BMS GENERAL PRIVACY NOTICE
If you reside in California, please find additional information in our section for California
residents.
If you are a healthcare professional, you can access our other notice here: HCP Privacy Notice(https://www.bms.com/privacy-policy.html#hcp).
BMS US Consumer Health Data Privacy Policy:
Washington Consumer Health Data Privacy Policy: if you are a resident of Washington or anindividual who falls within the definition of Consumer under Washington’s My Health My DataAct.
Nevada Consumer Health Data Privacy Policy: if you are a resident of Nevada.

Our Commitment
At Bristol Myers Squibb (BMS), your privacy matters to us. For us, data privacy goes beyond merecompliance with the law. BMS aims to collect, use, and share information that we obtain about you in amanner consistent with our company values, including high ethical standards, integrity, inclusion,
fairness, and transparency. We have a dedicated internal team that reviews how BMS accesses, collects,
uses, shares, stores, transfers, deletes and protects information about you. To safeguard your data, BMS
employs reasonable and appropriate security measures. When upholding your rights as a data subject,
you can contact us to respond to any questions you might have that are not answered in this Notice at
eudpo@bms.com or as described below.
1.

WHO WE ARE

We are Bristol Myers Squibb Company (BMS). In addition to this Notice, our details (name, address, etc.)
may have been given to you separately at the time of the collection of information about you, forexample, in a form, an app or a website notice, or in an e-mail, containing a link to this Notice. Together
with our worldwide affiliates and other entities that are part of the BMS group which have a relationshipwith you, we are the controllers of your Personal Information. We refer to these entities as “BMS”, “we”,“us” or “our”.
You can access the main locations of our entities and facilities, markets where we distribute our products
and the countries where we operate on www.bms.com.
2.

INTRODUCTION – HOW THIS NOTICE APPLIES TO YOU

This general privacy notice (“Notice”) is a global Notice. It describes how Bristol Myers Squibb may Use
information about you (“Personal Data” or “Personal Information”) when you interact with ourcompany, in connection with your use of BMS websites, mobile applications, devices and platforms,

2021 – JULY – 1

1 | 29when we communicate with you and in the context of our business activities. It also informs you about
your privacy rights and the measures and processes we put in place to protect your data.
This Notice applies whether you are a patient, member of the public, visitor, shareholder or investor,
member of a regulatory body or authority, supplier or business partner, job applicant, or any otherindividual with whom we engage or who is involved in our business activities.
If you are an employee, supplier, or business partner, there may be additional privacy notices that apply
to your information. Please refer to the information you received from us as an employee for additional
privacy notice information, and if you are a supplier or business partner, please refer to your contractual
agreements with BMS for additional information.
In this Notice, we refer to you as “you” or “your”. We use the term “Processing” or “Use” when we referto the access, collection, recording, organisation, structuring, retrieval, disclosure, storage, transfer,deletion or otherwise use of your Personal Information.
In some instances, we may Use your Personal Information in ways that are not described in this Notice.
Where this is the case, we will provide a supplemental or just-in-time privacy notice that explains such
Use when we collect it. You should read any supplemental explanation in conjunction with this Notice.

Compliance with applicable laws
When Using your Personal Information in the context of our activities, we will do so in compliance with
relevant data privacy and data protection laws, which includes regulatory and national law requirementsthat may apply to such Use and, where applicable, giving you the specific rights that apply in the country
where you reside (altogether “Applicable Data Protection Law”).
3.

HOW WE USE YOUR INFORMATION ONLINE

We may collect your Personal Information online when you use BMS or third-party operated websites andother online resources, including mobile applications, other digital means or platforms. This may also
happen through collaborations that we have in place with third parties or companies that host websites
for us or with whom we have partnerships for our products, services, or activities. Below, we give you
additional information about how we use your information online.
You may interact with BMS or our partners websites and platforms that relate to BMS products andservices, job application, patient recruitment, disease awareness, scientific research, alliance websites,or applications used in the context of patient support or management programs.
We enter into arrangements for those collaborations to require an appropriate protection of your
Personal Information. Some area of our web sites and platforms may require you to submit informationin order for BMS to respond to your request, permit you to access specific areas or participate in aparticular

activity.

Whenvisiting

ourwebsites,

please

also

read

our

Legal

Notice(https://www.bms.com/legal-notice.html) and if you are visiting our website for safety reasons, our page
on medical information (https://www.bmsmedinfo.com).
2021 – JULY – 1

2 | 29We have identified examples where we Use your Personal Information online in the table below.
Online Information that we may collect when you use our sites
Contact

If you communicate with us through the "contact us" link on our sites, we may ask you

information

for your Personal Information, such as your name, telephone number, professional
information and e-mail address so that we can verify your identity or respond to yourquestions and comments.

WebsiteOur site offers various features, which we may change from time to time. We may ask

featuresyou to submit certain Personal Information so we can communicate with you about
these features and manage them properly.

Contacting

If you contact our medical information team (medinfo) or report an adverse event in

Medicalrelation to a BMS product, the information you provide (including your name, contact

Information ordetails, professional information and your questions) will be documented andreporting an

retained on our databases for purposes of dealing with your enquiry and to comply

adverse eventwith the law.

Connections

Some areas of our web sites and platforms can be restricted. It may require you to log

andin with usernames, passwords and other authentication mechanisms that belong toauthentication

you, that you create or that we provide you. When using such features, this may
automatically allow us to access certain of your account credentials or other personaluser account details to verify your identity or that you have a valid license to practiceas a professional.

Other uses of

We may Use the Personal Information you provide through BMS websites or platforms

informationfor our internal purposes. These purposes include administration of the site, data
analytics, compliance with our legal obligations or our internal policies andprocedures.

Cookies andWhen connecting to our various websites, applications, and other digital platforms,

similar

we may use cookies and other similar technologies that may allow us or third parties

tracking

to collect Personal Information about you. Depending on the country where youtechnologies

reside, you may opt-in or opt-out from options or technologies that we use anddisplay. Please read our 18 below for more information.

Interest-BasedWe may use 3rd party advertising companies to tailor online and mobile

Advertising

advertisements to you based on predictions about your interests. We explain how we(IBA).

may Use your Personal Information in this context in our section about cookies.

Links to other third-party websites
2021 – JULY – 1

3 | 29

As a convenience to users, our sites contain links to other third-party websites that may offer additional
information, such as educational or professional materials, services and contacts. This Notice does not
apply to your use of those other websites. Before using the linked websites, please review their privacy
notices to understand how they use and protect your Personal Information.
4.

WHAT INFORMATION WE MAY PROCESS ABOUT YOU

The information that we Process about you may include various categories of Personal Data dependingon your interactions with BMS, third parties with whom we collaborate, or external sources that provide
us with your Personal Data. We have outlined below the main categories of Personal Information and,
where applicable categories of sensitive Personal Information that we may collect about you.

