process or retain, please contact us at using the contact information in Section 14.

7. THIRD PARTY WEBSITES AND LINKS

Our Services may contain links to other sites or online platforms operated by third parties as well as embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website. These websites may collect data about you, use cookies, embed additional third-party tracking and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website. We do not control such other sites or online platforms and are not responsible for their content, their privacy policiesor their use of your Personal Information. Ourinclusion of such links does not, by itself, imply any endorsement of the content on such sites or platforms or of their owners or operators except as disclosed on the Services.

Please keep in mind that Information you post on public or semi-public venues, including Information you share on third party social networking platforms (such as Facebookor Twitter) may also be viewable by other users of the Servicesand/or users of those third-party online platforms without limitation as to its use by us or by a third party.When you provide Information to a third-party online platform, the Information you provide may be separately collected by that third-party. The Information the third-party online platform collects is subject to the third-party online platform’s privacy practices. Privacy choices you make on the third-party online platform will not apply to our use of the Information we collect directly through our Services.

We expressly disclaim any and all liability for the actions of third parties, including but without limitation to actions relating to the use and/or disclosure of Personal Informationby third parties.

8. CHILDREN’S PRIVACY

We do not seek or knowingly collect any Personal Informationabout children under 13 yearsof age. If we become aware that we have unknowingly collected Personal Informationfrom a child 13 yearsof age or younger, we will make commercially reasonable efforts to delete such Information from our database.

If you are the parent or guardian of a child under 13 yearsof age who has provided us with Personal Information, you may contact us to request it be deleted.

9. DATA SECURITY, INTEGRITY AND RETENTION

Please note that Information you send to us electronically may not be secure when it is transmitted to us. We recommend that you do not use unsecure channels to communicate sensitive or confidential Information to us. Please be aware that, despite our best efforts, no security measures are perfect or impenetrable. All web analytics and technical usage Information will be automatically anonymized after 24 months. Otherwise, we will retain your Personal Information for as long as is necessary for the purposes for which it was collected (and to comply with all applicable laws).

10. UPDATING THIS PRIVACY POLICY

We may modify this Privacy Policy from time to time in which case we will update the “Last Revised” date at the top of this Privacy Policy. If we make changes that are material, we will use reasonable efforts to attempt to provide notice to you and, where required by applicable law, we will obtain your consent. Notice may be given by email to you at the last email address you provided us, by posting notice of such changes on the Services or by other means, consistent with applicable law. However, it is your sole responsibility to review the Privacy Policy from time to time to view any such changes. The updated Privacy Policy will be effective as of the time of posting, or such later date as may be specified in the updated Privacy Policy. IF YOU DO NOT ACCEPT AND AGREE TO THIS PRIVACY POLICY, INCLUDING ANY CHANGES, THEN YOU MUST NOT ACCESS OR USE THE SERVICES.

11. YOUR CALIFORNIAPRIVACY RIGHTS

This Privacy Policy describes how we may share your Information for marketing purposes. It applies to all users of the Services, including Californiaresidents.

If you are a user of this service and a Californiaresident under the age of 18, you may request to have your posted content or Information removed from the publicly-viewable portion of this website by contacting us directly (see Section 14 “How to Contact Us” below). Content or Information may not be removed from our systems or databases. In certain situations, content or Information cannot be removed.

As a Californiaresident, you may contact us with any questions or to request a list of third parties to whom we may disclose Information for such third parties’ marketing purposes and the categories of Information we may disclose. See How to Contact Us below.

12. INTERNATIONAL OPERATIONS AND TRANSFERS OUT OF EUROPEAN COUNTRIES

IMPORTANT: Your Personal Information will be sent to the United States and possibly other countries.

Our websites are hosted in the United States. If you are visiting our websites from outside the United States, your Personal Information will be transferred to, stored in, or processed in, the United States and may be transferred to, stored in or processed in additional countries where our third-party service providers maintain facilities or operations.

