DATA PROTECTION AND DATAPRIVACY NOTICE
The data privacy regulations of some countries require that a person making a reportcontaining personal data must be notified of certain collection and retention practices
regarding the information submitted by that person and must accept the terms and conditions
for the use of this helpline service.
You are being asked to read and accept the terms and conditions contained in this Data
Protection and Data Privacy Notice (the “Notice”). If you do not wish to accept the terms below,
we are unable to accept any information through this helpline system and suggest you report
this matter directly to your supervisor or manager or to a representative of Human Resources,
Legal, or Ethics & Compliance depending on the nature of the possible violation.
1. General
Alnylam Compliance Helpline (“Helpline”) is a web and phone-based intake system provided
by Alnylam Pharmaceuticals, Inc., 300 Third Street, Cambridge MA 02142 (“Alnylam”) to its
employees, vendors, suppliers and business partners, and those of its subsidiaries(“Reporters”) for reporting suspected violations of laws or regulations, or company policies
related to financial, accounting, auditing and bribery matters.
Alnylam will be responsible as data controller for the processing of any personal data collectedor otherwise processed via the Helpline.
The Helpline system is provided by Convercent, a software provider, which will also be
responsible for the maintenance and support of the Helpline and thus, acting as a dataprocessor for and on behalf of Alnylam. Convercent’s Terms and Conditions and Privacy
Notice are also applicable to the Helpline and can be found at https://www.convercent.com/.
In certain countries, such as the United States, the Helpline may also be used to reportsuspected violations of other matters. The Helpline and the database in which the personal
data and information that you may report is stored, are operated in the United States byConvercent.
You may contact Alnylam’s Privacy Office with any questions relating to this Notice or thisHelpline service as follows:
In the US: privacy@alnylam.com
In the EU/EEA/UK/CH: EUdataprivacy@alnylam.com
In Brazil: brasilprivacidade@alnylam.com

Please note that we are able to receive and process reports through the Helpline ifyou confirm that you have read and taken note of this Data Protection and Data Privacy
Notice by agreeing to the processing of the reports and your personal information as
described below by clicking the I AGREE box. You will then be able to submit a reportor question using the Helpline or otherwise, report this matter directly to the above
mentioned stakeholders.
2.

Use of the Alnylam Helpline

Use of the Alnylam Helpline is entirely voluntary. You are encouraged to report possible
violations directly to your manager, or to a representative of Human Resources, Legal, orEthics & Compliance, depending on the nature of the possible violation. If you feel that you
are unable to do so, you may use the Helpline to make your report.
The Helpline is a confidential online reporting system that allows you to report suspectedviolations of law or company policies, as well as other concerns you may have, to Alnylam. In
certain countries, Alnylam may only accept reports through the Helpline that relate to some or
all of the following: financial, accounting, auditing, bribery, competition law, discrimination andharassment and environment, health, hygiene, and safety matters. If your concern pertains toa matter that, under local law, may not be accepted by Alnylam through the Helpline, you willneed to contact your manager or local management or a representative of Human Resources,Legal, or Ethics & Compliance to report the matter.

Please be aware that the information you supply about yourself, your colleagues, or any
aspect of the Alnylam’s operations may result in decisions that affect others. Therefore, we
ask that you only provide information that you believe is true. You will not be subject toretaliation from Alnylam for any report of a suspected violation that is made in good faith, even
if it later turns out to be factually incorrect. Please be aware, however, that knowingly providing
false or misleading information will not be tolerated. The information you submit will be treatedconfidentially except in cases where this is not possible because of legal requirements or toconduct an investigation, in which case the information will be handled sensitively. We
encourage you to identify yourself in order for us to follow up with questions we may have.
3.

What personal data and information is collected and processed?

The Helpline captures the following personal data and information that you provide when you
make a report in accordance with applicable laws and regulations:
(i)
(ii)
(iii)

your name and contact details, unless you report anonymously where applicableand your employee ID number, if you are employed by Alnylam;the name and other personal data of the persons you name in your report if you
provide such information (i.e.: description of functions and contact details); anda description of the alleged misconduct as well as a description of thecircumstances of the incident.