Examples of general categories of Personal Information
Contact

Full name, personal or professional postal and/or email address, phone

information

number and other contact details.

Identification
information

Full name, initials, date of birth, photographs, or government-issued
identification, such as driving licence, passport, professional licence number,or government ID number.
Payment-related information, such as your bank address or account details

Financialinformationand number, tax-related information for business purposes, or otherinformation about you, your relatives, connections, your suppliers or third
parties for example to verify the absence of conflicts of interest or to comply
with anti-bribery laws.
Job title, CVs and resume, educational information, professional

Professional

qualifications, position, work experience, background checks, professional

information

networks, programs, publications and activities, referrals and, other relevant
professional information where needed.
In some cases, we may classify, organize, rank, rate or create profiles relating
to our audiences (for example, via our customer relationship management
system or other similar tools). When doing so, those activities are conductedwith human intervention by BMS staff or authorised third-party employees toCategorization andclassification data

capture:• data relating to how you behave using our technologies (for example
websites, mobile applications, platforms, or care programs);• data used to categorize, analyse, or predict performance andpreferences.

2021 – JULY – 1

4 | 29

You can read more about this activity in section 10 below.
We may obtain information from publicly available sources, third-party
service providers specialized in social media listening, or from the Internet tounderstand how the general public or influencers perceive our brand,
products and activities.
This may include collecting information about:• the volume of coverage, reach and popularity data, sentiments(negative/positive), most frequent words and topics that you use,
Sentiment analysis

engagement (amount of likes, favourites, comments, shares of users on

and analytics,

a specific topic), contributors’ demographics (native language, countrysocial media andof origin and gender), and date and time of posts to see development

data from publicly

over time, which we may collect either via our channels, websites, social

available sources

media or via third-party providers.
When conducting such activity, we do not make individual decisions onusers unless we inform you otherwise. We have agreements in place withthird parties to protect and limit information Used for this purpose toaggregate reports. If we need to specifically identify you, we will use
reasonable efforts to inform you about our Use of your Personal Information.
You can read more about this activity in section 10 below.
BMS uses social media channels to share important news about our researchand commercial activities, programs, and initiatives to improve the life ofpatients. You may connect using your login details on such platforms or visit
publicly available pages. When monitoring our channels, we may receive
aggregate information or access Personal Information about you, such as
your username, profile, and what you say, like or comment on our channel.

Data from social
media activities
and monitoring

When monitoring our channels, BMS may also receive information about
potential adverse events about someone using a BMS product. If we identify
or receive safety information about patients, we may be required to notify
competent authorities about pharmacovigilance cases.
You should consider carefully what information about yourself and others(such as colleagues, friends, customers, or patients) you choose to sharewhen you use social media. If you need to report any concern about our
products, we encourage you to contact us via our contact forms on our official
BMS sites. Because the information you may share becomes public and often
cannot be permanently erased on those platforms, we recommend that you

2021 – JULY – 1

5 | 29do not report sensitive information, including health information throughBMS social media platforms.
We may provide additional notice and choices to you about how BMS may Use
Personal Information on social media platforms, our websites and other
online resources that we utilize.
The information we may collect might originate from your use of BMS’s sites,
websites, mobile applications, and other connected devices (such as medical
devices and Apps) and includes:• Internet Protocol (IP) address, geolocation data, your browser, operating
systems, device ID;• data captured by cookies and similar tracking technologies, which may
Information

include analytics information and information about the date and time

technology-relatedof your request (read our cookies section below); or

data• Information that we may collect that describes and gives information
about other data ("metadata”). This Notice applies to the extent such
metadata allows us to draw precise conclusions about your private life,
to identify you or to further Use your Personal Information for our
purposes. Where required under Applicable Data Protection Laws, wewill inform you and ask for your permission prior to collecting suchinformation.

De-identified andanonymized
information

We may use Personal Information about you to:•aggregate and/or de-identify information about you; or•

use suggestions, comments, and ideas that are not personallyidentifiable.

Examples of special categories of data / sensitive Personal Information
In some situations, we may collect sensitive Personal Information about you. When doing so, we apply
stronger safeguards to protect your privacy. Depending upon the country in which you reside and theparticular context for the collection of such Personal Information, this may include the following
information:

2021 – JULY – 1

6 | 29• Data revealing race or ethnicity (such as for diversity and inclusion
initiatives);• Political opinions (such as for employment purposes);• Religious or philosophical beliefs (such as for tax purposes), or tradeunion membership (such as to comply with labor laws);
General types ofsensitive Personal
Information• Bank account and payment details (such as when contracting with you);• National ID, passport number, social security number, driver’s license
number (such as when contracting with you or to comply with the law);• In certain situations, or jurisdictions, e-mail content or text messages(such as non-solicited content);• Criminal records or creditworthy information (such as to enter into acontract with you or to comply with the law);• Data related to a person's sex life or sexual orientation;• Precise geolocation.
We may collect data relating to your health in limited contexts, which
includes:• health data or status needed for managing accidents cases or for disease
prevention in the context of public health;• dietary preferences or restrictions (such as food allergies), special
conditions or disabilities when attending an event;• genetic or biometric information, (for example, for identification andsafety purposes, in relation to BMS’s risk management and drug safety

Health information

programs, for accessibility purposes for visitors to BMS facilities and(if permitted or

manufacturing sites, or for security or fraud prevention or detection

required by law)

purposes); or• other health data, combined with other identifiers that we may collect toprovide you with cell therapies, personalized medicines and other
innovative therapies or devices that we use to manufacture our products,
ensure product quality, safety, performance, vigilance and to ensure
patient safety. Such Personal Information may include your initials,
name, key-coded or pseudonymized data, and other related informationnecessary for the provision of our products when necessary to protect
your health safety or to comply with the law.

Please note: The categories of Personal Data listed above are not exhaustive and may vary dependingon the way that you interact with us or the type of Personal Data that BMS needs to Process for particular
activities. In the event that BMS Uses Personal Data about you which is not listed in this Notice, we will2021 – JULY – 1

7 | 29inform you of the information that we will Use at the time of collection or when we communicate withyou.
5.

