Privacy Policy of Europejski Instytut Biomedyczny sp. z o.o. (European Biomedical Institute), Konmex Limited and North American Biomedical Institute LLC

I. Data of the Personal Data Controller

Please be informed that the Controllers of your personal data are Europejski Instytut Biomedyczny spółka z ograniczoną odpowiedzialnością with its registered seat in Warsaw, 63a/6 Bartycka Street, (00-716) in Poland (“European Biomedical Institute”), entered into the National Court Register under the number KRS 0000938236 and using Tax Id (NIP) number 5213950320, and Konmex Limited, with registered office at Chelsea House, Chelsea Street, Nottingham, Nottinghamshire NG7 7HP, the United Kingdom of Great Britain and Northern Ireland, hereinafter referred to as the “Company”. The contact with the Company regarding the protection of personal data is available at the following e-mail address: odo@eib.bio

II. Goals and basics of personal data processing

In order to provide services to you and to be able to contact you in order to answer your questions or send you information which you may request in accordance with the scope of our business operations, the Company processes your personal data for a variety of purposes, always in accordance with the law. Below you will find specific purposes for the processing of personal data, including the legal basis.

1. In order to to revert to you, if you ask us a question via the contact form posted on our website or call us on the phone numbers provided on the website, we process personal data such as:

• Your name and surname,

• Your e-mail address,

• The name of the company on behalf of which you have contacted us,

• Your telephone number.

The legal basis for such data processing is art. 6.1.a of the GDPR which allows us to process your personal data if you have given your consent to it.

2. In order to send you a commercial offer in response to your inquiry or telephone call,we process such personal data as:

• Your name and surname,

  • Your e-mail address,

  • The name of the company on behalf of which you have contacted us,

  • Your telephone number.

The legal basis for such data processing is art. 6.1.a of the GDPR which allows us to process your personal data if you have given your consent to it.

3. In order to provide a quotation for a service and the performance of the service, we process such personal data as:

• Your name and surname,

• Your e-mail address,

• The name of the company on behalf of which you have contacted us,

• Your telephone number.

The legal basis for such data processing is art. 6.1.b of the GDPR which allows us to process your personal data if it is necessary to perform the contract or take steps to conclude the contract; if you decide to give us also your surname, we consider that you have given your consent to the processing of your surname as well and then the legal basis for such processing is art. 6.1.a of the GDPR which allows us to process personal data on the basis of a voluntary consent;

4. In order to issue an invoice and fulfill other obligations resulting from the tax law, such as storing the accounting records for 6 years, we process personal data such as:

• Your name and surname,

  • The company name,

  • The address of residence or of the registered office

  • Tax Id No (NIP),

  • The number of your order.

The legal basis for such data processing is art. 6.1.c of the GDPR , which allows us to process your personal data if it is necessary for the Controller of Personal Data to fulfill its legal obligations;

5. In order to accept your recruitment documentation (such as your CV), we process personal data such as:

• Your name and surname,

• Names an surnames of your parents,

• Your date of birth,

• Your address,

• Your address for correspondence,

• Your education and the history of your previous employment.

The legal basis for such data processing is art. 22¹ of the Labor Code of April 13, 2018 (Journal of Law of 2018, item 917, as amended), which allows us to process exactly such scope of personal data (hereinafter referred to as the “Labor Code”).

6. In order to store unpaid queries, we process personal data such as:

• Your name and surname,

  • Your e-mail address,

  • The number of your order.

– because you may decide to use our services after some time from receiving our quotation. The legal basis for such data processing is art. 6.1.f of the GDPR , which allows us to process personal data for the purposes of the legitimate interests pursued by the Personal Data Controller (in this case, the interest of the Company is to conclude a contract within a certain period of time without the need to repeat the valuation);

7. In order to accept the recruitment documentation in which you send us data that goes beyond the scope of the list mentioned in point 5 above, , we process personal data which you choose to send to us, for example:

• Your image (if you send it yourself),

  • Any other personal data going beyond the list mentioned in art. 22

    of the Labor Code.