Note that depending upon the laws of the country in which you are residing, the report may
not be made anonymously; however, your personal data will be treated confidentially and will
only be disclosed as set out below.
4.
How will the personal data and information be processed after your report andwho may access personal data and information?
The personal data and information you provide will be stored in a database which is locatedon servers hosted and operated in the United States by Convercent. Convercent has enteredinto contractual commitments with Alnylam Pharmaceuticals to secure the information you
provide in accordance with applicable laws. Convercent is committed to maintaining stringent
privacy and security practices including those related to notice, choice, onward transfer,security, data integrity, access, and enforcement.
For the purpose of processing and investigating your report and subject to the provisions oflocal law, the personal data and information you provide may be accessed, processed andused by the relevant personnel of Alnylam, including Human Resources, Finance, Internal
Audit, Legal, Ethics & Compliance, management, Board members, external advisors (e.g.,legal advisors), or, in limited circumstances, by technical staff at Convercent. Those individuals
may be located in the United States, the United Kingdom or elsewhere.
Personal data and information you provide may also be disclosed to the police and/or otherenforcement or regulatory authorities subject to local requirements. The relevant bodies thatreceive and process personal data can be located in the US or in another country that may
not provide the level of data protection available in the EU.

5.

Accessing information concerning the report

Alnylam will promptly notify any person who is the subject of a report to the Helpline except
where notice needs to be delayed ensuring the integrity of the investigation and preservationof relevant information.
With some exceptions, as required by local law, the subject of the report may accessinformation concerning the report (except for the identity of the reporter) and request correctionof personal data that is inaccurate or incomplete in accordance with applicable law. Similarly,
with some exceptions, reporters may also access information about the report and request
corrections of their personal data in accordance with applicable law. To make any suchcorrections, please contact the General Counsel or the Global Head, Ethics & Compliance.
Alternatively, you can always contact the Privacy Office as indicated above.
6.

Legal Basis for Processing

Alnylam will collect and process all your personal data collected for ethical reporting purposes
to the extent strictly needed for Alnylam to comply with its legal and regulatory obligations as
per the applicable law and regulations in the territory in which you are making the report,
including those on whistleblowing, and data protection and data privacy.
In the absence of an established national legal or regulatory obligation, Alnylam shall rely on
its legitimate interests to collect and process personal data relating to the reporters and thereport for the purpose of maintaining an ethical and compliant workplace and to comply with
its internal Code of Ethics and supporting compliance policies.
7.

Retention of the Report and of Your Personal DataYour report and your personal data will only be retained for as long as they are needed for theinvestigation of your allegations and for any legitimate follow-up to the investigation inaccordance with the applicable data protection laws and regulations; such records will be fullyand securely destroyed or erased when and as soon as they are no longer needed for theinvestigation of the report, or for the purposes of any legitimate follow-up to the report(including legal action) or for compliance and auditing purposes, in compliance with local legal
or regulatory retention requirements. In the absence of a legal or regulatory requirement, suchrecords shall be retained on the basis of Alnylam’s overriding legitimate interests for as longas needed, to maintain an ethical working environment.
8.

Your Rights

Alnylam will fully support you in the exercise of any rights you may have as a data subjectunder applicable law, i.e., your:-right of access to your data;-

right to rectification of incorrect data;-

right to erasure of data (“right to be forgotten”);-

right to ask for restriction (“blocking”) of contested data;

right to have third parties who received incorrect, incomplete or contested data
informed of any rectifications or blocking of your data;-

right to data portability;-

right to object to processing;right not to be subject to automated decision-making including profiling (in fact we will
not use your data or any information in your report for such decision-making).
We will only restrict any of the above rights if and to the extent that that is necessary andproportionate in order to safeguard any of the major public interests recognized in applicablelaw such as the protection of criminal investigations or public security, or to protect thefundamental rights and freedoms of others, including any person(s) incriminated in your report,
in accordance with applicable law.
You may contact Alnylam’s Privacy Office to exercise any of your privacy rights as follows:
In the US: privacy@alnylam.com
In the EU: EUdataprivacy@alnylam.com
In Brazil: brasilprivacidade@alnylam.com
In addition to the rights listed above, you may also have the right to lodge a complaint about
our processing of your personal data with the authority competent for supervising theprocessing of personal data (often referred to as the data protection authority) in the countryof your residence or place of work (if that is inside the EU/EEA/UK/CH) or in one of thecountries in which Alnylam is physically present (if you live or work outside theEU/EEA/UK/CH).
9.

Special Country Regulations

Throughout much of the European Union and surrounding areas, reports may be limited intopics, generally to concerns about accounting, auditing, bribery, competition law,discrimination and harassment and environment, health, hygiene, and safety matters. Further,some countries restrict reports such that only employees in key or management functions may
be the subject of a report.

Any issues or concerns relating to topics not permitted by law to be reported via the Helpline
should be reported directly to your manager or a representative of Human Resources, Legal,or Ethics & Compliance as appropriate for the subject matter of the possible violation. In somecountries, anonymous reports may not be permitted under the law except under extremely
restrictive circumstances.

I AGREE
By choosing to continue with your report, you acknowledge that you have dully read andunderstood the Helpline terms and conditions described above and the related processing ofyour personal information which is strictly necessary to allow for the most complete
investigation of any claim as set out in this Data Protection and Privacy Notice.