WHERE DO WE GET YOUR INFORMATION FROM

In most cases, BMS will collect information directly from you, although sometimes we will obtain
information from public or third-party information sources or from use of web-based, devices or othertechnologies which automatically generate such information. We have outlined below the main ways
BMS collects and Processes Personal Data when interacting directly or indirectly with you.
We may collect information from you directly:•

when we interact with you in the course of our activities or when you participate in a BMS activity,
event or program (such as diversity and inclusion, ambassador or patient support programs);•

in the context of a specific treatment, such as for personalized medicines, using medical devices ordigital platforms or applications;•when we engage service providers, business partners or institutions for services, collaborations oroperations;•when you sign up to receive our communications to become a member of our databases or whenregistering to receive our press releases, e-mail alerts, marketing communications or more
information about our activities;•

when you share information with us through our various contact points, such as through ourcompany products, commercial, clinical or alliance websites, mobile applications, contact forms,
call centers, career application websites, during offices or manufacturing site visits, or for productinquiries;•

when we collect information about you from your computer or other devices you use when visiting
BMS’s website or mobile applications, or other products, our offices and facilities; or•when you share medical information with us relating to adverse events, pharmacovigilance or
incidents involving devices or applications. These disclosures can be communicated in-person or
remotely, including by calling us, or via our websites and other digital channels or means ofcommunication.

We may collect Information about you indirectly:•

when we receive information about you through a healthcare professional where necessary forpharmacovigilance, incident management, risk management, investigation, or litigation purposes;•

when we obtain information that is accessible from public registries, databases, or other third-party
sources, such as service providers, agencies or private organizations;•when you have made information about you publicly available on the Internet, including websites,
social media platforms, scientific reviews, articles and publications and other sources, in which casewe will either inform you, anonymize the data or get your prior consent;

2021 – JULY – 1

8 | 29•

when necessary to verify your credentials, professional information (such as by accessing publicly
accessible information, national registries or third-party databases) or your identity for compliance,
security or ID verification purposes;•

when you make public posts on social media platforms that we follow (for example, so that we canunderstand public opinions).

We may also collect information about you automatically, such as for security and systems monitoring(e.g. through video (CCTV) recording) and building access control logs when you visit our offices or inother contexts made apparent to you at the time.
Please note: When we collect information about you indirectly, we strive to inform you in the mostappropriate manner about the Processing of your Personal Data and how we collected that data throughour business partners or using other reasonable means.
6.

DATA MINIMIZATION

Where permitted and feasible, and to protect your right to privacy, BMS will take reasonable steps toremove, de-identify or anonymize information that may directly or indirectly identify you, and restrict tothe minimum the amount of Personal Information that BMS Uses, submits or transfers to third parties,
courts, or governmental bodies.
7.

FOR WHAT PURPOSES DOES BMS PROCESS YOUR INFORMATIONThis is a global Notice. BMS Processes your information in the context of our regular activities, and inaccordance with the purposes as set out in this Notice, a separate notice, or when Applicable Data
Protection Laws either permit or require us to do so. These purposes may vary depending on where youlive and where BMS operates. Where the laws of a country restrict or prohibit certain activities describedin this Notice, we will comply with such requirements. This may include refraining or not Using yourInformation for those purposes restricted or prohibited in that country.
Below, we list some of the main, but not all, of our purposes for which we may Use Personal Information
about you.
Main purposes for which BMS may Use your Personal Information
We may Use Personal Information about you, your staff and third
parties with whom you collaborate in the context of the services thatyou provide to us. Such Personal Information may include:
Contracting purposes• when you need access or authorization to connect to our systems,
devices or enter our facilities;• to protect our systems and IT infrastructure;• when assisting us in our activities; or2021 – JULY – 1

9 | 29• when we conduct audits or assessments of your organization.
This includes obtaining Personal Information before, during and after
we enter into a contract with you, your organization and your staff.
We may Use Personal Information about you when we partner with
Collaboration andother organizations, including private or public alliances, institutions,research purposes

for regional or local discussions, or life science industry groups
associations and consortiums.
When we exchange, interact or establish partnerships with service

Patient advocacy andproviders, local, regional or global patient advocacy associations or

support programs

organizations, or other life sciences companies, including in the context
of patient-related support or management programs.
As we develop and manufacture innovative therapies, we may Use
Personal Information, which may include sensitive Personal
Information about you when providing:

Providing innovative•

products, such as devices
or personalized medicine

personalized medicines, such as cell-therapies, or other
innovative therapies; or•digital health platforms, digital or medical devices, medical
equipment, tools or applications.

In this context, we may keep Personal Information, including healthinformation, about you for manufacturing, quality or safety purposes.
For example, when we:•

respond to your questions, comments, application andrequests;

Managing BMS’s•

manage your access to our systems, devices and facilities;•

conduct due diligence (including for compliance with antibribery laws and to avoid conflict of interests) or audits

relationship with you

activities;•

invite you to our events, activities, initiatives or programs;•

conduct assessments, provide training, perform backgroundchecks or identity verification, send invoices; or•Commercial andmarketing activities

have to disclose information to competent authorities.

When conducting our business operations, we may interact with you in
person or digitally or to improve our brand and products, such as
through the following activities:

2021 – JULY – 1

10 | 29•

Market Research and surveys: we collect Personal
Information about individuals for market research purposes.
We collect this information through surveys and interviews
with patients and healthcare professionals or otherstakeholders to help us improve our products and understandthe market;•

Direct Marketing including advertising: we Process your
Personal Information to provide you with marketing
information, including in-person, by electronic or remotemeans. We do this by conducting advertising ourselves or
through the sharing of your Personal Information to third
parties acting on our behalf. You can understand more about
advertising in our section on section on cookies; or•Websites and social media platforms: we may use social
media to inform the public about our activities. We mightcollect aggregate information about social media users when
you comment on BMS-related topics or use BMS media
channels. See more details in our section 4.

BMS Uses limited Personal Information before, during and after weplace a pharmaceutical product or a medical device on the market.
In the context of clinicaloperations and studies

This includes during our sponsored clinical trials and studies, such as
for drug safety (pharmacovigilance), or incident monitoring(materiovigilance) or when interacting with authorities, regulatory
agencies and bodies. We may also conduct real-world evidence
activities in compliance with regulatory requirements.
When we Process professional information to assess individual'ssuitability for roles at BMS or collaboration purposes, such as when you

Job application

apply on our career websites, through a job offer posted online or
through agencies with whom we have partnerships. You can read more
information in section “14”.
When we conduct in-person and activities to inform the general public,

Patient recruitment

healthcare professionals and patients about our diseases, upcoming

activities and websites

medicines and treatments or studies that may enable individuals toapply to such clinical trials or studies that we conduct.

2021 – JULY – 1

11 | 29

When we Process information to comply with regulatory obligations
Regulatory andparticularly where they relate to drug safety and risk management

complianceobligations, and obligations related to spend-transparency and similar
requirements specific to the pharmaceutical sector.
When keeping and preserving information about you in order to protect
our rights, or for the protection of third-party rights. In certain
situations, we may have to submit or transfer such information to third

Investigations,parties, courts, or governmental bodies. Where permitted and feasible,

prosecutions, or defence

and to protect your right to privacy, BMS will take reasonable steps toof legal claims

remove or anonymize information that may directly or indirectly
identify you, and restrict to the minimum the amount of Personal
Information that BMS submits or transfers to third parties, courts, orgovernmental bodies.

