Effective Date: September 14, 2023

At Zymeworks BC Inc. (“Zymeworks”), we take your privacy seriously and are committed to safeguarding information about you that we may receive when you visit our websites and through other interactions and correspondence with you (collectively, the “Services”). This Privacy Policy describes what information we and our affiliates collect, store, use, disclose or otherwise process about you and for what purposes, how we use that information, and the steps we have taken to protect that information.

Zymeworks may provide additional or supplemental privacy notices to individuals for specific products or services that we offer at the time we collect your information, for example, in connection with our clinical trials. These supplemental privacy policies govern how we may process your information in the context of the specific product or service.

PERSONAL INFORMATION WE COLLECT

Information you provide us.

• Contact information: While accessing our Services, we may ask you to provide us with information that can be used to contact or identify you, such as your email address, first and last name, telephone number, or physical address.
• Communications: If you choose to contact us via the “Contact Us” form or via email, we collect your name and email address, in addition to any content communicated by you in the body of the form or of your email.
• Marketing information: You may provide us with your preferences for receiving communications about our activities, events, and publications as well as details about how you engage with our communications.
• Job applicant data: If you apply for employment with Zymeworks through our Services, we may collect information listed above, as well as your current job title or occupation, educational information, employer name(s), professional qualifications, references and affiliations, and other information.
• Other data: You may provide us with other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Automatically generated usage data. As you navigate our Services, including when using a mobile device, we (and our service providers) may collect information from your computer or other device, such as your device identifier, Internet Protocol (IP) address, your browser related information, pages you viewed, your search queries, information about the date and time of your requests, and other information provided about your online activity.

Third party sources. We may combine personal information we receive from you with information we obtain from other sources such as our pages on social media sites. When you interact with our social media pages, we will collect information that you elect to provide to us, such as your contact details. In addition, the companies that host our pages may provide us with aggregate information and analytics regarding the use of our pages.

HOW WE USE YOUR PERSONAL INFORMATION

Service delivery. Zymeworks will use your personal information in connection with our Services, including responding to your inquiries or requests, providing and improving the content on our site, communicating information regarding our relationship to you or regarding our research or products, and evaluating the suitability of individuals who apply for roles at Zymeworks. We also use the collected data to monitor usage of the Services, to provide analysis or information so that we can improve the Services, and to detect, prevent and address technical issues.

Compliance and protection. We may use your personal information to:

• Comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities;
• Protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims);
• Audit our internal processes for compliance with legal and contractual requirements and internal policies;
• Enforce the terms and conditions that govern the Services; and
• Prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

Aggregated and de-identified data. We may also de-identify and aggregate your personal information for the functionality and optimization of our Services. Aggregated data is information that has been combined with that of other users and analyzed or evaluated as a whole, such that no specific individual may be reasonably identified. “De-identified Information” is information that has been stripped of your identifiers, such as your name, contact information, and other identifying data, such that you cannot reasonably be identified as an individual.

HOW WE SHARE YOUR PERSONAL INFORMATION

We will disclose personal information with others in accordance with applicable laws, and appropriate safeguards will be established, where applicable, to protect the privacy and security of your personal information.

Affiliates, vendors, and service providers. We may share your personal information with our corporate affiliates, vendors, service providers, and other third parties to help us perform our Services, protect us from cyberattacks, and comply with auditors to ensure our internal processes function as intended. Zymeworks may also disclose your personal information to third parties including providers of administrative services such as email communication (including appointment reminders or investment information you request through the websites) and other support services; to assist us in meeting business operations needs and to perform certain services and functions; and to perform data analytics. Pursuant to our instructions, these parties will access, process or store your personal information only in the course of performing the services and will not be permitted to use your personal information for their own purposes.

To comply with legal requirements. We will also disclose your personal information if we have reason to believe it is necessary or appropriate to comply with applicable laws or regulations; in response to a court order, subpoena, search warrant, or other legal or regulatory requests or processes; to enforce our terms and conditions; and to protect our rights, property, privacy, and safety, as well as your and others’ rights.

Business transfers or acquisitions. We may transfer your personal information, as permitted by applicable law, in connection with a merger, consolidation, sale, acquisition, financing due diligence, divestiture, restructuring, reorganization, dissolution, bankruptcy, receivership, sale of all or a portion of our assets or other change of ownership or control of Zymeworks, including to any of our affiliates.

We may provide additional notice and ask for your consent if we wish to share your personal information in a materially different way than discussed in this Privacy Policy.

DATA SECURITY

The security of your data is important to us. While we strive to use generally accepted security standards to protect your personal information from loss, misuse, alteration or destruction by an unauthorized party, we cannot guarantee its absolute security. No method of transmission over the Internet, or method of electronic storage is 100% secure.

