Data Privacy Policy

I. INTRODUCTION

Tango Therapeutics, Inc. (together with its subsidiaries, the “Company”, “Tango”, “we”, “us”, “our”) processes Personal Data (also referred to as “personal information”) relating to you or other individuals in different ways and for different purposes. These Privacy Principles, which are contained in this policy (the “Data Privacy Policy”), explain how we process your Personal Data. “Personal Data” is any information that can be linked to a particular individual, and “process” means any handling of Personal Data, such as the collection, use and disclosure of Personal Data.

Tango was founded with a clear mission: to discover the next wave of targeted therapies in oncology by addressing the specific genetic alterations that drive cancer. In the course of pursuing this mission, the Company collects and analyzes the Personal Data of various individuals, including patients, vendors and healthcare professionals. These Privacy Principles explain our processing of Personal Data when you:

visit our website (www.Tangotx.com);
are a signatory to a contract with us;
contact us via email, letter, a contact form, or other means;
deal with us in the context of all other data processing related to our business offerings;
participate in our research programs.

These Privacy Principles are not part of a contract. Company may amend these Privacy Principles at any time. The version published on this website is the most current version.

II. WHO IS RESPONSIBLE FOR PROCESSING YOUR PERSONAL DATA?

For data processing under this Data Privacy Policy, the following company is the “controller”, or the party primarily responsible under data protection law:

Tango Therapeutics, Inc.
201 Brookline Ave., Suite 901
Boston, MA 02215
USA

Email: dataprivacy@tangotx.com

III. WHAT PERSONAL DATA DO WE PROCESS?

These Privacy Principles apply to all Personal Data collected, processed, shared, or used by the Company in the context of its various activities.

We process the following Personal Data about you:

Master data and contact information: We refer to master data as the basic data that we need to conduct our business relationships and that relates directly to you and your characteristics. This includes, for example, first and last names, home address, phone number, email address, username, language skills, nationality, ethnic origin, gender, your relationship with the company that employs you, government-issued identification such as a driver’s license or passport, photo or image, login credentials, answers to security questions, medical license number, banking or credit card details. We typically obtain this master data from you but may also obtain it from other individuals who work for your company;
Contract data: Contract data are details collected or created in connection with the preparing, entering into, performing, or terminating a contract. For example, we may process information about the contract’s subject matter, type, terms, effective date, duration, termination, the services to be provided, contact information, use of services, payments and payment methods, invoices, complaints, customer satisfaction, and feedback;
Health data: For certain programs and services, we process health information from individuals directly or indirectly from a third party (e.g., information regarding patients’ health status, medications, medical history, and other healthcare-related information);
Communication data: Communication data are data collected in connection with our communications with you (e.g., when you contact us via a contact form on our website or via other means of communication). Communication data includes name and contact details (e.g., postal address, email address and telephone number); content of correspondence (e.g., from emails, written correspondence, and telephone conversations etc.); details of the type, time and possibly location of the communication and other metadata associated with the communication;
Technical data: Technical data are generated in connection with the use of our website. This includes, for example, the IP address of the device and device ID; information about your device, its operating system or its language settings; information about your internet provider; accessed content or logs in which the use of our systems is recorded; date and time of access to the website and your approximate location;
Applications, professional career, education and training: We may process information about job applicants, employees, former employees and healthcare professionals including their work history, qualifications, education, skills, competencies, professional organization memberships, and language skills. This information may include curriculum vitae, certificates, diplomas, job references, employment confirmations, previous jobs and employers, reference contacts and their contact details, information provided by references, and other information collected in connection with an application or obtained from the internet or other public sources;
Other data: We may process additional categories of Personal Data not specifically described in this notice. Where required by applicable law, or where reasonably practicable, we will provide additional information regarding the processing of such Personal Data at the time of collection or through a separate notice.

The Company may also collect other information that is not Personal Data, such as business, company, or institutional information.