Other purposes: BMS will Process your Personal Information for other purposes, where permitted orwhen required such as reporting information for BMS’s risk management and drug safety obligations.
8.

HOW BMS JUSTIFIES USING YOUR INFORMATIONIn this section, we describe our legal justifications (commonly referred to as “legal basis”) for the Use ofyour Personal Information related to each of our main Processing activities. We will use the legal basisthat is most appropriate for the purpose and circumstances related to such Processing. Below, we have
explained which legal bases we may choose or have to use when Using your Personal Information.
There may be times where we must use your consent to Process your Personal Information. We may alsodecide to ask your permission to Process your Personal Data, such as in the context of voluntary
initiatives or activities.
Please note: depending on the country where you reside, the law of your country may not require thatBMS use a specific legal basis to justify Using your Personal Information, including transfers of your
Personal Information outside your country (for example in the United States). However, when Applicable
Data Protection Law requires a legal basis, we will inform you about what legal basis we use at the timeof the collection or when we communicate with you. If your jurisdiction requires consent to Process your
Personal Information when you interact with us, we will obtain your consent prior to the Use of such
Information.
In the following table, you can read more details about what applicable legal basis or combination oflegal bases we may use when Processing your Personal Information.
Our legal bases

2021 – JULY – 1

Examples of activities that we conduct with your Personal Information

12 | 29•

conducting our regular commercial activities;•

scientific and statistical research purposes;•

registering BMS visitors and supplier personnel visiting our offices;•

improving our products and services;•interacting with contractors, patients and the general public;•

keeping you informed about our regular activities, such as withnewsletters;•

conducting market research and surveys•

collecting information that you decide to share on the internet or social
media platforms, collecting responses from surveys, sending you

We may use ournewsletters, and inviting you to events;

legitimate businessinterest or privateinterest to Process•

responding to your enquiries;•

engaging with you whether in-person, remotely, or digitally to organize

your Personal

our activities, or exchange information with you about our products orInformation for

initiatives, or services;•conducting profiling activities, such as tiering of individuals, ourcustomers, key opinion leaders, visitors of our websites, through theuse of applications and devices, and for other similar activities or
through other means;•conducting research activities alone or together with other third
parties,•

to prevent crime (such as fraud, financial crime, and theft of intellectual
and industry property) and to ensure the integrity of our manufacturing
and other operations, or•when necessary to enable us to operate as a pharmaceutical company.

when Using Personal Information about you, your staff, suppliers and third
parties with whom you collaborate, for example to:When we rely on our•collaborations;contractual
relationship with you

send you requests for proposals, suggest partnerships and•conduct due diligence, assessments or audits of your organization;•assess the feasibility of a study with your institution and to contract
with you, your institution and staff;

2021 – JULY – 1

13 | 29•

generally manage the contractual relationship with you as a partner,
supplier or a third party service provider, such as for billing andpayment purposes.

We may Use your Personal Information, including keeping or sharing itwith authorities as required or when allowed by Applicable Data
Protection Laws, such as to:

To comply withapplicable laws•

respond to or notify authorities about pharmacovigilance monitoring
activities, incidents or other post-market surveillance obligations;•for spend transparency;•

tax or accounting;•anti-bribery and other laws that prohibits conflicts interest;

to respond to government regulators, agencies, courts, or other third
parties in legal proceedings.
When the law of your country enables us to rely on it, in particular insituations that will be of significant public interest, such as for:•medicines, seeking for a better understanding of diseases or to

We use the public

improve our products;

interest

We may use yourVital interests

scientific research that leads to medical breakthroughs or new•

to provide early access to our medicines;•

the prevention of diseases (such as in a pandemic situation); or•

preventing or the detection of crime.

In limited situations, BMS may have to collect information, which includes
the use of sensitive Personal Data about you to protect your life or against
incidents or other threats.
In some instances, the law of your country may allow BMS to use a legal

Other legal

exception. This may apply, for example, when Using your health data to

exceptions

conduct research projects or to ensure high standards of quality and safetyof health care and of medicinal products or medical devices.

2021 – JULY – 1

14 | 29

We may use your prior permission when the law of your country requires us
to do so, for example to Use your Personal Information, disclose it, transfer
it to, or share it with, third parties, including outside your country ofresidence. In other instances, we may require your prior consent:•

to send you commercial communications electronically, such as for
direct marketing, market research, surveys, or for general

With your consent

interactions with you;•to invite you to events or to propose you participate in various BMS
activities and initiatives; or•to use your images (such as your photographs, audio or video
recordings) for interviews, events or other BMS initiatives.

When you consent to the Processing of your Personal Information, you may have the right to withdraw
that permission at any time. In such case, we will cease to Use your information in the future and,
unless BMS has an obligation to keep it for a longer period, we will employ reasonable measures tolimit or prevent further Use of it. This includes archiving, blocking, or employing encryption,
anonymization, or erasure techniques.

9.

WITH WHOM DO WE SHARE YOUR INFORMATIONAs a multinational company operating worldwide, your Personal Information may be shared with, oraccessed by, parties located outside your country of residence. If you are located outside of the UnitedStates, BMS may share your Personal Information with parties located in countries that provide lessprotection than in your country, which includes the United States. We may also Process and share your
Personal Information with some of our affiliates and other members of the BMS group including selected
and approved third parties (vendors and business partners) that help us operate worldwide. When doing
so, we implement appropriate measures to prevent unauthorized access or Use of your Personal
Information.
Below you can find more information about how BMS shares your Personal Information within its groupof entities and with third parties.

Sharing your Personal Information within the BMS group
Often, we share your Personal Information within the BMS group of companies (“BMS Group”). This may
include the Bristol Myers Squibb Company headquarters in the United States and all of its current andfuture subsidiaries, branch offices, affiliates, entities and other companies that are part of, owned orcontrolled by, the BMS Group. When exchanging information internally, we rely on appropriatearrangements and mechanisms to cover any transfer of your Personal Information within our corporate

2021 – JULY – 1

15 | 29

structure, such as binding corporate rules (BCRs), contractual arrangements approved by authorities orbased on consent.

Sharing your Personal Information with third parties
To conduct our business, we share with, or disclose Personal Information to, third parties, such as:•

Third-party service providers for the purpose of outsourcing specific business activities torequest external support and resources. This may include companies that provide information
technology services, clinical trials and studies support, marketing or market research services,
events, meeting and planning services, or services related to talent acquisition or consultancy;•

business partners such as external scientists and healthcare professionals to review and assist us
with healthcare compliance activities and institutions and other organizations with whom wecollaborate to support our clinical or commercial activities (such as for clinical studies, patient
support programs, and so on);•regulatory and health authorities including governmental bodies (such as the FDA, EMA, NHS),
data protection authorities, tax authorities, or courts in case of disputes, when permitted or
required by Applicable Data Protection Law; and•third parties to whom BMS is legally obligated to provide such information, such as otherparties in litigation or legal disputes, guardians, conservators, or individuals with powers of
attorney.

