FABRY FAMILY TREE - PRIVACY NOTICE

1. GENERAL

The Family Fabry Tree Builder application (hereinafter “Application”) is provided by Amicus Therapeutics, Inc. and its affiliates Amicus Therapeutics UK Ltd., and Amicus Therapeutics Europe Limited (hereinafter "we, "us", "our", "Amicus"). Thus, we assume responsibility for the processing of your Personal Data collected through the Application as "Controller." In addition, Amicus has engaged AMICULUM Business Services Ltd as a third-party agency for the purpose of collecting Application usage analytics on our behalf, as further described below, and other service providers who, act on our behalf and assist Amicus in providing and maintaining the Application (hereinafter “Processors”).

If you have any questions about this Fabry Family Tree – Privacy Notice (hereinafter “Privacy Notice”) please contact our Data Privacy Officer by email at dataprivacyofficer@amicusrx.com. 

In this Privacy Notice, "Personal Data" means any information relating to an identified or identifiable natural person that is collected from users when they use the Application. In the context of this Notice, such persons refer to the individual users of the Application (hereinafter “you”, “your”, “User”).

Please note, this Privacy Notice only applies to the Personal Data collected when you use the Application. For more information about our privacy and data collection practices generally, please view the Amicus Therapeutics Privacy Notice at https://amicusrx.com/privacy-notice/. This website may also use cookies. For more information about our use of cookies please view our Cookie Statement at https://amicusrx.com/cookie-statement/.  

Any collection and processing of Personal Data is governed by strict conditions, enforced by law. We act in accordance with the UK Data Protection Act 2018, the EU General Data Protection Regulation of 2016 (hereinafter “GDPR”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (hereinafter the “CCPA”), and any other applicable privacy law and regulation with respect to the Application’s usage.

The access to or use of the Application implies your full and unreserved understanding of this Privacy Notice. 

Our Privacy Notice can be subject to future amendment and modification. In this event we will notify you with an invite to take a look at these changes, which we will clearly indicate in the Privacy Notice.

2. PERSONAL DATA PROCESSED 

When you use the Application, you will be asked to enter certain Personal Data, including:

• Identifiers, such as name, email address, and account information 
• Gender 
• Sensitive Personal Information, such as if you have been diagnosed with Fabry 
• Information about your family members, including name, email address, gender, and information about if members of your family have been diagnosed with Fabry

Amicus will not process, analyse or store any Personal Data that you submit in the course of this Application. A SQL database will store all information, including family tree structures and names, login details and email addresses for both creators and recipients of shared trees. Such Personal Data is encrypted and is not visible and/or accessible to Amicus, the Processors, nor other third parties. Amicus (and our Processors) may collect and process aggregate and encrypted data from the Application. This data will not reveal any Personal Data of Users, as such information refers mostly to engagement metrics (e.g., time on site, aggregate number of Users and trees created etc.).

The Application is not intended for children under age 13 and is not designed to attract the attention of anyone under age 13. Further, we do not knowingly collect or process Personal Data of children under 13 years of age. If a User enters Personal Data of a child under age 13 into the Application, as discussed above and in Article 3, Amicus (or its Processors) will not have access to such information. 

3. PURPOSE FOR PROCESSING 

The purpose of the Application is for Users to create a family tree and identify family members who may be at risk of Fabry. Users may enter the information listed in Section 2 above for this purpose.  

Personal Data Users enter into the Application will be visible and/or accessible only to individual Users and other individuals the User chooses to share their family tree with. Amicus (and our Processors) will only access and process aggregate and encrypted data, and non-identifiable data for analytics/metrics which are necessary for our legitimate interests (continuity of funding/research/statistical analysis) and as necessary to provide the Application to Users. 

We do not use any Personal Data collected via the Application for profiling in furtherance of decisions that produce legal or similarly significant effects (which means a decision that results in the provision or denial of financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities, health-care services, or access to essential goods or services).

4. TRANSFER TO THIRD PARTIES

Individual Users have the option to share the Fabry Family Tree created in the Application with other individuals of their choosing. Only the Individual Users and those they share the tree with can view the Personal Data entered into the Application.

As described in Articles 2 and 3, Amicus (and our Processors) may receive aggregated and non-identifiable data, including Application usage data, subject to strict safeguards. We may also disclose this non-identifiable data to other third parties who provide services on our behalf for the purposes described in Article 3.  We will not sell or share (as those terms are defined by the CCPA), process for targeted advertising, rent, distribute or otherwise make your Personal Data that you enter into the Application commercially available to third parties.

5. DURATION OF THE PROCESSING

As described above, Amicus, as well as the Processors, will not store in their systems any Personal Data you submit in the Application. The Processors will only store the "last updated at" date on the Application trees, which will be retained for up to two years from that point. Such information, however, will not be used to identify you in any way.

6. YOUR RIGHTS

Users located in the European Union or United Kingdom and residents of certain US states with state privacy laws that apply to Amicus (including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia) have certain rights with respect to their Personal Data.

Please note that the exercise of these rights may be subject to limitations, considering that Amicus, the Processors, and other third parties do not intend to access, process, or store any Personal Data Users enter into this Application.

Rights of Users in the European Union/United Kingdom

Right of access and right to obtain a copy: You have the right to request access to your Personal Data at any time and to be informed about the purpose of the processing.

