Privacy Policy.

VolitionRx Limited and its subsidiaries throughout the world (collectively referred to as “Volition”) take privacy seriously. This Privacy Policy (the “Policy”) is for users of our public websites and other individuals we interact with for our commercial or business purposes.

During our activities, we may process personal data about you. We process this data as Controller.

Personal data means any information relating to an identified or identifiable natural person. Therefore, it is any information that is associated with, or can reasonably be linked to, a particular individual (natural person). Generally speaking, your personal data includes your unique identifiers (full name, phone number, email address, etc.), and information about your characteristics, conditions or behavior that is associated with one of your identifiers or could otherwise reasonably be linked to you.

This data is collected directly from you when you complete forms on our website or correspond with us by email, post, telephone, or other means, or by automated technologies when you interact with our website, including our use of cookies, server logs, and similar technologies; more detail on this is available in our Cookie Policy - https://volition.com/cookies-policy. Finally, we also process data obtained from third parties or publicly available sources.

This Policy describes the types of personal data we may collect about you, why we collect this data, how we use and share it, and how we keep it safe. It also explains related rights and choices you may have.

Volition is committed to protecting and respecting your privacy and personal data. If you have any questions, please get in touch with us here.

VolitionRx Limited is a Delaware corporation headquartered in Austin, Texas, U.S. Our registered address is 1489 West Warm Springs Road, Suite 110, Henderson, Nevada, 89014.

Volition also has offices in Belgium, United Kingdom, Singapore and in the U.S.

We collect personal data in the following circumstances:

A. When you visit any of our websites

You can visit our websites, learn about our activities and read our latest news without having to provide us with any personal information.

However, when you visit our Websites, information is automatically collected. This may include information like your IP address and other technical information. We may also collect information about how your device has interacted with our Websites.

We use this information for our internal analytics purposes and to improve the quality and relevance of our Websites to our visitors. Indeed, we use that information to ensure that content from our websites is presented in the most effective manner for you and for your computer. Some of this information may be collected using cookies and similar tracking technology, as explained further in our Cookie Policy - https://volition.com/cookies-policy.

This data may be processed by third party service providers and processors we use in connection with the services they provide to us, including to support us in areas such as IT platform management or support services, infrastructure and application services, marketing, data analytics.

If you are in a jurisdiction that requires opt-in consent before placement of non-essential cookies and tracking technologies in your browser, we will request your consent before such cookies are placed in your browser through our sites. In addition, if you have configured your browser to send a “Do Not Track” or Global Privacy Control signal, we will honor that signal as your automated request to opt-out of non-essential cookies and tracking technologies.

B. When you subscribe to receive news and information from Volition

Categories of data - your name, surname, email address, profession.

Purpose of the processing – We have a newsletter that aims to inform people about :

• our services and goods;

• our events;

• our activities in general.

Legal basis (UK and EEA)

• For Volition’s customers: Our legitimate interest justifies that we send information about our upcoming events and news to existing clients or to people who previously registered for one of our events.
• For non-customers: The processing of your personal data is based on your consent.

Recipients of the data - This data can be processed by our emailing service provider: Equisolve, Salesforce, Craft CMS.

Retention period - We keep your data for this purpose until you ask us to stop. In any event, you may opt-out of further communications by using the unsubscribe link in the email or by sending an email to privacyteam@volition.com.

C. When you discover, order, purchase or use one of Volition’ services

Categories of data – We might process your contact details (name, address, email address and telephone number, profession) and invoicing data. Additionally, as part of our research activities and services, we might collect and process basic personal data of any legal owner of an animal (dog/cat) undergoing tests developed by Volition or taking part in a clinical research supervised by Volition Veterinary affiliate, collecting the informed consent of animal’s owners.

Purpose of the processing – We process your data in order to provide you with the service that you ordered from us and communicate with you about it.

We also process your data for that purpose when we notify you about changes to our services.

Legal basis (UK and EEA) – The processing of such data is therefore necessary in order to perform the contract between you and Volition.

Recipients of the data – These data may be accessible and shared to Volition’s affiliates working with Volition Veterinary affiliate and/or with external entities involved in the research(es) conducted by Volition.

Retention period – This data is stored for 10 years after the end of the contractual relationship for liability reasons.

D. When you attend a Volition event

Categories of data – This may include your first and last name, profession and your email address.

Purpose of the processing – This data is necessary to allow you to sign you up for the event, provide you with the information on such event and give you access to the event.

This data is collected directly from you when you fill in the registration form.

Legal basis (UK and EEA) - The personal data processed is essential for the execution of the contract under which we organize events.

Recipients of the data - Your data may be processed by our IT services and our Commercial Team, for the purposes strictly necessary to comply with the instructions that we transmit to them. This data can be processed by our customer relationship management solution : Salesforce.

Retention period - Data may be retained for 10 years after the end of the contractual relationship.

E. Recording and sharing of the event

Categories of data - This may include videos and images (photographs or screenshots) taken during the event organized by Volition as well as the names of the speakers who intervene during the event.

