Data on server log file includes, in particular, the IP address of your terminal device (e.g. computer, smartphone or tablet), the time of access (data, time, time difference), the content of the request (e.g. the specific page requested), the code indicating the status of the response from the server, the amount of data sent (bytes) as well as information about the browser used and the operating system of your terminal device (e.g. Windows or iOS).

These data may be processed for the following purposes: (a) to enable a connection between your terminal device and our website; (b) to assess the security and stability of the system and to identify possible errors; (c) to investigate possible unauthorized access (e.g. DoS or DDoS attacks) and possibly to establish, exercise or defend a right.

The relevant legal basis for this is our overriding legitimate interest (Article 6(1)(f) GDPR), which can be easily deducted from the aforementioned purposes.

How may BioCryst use my personal information?

BioCryst may collect and use your personal information for reasons including, but not limited to, those listed below.

Please note that specific arrangements, contracts, consents, notices, or other forms of disclosure provided or made available to you may specify more detailed and/or additional uses of your personal information:

8) Technical

• To monitor BioCryst website usage levels, diagnose problems, and detect cybersecurity threats;
• To provide you with a more personal and interactive experience and improve our marketing efforts using cookies;
• To collect information about your use of BioCryst websites so that they can provide advertising about products and services tailored to your interests (if you opt-in);
• To collect information about the type of devices accessing BioCryst websites;
• To capture data related to when you open our message or click on any links or banners in the message;
• To reply to requests for support or in response to feedback.

If we decide to use your personal information for a purpose other than originally intended when we first collected your data, we will provide you with new Notice.

With whom may BioCryst share your personal information?

BioCryst may share your personal information in accordance with data privacy legislation with authorized third-parties for legitimate business purposes, including, but not limited to:

• BioCryst affiliates;
• Selected suppliers, vendors, and service providers, including web hosting providers;
• Legal or administrative authorities;
• Professional/legal service providers such as lawyers, accountants and auditors.

In any case, BioCryst will require that such third-parties:

• Comply with applicable data protection laws and the principles of this Notice;
• Only process the personal information for the purposes permitted in this Notice; and
• Implement appropriate technical and organizational security measures designed to protect the integrity and confidentiality of your personal information.

BioCryst may transfer, store, or process your personal information within its corporate locations or with service providers based in the European Union (EU) or in the United States (US).  BioCryst takes appropriate steps to ensure personal information is processed and transferred according to applicable laws and ensures appropriate safeguards are in place through the use of written agreements with recipients that require them to provide certain protections to your personal information through specific Standard Contractual Clauses and accordingly to GDPR Requirements. Please contact BioCryst at privacy@biocryst.com for more information regarding these safeguards.

How long will BioCryst retain your personal information

BioCryst will maintain your personal information only as long as is reasonably deemed required for legal, contractual, or business purposes. During these periods, we will take appropriate steps to ensure that the privacy of your personal information is maintained.

Your rights with regards to your personal information

You have certain rights with respect to your personal information accordingly to the GDPR.
Specifically, you have the right to:

• Ask BioCryst about the processing of your personal information including access to this information;
• Ask BioCryst to correct information you think is inaccurate or incomplete (rectification);
• Ask BioCryst to delete your personal information;
• Ask BioCryst to restrict the processing of your personal information;
• Object to the processing of your personal information;
• Ask that we transfer personal information you have given us (data portability);

To exercise any of these rights, please Email us at privacy@biocryst.com. If limitations apply, BioCryst will look at each circumstance and provide you with the reason if we cannot comply with your request. As required by law, BioCryst may take steps to verify your identity prior to taking any actions with regard to your personal information.

Changes to this notice

This Notice may be modified from time to time, particularly in the event of changes in the law or BioCryst’s practices. The date on which this Notice was last updated is shown at the end of this document. Please email privacy@biocryst.com for the current version.

Contact Information

If you have any questions pertaining to BioCryst’s privacy practices, use of your personal information, or your rights described above, you may contact us at privacy@biocryst.com. Our EU Data Protection Officer provided by privacy consultants Foxon may also be contacted at privacy@biocryst.com.

Effective: April 2024