The legal basis for such data processing is art. 6.1.a of the GDPR which allows us to process your personal data if you have given your prior, voluntary consent to it.

8. In order to establish claims, assert them or defend ourselves against them we process personal data such as:

• Your name and surname (if provided) or possibly the name of the company,

  • Your address of residence (if provided),

  • Personal Id (PESEL) number or tax identification number (NIP) (if provided),

  • E-mail address

  • The IP address,

  • The number of the order.

The legal basis for such data processing is art. 6.1.f of the GDPR which allows us to process personal data for the purposes of the legitimate interests pursued by the Personal Data Controller (in this case, the interest of the Company is to possess personal data that can identify claims, assert them or defend against them, including those of/by customers and third parties);

9. For archival and evidential purposes, we process personal data such as:

• Your name and surname (if provided),

  • E-mail address,

  • The number of the order.

– so that we could store information which may serve to prove facts of legal significance. The legal basis for such data processing is art. 6.1.f of the GDPR which allows us to process personal data for the purposes of the legitimate interests pursued by the Personal Data Controller (in this case, the interest of the Company is to possess personal data which may prove certain facts related to the provision of services, e.g. when a state authority requests it);

10. For analytical purposes such as the research and analysis of the activity on the website belonging to the Company, we process personal data such as:

• The date and time of visiting the website,

  • The type of your operating system,

  • Your approximate location,

  • The type of web browser used to browse the site,

  • The time spent on the site,

  • The subpages you visited,

  • The subpage where the contact form has been completed.

The legal basis for such data processing is art.6.1.f of the GDPR which allows us to process personal data for the purposes of the legitimate interests pursued by the Personal Data Controller (in this case, the interest of the Company is to know the clients’ activity on the website);

11. In order to use cookies on the website, we process appropriate text information (cookies are discussed in a separate section below). The legal basis for such processing is art. 6.1.a of the GDPR which allows us to process your personal data if you have given your voluntary consent to it. (the first time you enter the website, you will be asked for your permission to use cookies);

12. In order to administer our website, we process personal data such as:

• Your IP address,

  • The date and time of the server,

  • The information about the web browser,

  • The information about the operating system

– these data are automatically saved in the so-called server logs each time a website belonging to the Company is used. It would not be possible to administer the website without using the server and without this automatic saving function. The legal basis for such data processing is art. 6.1.f of the GDPR which allows us to process personal data for the purposes of the legitimate interests pursued by the Personal Data Controller (in this case, the interest of the Company is to administer the website);

III. Cookies

1. The website of this company, similarly to other business units, uses the so-called cookies, i.e. short text information saved on a computer, phone, tablet or any other user device. They can be read by our system, as well as by systems belonging to other business units whose services we use (such as Facebook, Google etc.).
   

2. Cookies perform a lot of functions on the website; most of them are useful and we will try to describe them below (if the information is insufficient, please contact us):

   • ensuring security – cookies are used to authenticate users and prevent unauthorized use of the client’s panel. They are therefore used to protect the user’s personal data against unauthorized access;

   • impact on the processes and efficiency of using the website – cookies are used to ensure that the website works efficiently and that you can use the features available on it, which is done, among other things, by remembering the settings of your subsequent visits on the website. In the result, you can efficiently navigate the website and individual subpages;

   • state of the session – cookies often record information about how visitors use the website, for example which subpages are displayed most often. They also allow to identify errors displayed on some subpages. Cookies used to record the so-called “session state” help to improve the quality of the services and increase the comfort of browsing;

   • maintaining session status – if a client logs in to his panel, the cookies sustain the session. This means that after switching to another subpage, you do not have to re-enter your login and password; this contributes to the comfort of using the website;

   • creating statistics – cookies are used to analyze how the visitors use the website (how many of them enter the website, how long they stay there, which content arouses the most interest, etc.). In the result, we can constantly improve the website and adapt its operation to the preferences of the users. In order to track the activity and create statistics, we use Google tools such as Google Analytics; in addition to reporting the website usage statistics, the pixel Google Analytics can also contribute, along with some of the cookies described above, to displaying more relevant content to the user in Google services (such as the Google search engine) and across the entire web;

   • using social functions – our website has a so-called Facebook pixel, which allows you to like our fanpage on FB while using our website. However, to make this possible, we need to use cookies provided by Facebook.
     

