MAXCYTE, INC. PRIVACY POLICY

MaxCyte considers the privacy and security of information an important component of the services we offer. This Privacy Policy (the “Policy”) describes how MaxCyte collects, uses, discloses and protects the information we collect when you:

Visit our Site;
Interact with us via email, phone or through electronic communications on the Site;
Otherwise interact with us and we refer you to this Policy.

This Policy also contains information about the choices and privacy rights you have with regard to the information we maintain about you, and how you can exercise those choices and rights.

Please review this Policy carefully and contact us using the information provided in the “Contact” section below if you have any questions or concerns.

Important Definitions.

"Cookies" are pieces of information that a website transfers to your computer’s hard disk for record-keeping purposes. Cookies are uniquely assigned to your browser and can only be read by a web server in the domain that issued the cookie to you. Cookies cannot be used to run programs or deliver viruses to your computer.

“MaxCyte” “we” or “us” means MaxCyte, Inc. MaxCyte is the data controller of the Personal Information collected under this Policy.

“Site” means the MaxCyte website (www.maxcyte.com) or any other website that we operate and that links to this Policy.

“Personal Information” means any information that relates to you directly or indirectly and can be used to identify you, in particular by reference to an identifier, location, or factors specific to the physical, physiological, genetic, economic, cultural or social identity.

Information We Collect.

Depending on how you interact with us, we may collect the following categories of Personal Information:

Contact information, such as your name, address, telephone number, business contact details and email address;
Device information, such as your IP address, device ID, and data collected about your interaction with the Site and our email communications; and
Any other information that you provide to us that we can use to identify you.

In addition to Personal Information, we may collect other information that alone cannot be generally used to identify you. For example, when you use the Site, we may collect your browser type, device type, and operating system information. If any of this information can be used to identify you because, for example, we link it to your Personal Information, we will treat such information as Personal Information.

We may collect this information in a variety of ways, including:

Your direct interactions with us, such as when you ask about our services or products, contact us through the Site, apply for employment or in any way engage with us or our personnel;
Cookies and other data collection technologies, such as when you interact with the Site, or click on links or emails;
Third party sources, such as your healthcare provider and marketing partners; and
Through social media, such as if you link to social media platforms or use social media plug-ins, we may (depending on the privacy settings on that social media platform) automatically receive information about you from that social media platform.

Use Of Personal Information.

We may use Personal Data for any of the following purposes:

PURPOSE	EXAMPLES
Provide Site functionality and fulfill your requests when we have a contractual relationship, your consent, or a legitimate interest.	To provide customer service to you. To respond to your inquiries, fulfill your requests and complete your transactions. To send communications to you, such as changes to our terms, conditions and policies, as well as marketing communications that we believe may be of interest to you. To facilitate social sharing functionality.
Provide personalized services when we have your consent or a legitimate interest in providing you with information of interest to you.	To better understand you and personalize our interactions with you. To analyze or predict our users’ preferences in order to identify aggregated trend reports on how our digital content is used. To analyze or predict your preferences in order to improve our interactions with you, i.e., to deliver you the content, products and offers (via our Site, emails or digital tools) that we believe will be relevant to your interests.
Operate our business in compliance with our legal obligations and fulfilling our legitimate interest in maintaining our business.	To conduct data analysis and audits. To identify usage trends in the use of our Sites and analyze the effectiveness of our communications. To detect, prevent, investigate fraud and including (cyber) security monitoring and prevention. To develop, enhance, improve or modify our products and services. To validate your ability to access or use certain products or services. To better understand how our products and services impact you and those for whom you care. To operate and expand our business activities. To comply with any applicable legal obligations, particularly those relating to drug safety, risk management, financial transparency and other requirements for companies in the biotechnology or pharmaceutical industries.

In addition, we may aggregate the Personal Information we maintain about you and individuals so that we have a data set that does not, and cannot be used to, identify any individual. When we aggregate Personal Information, we may use and disclose such aggregated data for any purpose.

In the event we wish to use your Personal Information for other purposes that are not listed above or make any other changes to the existing purposes, we will notify you by amending this Policy in accordance with the section “Changes” below.

Sharing Of Personal Information.

We may share your Personal Information in the following circumstances:

With our service providers that help us run and manage our business. When we share your Personal Information with our service providers, they may only process your Personal Information on our behalf.
As authorized, if the sharing of your Personal Information with a third party has been authorized by you.
As required by law and as necessary to protect legal rights, when we believe that such action is necessary to comply to applicable laws or any legal, regulatory or similar requirement or investigation that applies to us, to protect or defend the rights or property of MaxCyte or another business or individual, or to enforce our policies.
In the event of a corporate transaction, such as a merger, reorganization, acquisition or sale of all or a portion of our assets, MaxCyte may transfer your personal information to any successor to all or substantially all of our business or assets.

Cookies.

We may use Cookies, web beacons, pixel tags and other data collection technologies (together, “Data Collection Technologies”) on the Site to helps us improve your experience on our online services. For example, we may use web-based analytics tools that track and report on the manner in which the Site is used to help us improve it. These tools do this by placing Cookies on your device. The information that the Cookies collect, such as the number of visitors to the Site, the webpages visited and the length of time spent on the Site, is aggregated. We also may use Data Collection Technology to collect information from the computer or device that you use to access our online services, such as your operating system type, browser type, domain and other system settings, as well as the language your system uses and the country and time zone in which your computer or device is located.

