Privacy Policy

Last Updated: June 2026

 

1. Introduction

This Privacy Notice describes how Cytel Inc. and our affiliated companies (collectively, “Cytel” or “we”) collect, use and share information about you and how you can manage your privacy preferences.

This Privacy Notice applies to www.cytel.com and our other websites and digital properties that link to, or expressly adopt or refer to, this Privacy Notice (our “Online Platforms”).

EEA Residents: If you are a resident of the European Economic Area, please see our Cytel EEA Privacy Disclosures at cytel.com/eea-privacy-policy.

California Residents: If you are a resident of California, United States, please see our CCPA Privacy Policy at cytel.com/ccpa-privacy-policy.

UK Residents: If you are a resident of the United Kingdom, the provisions of this Privacy Notice apply to you together with the Data Subject Rights set out in Section 8 below, which have been updated to reflect your rights under UK GDPR and the Data (Use and Access) Act 2025.

 

2. Lawful Basis for Processing

Where required by UK GDPR, EU GDPR or applicable local law, we rely on the following lawful bases to process your personal data. Under the UK Data (Use and Access) Act 2025 (DUAA), a new seventh basis — Recognized Legitimate Interests (RLI) — was introduced for specific narrow purposes (crime prevention, safeguarding, national security). Cytel does not currently rely on RLI.

We process your personal data only where we have a valid lawful basis to do so. Depending on the nature of the processing activity, we rely on one or more of the following bases:

• performance of a contract with you or to take steps at your request before entering into a contract;
• compliance with a legal obligation;
• our legitimate interests or those of a third party, where these are not overridden by your rights and interest;
• your consent, which you may withdraw at any time;
• to protect the vital interests of you or another person.

For processing activities based on our legitimate interests, we have assessed that those interests are not overridden by the rights and freedoms of the individuals concerned.

 

3. What Information We Collect About You

“Personal Data” means any information that can be used to identify you, directly or indirectly, as an individual person. We collect Personal Data about you when you use our Online Platforms, including data provided by you, data we automatically collect, and data we obtain from third parties.

3.1 Data Provided By You

We collect Personal Data that you enter on our websites or give to us in another way. For example:

• When you access our Online Platforms: contact information (name, email, mailing address, telephone number); employment-related information (employer, department, job title, business contact information); product interest information; information on content and web pages of interest.
• When you purchase a product or service: the above, plus payment card information, order details and transaction information.
• When you complete a survey: your responses, which may include satisfaction data, product usage and market insights.
• When you contribute user-generated content: content you post on our blogs or social media platforms.
• When you register for an event: contact information and interests so we can send event notifications and related materials.
• When you apply for employment with Cytel: name, date of birth, demographic information, employment and educational history, and background check information where required by law. Applicants may receive supplementary privacy notice during the application process.

3.2 Data We Automatically Collect

We use technologies to collect data automatically when you use our Online Platforms. These include:

• Logging: IP addresses, browser type, operating system, ISP, pages visited, clickstream data, date and time of visit.
• Cookies, Analytics and Other Data Collection Tools: We and third parties we work with use cookies and similar tools to collect and store data about your preferences and interactions. See our Cookie Policy (Part A) for the full inventory.

3.3 Data We Obtain from Third Party Sources

• Business Partners and Service Providers: Our business partners (e.g. payment processors, analytics providers) may collect Personal Data and share some or all of it with us.
• Publicly Available Sources: We may collect contact, employment and interest information from social media platforms (e.g. LinkedIn, Facebook, X, Instagram, YouTube) and other publicly available databases.
• Supplemental Information: We may receive additional data from third-party sources such as credit reference agencies or public databases to supplement existing customer records.

 

4. How We Use Personal Data

We use Personal Data that we collect to provide the products and services you request, offer other Cytel products and services, communicate with you, develop new products and services, improve our business, and understand our customers. Examples include:

• Processing and completing your transactions (order confirmation, event enrolment, product delivery)
• Carrying out our contractual obligations to you
• Communicating with you about programmes, products or services that may interest you
• Tailoring our products and services to you and your device
• Allowing you to participate in interactive features of our Online Platforms
• Conducting market research and analysis to improve our products and services
• Preventing, investigating or providing notice of fraud or unlawful activity, as required by law
• Enforcing our Terms of Use and other agreements

 

5. How We Share and Disclose Personal Data

Within Cytel

We share Personal Data within Cytel for purposes consistent with this Privacy Notice — for example, to process and fulfil your order, facilitate communication between you and a local Cytel representative, and coordinate with you.