Where we transfer, store or process your Personal Information outside of the European Union or the European Economic Area:

• We do so to the extent such transfer, storage or processing is needed to fulfill a contract with you.
• We rely on different methods to ensure an adequate level of data protection:
  • Adequacy Decisions: Some of our third-party service providers are based in countries that the European Commission has found to have adequate levels of protection for Personal Information;
  • Privacy Shield: Some of our third-party service providers based in the United States, where we transfer your Personal Information, comply with the US Department of Commerce’s EU-US Privacy Shield and have certified that they adhere to the EU-US Privacy Shield; or
  • Model Clauses: We may rely on the European Commission’s model contracts for the transfer of Personal Information to third countries (i.e. the standard contractual clauses) when transferring Personal Information to our third-party service providers who do not adhere to the US Department of Commerce’s EU-US Privacy Shield or who are located in countries that the European Commission has not found to have adequate levels of protection for Personal Information.

Please note that the data protection and other applicable laws of the United States and other countries may not be as comprehensive as those laws or regulations in your country or may otherwise differ from the data protection or consumer protection laws in your country. Your Personal Information may be available to government authorities under lawful orders and law applicable in such jurisdictions.

13. EU PRIVACY RIGHTS

Rights: You have the following rights under the General Data Protection Regulation:

• You can access, correctand update most ofyour Personal Information by signing into your account. To access, correct or update any other Information, please contact us using the information in Section 14 “How to Contact Us” below.
• You can request that we deleteyour Personal Information.
• You can object to processingof your Personal Information.
• You can ask us torestrict processingof your Personal Information.
• You can request portabilityof your Personal Information.
• If we have collected and processed your Personal Information with your consent, then you can withdraw your consentat any time.
• You have the right to complain to a data protection authorityabout our collection and use of your Personal Information.

We respond to all data protection requests we receive in accordance with applicable data protection laws. Detailed and important information about how to exercise your rights is set forth below.

Right to access and deletion: You have the right to ask us to access the personal data we hold about you and be provided with certain information about how we use your personal data and who we share it with. You also have the right to ask us to correct your personal data where it is inaccurate or incomplete.

In certain circumstances, you have the right to ask us to delete the personal data we hold about you:

• Where you believe that it is no longer necessary for us to hold your personal data;
• Where we are processing your personal data on the basis of legitimate interests and you object to such processing and we cannot demonstrate an overriding legitimate ground for the processing;
• Where you have provided your personal data to us with your consent and you wish to withdraw your consent and there is no other ground under which we can process your personal data; or
• Where you believe the personal data we hold about you is being unlawfully processed by us.

In certain circumstances, you have the right to ask us to restrict (stop any active) processing of your personal data:

• Where you believe the personal data we hold about you is inaccurate and while we verify accuracy;
• Where we want to erase your personal data as the processing is unlawful but you want us to continue to store it
• Where we no longer need your personal data for the purposes of our processing but you require us to retain the data for the establishment, exercise or defense of legal claims; or
• Where you have objected to us processing your personal data based on our legitimate interests and we are considering your objection.

In addition, you can object to our processing of your personal data based on our legitimate interests and we will no longer process your personal data unless we can demonstrate an overriding legitimate ground.

To exercise any of these rights above, please contact us using the contact information in Section 14.

Please note that these rights are limited, for example, where fulfilling your request would adversely affect other individuals or Company trade secrets or intellectual property, where there are overriding public interest reasons or where we are required by law to retain your personal data.

Right to withdraw consent: Where you have provided your consent for us to process your personal data, you can withdraw your consent at any time by contacting us, using the contact information in Section 14.

Right to object to marketing: At any time you have the right to object to our processing of data about you in order to send you promotions and special offers, including where we build profiles for such purposes, and we will stop processing the data for that purpose.

Complaints: In addition to the above, you have the right to complain to your data protection supervisory authority. In the event that you wish to make a complaint about how we process your personal data, please contact us using the contact information in Section 14 and we will endeavor to deal with your request as soon as possible. This is without prejudice to your right to launch a claim with your relevant data protection supervisory authority.

14. HOW TO CONTACT US

You may contact us with any questions regarding the use or disclosure of Personal Information or otherwise regarding the Services or this Privacy Policy at: Dewpoint, 451 D Street, Suite 104, Boston, MA 02210; by phone at 617-914-8448; or by email to connect@dewpointx.com