IV. FOR WHAT PURPOSES DO WE PROCESS YOUR DATA?

We process the Personal Data described in Section III for a variety of purposes, including, but not limited to the following:

Communication purposes: To contact you and maintain communications with you.
Clinical or medical research: We collect and process healthcare professionals’ Personal Data for the purpose of entering into and performing specific agreements related to clinical or medical research and other aspects of product development.
Development of services: To improve and further develop our services.
Business operations and security purposes: To support business operations and maintain the security of our systems, facilities, and assets, including the operation and security of IT systems and applications, support hotlines, workplace and building security (including access controls), and the protection of data, confidential information, and assets. This includes the use of spam filters, virus protection, and data loss prevention (DLP) systems that may scan emails for specific terms or other criteria to help prevent the unauthorized disclosure of confidential information or Personal Data. This also includes the documentation of security incidents, data breaches, complaints, interactions with authorities and third parties, and other relevant events and related actions that involve or contain information about you.
Compliance, investigations and legal proceedings: To prevent, investigate, and prosecute or otherwise address violations of applicable laws, regulations, internal policies, or procedures, including the investigation of complaints, reports, and objections; the evaluation of monitoring activities; participation in governmental or regulatory investigations and proceedings; and the establishment, exercise, or defense of legal claims.
Identifying potential investigators: To analyze the professional profiles of physicians and other healthcare providers for the purpose of identifying potential investigators to assist in clinical and medical research on specific indications or to otherwise collaborate with the Company.

V. COLLECTION AND PROCESSING OF PERSONAL DATA

1.0 Principles – How does the Company collect and use Personal Data?

Where required by data privacy law or considered good practice, the Company will seek the consent of data subjects to collect, use, and disclose their Personal Data consistent with the relevant privacy notice. Specific requirements vary by jurisdiction and must always be followed.

As required under applicable law, the Company shall:

Collect and use Personal Data only where there is legal justification to do so. Company policies or applicable laws may require obtaining the data subject’s explicit consent or providing the data subject with the opportunity to object before collecting or further using their Personal Data, as required by applicable law (e.g., informed consent for clinical research);
Notify data subjects how their Personal Data will be used prior to the collection of their information;
Collect only the Personal Data that is required for the specified business purpose;
Use Personal Data only for the specific business purpose described in the applicable consent form or privacy notice or for purposes that would be reasonably anticipated by the data subject;
Use Personal Data in ways that do not adversely impact the data subject unless such use is justified by law; and
Anonymize or pseudonymize Personal Data where possible or appropriate.

The Company recognizes that the responsible handling of Personal Data is essential to protecting individuals’ privacy rights and complying with applicable data protection laws and regulations.

Personal Data may be shared with other Company affiliates, government agencies, service providers and third parties on a “need-to-know” basis for legitimate business reasons or as otherwise allowed or required by law.

Company websites may contain links to websites outside of the Company. Linked websites are neither controlled nor endorsed by Company, and, as a result, these Principles do not apply to linked websites hosted by other organizations. It is recommended that visitors review the Privacy Principles of each linked website.

2.0 Collection of Data – How is Personal Data collected?

The Company may collect Personal Data from the following sources:

Company may, to the extent permitted by law, collect Personal Data from data subjects through various channels, including through websites, in surveys, during business or marketing events, and when delivering programs and services to individuals.
Company may provide opportunities to sign up to receive specific information or services and may ask for contact information (e.g., name, home/contact address, home/contact phone number or personal/contact email address), so that we can send specific information about Company products, services, and specific health conditions, with data subjects’ consent.
Company may indirectly collect information about patients’ health condition, diagnosis, and treatment from healthcare professionals, but only where the healthcare professional has obtained consent to disclose that information to Company, as required by law.
Company may, to the extent permitted by law, collect various types of information from healthcare professionals as part of marketing or educational activities directed to healthcare professionals, including first name, last name, age, gender, home/contact address, home/contact phone number, personal/contact email address, medical specialization, professional qualifications, license number and scientific society membership number.
When navigating the Company’s website, certain passive information may also be collected. This type of information is used for the purposes of gathering data to provide improved administration of Company websites and to improve the quality of interactions with Company websites.
Company may also collect information about data subjects from third-party sources to supplement information received from the data subjects.
Company may collect Personal Data to enable data subjects to use online social media resources offered either by the Company or a third party.

