Last updated on: August 1, 2024
Washington Residents: If you are a Washington resident and when you provide your Health Data to us, we collect, use, and disclose your Health Data in accordance with Arcus’s Washington Health Data Privacy Policy.
CALIFORNIA NOTICE AT COLLECTION
This Notice at Collection, applicable to California Residents, explains:
You can review our complete Privacy Policy here.
Categories of Personal Data We Collect from California Residents |
Purpose(s) for Collection and Use |
Personal identifiers |
|
Financial information |
|
Medical information |
|
Internet and other electronic activity information |
|
Characteristics of protected classifications |
|
Professional or employment-related information, and educational information |
|
Categories of Personal Data We Sell or Share (for cross-context behavioral advertising)
Depending on the relationship we have with you, we may share the following categories of Personal Data for cross-context behavioral advertising:
Right to Opt-out of the Sale/Sharing of Personal Data
You have the right to opt-out of the sale and sharing of your Personal Data. To opt-out of the sale or sharing of your Personal Data, please visit “DO NOT SELL/SHARE MY PERSONAL INFORMATION”, contact us at [email protected] or call us at 1-888-914-9661, PIN 149825. You may also find our Notice of Right to Opt-out of Sale/Sharing by visiting the “DO NOT SELL/SHARE MY PERSONAL INFORMATION” form.
You may also opt out by sending an opt-out preference signal, specifically the Global Privacy Control (GPC) signal which is a browser setting that notifies us that you are opting-out of the sale or sharing of your Personal Data. To download and use a browser supporting the GPC browser signal, click here: https://globalprivacycontrol.org/. If you choose to use the GPC signal, you will need to turn it on for each supported browser or browser extension you use.
Retention of Personal Data
We only retain your Personal Data as long as is necessary to fulfill the purposes for which we collected it. To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements. In exceptional cases (e.g., in pending litigation matters or where the law requires us to) your Personal Data may need to be kept for longer periods of time.
We at Arcus Biosciences, Inc. (‘Arcus’; ‘we’; ‘our’) care about your privacy. This Privacy Policy describes how we process your Personal Data when you visit or interact with our websites, including https://arcusbio.com, http://trials.arcusbio.com, https://aiportraitsofcancer.com/, and http://investors.arcusbio.com (the ‘Site’), when we market Arcus and Arcus clinical trials, products, and services, when you provide services to us, when you apply for a job with us, when you visit our facilities, or when you connect to our wireless network (‘Wi-Fi’) while at our facilities. This Privacy Policy does not apply to Personal Data collected:
Arcus acts as a controller under the General Data Protection Regulation (‘GDPR’), a business under the California Consumer Privacy Rights Act of 2018 as amended by the California Privacy Rights Act of 2020 (‘CCPA’), and other similar designations under other relevant data protection laws for the processing activities described in this Privacy Policy. ‘Personal Data’ as used in this Privacy Policy means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular person or household.
PERSONAL DATA WE COLLECT AND PROCESS
We collect and process the categories of Personal Data identified below. For CCPA purposes, these are also the categories of Personal Data that we collected in the 12-month period prior to the date of this Privacy Policy.
SOURCES OF PERSONAL DATA
We collect Personal Data directly from you when you visit our Site, request information about our business or clinical trials, when you register to attend events with us, submit a job application or inquire about positions, visit our facilities, connect to our Wi-Fi, and when you otherwise voluntarily provide us with your Personal Data.
We may also collect your Personal Data from third parties with which we do business or that we engage such as service providers engaged to promote Arcus and our clinical trials or for online advertising and analytics services. We may also collect your Personal Data from public records databases.
As is now common with most websites, our Site uses cookies and may use other online tracking tools (e.g., web beacons) to automatically collect information about your IP address, your use of the Site, or other websites you may visit after ours. Cookies are small data files generated by a website and saved by your web browser. They are used to help users navigate websites efficiently as well as to provide information to the owner of the websites. To find out more about what cookies we use and how we use them, please consult our Cookies Policy here. Please note that if we cannot use certain types of cookies, the website may not function properly (please refer to our Cookie Policy and the meaning of “essential cookies”), or we may otherwise not be able to service you (e.g. provide you customer service).