THIRD PARTY LINKS

This Privacy Policy applies solely to personal information collected by us the through the Services. Our websites may contain links to third-party websites, social medial platforms, or digital services. These are provided for your browsing convenience only and are not endorsements of the third-parties or the information presented. Our Privacy Policy does not apply to these third-party sites. If you choose to visit a third-party site, the privacy policy of that site applies.

CHILDREN’S PRIVACY

Our Services are not directed or intended for children, and we will not knowingly collect personal information from any individual under the age of 13, or from any individual under the age of majority in their state or province of residence without the consent of their parent or legal guardian. Please contact us immediately at privacy@zymeworks.com if you believe we might have collected personal information from someone under the age of 13.

RETNETION OF YOUR PERSONAL INFORMATION

We will store your personal information for as long as we believe is necessary or appropriate (i) to carry out the purpose(s) for which we collected it, or (ii) to comply with applicable laws, contracts, or other rules or regulations.

YOUR PRIVACY CHOICES

You have the following choices with respect to your personal information.

Correct or update your information. You can correct or update the personal information we have about you by contacting us by e-mail at privacy@zymeworks.com. It may take us up to 30 days to process your request.

Opt out of marketing communications. You may opt out of marketing-related email communications by following the opt out or unsubscribe instructions contained in the marketing communications we send you.

COOKIES

We use cookies and similar tracking technologies, such as beacons, tags, and scripts, (hereafter referred to as “cookies”) to track the activity on our websites.  They are used to collect and track information necessary to improve and analyze our websites and to ensure its security.  For more information about cookies, including how to see what cookies have been set on your browser and how to manage and delete them, visit www.allaboutcookies.org.

• What cookies do we use?

Essential cookies.  We use some essential cookies that are strictly necessary to provide you with the Services and to use some of the website’s features, such as access to secure areas.  You can find a list of the essential cookies we use below:

Reporting and analytics cookies.  We also use reporting and analytics cookies to store information about what pages people visit, how long they are on our sites, how they got there, and what they click on.  Information supplied by analytics cookies helps us analyze the profile of visitors and provide them with a better experience.  Analytics cookies do not collect or store personal information (for example, names or addresses), so this information cannot be used to identify individuals.

Where required by law, we will only use non-essential cookies when you have consented to such cookies via our cookie banner. You can withdraw your consent to the use of non-essential cookies at any time as described under the “How to manage cookies” section below.

• How to manage cookies

We have a cookie consent banner you can use to select whether you want to accept or decline cookies.

In addition, you can set your browser settings so that you will not receive cookies and you can delete existing cookies from your browser.  Information about the procedure to follow in order to enable or disable cookies can be found on your Internet browser provider’s website via your help screen.  You may wish to refer to http://www.allaboutcookies.org/manage-cookies/index.html for information on commonly used browsers.  You may find that some parts of the Services will not function properly if you have refused cookies.

Do Not Track. We currently do not respond to “Do Not Track” (“DNT”) or similar signals and operate as described in this Privacy Policy whether or not a DNT signal is received. To find out more about “Do Not Track,” please visit www.allaboutdnt.com.

FOR US AND CANADA USERS

Your personal information may be transferred to, and maintained on, computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction.

FOR EU, UK and SWISS USERS

As indicated above, we use your personal data to provide the services you requested, to comply with applicable laws and for our legitimate business interests, namely to communicate with you, secure our website and provide information on our website and through other interactions with you.  Zymeworks  is the controller of any personal data collected.  Zymeworks is established in Canada which offers an equivalent level of privacy protection as in the EEA, the UK and Switzerland.

In addition to the rights mentioned above and subject to limitations in applicable law, you have a right of access to your personal information and a right of opposition, erasure and portability.  You have the right to lodge a complaint with the Supervisory Authority for data protection in your country.

CHANGES TO THIS PRIVACY POLICY

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on our websites and online services. If required by law we will also provide notification of changes in another way that we believe is reasonably likely to reach you, such as via email or another manner through our Services. Any modifications to this Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). In all cases, your use of our Services after the effective date of any modified Privacy Policy indicates your acceptance of the modified Privacy Policy.

Contact Us

If you have any questions about the Privacy Policy, please contact our data protection officer at:

By email: dpo@hewardmills.com

By mail:

HewardMills Ireland Limited

Fitzwilliam Hall

Fitzwilliam Place

Dublin 2 DO2 T292

Ireland

By phone:

+353 1485 4253

You can also contact our Canadian privacy officer using the contact details below:

privacy@zymeworks.com.