When using a social media platform or other online resource provided by a third party through the Company’s website, users acknowledge that the Company may have access to information that is publicly available through that platform, such as usernames, comments, posts, and contacts, as well as any other information that the user’s privacy settings permit the Company to access. Company will comply with the terms of these Privacy Principles and the privacy policies applicable to the third-party social media resources it uses.

3.0 Specific principles for Internet Users

We use third party services for our website in order to assess and improve the user experience of the website and online advertising campaigns. These services may be embedded in our website and may use cookies or similar technologies. These technologies allow us to distinguish your access to the website from that of other users, maintain website functionality, and perform statistical analyses. They are not intended to identify you by name. Instead, our servers or those of third parties may assign a unique recognition number, commonly called a “cookie,” to you or your browser so that you can be recognized as an individual visitor each time you access the website.

A cookie is a small text file that is placed on a user’s device when visiting a website. The Company uses cookies and similar technologies on its websites to support the operation of the website, enhance user experience, analyze website usage, improve website performance, and for other purposes described below:

To allow the site to deliver the service requested by the visitor;
To remember repeat visitors;
To improve the user experience of the site;
To allow the Company to perform site analytics; and
To help tailor marketing messages to the visitor based on previous browsing.

Company cookies are enabled and controlled by the Company IT team, which is located in the United States. The online relationship the visitor has with the Company may be managed by using settings available on most internet browsers. For example, most browsers will allow a visitor to choose which cookies can be placed on their device, to delete or disable cookies, and enable a “Do Not Track” setting. Please note that disabling cookies may prevent a visitor from using certain features on Company’s websites.

To learn more about cookies and principles for internet users, please visit the following link: https://www.tangotx.com/cookie-policy/

No part of the Company’s online presence is directed at children.

4.0 Transfers of Personal Data – What happens when Personal Data goes to another country?

The Company conducts business and research activities in multiple jurisdictions worldwide. These activities frequently involve collaboration among affiliates, service providers, research partners, and other third parties located in different countries. Personal Data may be shared across international borders as required to support global projects, particularly clinical trials. Company may, in the future, host Personal Data in databases in different locations throughout the world, including the United States and the European Union. Company recognizes that many countries have regulations restricting the flow of Personal Data across international borders. The Company will protect Personal Data during the transfer according to applicable laws and regulations. Where Personal Data is transferred to a recipient located in a country that does not provide an adequate level of data protection, the Company will implement appropriate safeguards and require the recipient to protect the Personal Data in accordance with applicable data protection requirements. Where required by applicable law, the Company uses appropriate safeguards for international transfers of Personal Data, such as the European Commission’s Standard Contractual Clauses. The Company may use another legally recognized transfer mechanism or rely on an applicable legal exception where permitted.

An exception may apply, for example, where the transfer is necessary for legal proceedings abroad, for overriding public-interest reasons, or for the performance of a contract, where the data subject has consented to the transfer, or where the data subject has made the Personal Data generally available and has not objected to its processing.

5.0 Data Protection Impact Assessments

The Company will conduct Data Protection Impact Assessments (DPIAs) as required by applicable laws. In determining whether a DPIA is required, the Company will consider the nature, scope, context, and purpose of the processing, including the use of new technologies and whether the processing is likely to result in a high risk to the rights and freedoms of individuals. A single DPIA may cover multiple similar processing activities that present similarly high risks.