When engaging with third parties, we enter into agreements with them for the Processing of Personal
Data so that such Processing is carried out in accordance with our instructions, in a confidential, secure,and transparent manner in order to protect your privacy rights. When it is not possible to enter into anagreement with a third party, such as when engaging, reporting or interacting with regulatory or healthauthorities or courts, and when legally possible, we will use our best efforts to implement appropriate
security measures and controls (such as pseudonymisation) to protect your Personal Information.

Data sharing in connection with a transfer of control
Circumstances may arise where we decide to reorganize or divest part or all of our business or a line ofour business (or any portion of our assets), including our information databases and websites, through asale, divestiture, merger, acquisition, in the event of a bankruptcy, or other means of transfer. In any suchcircumstance, your Personal Information may be shared with, sold, transferred, rented, licensed, orotherwise provided or made available by us or on our behalf to actual or potential parties to, and inconnection with, the contemplated transaction (without your consent or any further notice to you). In
such circumstances, we will seek written assurances that Personal Information about you submitted
through this Website will be protected appropriately.

If you are in the European Economic Area (“EEA”) and Switzerland

2021 – JULY – 1

16 | 29

Whenever we transfer your Personal Information within the EEA, Switzerland or to countries that are
deemed “adequate”, such countries are deemed to offer the same level of protection as given by the lawof your country. When accessing your Personal Data from, or transferring it, outside of the EEA or
Switzerland to countries that may not provide the same level of protection as your own country, we
will use appropriate safeguards to protect your right to privacy. For example, such safeguards may
consist of using Standard Contractual Clauses (to exchange information with third parties outside of the
EEA and Switzerland), Binding Corporate Rules (for data transfer within the BMS group of companies) as
approved by the European Commission or the competent authority, data transfer agreements or yourconsent.

If you are outside the EEA and Switzerland
Where possible, we will allow access to or the transfer of your Personal Information outside your countryof residence:•

to countries that provide a reasonable high level of data protection;•using the most appropriate data transfer mechanisms available to BMS; or•

where required by Applicable Data Protection Laws, after we get your prior permission, for thecollection, disclosure to third parties and the transfer of your Personal Information to a country
which does not provide an adequate protection equivalent to the laws of your country ofresidence.

10.

AUTOMATED DECISION-MAKING AND INDIVIDUALS’ RIGHTS

Unless permitted by law, BMS does not make decisions based solely on automated Processing(including profiling) of individual data unless we inform you otherwise prior to the Processing. We
may use algorithms that will enable us to use automated decision-making, including to create profiles.
This means that when we use certain technologies, software or algorithms, which may allow us to create
profiles, tiering, further understand trends and statistics or use other advanced technologies or
automated processing, someone will be involved to validate decisions resulting from such use.
As the use of such technologies evolves, we may use algorithms without a person involved in the decision.
In this case, if this activity requires us to Process your Personal Information that is not anonymized, we
will comply with any applicable legal requirements, such as to draw this to your attention and provide
you with information about the logic involved in the decision, as well as the significance and theenvisaged consequences for you of such Use of your Personal Information. Depending on your country ofresidence, you will have the right to ask that such decision is taken by an individual.
11.

WHAT ARE MY RIGHTS AND HOW TO EXERCISE THEM

You have a number of rights related to the Personal Data that we Process about you (this will depend on
the jurisdiction where you reside and the legal basis that we use). Most often, exercising your right is free

2021 – JULY – 1

17 | 29

of charge. We may also have to clarify your request and explain if we can comply with it or if this isrestricted in your situation. You can always contact BMS at dpo@bms.com or via this contact form
(https://www.bms.com/about-us/contact-us.html) to find out more about your rights and how best to
exercise them.
Below we have listed individual rights that may apply depending on your jurisdiction.
You may have the right to:•receive a copy of your Personal Data we hold about you;•correct your Personal Data we hold about you;•where applicable, receive a machine-readable copy of your Personal Data (portability);•

ask us to delete your Personal Data or restrict how it is used;•

where applicable, object to Processing of your Personal Data for certain purposes, such as when
we use it for marketing purposes (opt-out); and•where you have provided us with your consent to Use your Personal Data, you can withdraw
your consent at any time without affecting BMS’ Use of such information before your withdrawalof consent.

Exceptions to your rights
There may be exceptions to your privacy rights described in this Notice. This depends on the country
where you reside, why we are Processing your Personal Data and if your request may impair the rights ofothers. If we cannot comply with your request to exercise your privacy rights, for example when we keep
your information for regulatory purposes or for the investigation, prosecution, or defence of a legal claim,
we will explain this to you when you contact us.
ExampleIf you ask BMS to stop sending you marketing communications by e-mail, we may keep your e-mailaddress and other contact details in case we conduct other activities with you, such as when we have acontract with you or if we have a legal or a regulatory obligation to keep your contact details.

How to contact us
If you have any questions about how we Use your Personal Information, please contact our Data
Protection Office at dpo@bms.com. If you are resident in a State that provides you with more rights (suchas California), you can submit requests by calling 855-961-0474 or by completing the online form at
www.bms.com/dpo/us/request. For further details, see our section on State Privacy Rights.

Note: We may need to request specific information from you to help us confirm your identity. If yourrequest is complex or if you have made a large number of requests, it may take us longer to respond toyou, but we will keep you informed of any delays. You will not have to pay a fee to obtain a copy of your
Personal Data (or to exercise any of the other rights). However, we may charge a reasonable fee if yourrequest is clearly unfounded, repetitive or excessive.

2021 – JULY – 1

18 | 29

Lodging a complaint with a competent authority
In some countries, you may have the right to lodge a complaint to the relevant data protection orcompetent authority if you believe that we Process your Personal Information unlawfully or are violating
your rights.
12.

HOW LONG WE RETAIN YOUR INFORMATION

We aim not to retain your Personal Information for longer than necessary for the specific businesspurposes for which it was collected. After that, unless we are required to continue to maintain theinformation by law, we may anonymize, restrict, block or delete it. In certain cases, BMS may retain your
Personal Information for a longer period for the purpose that we have and, in a manner, or a format, that
may require BMS to keep certain identifiers. In such case, we may archive it and apply appropriate
measures which may consist of blocking, preventing, obfuscating, pseudonymizing, key-coding, or
restricting any further access and Use of Personal Information about you. When retaining and storing
information about you in our systems, we have put in place data retention schedules in accordance withour company policy and in compliance with Applicable Data Protection Laws.
When assessing the appropriate retention period, we take into account the quantity, nature andsensitivity of Personal Data, the potential risk of harm in the event of unauthorised use or disclosure, thepurposes of the Processing and whether or not these purposes can be achieved by other means, as well
as applicable legal obligations.
13.

