Privacy

We respect the privacy of visitors to our website. This Website Privacy Notice for the Bicycle Therapeutics group sets out the categories of your personal data we collect, how we collect it, what we use it for and with whom we share it in the context of providing this Site.

This Privacy Notice is intended to meet our duties of transparency under applicable data protection legislation, including the General Data Protection Regulation (EU) 2016/679 as it forms part of United Kingdom law by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as subsequently amended (the “UK GDPR”). Please read the following carefully to understand our practices regarding your personal data.

By personal data we mean any information relating to you such as your name, contact details. Personal data does not include data which has been anonymised, such as data from equal opportunities monitoring carried out on an anonymised basis.

BicycleTx Limited will be the data controller in respect of the processing of any personal data collected through the website except if such personal data is being collected in association with an application for a job based in the USA, in which case Bicycle Therapeutics, Inc. will be the data controller. In this Privacy Notice, “Bicycle”, “we”, “us” or “our” refers to BicycleTX Limited or Bicycle Therapeutics, Inc. dependent on which organization is the data controller. The data controller is responsible for deciding how personal data about you is used.

Should you have any questions about this Privacy Notice you can contact us by sending an email to privacy@bicycletx.com or write to us at:

BicycleTX Limited; Attention: General Counsel
Blocks A & B Portway Building
Granta Park
Great Abington
Cambridge CB21 6GS

Bicycle Therapeutics Inc; Attention: Office Manager
35 Cambridgepark Drive
Suite 350
Cambridge, MA 02140
USA

This Privacy Notice applies to personal data about you that we collect, use and otherwise process in connection with the use of our website, including applications via the website for job openings. We do not require you to provide any special categories of personal data (as defined below) and we would recommend that you do not include any additional special categories of personal data when you contact us via the website or apply for a job opening. Should your application meet our criteria for inclusion in our recruitment process, we shall send an additional Recruitment Candidate Privacy Notice that covers our recruitment, offer and on-boarding processes and how your personal data shall be collected, used and otherwise processed during these processes including any special categories of personal data that may be collected during such processes.

Bicycle Therapeutics, Inc’s UK representative under the UK GDPR is BicycleTX Limited. You can contact them by email and/or postal mail by using the contact details provided above.

We set out below the types of personal data about you which we may collect or create via your interaction with the website. In each case we have specified the purpose for which we use the relevant personal data and our ‘lawful basis’ for processing it. The law specifies certain ‘lawful bases’ for which we are allowed to use your personal data. Most commonly, we will rely on one or more of the following lawful bases for processing your personal data:

• you have given your consentto the processing in question for a specific purpose;
• where it is necessary for the performance of the contract;
• where it is necessary for compliance with a legal obligationto which we are subject; and/or
• where it is necessary for the purposes of the legitimate interestspursued by us or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of our recruitment candidates, which require their protection.

Where relevant, we have considered whether the interests or fundamental rights and freedoms of the individuals interacting with our website override our legitimate interests and have formed the view that they do not.

We will collect and process certain information about you that you provide to us and certain information we collect ourselves.

Information you give us

Responding to enquiries

If you contact us and choose to provide personal data, such as your name, address, telephone number or e-mail address, we may use that information in order to respond to your correspondence or address the matters raised by you. It is for you to decide what personal data you provide.

The legal basis for processing this information is that it is necessary for the purposes of legitimate interests pursued by us, namely our interest in receiving and responding to correspondence from members of the public and addressing matters raised by members of the public.

Application for job openings and assessment process

If you choose to apply for a job opening, we may use this information in connection with assessing your application. In this regard, we process the following categories of personal data (see also the section entitled ‘Special categories of personal data’ below):

• Information we collect from you at the application stageWe collect the personal data that you provide to us in your CV or resume and covering letter. It is for you to decide what you include in these documents. However, the kinds of information you may wish to include are: name, contact details, details of your qualifications and information about your employment experience.
• Information we create ourselvesFollowing your application for a job opening, we may create personal data in connection with the assessment of your application. For example, we may record the views of those considering your application about your suitability for the role for which you have applied.

We may use your name and contact details to contact you in connection with your application, such as to invite you to undertake further assessments or to attend an interview. We have a legitimate interest in facilitating the interview process.

We may use the information we collect as part of the application and assessment process and the information that we create ourselves in connection with the assessment of your application for the purpose of assessing your suitability for the role for which you have applied. We have a legitimate interest in making informed recruitment decisions and selecting suitable candidates for roles with us.

If your application is assessed to be appropriate to enter our recruitment process, we will contact you and we will provide a Recruitment Candidate Privacy Notice that will outline the additional personal data that we will collect from you during our recruitment, offer and onboarding processes and how such data is collected and processed.