VI. TO WHOM MAY WE DISCLOSE YOUR PERSONAL DATA?

We may disclose your Personal Data to other recipients if this is necessary for the stated purposes (Section IV) and insofar as this is permitted by law. We disclose Personal Data to following categories of recipients:

Service providers: We use various services from third parties domestically and abroad, including contract research organizations, IT service providers, maintenance and support service providers. These service providers may process or access your Personal Data to the extent necessary;
Governmental authorities and official agencies, when we deem it necessary or appropriate in order to comply with laws and regulations or to verify compliance therewith, to respond to inquiries from competent authorities (e.g., in the context of a criminal investigation, in the context of regulatory submissions) or to participate in official or judicial investigations and proceedings;
Parties to legal proceedings, e.g., opposing parties, other participants, experts, and witnesses, etc., if we participate in legal proceedings or are considering participation;
Acquirers or parties interested in acquiring business units, companies or assets.

VII. HOW LONG DO WE STORE YOUR PERSONAL DATA?

We generally store your Personal Data as required by applicable laws or regulations, or for the duration of the applicable contract. Exceptions may apply in the case of legal retention obligations or other applicable requirements. An exception also applies if earlier deletion is indicated (e.g., because we no longer require the data or are obliged to delete it).

For operational and security-related data, shorter retention periods usually apply. Business-related documents are retained for as long as we require them to achieve our purpose, have a sufficient business interest in retaining them or are legally obliged to do so. When the retention period has expired, your Personal Data will be deleted or anonymized.

VIII. ON WHAT LEGAL BASIS DOES THE DATA PROCESSING RELY?

Depending on the case, data processing is only permitted if the applicable law specifically allows it. The various privacy laws in the world apply different legal grounds for the collection and processing of Personal Data. We may rely on the following legal bases for processing your Personal Data:

your consent;
that the processing is necessary for the performance of a contract or pre-contractual measures (e.g., the examination of a contract application);
that the processing is necessary for the assertion or defense of legal claims or civil proceedings;
that the processing is necessary for compliance with domestic or foreign legal provisions;
that the processing is necessary for a legitimate interest in the data processing.

IX. HOW DO WE PROTECT YOUR PERSONAL DATA?

Information Security: We take appropriate technical and organizational measures to protect your Personal Data from loss, misuse and unauthorized access, disclosure, alteration, and destruction. These measures are regularly reviewed and updated to reflect technological developments, the nature of the Personal Data processed, and the risks involved in processing the Personal Data.

Research Data Protection: To enhance privacy in research activities, data subjects’ names and other direct identifiers are not attached to records or samples collected by the Company. Instead, data subjects are identified by a unique code.

X. WHAT RIGHTS DO YOU HAVE WITH REGARD TO YOUR PERSONAL DATA?

You have certain rights to control or influence our processing of your Personal Data. These include the following:

Information: You have the right to obtain information about how your Personal Data is processed by us at any time in writing and generally free of charge.
Correction: You may, at any time and free of charge, request that we correct, complete, or update your Personal Data if it is incorrect.
Objection and deletion: In certain circumstances, you may object to our data processing and request that we delete your Personal Data at any time if we are not obliged to continue processing or storing this data.
Withdrawal of consent: If we process your Personal Data based on your consent (see Section VIII), you may withdraw your consent at any time. Such withdrawal is effective only for future data processing activities.

Some of these rights may not apply in individual cases, and we may be entitled or obligated to restrict or postpone the fulfillment of a right requested by you. We will inform you accordingly in such a case.

XI. CONTACT

All communications, queries, requests to exercise data subjects’ rights (e.g., access to data), questions, or complaints should be directed to the Company’s Data Protection Office at dataprivacy@tangotx.com. To prevent misuse, the Company may need to verify the requestor’s identity.

ANNEX I SUPPLEMENTAL STATE NOTICE

If you are a resident of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia, you may have certain additional rights relating to your Personal Data. This section provides additional detail about the Personal Data we collect through the Sites and through the Services, the purposes for which we collect that personal information, and the persons or entities to whom we disclose that personal information.

Individual Rights

Depending on your state of residence, you may have rights relating to the collection, use, disclosure, and other processing of your personal information, subject to applicable legal exceptions and requirements. Such rights may include:

Right to Know/Access

You may have the right to ask for a copy of your Personal Data in a readable, usable format. You can also ask for details about how we handle your data, including:

Where we get your information from;
Why we collect, sell, or share it;
What kinds of companies we share it with; and
What types of your information we share.