3. Please note that many cookies are anonymized for us: we are unable to identify you only with such cookies, without any additional information.
   

4. Your Internet browser allows for the use of cookies in your device by default and therefore at your first visit we ask for your permission to use cookies. However, if you do not wish to use cookies while browsing the website, you can change the settings in the web browser – you can fully block the automatic support for cookies or request notification each time when any cookies are placed on the device. The settings can be changed at any time.
   

5. While respecting the independence of all persons using our website, we have to inform you that disabling or limiting the use of cookies may cause quite serious difficulties in using the website, such as the need to log in to each subpage, slower loading of the website, restrictions on the use of its functionalities, limitations in liking the fanpage on Facebook, etc.                                                                                                                                                                                                                                       

IV. The right to withdraw consent

1. If the processing of personal data is subject to your consent, you can withdraw it at any time – at your sole discretion.

2. If you would like to withdraw your consent to the processing of personal data, you can easily do it by:

• sending an email directly to the Company at the address odo@eib.bio or

• completing the contact form on the deletion or change of personal data. The form is on the contact or GDPR subpages.                                                                                                                                                                               

3. If the processing of your personal data was based on your consent, its withdrawal does not mean that the processing of personal data up to that point was illegal. In other words, we have the right to process your personal data until the withdrawal of your consent, and the withdrawal of such consent does not affect the legality of the current processing.

V. The requirement to provide personal data

1. Providing any personal data is voluntary and depends on your decision. However, in some cases, providing certain personal data is necessary to meet your expectations regarding the use of the contact form and the recruitment form on our website.

2. To answer your questions asked via the contact form or by phone, we need you to provide your email address and / or telephone number or else we will not be able to send you information or an answer your questions.

3. In order to send you an invoice for our services, we need you to provide all data required by the tax law such as your name or the company name, address or registered address of the company, and the tax identification number. Without this, we will not be able to properly issue invoices.

4. In order send you our quotation we need you to provide your e-mail address or telephone number – without this we will not be able to send you a quotation which you requested.

VI. Automated decision making and profiling

We kindly inform you that we do not make automated decision-making, including any decisions based on profiling.

VII. Recipients of personal data

1. Like most business people, we use the help of other entities in our operations, which often involves the need to provide personal data to them. Therefore, if necessary, we may provide your personal data to the following recipients: lawyers who provide services to us, quick payment companies, our accounting company and hosting company, a company responsible for sending text messages, and an insurance company ( if it is necessary to repair any damages).

2. In addition to this, we may for instance be obliged to transfer your personal data to other entities, whether public or private, if we are bound to do so by provisions of law or decisions of the competent authority. That is why it is extremely difficult for us to predict who may apply for the disclosure of personal data. Nevertheless, we assure you that every request to disclose your personal data is analyzed very carefully and thoroughly, to avoid passing any information inadvertently to unauthorized persons.

VIII. Transfer of personal data to third countries

1. Like most business people, we use various popular services and technologies offered by such entities as Facebook, Microsoft or Google. These companies are based outside the European Union and are therefore treated as third countries in the light of the provisions of the GDPR.

2. The GDPR imposes certain restrictions on the transfer of personal data to third countries, because the European rules do not apply there, and therefore the protection of personal data of European Union citizens may unfortunately be insufficient. Therefore, each controller of the personal data is required to establish the legal basis for such transfer.