Purpose of the processing – Volition may keep a recording or/and photographs (or screenshots) of the events organized and share these images on its different communication channels and social media accounts for multiple purposes :

• Archival purposes ;
• Accountability purposes ;
• Monitoring and Improvement of our activities purposes ;
• Promotion of our activities purposes (including the sharing of the recordings/images to participants who want to rewatch the event or people who were not able to attend the event).

Legal basis (UK and EEA) - It is within Volition’s legitimate interest to conserve and share these images.

Recipients of the data - Your data may be shared among Volition’ staff, members, people participating to the event or even with the public via our social media accounts.

Retention period - Data may be retained as long as you do not oppose to the processing of your data.

F. When you engage with us on social media

Categories of data - In principle, we only process data relating to your interaction with Volition’ accounts on social media. However, this may include data related to your account, data related to the content shared or communications you have with others.

Purpose of the processing - The data that you communicate when interacting with our social networks profiles are or could be processed jointly by the social networks and the administrator of this page for the collection of certain data by means of cookies, for the improvement by the social network of its advertising system, or for the obtaining of statistics of audience of the page.

Legal basis (UK and EEA)- These data will be processed by Volition only in the framework of his legitimate interest to obtain statistics on the visitors of his page in order to adequately promote its page. The audience statistics established by the social network are only transmitted to the administrator of the page in an anonymized form.

Recipients of the data - Those data are not transmitted to any third party.

Retention period –These data are or could be processed as long as the page exists and as long as you visit it.

The Privacy Policies of each social network used by Volition can be found by clicking on the following links:

• Facebook
• Twitter
• Linkedin

G. Security and Maintenance of Volition’s Infrastructures

Purpose – Your data might be processed for and to the extent necessary for the security of our infrastructures.

Legal basis – We process your personal data according to our legitimate interest to secure our facilities and the events held there.

Categories of data – It consists in video surveillance footage.

Recipients of the data - These images are not transmitted to any third party. They could however be transferred to the competent police department, upon request.

Duration – Video surveillance images are not kept for more than thirty (30) days unless it can contribute to the proof of an offence, damage or nuisance.

H. When you contact us

Categories of data - When submitting a contact request via our Websites or when you contact us by any other mean, we ask for your first name, organization, email address and message.

Purpose of the processing - Data is collected when you contact us by e-mail, phone or mail regarding our activities.

This data is therefore essential in order to perform the contract you have requested by filling in and sending this form.

Legal basis (UK and EEA) - We use this information to respond to your inquiry, including providing you with all the information you have requested about our organization and its activities. The data is processed at your request and based on your consent.

Recipients of the data - This data is not shared with any third party except our subsidiaries if necessary.

Retention period - We keep the contact request for a period complying with data protection law and regulations, after which these emails are deleted.

The data you create when you visit our website, register to an event, or subscribe to our newsletter may be used by Volition for statistical purposes.

We collect, use and share such aggregated statistical data on the proportion of website visitors using the various parts and features of the site.

We do not collect any sensitive personal data about you (details such as race, ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, genetic or biometric data, information relating to your health, government-issued ID number, complete account login credentials, or precise geolocation).

The security of your personal data is important to us, and we take steps reasonably necessary to safeguard your personal data in our custody and control from unauthorized access, use or disclosure.

We maintain technical measures to ensure data security to protect your personal data against unauthorized access, unlawful use, accidental loss, corruption or destruction. We update and adjust these technical measures according to the latest technologies.

We will always take steps to ensure your data is treated and transferred securely with appropriate safeguards and controls in place.

In addition to the specific recipients of data listed above for each particular processing, we may share your personal data with other companies within our group, including subsidiaries and our holding company and its subsidiaries.

In the event that we choose to sell, transfer, or merge part of our business, your personal data may be shared with potential counterparties provided that they are subject to confidentiality obligations. In the event of a sale of all or part of the business, your personal data will, where relevant, be transferred to the new owner or controlling party, under the terms of this Privacy Notice.

We will only share your personal data with law enforcement, regulatory or other Government bodies when required to do so, or to comply with a valid legal request such as a court order.

We may share your personal data with service providers working on our behalf to collect, store, process, and safeguard your personal data, including :

• IT companies who support our website and other business systems;
• Operational companies such as distributors, resellers and delivery couriers;
• Marketing companies who help us manage our electronic communications with you.

When we use service providers:

• If applicable, we conclude a data processing agreement according to article 28 of the GDPR or other governing law;
• We only share with them the information they need to perform their specific services;
• They may only use your data for the exact purposes we specify in our contract with them;
• We work closely with them to ensure that your privacy is respected and protected at all times;

If we stop using their services, any of your data held by them will either be deleted or rendered anonymous.

Your personal data can sometimes be transferred outside of the country in which it was collected. In such cases, we ensure that this transfer is carried out in accordance with the applicable regulations and ensure a sufficient level of protection of individuals’ privacy and fundamental rights (mainly through the European Commission’s standard contractual clauses and supplementary measures when GDPR is applicable).