Right to Data Portability.

You may have the right to access your Personal Data in a portable format.

Right to Delete

You may have the right to request that we delete the Personal Data we have collected from or about you.

Right to Correct

You may have the right to request that we correct inaccurate Personal Data that we have collected and maintained about you.

Right to Revoke Consent

You may have the right to revoke your consent to certain processing activities concerning any sensitive Personal Data we may collect about you.

Right to Limit Use of Sensitive Personal Information

You may have the right to limit the use and disclosure of your sensitive Personal Data to certain limited purposes, including for the specific provision of service you may have requested.

Right to Appeal

In certain states, you may have the right to appeal a decision we have made in connection with your privacy rights request.

Right to opt Out of Targeted Advertising, Sale, or Sharing of Personal Information

You may have the right to opt out of “targeted advertising” and the “sale” or “sharing” of your personal information.

Right to Request Categories of Third Parties

You have the right to request a list of the categories of third parties to whom we have disclosed your personal information.

Right to Non-Discrimination

You may have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise your rights under applicable laws.

Submitting Requests and Exercising Your Applicable Rights

To submit requests under applicable laws, please contact us at dataprivacy@tangotx.com. We may ask you to verify your identity before responding to such requests. We reserve the right to refuse any request if we are not obligated to respond under applicable law. Where permitted by applicable law, you may designate an authorized agent to submit a request on your behalf. We may ask any authorized agent to verify that they have been authorized by you to make the request under applicable local law, which may include signed permission provided by you. Please note, we may not be able to provide certain aspects of the Sites or Services without some necessary data. If you have any questions specifically about this Policy or our privacy practices, please contact us.

ANNEX II SUPPLEMENTAL INFORMATION FOR INDIVIDUALS IN THE EUROPEAN ECONOMIC AREA, UNITED KINGDOM AND SWITZERLAND

If you are located in the European Economic Area (“EEA”), the United Kingdom (“UK”) or Switzerland, this section provides additional information about our processing of your Personal Data and the rights that may be available to you under applicable data protection laws, including the EU General Data Protection Regulation (“EU GDPR”), the UK General Data Protection Regulation (“UK GDPR”) and the Swiss Federal Act on Data Protection (“FADP”), as applicable.

This Supplemental Information should be read together with the other sections of these Privacy Principles and any more specific privacy notice that we may provide to you in connection with a particular activity.

1.0 Who is responsible for your Personal Data?

Tango, as identified at the beginning of these Privacy Principles, will be responsible for the processing of your Personal Data and will act as the data controller.

2.0 What Personal Data do we collect and where do we obtain it?

The categories of Personal Data that we may process are described in the sections “What Personal Data do we Process?” above.

We may obtain your Personal Data directly from you, automatically through your interaction with our website or services, or indirectly from third parties and other sources, as described in the section “Collection of Data – How is Personal Data collected?” above.

Where we obtain Personal Data about you from another source, the categories of information and the particular source will depend on the nature of our relationship with you and the relevant processing activity. Where required by applicable law, we will provide additional information to you in a specific privacy notice relating to that activity.

3.0 Why do we process your Personal Data and what is our legal basis?

The purposes for which we process Personal Data are described more generally in the section “For what purposes do we process your data?” above.

Where the EU GDPR or UK GDPR applies, we must have a legal basis for processing your personal information. The legal basis will depend on the purpose and circumstances of the particular processing activity.

The principal purposes for which we may process your personal information, together with the legal bases on which we may rely and, where applicable, the legitimate interests that we pursue, are set out below.