3. For our part, we assure you that when using services and technologies, we only transfer personal data to entities from the United States and only to those which joined the Privacy Shield program based on the European Commission’s decision of July 12, 2016. More information on this subject is available on the European Commission website https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/eu-us-privacy-shield_pl. Entities that have joined the Privacy Shield guarantee that they will comply with the high standards of personal data protection that are in force in the European Union and therefore it is legal to use their services and technologies in the course of personal data processing.

4. We will provide you with additional explanations regarding the transfer of personal data at any time, in particular when this issue raises your concern.                                                                                                      

5. You have the right to obtain a copy of your personal data transferred to a third country at any time.                                                                                                                                                                                            

IX. Personal data processing period

1. In accordance with the applicable law, we do not process your personal information “infinitely”, but only for the time that is needed to achieve the goal. After that period your personal data will be irretrievably deleted or destroyed.

2. Regarding individual periods of personal data processing, we kindly inform you that we process personal data for the period of:

• the duration of the contract – in relation to personal data processed in order to conclude and perform a contract;

• 3 years or 10 years + 1 year – in relation to personal data processed in order to establish, assert or defend claims (the length of the period depends on whether both parties are business persons or not);

• 6 months – in relation to personal data that were collected when valuing the service, if the contract was not concluded immediately;

• 6 years – in relation to personal data related to the fulfillment of obligations under tax law;

• no longer than until the end date of the recruitment for a given position – in the process of recruitment; also for a period not longer than 12 months if you agreed to participate in future recruitment processes;

• until the consent is withdrawn or the purpose of processing is achieved but no longer than\ 5 years – in relation to personal data processed on the basis of consent;

• until an effective objection is filed or the the purpose of the processing is achieved, but no longer than 5 years – in relation to personal data processed on the basis of the legitimate interests of the Personal Data Controller or for marketing purposes;

• until the time of obsolescence or loss of usefulness, but no longer than for 3 years – in relation to personal data processed mainly for analytical purposes, the use of cookies and the administration of the website.

3. In order to facilitate the process of removing or destroying personal data, the years are counted from the end of the year in which we started to process personal data. Separate timing for each event would entail significant organizational and technical difficulties, as well as significant financial outlay; for this reason we set a single date for removing or destroying personal data. This allows us to manage the whole process more efficiently. Of course, if you use the right to be forgotten, we will consider your case individually.

4. The additional year for the processing of personal data collected for the performance of a contract is to account for instances when someone may assert a claim a moment before the claim limitation date, a request is delivered with a significant delay or someone incorrectly calculates the limitation date for a claim.

X.  Rights of data subjects

1. We kindly inform you that you have the right to:

• the access to your personal data;

• correct your personal data;

• request deletion of your personal data;

• restrict the processing of your personal data;

• refuse the processing of your personal data;

• transfer your personal data.

2. We respect your rights under the provisions of the act on the protection of personal data and we strive to facilitate their implementation to the highest extent possible.

3. Please note that these rights are not absolute, and therefore we may legally refuse to comply with your requests in some cases. However, even if we refuse your request, we always do it after careful consideration and only when such refusal is necessary.

4. Regarding your right to object, we explain that you have the right to object at any time to the processing of your personal data based on the legitimate interest of the Data Controller (they are listed in point III) due to your particular situation. However, you must remember that in accordance with the law, we may refuse to take your objection into account, if we demonstrate that:

• there are legitimate grounds for processing that override your interests, rights and freedoms or

  • there are grounds for establishing, pursuing or defending any claims.

5. Furthermore, at any time, you may object to the processing of your personal data for marketing purposes. In this situation, after receiving the objection, we will stop processing them for such purpose.

6. You can exercise your rights by:

• sending an email directly to the Company at the address odo@eib.bio or

• completing the contact form for the deletion or change of personal data. Such form is available on the contact or GDPR subpages.

XI. The right to submit a complaint

If you believe that your personal data are being processed contrary to the law in force, you can complain to the President of the Office of Personal Data Protection.

XII. Final Provisions

1. Cases not covered by this Privacy Policy are governed by provisions regarding the personal data protection.

2. You will be notified of any changes made to this Privacy Policy by publishing them on the Company’s website (www.konmex.com, lab.konmex.com).