If you have applied for a job with us, we may collect your Personal Data from your previous employer or references, from third party vendors (e.g. a background check vendor), and from publicly-available sources such as LinkedIn and social media profiles (but only to the extent they are publicly available). We will seek your consent before doing so where such is required by law.
HOW WE USE YOUR PERSONAL DATA: PURPOSES AND LEGAL BASES OF THE PROCESSING
We use and process your Personal Data for the purposes and legal bases set out below:
Use/Purpose | Lawful Basis |
Communicating with you, providing you with information about our business and other information you have requested, considering you for participation in patient advocacy and support programs, and operating and improving our website |
Arcus has a legitimate interest to operate its website, manage its business, and communicate with you upon your request (Article 6(1)(f), GDPR) |
Provide you with access to our facilities and to our Wi-Fi |
Arcus has a legitimate interest to manage its business (Article 6(1)(f), GDPR)
We may also ask for your consent prior to granting you access to our facilities and our Wi-Fi |
Contact you with respect to clinical trials offered by us which we believe may interest you (including direct marketing) | Arcus has a legitimate interest to operate its website and communicate with you upon your request (Article 6(1)(f), GDPR)
Depending on your location, we may also ask for your consent prior to sending you direct marketing |
Marketing and advertising Arcus and our clinical trials, and any future marketing of products and services | Depending on your location, we may also ask for your consent prior to marketing and advertising our clinical trials, products, and services online |
Carrying out audits and investigations, and to investigate and resolve complaints, grievances or misconduct | Arcus has a legitimate interest to manage its business and to ensure that all investigations and proceedings are managed efficiently and effectively (Article 6(1)(f), GDPR)
Arcus has a legal obligation to do so (Article 6(1)(c), GDPR) |
Preparing for and acting in relation to enquiries, investigations or proceedings, by governmental, administrative, judicial or regulatory authorities, including civil litigation | Arcus has a legitimate interest to manage its business and to ensure that all investigations and proceedings are managed efficiently and effectively (Article 6(1)(f), GDPR)
Arcus has a legal obligation to do so (Article 6(1)(c), GDPR) |
In connection with a potential asset or stock acquisition of Arcus, or the outsourcing or insourcing of services provided by employees, providing reasonable diligence material to a third party or meeting any disclosure obligations as required by law | Arcus has a legitimate interest to manage its business (Article 6(1)(f), GDPR) |
If you are applying for a job with us we will process your Personal Data in order to make a decision about recruitment or appointment, including the right to work. For these purposes we may process your characteristics of protected classifications and special categories of Personal Data.
If you are in the European Economic Area (“EEA”) or the UK, you have a right to object to the processing of your Personal Data where that processing is carried out for our legitimate interests. Please note however that we may not be able to fulfill this request in all instances.
DISCLOSURE OF PERSONAL DATA
The following chart describes the categories of Personal Data we disclose to third parties and which we will continue to disclose. For CCPA purposes this chart also describes the categories of Personal Data we disclosed to third parties for a business purpose in the 12 months prior to the date of this Privacy Policy.