In fact, the personal data we hold is stored and used within the countries within which a Volition entity is legally registered, including the U.S., Singapore, Belgium, UK and the member countries of the EU or the EEA (the EU plus Iceland, Liechtenstein and Norway).

We may sometime share personal data that we collect from you to service providers (i.e., data processors) in countries that are outside these jurisdictions, for example, if required in order to fulfill your order, or provide support services. In addition, personnel working for Volition affiliates may access certain personal data to the extent necessary for their duties from other countries.

If we do this, we require all our service providers and data processors, including our affiliates, by written contract (such as standard contractual clauses where applicable, which you can consult a copy upon request), to implement appropriate supplementary security measures to protect your data. Service providers may disclose Customer Data as necessary in connection with their performance of services and in accordance with our instructions.

Our Services are not directed to children (individuals under the age of 18). We do not knowingly collect, maintain, or process children’s personal data unless the child’s parent or guardian consents and provides the information. If we determine that we have received a child’s personal data from a source other than the child’s consenting parent/guardian, we will immediately delete the information.

10.1. California Residents

Under California’s “Shine The Light” law, California residents have a right to know whether companies share their personal data for direct marketing purposes. We do not share personal data with third parties for direct marketing purposes.

The California Consumer Privacy Act of 2018 (the “CCPA”) gives Californians additional rights regarding their personal data held by a covered “business.” As of the time this Policy was last updated, Volition is not a “business” as defined in the CCPA. We are committed to complying with all applicable privacy regulations and will update this Policy accordingly as our operations, and applicable regulations, change.

10.2. Data Subjects in The EEA, United Kingdom and Switzerland

If you are in the EEA or Switzerland, you may have additional rights under EU and domestic privacy laws, including the EU’s General Data Protection Regulation (“GDPR”) or its domestic equivalents. Here are your rights :

• Information - This right is exercised through this document. If the data processed includes the data of your staff, you are responsible for making them aware of this document.
• Access and rectification - You have the right to access your data and to have them rectified if necessary. We voluntarily provide you with the means to ensure that any of your personal data that we have collected is correct and current. You may review this information by contacting our privacy team by sending an email to privacyteam@volition.com. You also have the right to demand that incorrect data be corrected and that inappropriate or unnecessary data be deleted.
• Opposition - You may object to the processing of your data by Volition on the basis of our legitimate interest. You will be able to exercise your right to object through the unsubscribe links available in the e-mails sent to you or you can directly object by sending an email to Volition. We must then stop the processing unless we believe we have a legitimate overriding reason to continue processing your personal data.
• Withdrawing your consent - Where data is processed on the basis of your consent, you may withdraw this consent at any time, without calling into question the past processing.
• Erasure - You may obtain the erasure of your data or the restriction of processing under the conditions set out in Articles 17 and 18 of the General Data Protection Regulation.
• Portability - The data you have provided to us may be communicated or transmitted in electronic format.
• Automated decision making - We do not make any decisions involving the use of algorithms or profiling that significantly affects you.

10.3. Contacting the Controller or the Regulator

US: The Controller of your data, VolitionRx is responsible for the processing of your data and is at your disposal for any question and for any request relating to the rights set forth above.

Volition Privacy Team, 1489 West Warm Springs Road, Suite 110, Henderson, Nevada, 89014

privacyteam@volition.com

EEA: If you reside in the European Economic Area, United Kingdom or Switzerland, or otherwise have questions related to our operations in those countries, please contact Belgian Volition SRL through its Data Protection Officer, Lexing Law Firm :

Belgian Volition SRL
c/o Lexing Law Firm
Attn: Ms. Fanny Coton
Boulevard d’Avroy, 280 – 4000 Liège
+32 4 229 20 10

privacy@volition.com

If you would like more information, or if you wish to lodge a complaint, you can contact the Data Protection Authority in your country.

• Belgium : Rue de la Presse, 35 - 1000 Brussels, Tel. + 32 2 274 48 00 - contact@apd-gba.be (https://www.autoriteprotectiondonnees.be/citoyen/agir/introduire-une-plainte).
• UK : If you are in the United Kingdom and feel that your personal data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office. Details are available on the website of the Information Commissioner’s Office at www.ico.org.uk/concerns. The telephone number of the Information Commissioner’s Office is 0303 123 1113.
• Switzerland : Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, CH - 3003 Berne Switzerland, Tel: +41 (0)58 462 43 95, Fax: +41 (0)58 465 99 96, info@edoeb.admin.ch .

Our website may contain links to third-party websites, products or services. If you use these links, you will leave our site. Such links do not constitute or imply an endorsement, sponsorship or recommendation by us of the third party, the third-party website or the information contained therein, and we shall not be responsible or liable for your use thereof. Such use shall be subject to the terms of use and privacy policies applicable to those sites.

We reserve the right to update or change our Privacy Policy at any time and you should check this Privacy Policy periodically. If we make any material changes to this Privacy Policy, we will notify you either through the email address you have provided us, or by placing a prominent notice on our website. Your continued use of our services after we post any modifications to the Privacy Policy on this page will constitute your consent to the modified Privacy Policy.

Last updated: December 1^st, 2022