3. This Privacy Policy applies from May 25.2018.

Last updated December 01, 2023

This privacy notice for North American Biomedical Institute LLC (doing business as NABI) (“we,” “us,” or “our“), describes how and why we might collect, store, use, and/or share (“process“) your information when you use our services (“Services“), such as when you:

• Visit our website at http://www.nabi.bio, or any website of ours that links to this privacy notice

• Engage with us in other related ways, including any sales, marketing, or events

Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at privacy@nabi.bio.

SUMMARY OF KEY POINTS

This summary provides key points from our privacy notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.

Do we process any sensitive personal information? We do not process sensitive personal information.

Do we receive any information from third parties? We may receive information from public databases, marketing partners, social media platforms, and other outside sources. Learn more about information collected from other source.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties. Learn more about when and with whom we share your personal information.

How do we keep your information safe? We have organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.

How do you exercise your rights? The easiest way to exercise your rights is by visiting https://nabi.bio/contact/, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.

Want to learn more about what we do with any information we collect? Review the privacy notice in full.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?

2. HOW DO WE PROCESS YOUR INFORMATION?

3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

5. HOW LONG DO WE KEEP YOUR INFORMATION?

6. HOW DO WE KEEP YOUR INFORMATION SAFE?

7. DO WE COLLECT INFORMATION FROM MINORS?

8. WHAT ARE YOUR PRIVACY RIGHTS?

9. CONTROLS FOR DO-NOT-TRACK FEATURES

10. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

11. COOKIES

12. DO WE MAKE UPDATES TO THIS NOTICE?

13. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

14. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

• names

• phone numbers

• email addresses

• business name

Sensitive Information. We do not process sensitive information.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies.

The information we collect includes:

• Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called “crash dumps”), and hardware settings).

• Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.

• Location Data. We collect location data such as information about your device’s location, which can be either precise or imprecise. How much information we collect depends on the type and settings of the device you use to access the Services. For example, we may use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt out of allowing us to collect this information either by refusing access to the information or by disabling your Location setting on your device. However, if you choose to opt out, you may not be able to use certain aspects of the Services.

Information collected from other sources

In Short: We may collect limited data from public databases, marketing partners, and other outside sources.

In order to enhance our ability to provide relevant marketing, offers, and services to you and update our records, we may obtain information about you from other sources, such as public databases, joint marketing partners, affiliate programs, data providers, and from other third parties. This information includes mailing addresses, job titles, email addresses, phone numbers, intent data (or user behavior data), Internet Protocol (IP) addresses, social media profiles, social media URLs, and custom profiles, for purposes of targeted advertising and event promotion.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.

• To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.

• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.

• To send you marketing and promotional communications. We may process the personal information you send to us for our marketing purposes, if this is in accordance with your marketing preferences. You can opt out of our marketing emails at any time. For more information, see “WHAT ARE YOUR PRIVACY RIGHTS?“ below.

• To deliver targeted advertising to you. We may process your information to develop and display personalized content and advertising tailored to your interests, location, and more.

• To determine the effectiveness of our marketing and promotional campaigns. We may process your information to better understand how to provide marketing and promotional campaigns that are most relevant to you.

3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations described in this section and/or with the following third parties.

We may need to share your personal information in the following situations:

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels) to access or store information. Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice.

5. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this privacy notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

6. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

7. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly solicit data from or market to children under 18 years of age. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent’s use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at privacy@nabi.bio.

8. WHAT ARE YOUR PRIVACY RIGHTS?

In Short:  You may review, change, or terminate your account at any time.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section “HOW CAN YOU CONTACT US ABOUT THIS NOTICE?“ below.

However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Opting out of marketing and promotional communications: You can unsubscribe from our marketing and promotional communications at any time by replying “STOP” or “UNSUBSCRIBE” to the SMS messages that we send, or by contacting us using the details provided in the section “HOW CAN YOU CONTACT US ABOUT THIS NOTICE?“ below. You will then be removed from the marketing lists. However, we may still communicate with you — for example, to send you service-related messages that are necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes.