HOW DO WE PROTECT YOUR INFORMATION

We implement appropriate technical and organizational controls to protect your Personal Informationthat we hold to prevent unauthorized Processing, loss of data, disclosure, use, alteration, or destruction.
Where appropriate, we use encryption, pseudonymisation (such as key coding), de-identification andother technologies that can assist us in securing the information about you, including measures torestore access to your information. We also require our service providers to comply with reasonable andrecognized data privacy and security requirements.
We conduct tests and reviews of our technologies and processes, including a review of our business
partners and vendors, so that our security controls remain effective. Also, we may further anonymize your
Personal Information when it is no longer needed for the purpose for which BMS originally collected such
Information.
14.

APPLYING TO WORK AT BMS

BMS may Process your Personal Data to evaluate your application to work at BMS. When applying for an
opportunity at BMS, we may collect and Process Personal Information about you directly or indirectlyfrom our official websites, third parties or when you make this information publicly available oraccessible by third parties for recruitment purposes. You can consult our career opportunities on this2021 – JULY – 1

19 | 29

page: https://careers.bms.com/. Below, you can find more information about how BMS Processes your
Personal Information when you apply to work for us.

To consider your application we may collect:•your professional experience, such as job title, education information, professional
qualifications, work experience, publications, and professional networks, programs andactivities in which you participated;•

your contact details, such as your e-mail address, full name, date of birth and other informationnecessary to submit your application;•

information gathered from agencies, such as information from recruitment agencies,
reference providers, and (where permitted by law) background screening providers;•publicly available information from a company website, internet searches or social media
platforms such as LinkedIn or other social media platforms, and publicly available profile
information (such as your experience, skills, and interests);•

information that you allow us to access, for example, if you choose to simplify your login
Process to the job platform to allow direct access once you have signed in to your third partysocial media user account, (such as Gmail or Yahoo!), or if you want to upload information to theplatform (such as from LinkedIn) instead of manually completing an application; and•other information that you submit to us, that we obtain indirectly or that we access whenlooking for new hires or career opportunities.

As your job application proceeds
We may ask you to share additional Personal Information with us, such as:•

official information, such as government issued identification number or tax status;•

financial information, such as bank account details;•

special categories of Personal Data / sensitive Personal Data, including (where it is permitted,
necessary or required for your application) information about your health, marital status, tradeunion membership religion, criminal records, or credit worthiness data; or•other information necessary for your interview or providing you with a job offer, such as detailsof any known disability or workplace accessibility needs, background information, travel andexpenses, performance management, emergency contact details, compensation, hours of work,
holidays and benefits-related information.

Where do we Use your Personal Information for job application
As a multinational organization, our affiliates transfer information globally. When you upload
information to a job search platform, you provide it to all our affiliates, each of which may Process it for
its own recruitment purposes. This is the case even where you respond to a job posting that mentions aparticular BMS affiliate. Accordingly, we may transfer globally information about you (for example, if you
2021 – JULY – 1

20 | 29

are in the European Economic Area ("EEA"), your information may be transferred outside the EEA; if you
are in Australia, your information may be transferred outside Australia).
We will not keep your Personal Information for longer than needed to consider your application.
However, we may ask your permission to keep some information about you for a longer period (forexample your CV or resume, work experience, cover letters and so on) to consider your eligibility forfurther job opportunities.
15.

WHAT INFORMATION DO WE COLLECT ABOUT OUR PATIENTSBMS Processes Personal Information about patients that use our treatments and in the context of ourclinical research activities. We may also Use patient Personal Information in connection with certain
activities, such as through our services, collaborations or consortium agreements with third parties (forexample genetic data), during events interviews, for advocacy related activities, or for clinical trials,
studies or research projects linked to our products.
Note, this section, together with this Notice, does not apply to participants to clinical trials.
This Notice applies to how BMS may Use Personal Information about you when you participate in nonclinical activities. If you are involved in a research project, clinical trial or in a study you can contact yourphysician or contact dpo@bms.com. Below, you will find out more information about Personal Data that
we collect about patients in contexts other than clinical studies or research projects.

Patients participating in non-clinical research activities with BMS
In the context of non-clinical research activities, BMS generally does not collect patient data, except incertain occasions, such as where we have reporting obligations to authorities, if you agree to share suchinformation with us or, if permitted, by information you prior to the collection of your Personal
Information. In some instances, we may have interactions with you or access information about you
outside of our clinical research activities. This may happen, for example and where permitted, when:•accessing our personalized medicines, other innovative therapies or devices;•

BMS collaborates with patient organizations;•inviting you to our events;•

we propose patient support programs;•

we use certain digital technologies, platform or device;•

we use patient recruitment websites or conduct awareness or recruitment campaigns on social
media; or•when conducting surveys, market research, interviews or propose ambassador programs.

When doing so, BMS will either collect information that does not allow us to identify you or use technicalmeasures to limit the risk of identification. For example, we may use measures that could include:•

replacing your information such as name, identification number or any other information with acode (key-coded study data);

2021 – JULY – 1

21 | 29•

using a third party provider who will only share your Personal Information in an aggregate
manner with BMS;•

anonymizing your Personal Information after its collection; or•requesting your prior consent.

If BMS accesses Personal Information about you that is sensitive, we will protect it adequately. For more
information about our Use of sensitive data, please refer to section 4.
16.

STATE PRIVACY RIGHTSThis section applies to data subjects located in States which have implemented privacy laws (e.g.
California). Depending on the State where you reside or from which you originate, you may have certain
specific rights (e.g., access and deletion) that apply to you. These rights are not absolute and only apply
in certain circumstances. This means that we may be unable (e.g., due to legal requirements), or not
obligated, to satisfy your request. In some cases, we may need to collect additional Personal Informationfrom you to verify your identity before we provide access or delete your information, such as governmentissued identification. BMS will not discriminate against you for exercising your rights but may not be able
to provide you with services or programs that you have requested if we are not able to use your Personal
Information.

To submit requests, please call 855-961-0474 or complete the online form at

www.bms.com/dpo/us/request.
Below, you will find more information about State privacy laws.
CALIFORNIA
Under the California Consumer Privacy Act of 2018 (CCPA), its further amendments and related legal acts
(such as the California Privacy Rights Act of 2020), California residents may have specific rights regarding
their Personal Information held by private companies. The information in this section applies solely tovisitors, users, and others who reside in the State of California (“consumers,” “you”).