Your Control of Cookies: Most web browsers automatically accept Cookies, but you can usually modify your browser setting to decline Cookies. If you choose to decline Cookies, you may not be able to fully utilize all features of this Site. You have the ability to delete Cookies files from your hard drive at any time.

International Data Transfers.

We are committed to complying with this Policy and data protection laws, including those outside of the United States, that apply to our collection and use of your Personal Information. MaxCyte is headquartered in the United States, and we recognize that the laws in the United States may be different and, in some cases, not as protective as the laws other countries, including those located in the European Economic Area. By providing us with your Personal Information and using our Site, you acknowledge that your Personal Information will be transferred and processed in the United States. If you would like to know more about how we protect your Personal Information, you can contact us using the information provided in the “Contact” section below.

Accessing, Updating Or Removing Information.

If you become aware that information maintains about you is inaccurate, incomplete, misleading, irrelevant or out of date, or if you would like to access, update or remove your information, you may contact us using the information provided in the “Contact” section below. The right to erase your Personal Information may be limited if your Personal Information was collected for research purposes.

We will attempt to provide the requested information or make requested changes or removals to the extent allowable by the laws applicable to us. Please note that some of the above rights are limited by applicable law, and we may have the right to collect, process and hold your information pursuant to our legal obligations.

We may require you to provide additional information necessary to confirm your identity before complying with any request you make to us.

Opting Out Of Marketing.

You may elect to avoid future communications from MaxCyte by clicking the unsubscribe link at the bottom of any marketing email or contacting us using the information provided in the “Contact” section below. Please note that even if you opt out of marketing communications, you may still receive administrative, legal, and other important communications from us.

Retention Of Personal Information.

MaxCyte will keep your Personal Information for as long as necessary to fulfill the purposes for which it was collected, including any legal, professional, accounting or reporting requirements. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of Personal Information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes for which your Personal Information is processed, whether we can achieve those purposes through other means, and all applicable legal requirements.

Security.

Information collected by MaxCyte is stored in secure operating environments designed to ensure your Personal Information in protected from unauthorized access, use, disclosure, alteration or destruction, in accordance with applicable laws and regulations. Unfortunately, electronic data storage or transmission over the Internet cannot be guaranteed to be 100% secure. As a result, MaxCyte cannot ensure the security of any information you provide. We encourage you to take reasonable precautions to safeguard your Personal Information.

Third Party Websites.

Our Site and other services may contain links to other websites on the Internet, and other websites may contain links to the Site. These third party websites are not under our control, and this Policy does not cover the privacy and security practices of those third party operators. MaxCyte is not responsible for the privacy or security practices or the content of such websites. We recommend that you review the privacy practices of any third party website to which you submit your Personal Information.

Children’s Policy.

The Site and our services are intended for adult users over the age of 16. The Site is not designed to attract child users. MaxCyte is committed to protecting the privacy of children and does not collect Personal Information from any person it actually knows is a child under the age of 16.

Special Rights Of Individuals In The European Economic Area.

If you are located in the European Economic Area and MaxCyte maintains your Personal Information, you have the following additional rights under the GDPR with regard to your Personal Information:

Right to receive and transfer: You may request a copy of the Personal Information we hold about you. You may also request that we transfer your Personal Information to a third party in a machine-readable format.
Right to limit or restrict: You may have the right to request that we stop using all or some of your Personal Information or to limit the use of it.
Right to withdraw consent: You have the right to withdraw any consent you have previously given to us at any time. Your withdrawal of consent does not affect the lawfulness of the collecting, using, and sharing of your Personal Information prior to the withdrawal of your consent. Even if you withdraw your consent, we may have the right to use your Personal Information if it has been fully anonymized and cannot be used to personally identify you.
Right to complain: You have the right to lodge a complaint with your Supervisory Authority if you are unhappy with how we process your Personal Information. You can find contact information for your Supervisory Authority on the European Commission Data Protection Authorities webpage or through other publicly available sources.

These rights may be subject to certain exceptions provided in the GDPR.

Please note that if you decide to exercise some of your rights, we may be unable to provide you certain services, or you may not be able to use or take full advantage of the services we offer. We may charge you a reasonable fee if you request additional copies of your Personal Information or make other requests that are manifestly unfounded or excessive. If we are unable to honor your request, or if we determine to charge a fee, we will let you know why. For purposes of the GDPR, MaxCyte is the data controller of the information collected under this Policy.

Special Notice To California Residents.

California Civil Code Section 1798.83 permits individual California residents to request certain information regarding our disclosure of certain categories of Personal Information to third parties for those third parties’ direct marketing purposes. To make such a request, please contact us using the information in the “Contact” section below. This request may be made no more than once per calendar year, and we reserve the right not to respond to requests submitted other than to the email or mailing addresses specified below.

Changes.

We reserve the right to change or update this Privacy Policy at any time, and we may notify you of any such change or update by reasonable means, including by posting a notice on the Site or by email using the email address on file. Any modified Policy will supersede the current Policy, and the date of the when the Policy was revised will be identified at the top of the relevant Site webpage.