Privacy Notice
Who we are
CellCentric Ltd is a clinical stage biotechnology company focused on the development of thenovel drug CCS1477 for specific cancers.
Our registered address is: Chesterford Research Park, Little Chesterford, Cambridge, CB101XL.
CellCentric Ltd are registered with the Information Commissioners Office as a Data Controller
under registration number ZB041648.
Your Privacy
Your privacy matters to us. We are committed to the highest data privacy standards,
confidentiality and compliance with UK & European data protection laws. Our Privacy Noticeincludes the following:•••what data we collect from you
how and why we process it
who we share it with and why

We adopt the six core principles of data protection, as required by UK / EU GDPR and Data
Protection Act 2018:
1. Lawfulness, fairness and transparency - we process personal data lawfully, fairly
and in a transparent manner in relation to you, the data subject.
2. Purpose limitation - we only collect personal data for a specific, explicit andlegitimate purpose. We clearly state what this purpose is in this Privacy Notice, andwe only collect data for as long as necessary to complete that purpose.
3. Data minimisation - we ensure that personal data we process is adequate, relevant
and limited to what is necessary in relation to the processing purpose.
4. Accuracy - we take every reasonable step to update or remove data that is
inaccurate or incomplete. You have the right to request that we erase or rectify
erroneous data that relates to you, and we will complete this task as soon as possible
but guarantee to do so within a month.
5. Storage limitation - we delete personal data when we no longer need it. Whilst thetimescales in most cases aren't set, we outline our retention strategy within this Privacy
Notice.
6. Integrity and confidentiality - we keep personal data safe and protected against
unauthorised or unlawful processing and against accidental loss, destruction ordamage, using appropriate technical or organisational measures.
Collection of Personal Data for which we are responsible as a Data Controller
We collect the personal information of our business clients, prospective clients, research
partners, consultants and other interested parties via disclosure directly from them. This might
be via our website, e-mail, telephone, face to face engagement or through contractual
agreements.

CellCentric - Privacy Notice v1.1 March 20241

We also collect pseudonymised (coded) personal data of individuals who take part in clinical
trials which we sponsor and the personal data of individuals involved in organising,conducting, monitoring and regulating those trials.
Categories and Type of Personal Data collected and processed as Data Controller
In our engagement with individuals directly as part of our business and research interactions
we may collect:• Names• Telephone number(s)• Work email addresses• Work addresses
In our activities as the Sponsor of clinical trials we may collect the following information on
individuals taking part in trials:
••
•
•
•

Trail subject identifiers (Codes)*Ethnicity, Gender, Age, Weight, Height*Health & Medical information*Medical samples*Medical study results & reactions

In our activities as the Sponsor of clinical trials we collect the following information on
individuals organising, conducting, monitoring and regulating them:
••
•
••
•
•
•

Names / Signatures
Telephone number(s)Work email addressesWork addresses
Qualifications and experience
Financial disclosures
GenderProfessional roles* We treat all personal data as sensitive but acknowledge that we are processing special
category data. We recognise our obligations in ensuring that special category data is given
particular protection.
Reason for Data collection and processing activities.
Contact information is captured to enable us to work with clients, partners, consultants andcontractors efficiently.
Information collected on those individuals taking part in our clinical trials is done so to provide
us with the information required to establish the effectiveness of our product, its safety and inmeeting our legal obligations for the development of a new drug.
Information collected from those organising, conducting, monitoring and regulating our clinical
trials is done so to ensure that we have the required information to meet the legal obligations
for clinical trails and the marketing of medical products.
Sharing of Personal Data
During our engagement with you for business, research or clinical trial activities, we may shareyour personal data with other organisations who are critical for these purposes. Theseorganisations will be contracted as our Data Processors. Under the terms of the contracts withthem, they will have provided sufficient guarantees that they will process your data only as

CellCentric - Privacy Notice v1.1 March 2024

2

instructed by us and throughout their processing activities will ensure that data is protectedusing appropriate technical and organisation measures.
These organisations are usually located within the UK and the European Economic Area
(EEA), however there may be occasions where they are located in other countries, who do
not have the same regulatory data protection standards as the UK or EEA. In this situation wewill ensure that the appropriate safeguards for the protection of your personal data are in place
before allowing transfer to these countries.
A full list of processors is available from our Data Protection Officer.
Securing and Processing of your Personal Data
The personal data that we process is stored within our own internal IT systems, Offices andthose of contracted electronic storage providers.
We have assessed the risks of the processing and storage of your personal data, to ensure
we have implemented appropriate technical and organisational measures to protect it.
In the unlikely event that we lose personal data, or a device on which personal data resides,
or it is accessed by someone unauthorised, we have a duty to inform those individuals affected
immediately. If the loss or unauthorised access of personal data has potential to cause harmor impact the data rights of individuals, we will also report this to the Information
Commissioners Office, who are responsible for regulating data protection legislation in theUK. https://ico.org.uk/
Our legal basis for processing your personal data ?
Depending on the processing activity, we rely on the following lawful basis for processing data
under UK GDPR:•Article 6(1)(a) consent•
Article 6(1)(b) contract•
Article 6(1)(c) legal obligation•
Article 6(1)(d) vital interests•
Article 6(1)(e) public task•
Article 6(1)(f) legitimate interests
Our processing activities in respect to business, research and clinical trial management will
be done so on a contractual relationship with you.
We could also process your data under our legitimate interests in respect to the effective
management of business operations and also in order to meet our legal requirements.
The processing of clinical trial subject data is done so in order to meet our legal requirements.
Where special category of data is processed, for example your health data, the additionalbases for processing that we rely on are:
• Article 9(2)(i) for reasons of public interest in the area of public health
How long do we keep personal data for?
We process personal data for the shortest duration needed to conduct our business operations
and manage the successful clinical trials of the drug we’ve developed.
We will retain some personal data following expiry of any contractual agreement, in order tomeet legal requirements, such as Financial accounting.
Information collected for the purpose of and used to satisfy the legal requirements ofconducting clinical trials and marketing new medical products, will be retained for a minimumof 25 Years.
CellCentric - Privacy Notice v1.1 March 2024

3

Your rights in relation to personal data
Under the UK & EU GDPR, you have rights to access and control your personal data. Theserights include:•access to personal information•correction and deletion•
withdrawal of consent (if processing data on condition of consent)•data portability•restriction of processing and objection•
lodging a complaint with the appointed supervisory bodies
You can exercise your rights by emailing our Data Protection Officer on:
CellCentricDPO@Clinicaldpo.com
If you took a part in one of our clinical trials, please refer to your Patient Information Sheet
which provided further details on your data rights and the preferred way in which you should
exercise your rights.
If you are unhappy with anything we have done with your data, you have the right to complain
to the Information Commissioners Office in the UK or the supervisory body appointed in yourown country or both.
To make a complaint to the Information Commissioners Office use the link below or call their
hotline on Tel No.: 0303 123 1113.
https://ico.org.uk/concerns/
Use of cookies and other technologies on our website
Cookies are a small text file sent to your computer by the web page you visit and enables us
to monitor the number of visitors to our site and the pages which were viewed.
We only utilise Google Analytics on our website which is a tracking cookie and have this setup so that your IP address is anonymised; which therefore means we are not able to identify
you or your individual browsing history or preferences. All information collected is used in thisanonymised format and the cookies on your computer will be deleted when you close yourbrowser.
How to contact us?
For all data protection matters or questions relating to how we manage your data, you cancontact our Data Protection Officer via these means:
Data Protection Officer:
Phone Number:
Email:

Clinical DPO
0203 411 2848
CellCentricDPO@Clinicaldpo.com

CellCentric - Privacy Notice v1.1 March 20244