Right to rectification, erasure or restriction: You have the right to ask us to rectify your Personal Data if you believe it to be incorrect or no longer up to date. You can also request the processing of your Personal Data to be restricted if you think that your Personal Data is inaccurate, and you subsequently notified us about this.

Right of objection: You have the right to object to the processing of your Personal Data if you have legitimate reasons and communicate them to us.

Right to data portability: You have the right to request to obtain your Personal Data in a structured, commonly used format and/or to transfer such data to another controller.

Right to withdraw consent: Where the processing of your Personal Data is based on your prior consent, you have the right to withdraw this consent at any time. Your withdrawal of consent shall not affect the lawfulness of processing based on consent before such withdrawal.

Automated decisions and profiling: Please note that, although the Application uses an existing genetics algorithm, there is no automated decision/AI technology involved. Thus, you will not be subjected to decisions based solely on automated processing which produces legal effects concerning you or similarly significantly affects you. Nevertheless, you have the right to request us not to be subject to such automated decision making.

Exercising your rights: You can exercise your rights by contacting us with a copy of the essential parts of your proof of identity, such as name and date of birth:

• through email to dataprivacyofficer@amicusrx.com. 
• via ordinary mail to:

For residents of the United Kingdom:
Amicus Therapeutics UK Operations ltd
One Globe Side, Fieldhouse Lane,
Marlow, SL7 1HZ
United Kingdom

For residents of the European Economic Area/EU to our EU Representative at:
Amicus Therapeutics Europe Limited
Block 1, Blanchardstown Corporate Park,
Ballycoolen Road, Blanchardstown,
Dublin 15, D15 AKK1

Right to file a complaint: If you feel unhappy about how we treated your Personal Data or handled your privacy requests, you have the right to lodge a complaint with the UK data protection supervisory authority (ICO) at: https://ico.org.uk/make-a-complaint/.

This is without prejudice to proceedings before the civil courts. If you are from an EU member state, you can also complain to your national data protection authority (a list of the data protection authority for each EU member state can be found here: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm). If you have suffered damages as a result of the processing of your Personal Data, you may file a claim for compensation.

Rights of Residents of Certain US States

Right to Know. You have the right to request that we disclose to you the following, limited to the preceding twelve months: (i) the categories of Personal Data we have collected about you; (ii) the categories of sources from which the Personal Data was collected; (iii) the business or commercial purpose for selling or sharing Personal Data; (iv) the categories of third parties with whom we have disclosed the Personal Data; (v) the categories of Personal Data that we have sold, and for each category identified, the categories of third parties to whom we sold that particular category of Personal Data; and (vi) the categories of Personal Data that we disclosed for a business purpose, and for each category identified, the categories of third parties to whom we disclosed that particular category of Personal Data.

Right to Access Specific Pieces of Personal Information. You have the right to request that we disclose to you the specific pieces of Personal Data we have collected about you, in the preceding 12 month period.

Right to Deletion. You have the right to request that we delete any Personal Data about you that we collected about you.

Right to Correction. You have the right to request that we correct any inaccurate Personal Data we maintain about you. Please note this right does not apply to Iowa and Utah residents.

Right to Data Portability. You have the right to request the Personal Data we have collected about you in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the personal information to another entity without hindrance. You may not exercise this right more than two times in a calendar year.

Exercising your Rights. You may exercise the data subject rights below by contacting us at dataprivacyofficer@amicusrx.com, by calling us toll-free at 844-927-2010, or by clicking www.amicusrx.com/content/dl/CCPA-Request-Form.docx and submitting details regarding your request. You may also authorize an agent to make data subject requests on your behalf. In such instances, authorized agents may use the same methods as you to submit the requests on your behalf. To verify your identity and protect your personal information, we may ask the requestor to provide information that will enable us to verify your identity in order to comply with your data subject request, such as asking your agent to provide proof of signed permission from you, or ask you to confirm with us directly that you provided the agent with permission to submit the request. In some instances, we may decline to honor your request if an exception applies under applicable law. We will respond to your request consistent with applicable law.

Right to Non-Discrimination. You have the right not to be discriminated against for exercising your data subject rights. We will not discriminate against you for exercising your data subject rights.

Appeal. Residents of certain states have the right to appeal our decisions on their data subject requests. This right does not apply to California or Utah residents, or to residents who reside in other states where the applicable privacy law does not give them the right to appeal Controllers’ decisions regarding data subject rights. To appeal our decision on your data subject requests, you may contact us via email to dataprivacyofficer@amicusrx.com or by calling us at 844-927-2010. Please enclose a copy of or otherwise specifically reference our decision on your data subject request, so that we may adequately address your appeal. We will respond to your appeal in accordance with applicable law.

7. SAFETY AND CONFIDENTIALITY

Amicus has taken security measures that are appropriate on a technical, organizational and physical level to prevent the destruction, loss, falsification, modification, unauthorized access or notification of Personal Data accidentally to a third party, as well as the unauthorized processing of such data. However, while the security of your Personal Data is of the utmost important to us, we cannot fully guarantee the security of any information you choose to disclose online. Any information you provide in the Application is done at your own risk.

8. APPLICABLE LAW AND JURISDICTION

This Privacy Notice is administered, interpreted and implemented in accordance with UK law, which is exclusively applicable to any potential dispute.