Categories of Consumers’ Personal Data | Categories of Third Parties With Which We Disclosed Personal Data (for a Business Purpose) |
Personal identifiers |
Service providers (i.e., vendors) that we retain to undertake the following activities: manage the Personal Data, facilitate email communications, process job applications, provide our wireless network, support our clinical trials, manage patient advocacy and support programs, provide advertising and marketing assistance, provide security services and cloud-based data storage, host and manage our Site and assist with other IT-related functions, provide analytics information, provide legal, insurance, financial and accounting services, and host conferencing services. |
Financial information |
Service providers (i.e., vendors) that we retain to undertake the following activities: manage the Personal Data, provide security services and cloud-based data storage, host and manage our Site and assist with other IT-related functions, and provide legal, insurance, financial and accounting services. |
Medical information/ Health data such as health condition or status, disease, or diagnosis |
Service providers (i.e., vendors) that we retain to undertake the following activities: manage the Personal Data, facilitate email communications, support our clinical trials, manage patient advocacy and support programs, provide advertising and marketing assistance, provide security services and cloud-based data storage, host and manage our Site and assist with other IT-related functions, provide analytics information, and provide legal services. |
Internet and other electronic activity information |
Service providers we retain to undertake the following activities: provide our wireless network, provide advertising and marketing assistance, provide security services and cloud-based data storage, host and manage our Site and assist with other IT-related functions, and provide analytics information. |
Characteristics of protected classifications |
Service providers that we retain to undertake the following activities: manage the Personal Data, facilitate email communications, support our clinical trials, manage patient advocacy and support programs, process job applications, new hire onboarding, and provide legal services. |
Professional or employment-related information, educational information, and data related to criminal convictions and offenses |
Service providers that we retain to undertake the following activities: provide recruiting services, process job applications, new hire onboarding, undertake background checks and other screening services for job applicants, provide security services and cloud-based data storage, host and manage our Site and assist with other IT-related functions, and provide analytics information. |
We also disclose your Personal Data as required or permitted by law to comply with a subpoena or similar legal process or government request, or when we believe in good faith that disclosure is legally required or otherwise necessary to protect our rights and property or the rights, property or safety of others, including to law enforcement agencies, and judicial and regulatory authorities. We also disclose your Personal Data with third parties to help detect and protect against fraud or data security vulnerabilities. And we may transfer your Personal Data to a third party in the event of a sale, merger, reorganization of our entity or other restructuring.
SALE OR SHARING (FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING) OF PERSONAL DATA
In the last 12 months, depending on the relationship we have with you, we may have disclosed your Personal Data in ways that could be deemed a “sale” for purposes of the CCPA and we may have shared the following categories of Personal Data for cross-context behavioral advertising with the categories of third parties listed below:
Categories of Consumers’ Personal Data |
Categories of Third Parties To Whom the Personal Data was Sold or Shared |
Purpose for Selling or Sharing the Personal Data |
Personal identifiers | Service providers that we retain to provide advertising and marketing assistance, such as advertising agencies and other third-party ad-tech providers. | To market and advertise Arcus and our clinical trials, as well as any future marketing of products and services |
Medical information | Service providers that we retain to provide advertising and marketing assistance, such as advertising agencies and other third-party ad-tech providers. | To market and advertise Arcus and our clinical trials, as well as any future marketing of products and services |
Internet and other electronic activity information | Service providers that we retain to provide advertising and marketing assistance, such as advertising agencies and other third-party ad-tech providers. | To market and advertise Arcus and our clinical trials, as well as any future marketing of products and services |
Professional or employment-related information | Service providers that we retain to provide advertising and marketing assistance, such as advertising agencies and other third-party ad-tech providers. | To market and advertise Arcus and our clinical trials, as well as any future marketing of products and services |
We may allow certain service providers to place tracking technologies, such as targeting cookies or social media cookies, on our Site. These service providers track your online activity for the purposes of delivering advertisements about our business and clinical trials and other businesses on other websites you visit. You can change your cookie preferences through the cookie banner, where you have the option of opting-in to or opting-out of the use of non-essential cookies on your device. On our Site, you can also update your cookie preferences at all times by clicking on the blue shield in the bottom left-hand corner of your screen link which is included at the bottom of the Site. To learn more, please consult our Cookies Policy here.
We do not have actual knowledge that we sell or share the Personal Data of minors under 16 years of age.
For purposes of Nevada’s Consumer Health Data Privacy Law, we do not allow third parties to collect your Health data over time and across different internet websites or online services when you use our Site.