Service Providers

We share Personal Data with third-party service providers who perform services on our behalf, such as payment processing, marketing, analytics, event coordination, and verification.

Consent Management, Website Hosting and CRM

We use third-party vendors for cookie consent management, for website hosting and CRM, and for customer relationship management.

Third-Party Mobile App Providers

With your knowledge and consent, our Online Platforms may gather and transfer Personal Data, including location information, from and to other applications on your mobile device.

Legal Process, Safety and Terms Enforcement

We may disclose Personal Data to regulatory authorities as required by law, in connection with claims or disputes, for investigations, to protect health and safety, to prevent fraud or to enforce our legal rights.

Business Transfers

We may disclose Personal Data as part of a corporate transaction such as a merger, acquisition, joint venture, or sale of company assets. Personal Data may also be disclosed in the event of insolvency, bankruptcy or receivership. You will be notified of any change in ownership or uses of Personal Data.

 

6. International Data Transfer

Cytel operates globally. Data protection laws vary among countries, with some providing more protection than others. Regardless of where your information is processed, we apply the same protections described in our Privacy Policy.

We also comply with certain legal frameworks relating to the transfer of data, such as the frameworks described below:

Transfer Mechanism	When Used	Further Information
UK International Data Transfer Agreement (IDTA)	Transfers from UK to countries without an adequacy decision, including certain US service providers.	ICO guidance at ico.org.uk/idta
EU Standard Contractual Clauses (SCCs — Commission Decision 2021/914)	Transfers from EEA to countries without an adequacy decision.	You can see the Standard Contractual Clauses adopted by the European Commission on their website.
Adequacy Decisions (Art. 45 GDPR / UK Schedule 21 DPA 2018)	Transfers to countries with UK or EU adequacy status.	See ec.europa.eu and ico.org.uk for current lists
Intra-group arrangements	Transfers between Cytel group entities across jurisdictions, governed by intra-group data sharing agreements.	Group transfer arrangements enacted by Cytel.

 

7. Data Retention

We retain Personal Data for as long as necessary for the purposes set out in this Privacy Notice, or as required by law. The criteria we use to determine retention periods include:

• The nature and sensitivity of the data
• The purposes for which we process the data and whether those purposes can be achieved in a shorter period
• Our legal obligations (e.g. statutory retention requirements for financial records)
• Whether retention is advisable in light of our legal position (e.g. for litigation, audits or investigations)

 

8. Your Data Subject Rights

The privacy rights available to you depend on the laws of the country or region in which you are located. The table below provides an overview of common rights.

Depending on your location, you have the following rights in relation to your Personal Data. To exercise any of these rights, please contact us as set out in the Privacy Policy in the “How to Contact Us” section.

Right	What It Means
Right of Access (SAR)	Request a copy of the Personal Data we hold about you and information about how it is processed.
Right to Rectification	Request correction of inaccurate or incomplete Personal Data.
Right to Erasure	Request deletion of your Personal Data in certain circumstances (e.g. where consent is withdrawn and no other lawful basis applies).
Right to Restrict Processing	Request that we limit how we use your data while a dispute or objection is resolved.
Right to Data Portability	Receive your data in a structured, commonly used, machine-readable format.
Right to Object	Object to processing based on legitimate interests or for direct marketing purposes.
Rights re. Automated Decisions	Not to be subject to solely automated decision-making, including profiling, that produces significant effects (scope differs by jurisdiction).
Right to Withdraw Consent	Withdraw consent at any time where processing is based on consent.
Opt-out of Sale/Sharing (US)	California residents may opt out of the sale or sharing of Personal Data for targeted advertising.

 

We will respond to all rights requests within one calendar month of receipt. In complex cases, this may be extended by a further two months, in which case we will notify you. We will not charge a fee for handling rights requests unless they are manifestly unfounded or excessive.

