Privacy Notice

This Privacy Notice applies to the processing of personal data collected within the European Economic Area (“EEA”) or processed in the context of our establishment in the EEA (“EU Personal Data”).

As described below, this Privacy Notice applies to the activities of:

• Axxora (UK) Limited - 1 Colleton Crescent, Exeter, Devon, EX2 4DG, United Kingdom
• Enzo Life Sciences (UK) Limited - 1 Colleton Crescent, Exeter, Devon, EX2 4DG, United Kingdom
• Enzo Life Sciences GmbH - Basler Strasse 57a DE-79540 Lörrach, Germany
• Enzo Life Sciences BVBA - Avenue Louise 65/Box 11 1050 Bruxelles, Belgium
• Enzo Life Sciences (ELS) AG - Industriestrasse 17 CH-4415 Lausen, Switzerland
• Enzo Life Sciences Europe AG - Industriestrasse 17 CH-4415 Lausen, Switzerland
• Enzo Life Sciences (ELS) AG - France 13, avenue Albert Einstein, F-69100, Villeurbanne

Such entities shall be jointly and severally referred to as “we” and “us”.

This EU Privacy Notice sets out what EU Personal Data we collect, how we collect it, how we use it, and your rights in connection with how we process your EU Personal Data. We are committed to protecting your EU Personal Data as in accordance with our duties under the General Data Protection Regulation (“GDPR”). This Privacy Notice applies to all of us and for your convenience you may exercise any of your rights against any of us, and we will ensure it is routed to the correct department.

In addition, please refer to our “Cookie Policy” for more information regarding the data we collect when you access our website and how it is processed.

1. Collection, use and transfer of EU Personal Data

We have set out below, in a table format, a description of the types of EU Personal Data we collect, the sources we collect it from, how we plan to use your EU Personal Data, which are the legal basis we rely on to do so.

Categories of EU Personal Data	Source of EU Personal Data	Use	Legal Basis
Contact data	Direct interactions with the customer; through cookies or other automated technologies when you visit our website; through third party sources such as tradeshows or online survey; through publically available information, such as social media, institutional websites or scientific publications.	Build and segment a list of customers and potential customers. Send relevant commercial communication to customers and potential customers.	Legitimate interests.
Contact data	Direct interactions with the customer. Forms filled out to obtain application notes, technotes, and marketing collateral.	Build and segment a list of customers and potential customers. Send relevant commercial communication to customers and potential customers.	Legitimate interests.
Contact data	Direct interactions with the customer.	Invoicing of our products and service, shipping of purchased product to customer.	Contract.
Credit card data	Direct interactions with the customer on our website.	Electronic payment of products and services.	Contract.

Please note that depending on the purpose for which we use your EU Personal Data, we may rely on more than one legal basis for processing. When we rely on legitimate interest, we do so because we have determined that this processing is required to be performed by us or a third party controller to provide the service. In making this determination we have considered your rights under European data protection law and balanced them against our legitimate interests. If you have any queries, you can contact us at the email address listed in section 11. Contact Us of this notice.

Generally we don’t rely on your consent as a legal basis for processing other than in relation to sending direct marketing communications to you or collecting your location data through interaction with our websites and mobile applications. You have the right to withdraw your consent at any time (for more information on this see section 4(4) Right to stop your EU Personal Data being used for direct marketing purposes below).

We may use your EU Personal Data for purposes other than the ones listed above. Should this be the case, we will inform you of the purpose in accordance with applicable laws and regulations.

2. Recipients

In order to achieve our purposes set out in the table above, we may share your EU Personal Data with the following categories of recipients:

• Our appointed distributors (complete list can be found here).
• Credit card companies, which use your credit card data to process payments.
• Shippers, who use your data to send you our goods.
• Customer relationship management (CRM) system vendors, which store your personal data on their server on our behalf.
• Content management system (CMS) companies, which store your personal data on their server on our behalf.

We require all third parties who process EU Personal Data on our behalf to respect the security of your EU Personal Data and to treat it in accordance with their contractual obligations.

We may need to share your EU Personal Data with more recipients than the ones listed above. Should this be the case, we will inform you in accordance with applicable laws and regulations.

3. International Transfer of EU Personal Data

Your personal data will be transmitted outside of EU, mainly to the US, as well as to other countries.
Your personal data are stored on servers located in the US. These servers offer data protection which is compliant with data protection requirements.
Your personal data may also be transmitted to our local distributors around the globe. Your personal data will be shared only with the distributor(s) which serve the country in which you reside. Please refer to our distributors listing.

4. Your rights in relation to EU Personal Data

You have the following rights regarding your EU Personal Data that we hold:


(1) Right of access

You can request details of your EU Personal Data that we hold. We will confirm whether we are processing your EU Personal Data and we will disclose supplementary information including the categories of data, the sources from which it originated, the purpose and legal basis for the processing, the expected retention period, and the safeguards regarding data transfers to non-EEA countries, subject to the limitations set out in applicable laws and regulations. We will provide you free of charge with a copy of your EU Personal Data, but we may charge you a fee to cover our administrative costs if you request further copies of the same information.


(2) Right of correction

We will comply with your request to correct incomplete or inaccurate parts of your EU Personal Data, although we may need to verify the accuracy of the new information you provide us.


(3) Right to be forgotten

At your request, we will delete your EU Personal Data promptly if:

• it is no longer necessary to retain your EU Personal Data;
• you withdraw the consent which formed the basis of your EU Personal Data processing;
• you object to the processing of your EU Personal Data and there are no overriding legitimate grounds for such processing;
• the EU Personal Data was processed illegally; or
• the EU Personal Data must be deleted for us to comply with our legal obligations.

We will decline your request for deletion if processing of your EU Personal Data is necessary:

• to comply with our legal obligations;
• in pursuit of a legal action;
• to detect and monitor fraud; or
• for the performance of a task in the public interest.

(4) Right to stop your EU Personal Data being used for direct marketing purposes.

At your request, we will stop using your EU Personal Data for the purpose of direct marketing. If you want to stop us from calling, emailing you in connection with marketing communications, please email us at the email address listed in section 11. Contact Us of this notice.

Please note that even if we stop all marketing communications, you may still receive administrative communications from us.


(5) Right to restrict processing of your EU Personal Data

At your request, we will limit the processing of your EU Personal Data if:

• you dispute the accuracy of your EU Personal Data;
• your EU Personal Data was processed unlawfully and you request a limitation on processing, rather than the deletion of your EU Personal Data;
• we no longer need to process your EU Personal Data, but you require your EU Personal Data in connection with a legal claim; or
• you object to the processing pending verification as to whether an overriding legitimate ground for such processing exists.

We may continue to store your EU Personal Data to the extent required to ensure that your request to limit the processing is respected in the future.


(6) Right to data portability

At your request, we will provide you free of charge with your EU Personal Data in a structured, commonly used and machine readable format, if:

• you provided us with EU Personal Data;
• the processing of your EU Personal Data is based on your consent or required for the performance of a contract; or
• the processing is carried out by automated means.

(7) Right to object

Where we process your EU Personal Data based upon our legitimate interest (or that of a third party), you have the right to object to this processing on grounds relating to your particular situation if you feel it impacts on your fundamental rights and freedoms. We will comply with your request unless we have compelling legitimate grounds for the processing which override your rights and freedoms, or where the processing is in connection with the establishment, exercise or defense of legal claims.


(8) Right not to be subject to decisions based solely on automated processing

You will not be subject to decisions with a legal or similarly significant effect that are based solely on the automated processing of your EU Personal Data, unless you have given us your explicit consent or where they are necessary for a contract with us.


(9) Right to withdraw consent

You have the right to withdraw any consent you may have previously given us at any time.


(10) Right to complain to a supervisory authority

If you are not satisfied with our response, you have the right to complain to or seek advice from a supervisory authority and/or bring a claim against us in any court of competent jurisdiction.

If you wish to contact us in connection with the exercise of your rights listed above, please email us at the email address listed in section 11. Contact Us of this notice. We will respond to your written request as soon as possible and no later than 30 days from receiving it.

Unless stated otherwise, we will not charge you any fee in connection with the exercise of your rights. In so far as it is practicable, we will notify the recipients of your EU Personal Data of any correction, deletion, and/or limitation on processing of your EU Personal Data.

Please note that if you decide to exercise your rights under sub-sections (3), (4), (5), (7) and (8), depending on our response, you may not be able to take full advantage of all of our benefits and services from that point on.

5. Retention Period

We keep your information as long as needed to achieve the above listed purposes, as well as for the amount of time necessary to meet any legal, tax, or reporting requirements.

6. Security

We have a management system to correct and prevent unauthorised access, loss, destruction, falsification, and leakage of EU Personal Data, as well as the appropriate technical and organizational measures to address such risks, as further detailed below. The goal of these measures is to maintain our data protection standards, and to ensure we have the necessary safeguards for the processing of EU Personal Data. Our service providers secure your personal data using encryption. In addition, we limit access to data to authorized employees, service providers, and contractors only. Although we strive to provide reasonable security for information we process and maintain, no security system can prevent all potential security breaches.

7. Children

Our websites are not intended for or designed for children under the age of 13, and we do not knowingly collect EU Personal Data from children under the age of 13. In the event that we have inadvertently collected EU Personal Data from children under the age of 13, we delete the personal data.

8. Updates

This Privacy Notice may be updated to reflect changes to our EU Personal Data processing policy. In the event there is material change to this Privacy Notice we will inform you via our website.

9. Automated decision making

We are using an automated marketing platform which is used to generate sales leads. Your browsing information is used to ascertain your specific interests so that we can suggest products to you which may best suit your needs.

10. If you fail to provide EU Personal Data

Where we need to collect EU Personal Data by law, or under the terms of a contract we have with you and you fail to provide the data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for the provision of Enzo product (s)). If that is the case, we may have to cancel a product order you have placed with us.

11. Contact Us

If you have any questions or opinions regarding this Privacy Notice, or if you have a request regarding information you provided us, you may either email us or send us a letter to the address below:

Enzo Biochem, Inc. - 527 Madison Ave., New York, NY 10022 USA - PrivacyAct@Enzo.com


Last updated: 05/24/2018