YOUR RIGHTS IF YOU ARE IN THE EEA/UK
If you are in the EEA/UK, you have a number of rights over the Personal Data which we process about you which may be subject to limitations and/or restrictions. These include the right to:
(a) request access to and rectification or erasure of your Personal Data;
(b) obtain restriction of processing or to object to the processing of your Personal Data; and
(c) ask for a copy of your Personal Data to be provided to you, or a third party, in a digital format.
To submit a request for any of the above, you may contact us at [email protected] or use this form. You also have the right to lodge a complaint about the processing of your Personal Data with the competent data protection authority.
YOUR RIGHTS IF YOU ARE A CALIFORNIA RESIDENT
If you are a California resident, you may have separate rights regarding your Personal Data, in accordance with California law.
California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020
The CCPA grants California residents certain rights with respect to their Personal Data, including, as described below, the right to know about, delete, and correct their Personal Data and the right to opt-out of the sale or sharing of your Personal Data. Where exceptions to the CCPA apply to a request you submit, we will provide you with an explanation. California residents should be aware of the following information about these rights:
Right to request disclosure of information we collect or share about you. You can submit a request to us for the following data regarding the Personal Data we have collected about you in the 12 months prior to our receipt of your request (a “request to know”):
Right to request the deletion of Personal Data we have collected from you. Upon request, we will delete the Personal Data we have collected about you, except for situations where specific information is necessary for us to provide you with a product or service that you requested; perform a contract we entered into with you; maintain the functionality or security of our systems; or comply with or exercise rights provided by the law.
The law also permits us to retain specific information for our exclusively internal use, but only in ways that are compatible with the context in which you provided the information to us or that are reasonably aligned with your expectations based on your relationship with us.
Right to request the correction of inaccurate Personal Data we have collected from you. Upon request, we will correct, if appropriate, the Personal Data we have collected about you that you have identified as inaccurate.
How can you make a request to exercise your rights? To submit requests to know, delete, or correct, you may contact us at [email protected] or through our toll-free number, 1-888-914-9661, PIN 149825, or this form.
Right to opt-out of the sale or sharing of Personal Data. You have the right to opt-out of the sale and sharing of your Personal Data. To opt-out of the sale or sharing of your Personal Data, you can update your cookie preferences by clicking on the blue shield in the bottom left-hand corner of your screen link which is included at the bottom of the Site, visit “DO NOT SELL/SHARE MY PERSONAL INFORMATION,” contact us at [email protected], or call us at 1-888-914-9661, PIN 149825. You may also find our Notice of Right to Opt-out of Sale/Sharing by visiting the “DO NOT SELL/SHARE MY PERSONAL INFORMATION” form.
You may also opt out by sending an opt-out preference signal, specifically the Global Privacy Control (GPC) signal which is a browser setting that notifies us that you are opting-out of the sale or sharing of your Personal Data. To download and use a browser supporting the GPC browser signal, click here: https://globalprivacycontrol.org/. If you choose to use the GPC signal, you will need to turn it on for each supported browser or browser extension you use.
How we will handle a request to exercise your rights. For requests to know, delete, or correct inaccurate Personal Data, we will first acknowledge receipt of the request within 10 business days of receipt of your request. We will provide a substantive response to your request within 45 days from receipt of your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we’ll let you know.
When you make a request to know, delete, or correct your Personal Data, we will take steps to verify your identity. These steps may include asking you for Personal Data, such as your name, address, or other information we maintain about you. If we are unable to verify your identity with the degree of certainty required, we will not be able to respond to the request. We will notify you to explain the basis of the denial.
You are also entitled to submit a request for Personal Data that could be associated with a household as defined in the CCPA. To submit a request to know, delete, or correct household Personal Data, such requests must be jointly made by each member of the household, and we will individually verify all of the members of the household using the verification criteria explained above, and separately verify that each household member making the request currently resides in the household. If we are unable to verify the identity of each household member with the degree of certainty required, we will not be able to respond to the request. We will notify you to explain the basis of our denial.