Your rights under Californian data privacy law
You have the right to ask us to disclose to you any Personal Information we
have collected about you in the last 12 months. In order to exercise this right,
BMS must first verify your identity to ensure it is a legitimate request, and thendisclose to you:
Disclosure2021 – JULY – 1•

The categories of Personal Information we have collected about you;•

The types of sources used to collect Personal Information about you;•

The types of third parties with which we have shared any of your
Personal Information (if applicable); and•The purpose(s) of collecting your Personal Information.

22 | 29

You have the right to request that we delete the Personal Information we have
Deletioncollected from and about you. In order to exercise this right, BMS must first
verify your identity to ensure it is a legitimate request, we will then delete therelevant information unless an exemption applies.

You have the right to designate an authorized agent to act on your behalf toexercise your rights under the CCPA. In order to do so, BMS must verify your
Authorized Agents

identity, and your authorized agent must have written permission from you.
We reserve the right to deny a request from an agent that does not submit
proof that they are authorized to act on your behalf.

Non-discrimination

Consumers with
Disabilities

You have the right to be free from unlawful discrimination for exercising yourrights under the CCPA.

BMS strives to accommodate all customers regardless of disabilities. If you
need to receive the information contained in this document in a different
format, please contact us using the contact information listed below.

To make a request please follow the link here (or here: www.bms.com/dpo/us/request) to our online form or contact us at the phone number below in
Submitting a
Requestthe “Contact Information” section of this Privacy Notice statement. As
outlined above, BMS will need to verify your identity before we provide accessor delete your Personal Information and BMS may be unable (e.g., due to legal
requirements), or not obligated (e.g., due to applicable exemptions) to fulfill
your request (e.g., due to applicable exemptions) to satisfy your request.

Information BMS Collects
Personal Data, or Personal Information, means any information about an identifiable individual. BMS
may collect Personal Information directly from you (in person, through online forms, and otherinteractions with BMS employees, websites, and systems), or from other third parties.
Please note: BMS does not “sell” your Personal Information. For purposes of this Disclosure, “sell” or“sold” means the disclosure of Personal Information for monetary or other valuable consideration.

How BMS Uses Personal Information

2021 – JULY – 1

23 | 29

The purposes for which BMS Uses Personal Information depends on the relationship or interaction witha specific California resident, and we only Process your information for purposes permitted by Applicable
Data Protection Laws. BMS may Use Personal Information to operate, manage, and maintain ourbusiness, to provide products and services, and to accomplish business purposes and objectives.
For more information about the purposes for which we Use your Personal Information please refer tosection 7 of this Notice.
17.

CHILDREN

BMS websites and mobile applications are not intended or designed for children under the age of 13.
Depending on the country where you reside, you may not use this website under the age of 16 or 18. We
do not collect information from any individual we know to be under the age of 13 (or older if your country
is more restrictive). Please contact your physician or dpo@bms.com if you need further information
relating non-adults participation to our studies.
18.

COOKIES AND TRACKING TECHNOLOGIES

Depending on the country where you reside, you may manage your preferences on cookies and similar
tracking technologies through the use of consent management tools that are available on our websites.
This section applies to cookies and similar tracking technologies. When we collect information that may
enable us to identify you, the other sections of this Notice will apply.

What are cookies?
A cookie is a small piece of data that a website asks your browser to store on your device in order toremember information about you, such as your language preference or login information. Such cookies
when set by us are called first-party cookies. We may also use third-party cookies – which are cookies
from a domain different than the domain of the website you are visiting (for example, those used by social
media, instant messaging, CRM or marketing platforms, or advertising companies). For more information
about cookies, types of cookies and how to manage cookies, including how to block them and delete
them, please visit http://www.allaboutcookies.org.
Below, we list the main categories of cookies and similar tracking technologies that we may use when
you connect to our websites, use our web-based platforms, applications, devices, or when you interact
with us electronically or when you receive electronic communications from us (“Online Use”). You canlearn more about the purposes for which BMS may use such technologies for your Online Use.

What categories of cookies may BMS use?
We generally use certain types of cookies during your session on our website (“session cookies”). To
improve your experience or remember your preferences or choices, we may use cookies that will remain

2021 – JULY – 1

24 | 29

on your device unless you remove them (“persistent cookies”). When using cookies on our websites andother digital services, such technology may include:
Categories of cookies and tracking technologies that BMS may use
Strictly necessary
cookiesThose cookies and tracking technologies enable our websites to operate
and to improve the security of our website for your Online use, such as
when you have to authenticate or use login functionalities to access
restricted parts of our websites.

Performance andanalytics cookies

Those cookies may allow BMS to:•

improve our websites;•

understand trends, statistics, capture audience metrics or other siteusage about the use of the website or other platform that we may use(such as for analytics purposes);•remember language or other preferences when you navigate; or•

use other features on our websites, applications, platforms anddevices to improve your Online use.

Social media cookies

On certain BMS websites, we may use social media plugins for you to shareinteresting content or to connect to certain accounts to share your
Personal Information with us. Such platforms may access your history ofnavigation and collect information about your browsing journey under
their own terms. You can access more information when connecting to our
Web sites.

Web server data andother technologies

BMS and 3rd parties we work with may also collect usage data from our Web
site, such as:•

the source address that a page request is coming from (e.g. IP
address);•domain name, date and time of the page request;•

the referring Web site (if any); or•

other parameters in the URL (e.g., search criteria).

We use the above-mentioned data to better understand Web site usage asa whole and to determine which areas of our Web site users prefer (e.g.,based on the number of visits to those areas). BMS and 3rd parties we workwith store and use this information for statistical reporting.

2021 – JULY – 1

25 | 29

Advertising cookies

Cookies classified as advertising cookies are specifically designed to gather
information from you on your device to display advertisements to you
based on relevant topics that interest you. To the extent BMS can use suchcookies and where relevant to the interaction with you, advertisers willplace these cookies on a website with the website operator's permission or
inform you in a notice about the use of such advertising features. Read
more information about interest-based advertising in section 3 above.

Other tracking
technologies

When using third-party software or websites, mobile applications, devices,
web-based platforms or through other Online use, the technology may
involve certain built-in tracking technologies. This may include:•

web beacons, web server data and similar technologies (in order toimprove user experience for our website visitors);•

tracking pixels, which we may include as an image in ourcommunications to you. This may allow us to understand when you
read electronic communications that we send you, to send you moreaccurate and relevant content and improve our communications toyou;•other trackers that enable functionalities such as remote interactions
with you through chatbots, instant messaging; or•

cookies used for authentication purposes (such as using patient or
physician login to restricted pages or areas).

Why do we use cookies on our website?
In addition to the explanation provided in this Notice and the section above, we use cookies or similar
tracking technologies in various instances, such as for the following purposes:•

Making your experience more efficient, faster and easier. By remembering your preferences,like preferred language, display and other settings, maintaining your session, and forauthentication purposes. This helps us to provide you with a better user experience. These
cookies are also referred to as Session-Id cookies, authentication cookies, and User Interface
customization cookies.

•

Gain useful knowledge about how the site is used. By collecting information about the
number of visitors and other uses. This helps us improve our sites. These cookies are also
referred to as analytics cookies. For this purpose, we use services such as Google Analytics whichmeans that Google and similar suppliers will also have access to this information (including yourIP address and any other equipment identifiers such as the IMEI number and the MAC address).

2021 – JULY – 1

26 | 29

•Provide easy access to our websites. This helps us to direct you, share with you our content
within sites such as Facebook, Twitter, LinkedIn, YouTube or Pinterest or allow you to sharecontent that is of your interest. To the extent we use such technology, these ‘social media plugins’ may store cookies and similar technology on your computer or other device. This means thatthe social media sites may access this information (including your IP address), may identify thatyou interacted with the BMS site.

•

Improve our marketing communications to you. Certain cookies, such as web beacons or
tracking pixels, may be used by third party systems, such as customer relationship management
systems or other service providers who help us manage e-mail campaigns. Those trackers enable
us to better understand the success of our communications and the relevance of the content
that we share with you. This may allow us to reduce the number of e-mails that we send you andprovide you with content, scientific information, or initiatives that are more tailored to yourinterests.

•

Collect and analyse advertising campaigns. We use, and allow certain 3rd parties to use, othertechnologies, such as web beacons, on our Web sites and in our digital communications to tailor
advertising, or to measure the effectiveness of advertising campaigns. A web beacon is a clear
GIF (Graphics Interchange Format) that a company can place on a web site or in digitalcommunications to allow it or a third party (such as an Internet advertising, audiencemeasurement, or social media company). As a result, we and these 3rd parties may collect anduse information about your online visits to our Web sites or engagement with our digitalcommunications.

How can you object or refuse cookies?
Subject to the law of your country, in particular in the European Union, we will either inform you, ask yourprior permission (opt-in) before placing tracking technologies on your device, or provide you with a rightto object (opt-out) for the purposes that we describe in this section. Your web browser, e-mail software(such as Microsoft Outlook, or Google Gmail) and other clients that you use can be set to manage cookies
and similar trackers and even reject them by default. Do bear in mind that if you set your browser toautomatically reject cookies, your user experience when visiting websites will not be the same: yourpreferences may not be remembered, some functionality may be lost and you may not be able to accesscertain areas or features of the sites.

Do-Not-Track Signals
When you visit our Web sites, the collection of traffic data occurs even when do-not-track signals areenabled on your internet browser. Under certain circumstances, we may be able to identify you when you
visit our websites. For example, if you register on our website, we may be able to link your Personal
Information to previous visits on our websites depending on whether our website cookies from earlier

2021 – JULY – 1

27 | 29

visits are still stored on your computer. For more information about do not track signals,
visit https://www.allaboutdnt.com.

Interest-Based Advertising (IBA)
We may use 3rd party advertising companies to tailor online and mobile advertisements to you based on
predictions about your interests. Your interests could come from several sources including your browsing
activity, such as visits to our web sites from your browser and device or your response to online
advertisements. These 3rd parties collect and store data about your interests based on your online andmobile activity using different technologies, such as placing or recognizing cookies on your browser,
recognizing device identifiers, or using pixel tags. These 3rd parties may also use these types oftechnologies to recognize you across the devices you use.
For interest-based ads, to opt-out, you may click on the "AdChoices" icon within the advertisement or
Web site which will take you to a page where you can learn more about interest-based advertising andmanage or opt out of the online targeting technology from the 3rd parties that we work with. Ad Choices
Opt-outs are browser and device-specific; therefore, you should repeat your selections across eachdevice and browser on you wish to be opted out. If you opt-out, you may still see advertising from BristolMyers Squibb online or in mobile applications, but the 3rd parties we work with will not serve our ads
based on predictions about your interests. Also, if you delete or remove cookies or apps, your opt-out
selections will not be stored. You should review your opt-out preferences periodically, or update yourchoices to include new participating companies. In some cases, the 3rd parties we work with may stillcollect data about your browsing activity and mobile application activity for other purposes, but will not
use this information to select our ads that you see. To learn more about interest-based advertising andhow to opt out in desktop and mobile, please visit http://optout.aboutads.info/#/ andhttp://optout.networkadvertising.org/#/. To opt out of interest-based ads on mobile, you can download
the AppChoices app at www.aboutads.info/appchoices. Some parties we work with, such as social media
platforms or other 3rd party technology platforms, have their own opt-out procedure. You should review
the privacy policies of those properties to learn more about how you can opt-out of interest-based ads
on those sites.

Retargeting
The data captured through the tracking technologies used by our Web sites may be shared with our 3rdparty advertising technology partners in order to provide you with targeted advertising that may appear
on other websites you visit on the internet. These partners use technology to match cookies on yourcomputer with cookies placed on your computer by other websites you may visit or have visited. These
partners may also use cookies and other technologies (e.g. web beacons) to recognize you across thedevices you use, such as a mobile phone or laptop.
Below we have identified the main cookies and categories that BMS uses on our websites and platforms.

2021 – JULY – 1

28 | 29

19.

CHANGES TO THIS PRIVACY NOTICEBMS may update this notice from time to time by posting any revisions on this website. Where any
material revisions are made, BMS may place a prominent notice on this website and when legallyrequired to do so, will directly notify you. You are bound by any such revisions and should therefore
periodically visit this page to review the most current privacy statement.
20.

ONLINE PRIVACY FOR CHILDREN

We are committed to protecting the privacy of children. We do not intend to collect Personal Informationfrom children under 18 years old. If a child has provided us with his or her information that enables us to
identify him or her, the parent or guardian of that child may contact us at (877) 274-0626.
21.

POLICY ON USE OF SOCIAL SECURITY NUMBERS

Bristol-Myers Squibb has a policy which provides for the proper use and protection of Social Security
numbers obtained in the course of doing business by Bristol-Myers Squibb. Such policy protects theconfidentiality of Social Security numbers, prohibits unlawful disclosure of Social Security numbers, andlimits access to Social Security numbers. This policy applies to all methods of collection of Social Security
numbers, including Social Security numbers obtained by oral, written and electronic means.
22.

CONTACT US

If you have questions about this Notice or want to obtain more information about our privacy practices,
please read the privacy notice of your country of residence for local information and contact details,
contact our Data Protection Officer or contact us by postal mail as described below.
Contact

Name of the legal entity / controller

For residents in the United States you canBristol Myers Squibb Company

contact BMS at:

P.O. Box 640
Palatine, IL 60078-0640
800-332-2056
United States

For residents in the United States you canCelgene Corporation

contact Celgene at:

86 Morris Avenue
Summit, NJ 07901
United States

2021 – JULY – 1

29 | 29