Purpose	Legal Basis	Legitimate Interests Pursued, where applicable
1. Providing, operating, maintaining and administering our sites and services and responding to your requests and inquiries	Performance of a contract or taking steps at your request before entering into a contract, where applicable; our legitimate interests; and consent where required.	Operating our business; providing effective, secure and accessible sites and services; and responding to and communicating with individuals who interact with us.
2. Managing our relationships and interactions with healthcare professionals, investigators, researchers, healthcare institutions and other professional contacts	Our legitimate interests; performance of a contract, where applicable; compliance with legal obligations, where applicable; and consent where required.	Developing and maintaining appropriate professional, medical and scientific relationships; facilitating medical and scientific engagement; and supporting our business and activities.
3. Providing customer, medical or other support and responding to communications, requests and inquiries	Performance of a contract, where applicable; our legitimate interests; compliance with legal obligations, where applicable; and consent where required.	Responding effectively to requests and inquiries; providing appropriate support; and managing our relationships with individuals and organizations with whom we interact.
4. Operating, analyzing, maintaining and improving our Sites, Services, systems and business activities	Our legitimate interests; and consent where required, including for certain cookies and similar technologies.	Understanding how our sites and services are used; maintaining and improving their performance, functionality and user experience; and developing and improving our business activities.
5. Protecting the security and integrity of our sites, services, systems, premises and business, and detecting, preventing and addressing fraud, misuse, security incidents and technical issues	Our legitimate interests; and compliance with legal obligations, where applicable.	Protecting our business, systems, information, personnel and users; preventing and investigating fraud, misuse and security incidents; and maintaining network and information security.
6. Entering into, administering and performing contracts and managing relationships with suppliers, consultants, contractors and other business partners	Performance of a contract or taking steps before entering into a contract, where applicable; our legitimate interests; and compliance with legal obligations, where applicable.	Managing our contractual and commercial relationships; administering agreements; and operating our business effectively.
7. Providing news, information and marketing or promotional communications concerning Company and our activities	Our legitimate interests where permitted by applicable law; and consent where required.	Communicating with individuals who have an existing or potential professional or business interest in Company, our activities or Services; and promoting and developing our business.
8. Recruitment, including receiving and assessing applications, communicating with candidates and managing the recruitment process	Taking steps at your request before entering into a contract; our legitimate interests; compliance with legal obligations; and consent where appropriate.	Identifying and recruiting suitable candidates; managing and improving our recruitment processes; and establishing and maintaining an appropriate workforce.
9. Identifying and evaluating healthcare professionals and potential investigators for clinical trials, medical research and other scientific activities	Our legitimate interests; compliance with legal obligations, where applicable; and other legal bases where applicable to the particular activity.	Identifying appropriately qualified healthcare professionals, researchers and investigators; and planning and supporting clinical, medical and scientific activities.
10. Conducting and supporting clinical, medical and scientific research	The applicable legal basis will depend on the nature and circumstances of the relevant research activity and may include our legitimate interests, compliance with legal obligations, consent or another legal basis available under applicable law.	Advancing scientific and medical knowledge; developing, evaluating and improving our treatments; and conducting and supporting responsible clinical, medical and scientific research.
11. Complying with pharmacovigilance, product safety, regulatory, transparency, reporting and other legal or regulatory requirements	Compliance with legal obligations where applicable; our legitimate interests or another appropriate legal basis where the relevant requirement is not directly imposed by applicable EEA or UK law.	Ensuring the safety of our products; meeting applicable regulatory and compliance standards; protecting patients and public health; and cooperating with competent authorities.
12. Conducting audits, compliance activities, internal reviews and investigations and establishing, exercising or defending legal claims	Our legitimate interests; and compliance with legal obligations, where applicable.	Protecting our legal rights and interests; maintaining effective governance and compliance; investigating suspected misconduct or breaches; and establishing, exercising and defending legal claims.
13. Protecting the rights, property, health or safety of Company, our personnel, individuals with whom we interact or other persons	Our legitimate interests; vital interests where applicable; and compliance with legal obligations, where applicable.	Protecting individuals and our business, personnel, property and legal rights; and responding appropriately to emergencies and other risks.
14. Corporate transactions, including an actual or proposed merger, acquisition, financing, restructuring, sale of assets or similar transaction	Our legitimate interests; and compliance with legal obligations, where applicable.	Managing and developing our business and evaluating and facilitating legitimate corporate transactions.