 

9. Automated Decision-Making and Profiling

Cytel does not make solely automated decisions that produce significant legal or similarly significant effects on individuals. We may use analytics tools (including Google Analytics and HubSpot) to analyze how visitors interact with our Online Platforms and to segment audiences for marketing purposes. This constitutes profiling for marketing analytics, but no automated decision produces a legal or similarly significant effect without human review.

 

10. Other Important Information

10.1 Children’s Privacy

Our Online Platforms are not directed at, and we do not intend to or knowingly collect or solicit Personal Data from, children under the age of 18. If you are under 18, do not provide Personal Data to us. If a child under 18 has provided Personal Data to us, we encourage a parent or guardian to contact us to request removal.

10.2 Links to Other Websites

Our Online Platforms may contain links to third-party websites and digital services. This Privacy Notice does not apply to those third parties. We encourage you to review their privacy notices. Our pages may also include third-party widgets (e.g. social media buttons) that collect data; again, their practices are governed by their own notices.

10.3 User-Generated Content

Some Online Platforms enable users to submit content (e.g. blogs, testimonials). Please note that content submitted to public areas of our platforms may be visible to others. Exercise caution in such submissions. We are not responsible for how others use publicly posted content.

10.4 Managing Communication Preferences

You may opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email, or by contacting us as mentioned in our Privacy Policy in the “How to Contact Us” section. Please note that you may continue to receive transactional or service-related communications.

 

11. Data Protection Complaints

11.1 How to Make a Data Protection Complaint

If you have any concerns about how Cytel has collected, used, shared or otherwise processed your Personal Data — or if you are dissatisfied with our response to a data subject rights request — you may make a formal data protection complaint to us through any of the following channels:

Channel	Details	Notes
Email	DPO@cytel.com / privacy@cytel.com	Preferred method; available 24/7
Post	Att: DPO, Cytel Inc., 675 Massachusetts Avenue, Cambridge MA 02139, USA	Mark envelope ‘Private & Confidential — DPO’

Important: You do not need to use a specific form or channel. A complaint is valid, however it is submitted — including verbally, informally by email to any Cytel employee, or via social media. You do not need to use the word “complaint” for it to be treated as one.

11.2 What Happens When You Complain

• We will acknowledge receipt of your complaint within 30 days of receiving it and provide you with a reference number.
• We will investigate your complaint without undue delay, making appropriate enquiries and keeping you informed of progress.
• We will notify you of the outcome of your complaint without undue delay, including any steps we have taken in response.

11.3 Escalating to a Supervisory Authority

If you are not satisfied with our response, or if we have not responded within a reasonable time, you have the right to escalate your complaint to the relevant supervisory authority for your location:

Your Location	Supervisory Authority	Contact
United Kingdom	Information Commissioner’s Office (ICO)	ico.org.uk/make-a-complaint
European Union / EEA	Lead supervisory authority in your Member State	edpb.europa.eu for contact details
United States (California)	California Attorney General / California Privacy Protection Agency	oag.ca.gov | cppa.ca.gov
Other jurisdictions	Local data protection authority	Contact DPO@cytel.com for guidance

12. Updates to this Privacy Notice

This Privacy Notice will be revised as required. If we make material changes to how we use Personal Data, we will post notice of the changes on our Online Platforms. The updated notice will be effective thirty (30) calendar days following posting. The Last Updated date and version number at the start of this document indicate the current version.

13. Country/Region-Specific Disclosures

The laws of certain countries and regions require specific information to be included in a privacy notice. Please visit the relevant page below:

Region	Link
European Economic Area	cytel.com/eea-privacy-policy
California, United States	cytel.com/ccpa-privacy-policy
United Kingdom	See Section 8 (Data Subject Rights) and Section 11 (DP Complaints) of this Notice

14. How to Contact Us

If you have any questions or comments about this Privacy Notice, or wish to exercise your data subject rights or make a complaint, please contact us:

Organization	Cytel, Inc.
Attn	Privacy / Data Protection Officer
Postal Address	675 Massachusetts Avenue, Cambridge MA 02139, USA
Data Protection Officer	DPO@cytel.com  | Privacy@cytel.com
Website	cytel.com/privacy-policy | cytel.com/cookie-policy