You may also designate an authorized agent to submit requests on your behalf. If you do so, you will be required to verify your identity by providing us with certain Personal Data as described above. Additionally, we will also require that you provide the agent with written and signed permission to act on your behalf, and we will separately confirm with you that you provided the agent with permission to submit the request. We will deny the request if the agent is unable to submit proof to us that you have authorized them to act on your behalf or if any of the above verification criteria are not met.
We are committed to honoring your rights. If you exercise any of the CCPA rights explained in this Privacy Policy, we will continue to treat you fairly.
Shine the Light Law
California’s “Shine the Light” law, Civil Code section 1798.83, requires certain businesses to respond to requests from California residents asking about the business’ practices related to disclosing certain types of Personal Data to third parties for the third parties’ direct marketing purposes. We do not disclose Personal Data to such entities, for such purposes.
YOUR RIGHTS IF YOU ARE A NEVADA RESIDENT
If you are a Nevada resident, you may have separate rights regarding your Personal Data in accordance with Senate Bill 370, Nevada’s Consumer Health Data Privacy Law. Where exceptions to the Nevada Consumer Health Data Privacy Law apply to a request you submit, we will provide you with an explanation.
Nevada’s Consumer Health Data Privacy Law provides Nevada residents with the following rights:
To submit a request for any of the above, you may contact us at [email protected] or through this form.
Right to op-out of sale of Personal Data. Nevada residents have the right to opt-out of the sale of Personal Data in accordance with Nevada law. We do not sell Personal Data within the meaning of Nevada law.
YOUR RIGHTS IF YOU ARE A TEXAS RESIDENT
If you are a Texas resident, you may have separate rights regarding your Personal Data in accordance with the Texas Data Privacy and Security Act. To submit a request to exercise your rights, you may contact us at [email protected] or through this form. Where exceptions to the Texas Data Privacy and Security Act apply to a request you submit, we will provide you with an explanation. You may appeal our decision with regard to your request by contacting us at [email protected].
DO NOT TRACK
“Do Not Track” is a privacy preference that users can set in certain web browsers. We do not respond to browser do not track signals at this time.
For California residents, we do recognize Global Privacy Control signals which is a browser setting that notifies us that you are opting-out of the sale or sharing of your Personal Data.
INTERNATIONAL DATA TRANSFERS
The Personal Data that has been collected from you will be processed in the United States, where we are located. Your Personal Data may also be transferred to service providers some of which may be located in countries outside the EEA and/or UK and which are not considered to provide an adequate level of data protection.
Your Personal Data will only be transferred from the EEA/UK to a recipient in a country which is not considered to provide an adequate level of data protection when the transfer is in compliance with applicable data protection law requirements including the GDPR.
HOW LONG WE RETAIN PERSONAL DATA
We only retain your Personal Data as long as is necessary to fulfill the purposes for which we collected it. To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements. In exceptional cases (e.g., in pending litigation matters or where the law requires us to) your Personal Data may need to be kept for longer periods of time.
HOW WE PROTECT YOUR PERSONAL DATA
We are committed to protecting the security and privacy of your Personal Data. We maintain reasonable security measures to protect the security, confidentiality, and integrity of Personal Data. While we are committed to safeguarding your Personal Data through our information security program, even the most stringent security program may not be able to prevent all security breaches.
OTHER WEBSITES
Our Site provides links to other websites. These websites may operate independently from us and may have their own privacy notices or policies, which we advise you to review. To the extent any linked websites or apps are not owned or controlled by us, we are not responsible for their content.
PERSONAL DATA OF MINORS
Our products and services are not directed to minors under the age of 13. We do not knowingly collect, sell, or share the Personal Data of minors under 16.
CHANGES TO THIS POLICY
We will review and update this Privacy Policy as required to keep current with rules and regulations, new technologies and security standards. We will post those changes on the website or update the “last updated” date of the Privacy Policy. In certain cases and if the changes are material, you will be notified via email or a notice on our website.
ACCESSIBILITY
We are committed to ensuring that our communications are accessible to people with disabilities. To make accessibility-related requests or report barriers, please contact us at [email protected].
HOW TO CONTACT US
If you wish to contact us about this Privacy Policy: