CAREERS CONTACT US OUR STORY MEDICINES RESEARCH & DEVELOPMENT IMPACT INVESTORS & MEDIA Exelixis Online Privacy Statement Updated February 20, 2020 Thank you for visiting the Exelixis website and reading our Online Privacy Statement (or “Statement”). This Statement pertains to www.exelixis.com and for other Exelixis websites that link to this Statement (generally referred to here as our websites). This Statement also provides disclosures about certain information we collect offline, as described below. It does not apply to information we collect from our employees or information we collect through clinical trials. Exelixis appreciates that visitors to our websites may have concerns over their privacy, so we want to share information with you concerning the information we collect and how we use it. We do, however, reserve the right to disclose information during emergencies if safety is at risk, if we are required to do so by law or to comply with valid legal processes (such as a search warrant, subpoena, or court order), or to protect Exelixis’ rights or property, including in the event of a transfer of control of Exelixis or the sale of substantially all its assets. This Statement also provides information about the purposes for our collection of personal information, and certain rights individuals may have with respect to such information. Please read this entire Statement before using or submitting information to this website. By using this website, you agree to our Terms of Service, which incorporate this Statement, and you consent to the collection, use and disclosure of any information you share in accordance with this Statement. As used in this Statement, “personal information” means information that reasonably can be used to identify a living person, or that reasonably relates to a living person. Data We Collect and How We Use It We may collect data from you, including personal information under certain circumstances, including through your interactions with our websites, your use of our products (including as required for us to collect pursuant to applicable regulations), and through other means in which you contact us by phone, fax, mail or in person and provide personal information. For more information about the specific information we collect through various means, and the business purposes for which we may do so, please click here. Disclosure of Your Information to Third Parties We may disclose your personal information as necessary to operate our websites or business, market our products and services, respond to medical information requests, or respond to other specific inquiries. In such cases, the personal information we may disclose includes identifiers, internet or other electronic network activity, geolocation data and, in certain instances in the context of medical information requests or our adverse event reporting and safety activities, medical information. Such disclosures may be made to third parties who perform certain functions and services for us, including organizing, processing, tracking and storing information on our behalf. These service providers may have access to such personal information to perform their functions, but are not permitted to use personal information for purposes other than providing services to us. We may also share information with our partners relating to medical information requests for the purposes of ensuring the request is appropriately handled by the correct party. We may disclose your personal information if we conclude that we are required by law (including to regulatory authorities pursuant to applicable regulations) or to comply with valid legal processes (such as a search warrant, subpoena, or court order), or if we have a good faith belief that access, preservation, or disclosure of such information is reasonably necessary to protect the rights, property, or safety of Exelixis, our customers, or the public. We also may disclose such information in the event of a transfer of control of Exelixis or the sale of substantially all its assets (subject to appropriate confidentiality protections). We do not otherwise exchange your personal information with unaffiliated entities unless you are first notified and expressly consent to such transfer, and we do not sell your personal information. Aggregated Information Exelixis may also collect non-personal information in aggregate form to track data such as the total number of visitors to each page of our websites, and the domain names of our visitors’ Internet Service Providers. We may use this information, which remains in aggregate form, to understand how our visitors use our websites so that we may make them better. Children Exelixis does not knowingly collect any personal information from or about children under 13 years old through our websites. However, if the parent or the guardian of a child under 13 believes that the child has provided us with personal information, the parent or guardian of that child should contact us at privacy@exelixis.com, or via any applicable data subject request process as detailed below, if they want this information deleted from our files. Anyone under 18 years old should seek their parent’s or guardian’s permission prior to using or disclosing any personal information on our websites. How You Can Control And Update Data About You Updating Contact Information We want to be sure that we keep only the most accurate and up-to-date information in our records. Therefore, whenever you believe that your contact information needs to be updated, you can contact us at privacy@exelixis.com. You may also choose at any time to remove your name, telephone number and postal and e-mail addresses from the list we use to send notices or updates and elect not to receive correspondence from us by contacting us at privacy@exelixis.com. Cookies, Web Beacons and Online Advertising As described under “Information that may be collected automatically online” above, we or our service providers may use cookies, web beacons or other tracking technologies to collect information passively. Cookies are small data files stored on your device. Web beacons are electronic images that we may use on our websites or communications, and which may be used to deliver cookies, count users who have visited our websites or otherwise understand how you interact with our websites or services. We may use these technologies to collect information about how you interact with our websites or our communications, and to improve and personalize our websites, services and advertising, including by targeting advertisements to you on third-party websites. We may also enter into relationships with third-party companies to drive traffic to our websites, and such third-party companies may also collect information through their own cookies or other tools. We do not have access to or control over cookies or other tools used by these companies, and their information practices are not covered by this Statement. Please contact them directly for more information about their privacy practices. Choices About Tracking Technologies and Advertising. You can set your browser to refuse all or some browser cookies; however, refusing cookies may affect your experience using website features or services. We may also allow certain service providers to serve targeted advertisements to you on third-party websites based upon your use of our websites or services. For further information about targeted advertising and how you can opt out of having certain providers use your browsing information for these activities, visit www.aboutads.info/choices. We may also use third-party analytics providers (such as Google Analytics) on our websites to collect and analyze usage information using cookies and similar tools, to engage in auditing, research, or reporting, assist with fraud prevention, or provide certain features to you. To prevent Google Analytics from using your information for analytics, you may install the Google Analytics Opt-Out add-on for your browser by visiting https://tools.google.com/dlpage/gaoptout. Do Not Track Requests Your browser may allow you to transmit a “Do Not Track” signal to online services. There is no consensus as to what these “Do Not Track” signals mean, or how to respond to them. Like many other online services, we do not alter any of our online practices when a “Do Not Track” signal is received. For more information about “Do Not Track,” please visit www.allaboutdnt.com. Data Subject Rights Depending on your residency, you may have certain rights relating to your personal information. These rights vary by state and country, but they may include the following rights: The right to request additional disclosures about the personal information we collect, use and disclose; The right to request access to, and rectification or erasure of, your personal information; The right to restrict or object to the processing of your personal information; The right to opt-out of the sale of personal information (if any); and The right to obtain a copy of your personal information in portable format. We will not discriminate against you for exercising any rights available to you under applicable law. Exercising Data Subject Rights If you would like to exercise any of the rights described above, please email privacy@exelixis.com with the phrase “Data Subject Request” in the subject line. You may also call 1-833-306-0552 or complete our web form. We will review your request and respond accordingly. Please note that the rights described are not absolute and we reserve all of our rights available under applicable laws. Additionally, if we retain information relating to you in de-identified form, we will not attempt to re-identify your information in response to a request. If you make a request relating to your personal information, you will be required to supply a valid means of identification as a precaution to verify your identity. In order to do this, we will request that you match specific pieces of information we have been provided previously, as well as, in some instances, provide a signed declaration under penalty of perjury that you are the individual whose personal information is the subject of the request. If it is necessary to collect additional information from you, we will use the information only for verification purposes and will delete it as soon as practicable after complying with the request. For requests relating to particularly sensitive information, we may require additional proof of identification. If you make a request relating to your personal information through an authorized agent, we will require written proof that the agent is authorized to act on your behalf. We will process requests within the timeframe provided under applicable law. Data Integrity and Security Exelixis takes reasonable steps to protect your personal information as you transmit your information from your computer to our website and to protect your information from loss, misuse and unauthorized access, disclosure, alteration or destruction. We endeavor to keep information transmitted to this website secure to the extent possible using existing and appropriate technology. You should keep in mind, however, that no internet transmission is ever 100% secure or error free. In particular, email sent to or from this website may not be secure, and you should therefore take special care in deciding what information you send to us via email. Moreover, where you use passwords, ID numbers, or other special access features on this website, it is your responsibility to safeguard them. Hyperlinks This website may provide links to other websites as a service to our visitors. These are websites we believe may have helpful information. However, Exelixis does not endorse and is not responsible for the content of third-party websites. Similarly, Exelixis does not have any control over information you may choose to provide to those websites. This Statement does not apply to third-party websites, even if they are linked to Exelixis websites. Other Internet websites you visit may have their own privacy policies or no policy at all. Other websites might use personal information differently than this Statement permits. We strongly encourage you to review the privacy policies of any website before providing any personal information. Cross-Border Data Transfers This website and other websites that link to this Statement are controlled and operated by Exelixis from the United States and are not intended to subject us to the laws or jurisdiction of any state, country or territory other than that of the United States. Any information you provide to us through use of our websites may be stored and processed, transferred between and accessed from the United States and other countries that may not guarantee the same level of protection of personal data as the one in which you reside. However, we will handle your personal data in accordance with this Statement regardless of where your personal data is stored or accessed. Your California Privacy Rights In addition to other rights that may be provided to California residents, California law permits users of our websites who are California residents to request certain information about how their information is shared with third parties for direct marketing purposes. If you would like to make such a request, please email us at privacy@exelixis.com or write us at Legal Department, 1851 Harbor Bay Parkway, Alameda, California 94502, Attn: Privacy. Changes You should check this Online Privacy Statement regularly for any changes. We will provide a notice if we make any material changes to this Statement, which we may do by posting a message on our websites. Questions In the event of any questions, comments or concerns, please write to us at Legal Department, Exelixis, Inc., 1851 Harbor Bay Parkway, Alameda, CA 94502, or at privacy@exelixis.com. Or, you can call us at 1 (650) 837-7000. ©2020 Exelixis, Inc. All rights reserved. Ethics & Compliance Code of Conduct Privacy Terms of Use OUR STORY Mission Leadership Board of Directors Collaborations MEDICINES Our Medicines Access RESEARCH & DEVELOPMENT Research & Development Pipeline Clinical Trials IMPACT Why Cancer? Patient Stories Grants & Giving Corporate Responsibility Environmental, Social & Governance Statement on COVID-19 INVESTORS & MEDIA Investors Overview News & Events Stock Information Financial Information Investor Resources Corporate Governance Contact IR © Exelixis, Inc. 2021 Ethics & Compliance Privacy Terms of Use You can learn more from our Privacy Statement. OK