The legal bases identified above may not apply in every case. The appropriate legal basis will depend on the particular processing activity, our relationship with you and applicable law.

Where we rely on legitimate interests, we consider whether the processing is necessary to pursue those interests and balance those interests against your interests, rights and freedoms. We will not rely on legitimate interests where your interests, rights or freedoms override our legitimate interests.

Where we rely on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before your consent was withdrawn.

Where the provision of Personal Data is necessary to enter into or perform a contract with you or to comply with a legal requirement, failure to provide the relevant information may mean that we are unable to enter into or perform the relevant contract, provide a requested service or otherwise interact with you as intended. Where required, we will inform you whether you are required to provide certain Personal Data and of the possible consequences for failing to provide it.

More specific purposes and legal bases may apply to particular activities, including clinical research, pharmacovigilance, medical affairs and other regulated activities. Where appropriate or required by applicable law, these will be described in the specific privacy notice provided in connection with the relevant activity.

4.0 Sensitive or special category personal information

Certain Personal Data is subject to additional protection under applicable data protection laws.

Under the EU GDPR and UK GDPR, this includes “special categories” of personal information, such as information concerning health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic information, biometric information used for the purpose of uniquely identifying an individual, and information concerning a person’s sex life or sexual orientation.

Where we process special category personal information, we will only do so where we have both an appropriate legal basis for the processing and an additional condition permitting the processing of such information under applicable law.

Depending on the circumstances, the applicable condition may include:

your explicit consent

processing necessary for obligations or rights in the field of employment, social security or social protection

protection of your vital interests or those of another person where the relevant individual is incapable of giving consent

processing of information that you have manifestly made public

establishing, exercising or defending legal claims

reasons of substantial public interest, where provided for by applicable law

preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or management of health or social care systems and services

reasons of public interest in the area of public health

scientific research, statistical or archiving purposes, where the applicable legal requirements and safeguards are satisfied

Where Swiss data protection law applies, we process sensitive Personal Data, including health data, genetic data and biometric data, in accordance with the requirements of the FADP.

Where appropriate, the particular legal basis and, in the EEA or UK, special category condition applicable to a specific processing activity will be described in the privacy notice relating to that activity.

5.0 Who receives your Personal Data?

As further described in the section “To whom do we disclose your Personal Data?” above, depending on the circumstances, we may disclose Personal Data to:

other companies within the Tango group;
contractors, consultants, vendors and other service providers that provide services to us or process Personal Data on our behalf;
healthcare institutions, healthcare professionals, clinical trial sites, investigators, contract research organizations and other clinical, medical and scientific research partners where relevant to the applicable activity;
professional advisers, including lawyers, accountants, auditors and other advisers;
governmental, regulatory, judicial, law-enforcement and other competent authorities where required or permitted by applicable law; and
prospective purchasers, investors and other relevant parties and their professional advisers in connection with an actual or proposed merger, acquisition, financing, restructuring, sale of assets or other corporate transaction.

The particular recipients of your Personal Data will depend on the processing activity. Where required by applicable law, additional information will be provided in the specific privacy notice applicable to that activity.

6.0 International transfers of your personal information

Tango operates internationally. As a result, your Personal Data may be transferred to, accessed from, or otherwise processed in countries outside the EEA, UK or Switzerland, including by other Tango group companies and by our service providers.

These countries may have data protection laws that differ from those applicable in the country in which you are located and, in some cases, may not have been recognized as providing an adequate level of protection for personal information.

Where your Personal Data is transferred internationally, we take the steps required by applicable data protection law to protect it.

EEA: For Personal Data subject to the EU GDPR, we may transfer Personal Data to a country that the European Commission has recognized as providing an adequate level of protection. Where the recipient is located in a country that has not been recognized as providing an adequate level of protection and no other applicable transfer mechanism is available, we may use the European Commission’s Standard Contractual Clauses or another legally recognized transfer mechanism. Where required, we also assess the circumstances of the transfer and implement supplementary technical, contractual or organizational measures designed to provide an appropriate level of protection.