Cookies and similar technologies: Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Services.

If you have questions or comments about your privacy rights, you may email us at privacy@nabi.bio.

9. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy notice.

10. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a resident of Virginia, Utah, Connecticut, Colorado or California, you are granted specific rights regarding access to your personal information.

What categories of personal information do we collect?

We have collected the following categories of personal information in the past twelve (12) months:

Category: A. Identifiers

Examples: Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, and account name

Collected: NO

Category: B. Personal information as defined in the California Customer Records statute

Examples: Name, contact information, education, employment, employment history, and financial information

Collected: NO

Category: C. Protected classification characteristics under state or federal law

Examples: Gender and date of birth

Collected: NO

Category: D. Commercial information

Examples: Transaction information, purchase history, financial details, and payment information

Collected: NO

Category: E. Biometric information

Examples: Fingerprints and voiceprints

Collected: NO

Category: F. Internet or other similar network activity

Examples: Browsing history, search history, online behavior, interest data, and interactions with our and other websites, applications, systems, and advertisements

Collected: NO

Category: G. Geolocation data

Examples: Device location

Collected: NO

Category: H. Audio, electronic, visual, thermal, olfactory, or similar information

Examples: Images and audio, video or call recordings created in connection with our business activities

Collected: NO

Category: I. Professional or employment-related information

Examples: Business contact details in order to provide you our Services at a business level or job title, work history, and professional qualifications if you apply for a job with us

Collected: NO

Category: J. Education Information

Examples: Student records and directory information

Collected: NO

Category: K. Inferences drawn from collected personal information

Examples: Inferences drawn from any of the collected personal information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics

Collected: NO

Category: L. Sensitive personal Information

Collected: NO

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:

• Receiving help through our customer support channels;

• Participation in customer surveys or contests; and

• Facilitation in the delivery of our Services and to respond to your inquiries.

How do we use and share your personal information?

Learn about how we use your personal information in the section, “HOW DO WE PROCESS YOUR INFORMATION?“

Will your information be shared with anyone else?

We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information to in the section, “WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?“

We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be “selling” of your personal information.

We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We will not sell or share personal information in the future belonging to website visitors, users, and other consumers.

California Residents

California Civil Code Section 1798.83, also known as the “Shine The Light” law permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided below.

If you are under 18 years of age, reside in California, and have a registered account with the Services, you have the right to request removal of unwanted data that you publicly post on the Services. To request removal of such data, please contact us using the contact information provided below and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on the Services, but please be aware that the data may not be completely or comprehensively removed from all our systems (e.g., backups, etc.).

CCPA Privacy Notice

This section applies only to California residents. Under the California Consumer Privacy Act (CCPA), you have the rights listed below.

The California Code of Regulations defines a “residents” as:

(1) every individual who is in the State of California for other than a temporary or transitory purpose and

(2) every individual who is domiciled in the State of California who is outside the State of California for a temporary or transitory purpose

All other individuals are defined as “non-residents.”

If this definition of “resident” applies to you, we must adhere to certain rights and obligations regarding your personal information.

Your rights with respect to your personal data

Right to request deletion of the data — Request to delete

You can ask for the deletion of your personal information. If you ask us to delete your personal information, we will respect your request and delete your personal information, subject to certain exceptions provided by law, such as (but not limited to) the exercise by another consumer of his or her right to free speech, our compliance requirements resulting from a legal obligation, or any processing that may be required to protect against illegal activities.

Right to be informed — Request to know

Depending on the circumstances, you have a right to know:

• whether we collect and use your personal information;

• the categories of personal information that we collect;

• the purposes for which the collected personal information is used;

• whether we sell or share personal information to third parties;

• the categories of personal information that we sold, shared, or disclosed for a business purpose;

• the categories of third parties to whom the personal information was sold, shared, or disclosed for a business purpose;

• the business or commercial purpose for collecting, selling, or sharing personal information; and

• the specific pieces of personal information we collected about you.

In accordance with applicable law, we are not obligated to provide or delete consumer information that is de-identified in response to a consumer request or to re-identify individual data to verify a consumer request.

Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights

We will not discriminate against you if you exercise your privacy rights.

Right to Limit Use and Disclosure of Sensitive Personal Information

We do not process consumer’s sensitive personal information.

Verification process

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. These verification efforts require us to ask you to provide information so that we can match it with information you have previously provided us. For instance, depending on the type of request you submit, we may ask you to provide certain information so that we can match the information you provide with the information we already have on file, or we may contact you through a communication method (e.g., phone or email) that you have previously provided to us. We may also use other verification methods as the circumstances dictate.

We will only use personal information provided in your request to verify your identity or authority to make the request. To the extent possible, we will avoid requesting additional information from you for the purposes of verification. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes. We will delete such additionally provided information as soon as we finish verifying you.

Other privacy rights

• You may object to the processing of your personal information.

• You may request correction of your personal data if it is incorrect or no longer relevant, or ask to restrict the processing of the information.

• You can designate an authorized agent to make a request under the CCPA on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with the CCPA.

• You may request to opt out from future selling or sharing of your personal information to third parties. Upon receiving an opt-out request, we will act upon the request as soon as feasibly possible, but no later than fifteen (15) days from the date of the request submission.

To exercise these rights, you can contact us by visiting https://nabi.bio/contact/, by email at privacy@nabi.bio, or by referring to the contact details at the bottom of this document. If you have a complaint about how we handle your data, we would like to hear from you.

Colorado Residents

This section applies only to Colorado residents. Under the Colorado Privacy Act (CPA), you have the rights listed below. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law.

• Right to be informed whether or not we are processing your personal data

• Right to access your personal data

• Right to correct inaccuracies in your personal data

• Right to request deletion of your personal data

• Right to obtain a copy of the personal data you previously shared with us

• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”)

To submit a request to exercise these rights described above, please email privacy@nabi.bio or visit https://nabi.bio/contact/.

If we decline to take action regarding your request and you wish to appeal our decision, please email us at privacy@nabi.bio. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.

Connecticut Residents

This section applies only to Connecticut residents. Under the Connecticut Data Privacy Act (CTDPA), you have the rights listed below. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law.

• Right to be informed whether or not we are processing your personal data

• Right to access your personal data

• Right to correct inaccuracies in your personal data

• Right to request deletion of your personal data

• Right to obtain a copy of the personal data you previously shared with us

• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”)

To submit a request to exercise these rights described above, please email privacy@nabi.bio or visit https://nabi.bio/contact/.

If we decline to take action regarding your request and you wish to appeal our decision, please email us at privacy@nabi.bio. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.

Utah Residents

This section applies only to Utah residents. Under the Utah Consumer Privacy Act (UCPA), you have the rights listed below. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law.

• Right to be informed whether or not we are processing your personal data

• Right to access your personal data

• Right to request deletion of your personal data

• Right to obtain a copy of the personal data you previously shared with us

• Right to opt out of the processing of your personal data if it is used for targeted advertising or the sale of personal data

To submit a request to exercise these rights described above, please email privacy@nabi.bio or visit https://nabi.bio/contact/.

Virginia Residents

Under the Virginia Consumer Data Protection Act (VCDPA):

“Consumer” means a natural person who is a resident of the Commonwealth acting only in an individual or household context. It does not include a natural person acting in a commercial or employment context.

“Personal data” means any information that is linked or reasonably linkable to an identified or identifiable natural person. “Personal data” does not include de-identified data or publicly available information.

“Sale of personal data” means the exchange of personal data for monetary consideration.

If this definition of “consumer” applies to you, we must adhere to certain rights and obligations regarding your personal data.

Your rights with respect to your personal data

• Right to be informed whether or not we are processing your personal data

• Right to access your personal data

• Right to correct inaccuracies in your personal data

• Right to request deletion of your personal data

• Right to obtain a copy of the personal data you previously shared with us

• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”)

Exercise your rights provided under the Virginia VCDPA

You may contact us by email at privacy@nabi.bio or visit https://nabi.bio/contact/.

If you are using an authorized agent to exercise your rights, we may deny a request if the authorized agent does not submit proof that they have been validly authorized to act on your behalf.

Verification process

We may request that you provide additional information reasonably necessary to verify you and your consumer’s request. If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request.

Upon receiving your request, we will respond without undue delay, but in all cases, within forty-five (45) days of receipt. The response period may be extended once by forty-five (45) additional days when reasonably necessary. We will inform you of any such extension within the initial 45-day response period, together with the reason for the extension.

Right to appeal

If we decline to take action regarding your request, we will inform you of our decision and reasoning behind it. If you wish to appeal our decision, please email us at privacy@nabi.bio. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may contact the Attorney General to submit a complaint.

11. COOKIES

1. The website of this company, similarly to other business units, uses the so-called cookies, i.e., short text information saved on a computer, phone, tablet or any other user device. They can be read by our system, as well as by systems belonging to other business units whose services we use (such as Facebook, Google etc.).
2. Cookies perform a lot of functions on the website; most of them are useful and we will try to describe them below (if the information is insufficient, please contact us):

1. ensuring security – cookies are used to authenticate users and prevent unauthorized use of the client’s panel. They are therefore used to protect the user’s personal data against unauthorized access;
2. impact on the processes and efficiency of using the website – cookies are used to ensure that the website works efficiently and that you can use the features available on it, which is done, among other things, by remembering the settings of your subsequent visits on the website. In the result, you can efficiently navigate the website and individual subpages;
3. state of the session – cookies often record information about how visitors use the website, for example which subpages are displayed most often. They also allow to identify errors displayed on some subpages. Cookies used to record the so-called “session state” help to improve the quality of the services and increase the comfort of browsing;
4. maintaining session status – if a client logs in to his panel, the cookies sustain the session. This means that after switching to another subpage, you do not have to re-enter your login and password; this contributes to the comfort of using the website;
5. creating statistics – cookies are used to analyze how the visitors use the website (how many of them enter the website, how long they stay there, which content arouses the most interest, etc.). In the result, we can constantly improve the website and adapt its operation to the preferences of the users. In order to track the activity and create statistics, we use Google tools such as Google Analytics; in addition to reporting the website usage statistics, the pixel Google Analytics can also contribute, along with some of the cookies described above, to displaying more relevant content to the user in Google services (such as the Google search engine) and across the entire web;
6. using social functions – our website has a so-called Facebook pixel, which allows you to like our fanpage on FB while using our website. However, to make this possible, we need to use cookies provided by Facebook.
3. Please note that many cookies are anonymized for us: we are unable to identify you only with such cookies, without any additional information.
4. Your Internet browser allows for the use of cookies in your device by default and therefore at your first visit we ask for your permission to use cookies. However, if you do not wish to use cookies while browsing the website, you can change the settings in the web browser – you can fully block the automatic support for cookies or request notification each time when any cookies are placed on the device. The settings can be changed at any time.
5. While respecting the independence of all persons using our website, we have to inform you that disabling or limiting the use of cookies may cause quite serious difficulties in using the website, such as the need to log in to each subpage, slower loading of the website, restrictions on the use of its functionalities, limitations in liking the fanpage on Facebook, etc.

12. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this privacy notice from time to time. The updated version will be indicated by an updated “Revised” date and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy notice frequently to be informed of how we are protecting your information.

13. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at privacy@nabi.bio or contact us by post at:

North American Biomedical Institute LLC

7901 4th St Suite 15415

St. Petersburg, FL 33702

United States

14. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

You have the right to request access to the personal information we collect from you, change that information, or delete it. To request to review, update, or delete your personal information, please visit: https://nabi.bio/contact/.