UK: For Personal Data subject to the UK GDPR, we may transfer Personal Data to a country recognized under UK data protection law as providing an adequate level of protection. Where this is not the case and no other applicable transfer mechanism is available, we may use an appropriate safeguard recognized under UK data protection law, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses, as applicable, together with any supplementary measures required in the circumstances.

Switzerland: For Personal Data subject to Swiss data protection law, we may disclose Personal Data to countries recognized under Swiss law as providing an adequate level of data protection. Where Personal Data is disclosed to a country that does not provide an adequate level of protection, we will use an appropriate safeguard or other transfer mechanism permitted under the FADP. This may include recognized standard contractual clauses, with any adaptations required under Swiss data protection law, together with supplementary measures where appropriate.

In certain limited circumstances, applicable data protection laws may also permit an international transfer without an adequacy decision or contractual safeguard where a specific statutory exception applies.

You may contact us at dataprivacy@tangotx.com if you would like further information about international transfers of your Personal Data, including the safeguards applicable to a particular transfer. Where applicable, you may also request information about, or a copy of, the relevant safeguards.

7.0 How long do we retain your personal information?

As described in the section “How long do we store your Personal Data” above, we retain your Personal Data only for as long as reasonably necessary for the purposes for which it was collected or otherwise processed, including to satisfy applicable legal, regulatory, accounting, reporting and compliance requirements and, where appropriate, to establish, exercise or defend legal claims.

The applicable retention period will depend on factors including the nature and sensitivity of the personal information, the purposes for which it is processed, applicable legal and regulatory requirements and the period for which the information may be relevant to actual or potential legal claims.

Where appropriate or required by applicable law, more specific information concerning retention periods or the criteria used to determine those periods will be provided in the privacy notice relating to the relevant processing activity.

8.0 Your data protection rights

Subject to applicable law and any relevant conditions, limitations or exceptions, you may have the right to:

Access your Personal Data and obtain information about how we process it;
Rectify inaccurate Personal Data and have incomplete Personal Data completed;
Request deletion or erasure of your Personal Data in certain circumstances;
Restrict processing of your Personal Data in certain circumstances;
Object to processing based on legitimate interests in certain circumstances;
Object to direct marketing at any time where your Personal Data is processed for direct marketing purposes;
Data portability, where applicable, allowing you to receive certain Personal Data in a structured, commonly used and machine-readable format and, where applicable, have it transmitted to another controller;
Withdraw your consent at any time where processing is based on your consent, without affecting the lawfulness of processing carried out before your consent was withdrawn; and
Rights relating to certain automated decision-making, including profiling, where applicable under the relevant data protection law.

The precise rights available to you and the circumstances in which they apply may differ depending on whether EU, UK or Swiss data protection law applies to the processing.

9.0 How can you exercise your rights?

To exercise an applicable data protection right or ask a question about our processing of your personal information, please contact us at dataprivacy@tangotx.com.

We may request information from you that is reasonably necessary to confirm your identity and ensure that Personal Data is not disclosed to a person who is not entitled to receive it. We will respond to your request within the period required by applicable law.

Your rights may be subject to conditions, limitations and exceptions under applicable law. We may therefore be unable to comply with a request in whole or in part in some circumstances. Where required by applicable law, we will explain the reasons for our decision.

10.0 Complaints

If you have concerns about how we process your Personal Data, we encourage you to contact us at dataprivacy@tangotx.com so that we can consider and respond to your concerns.

You may also have the right to lodge a complaint with the competent data protection or supervisory authority.

EEA: You may lodge a complaint with the competent supervisory authority, in particular in the EEA country in which you live or work or where you believe an infringement of applicable data protection law has occurred.

UK: You may lodge a complaint with the Information Commissioner’s Office (“ICO”).

Switzerland: You may contact the Federal Data Protection and Information Commissioner (“FDPIC”).