Information we collect

We use a tool called “Google Analytics” to collect information about the use of our website. Google Analytics collects information such as how often users visit the site, what pages they visit when they do so, and what other sites they used prior to coming to this site. We use the information we get from Google Analytics only to improve our website. Google Analytics collects only the IP address assigned to you on the date you visit this site, rather than your name or other identifying information. We do not combine the information collected through the use of Google Analytics with personally identifiable information.

Google Analytics uses cookies to distinguish you from other uses of our website. A “cookie” is a small file of letters and numbers that is stored on your browser or the hard drive of your computer to identify you as a unique user the next time you visit the site and to distinguish you from other users of our website. Cookies cannot read data off your hard drive but are used for site registration and identification. The Google Analytics cookies cannot be used by anyone but Google. When you open our website, you will be asked to accept the use of cookies. If you accept, you are agreeing to the use of cookies for the purposes described here. If you do not accept cookies, some pages on our website may not be able to access certain information on the website. Please note that third parties including, for example, advertising networks and providers of external services like web traffic analysis services may also use cookies, over which we have no control. You may block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. You may also opt-out by completing Google Analytics’ opt-out form accessible through this link: https://tools.google.com/dlpage/gaoptout.

Google’s ability to use and share information collected by Google Analytics about your visits to this site is restricted by the Google Analytics Terms of Use and the Google Privacy Policy.

Where the information that we collect automatically on our website is personal data, the legal basis for the processing of this information is that it is necessary for the purposes of our legitimate interests in maintaining the safe operation of our website and improving our website, as well as in learning from how users interact with our website.

There are more limited bases for processing special category personal data. This is personal data which reveals or contains:

• racial or ethnic origin
• political opinions
• religious and philosophical beliefs
• trade union membership
• genetic data
• biometric data processed for the purposes of unique identification
• health data
• sex life or sexual orientation

We request that you do not provide any special category personal data when making contact with us via the website of when applying for a job opening. If your application formally enters the recruitment process, we may collect special categories of personal data when we have a lawful basis, and can rely on an ‘article 9 condition’, for doing so and will provide additional information on this in our Recruitment Candidate Privacy Notice.

We will only use your personal data for the purposes for which we collected it (as identified above), unless we reasonably consider that we need to use it for another reason which is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case it is no longer personal data.

We may share your personal data with third parties where this is required by law, where it is necessary to perform our contract with you, or where we have another legitimate interest in doing so as outlined below:

Other members of our corporate group

We are part of a group of companies (the “Bicycle Therapeutics Group”) that includes Bicycle Therapeutics plc, BicycleTx Limited, BicycleRD Limited and Bicycle Therapeutics, Inc.

Certain functions of the Bicycle Therapeutics Group are centralised and conducted by members of the Bicycle Therapeutics Group other than us. We have a legitimate interest in benefiting from such centralisation and the services provided to us (as our data processor) by other members of the Bicycle Therapeutics Group. For example, other members of the Bicycle Therapeutics Group may assist in the recruitment process and may receive personal data in connection with such assistance.

We may also share your personal data with other entities in the Bicycle Therapeutics Group in the context of a business reorganisation or group restructuring exercise, for system maintenance support and for hosting of data.

Our service providers

We share personal data with Bicycle Therapeutics Group’s third-party service providers that perform services and functions at our direction and on our behalf. Our service providers are our IT service providers, recruitment service providers and our lawyers. We rely on service providers in order to effectively operate our business.

Analytics and search engine providers that assist us in the improvement and optimization of our website

We use a tool called “Google Analytics” as described above. Google’s ability to use and share information collected by Google Analytics about your visits to this site is restricted by the Google Analytics Terms of Use and the Google Privacy Policy.

Third party companies associated with a sale or acquisition of the business

In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets

If all or any of our group companies or substantially all of their assets are acquired by a third party, in which case personal data may be one of the transferred assets.

Other third parties

We may need to share your personal data with a regulator or to otherwise comply with applicable law or judicial process. We may disclose your personal data if we are required by law to do so or if we reasonably believe that disclosure is necessary to protect our rights and/or to comply with judicial or regulatory proceedings, a court order or another legal process. We may share your personal data where this is required by law, where it is necessary to perform our contract with you, or where we have another legitimate interest in doing so.

Certain of the parties with whom we may share your personal data (see the section immediately above) may be located outside the UK – for example, but without limitation, this will be relevant in respect of the following:

• members of our corporate group (such as Bicycle Therapeutics, Inc.);
• our third-party service providers (e.g., our recruitment service providers, investor relations service providers, and IT providers); and
• our lawyers and other advisers.

A number of the countries in which recipients of your personal data are based may be countries in respect of which there is not an adequacy decision issued by the UK Government under the UK GDPR – what this means is that the country to which we transfer your data has not been deemed to provide an adequate level of protection for your personal data for the purposes of the UK GDPR.

However, in these cases:

• we may use specific appropriate safeguards, which are designed to give personal data the same protection it has in the UK – for example, requiring the recipient of personal data to enter into the International Data Transfer Agreement issued by the UK Information Commissioner’s Office and/or the Standard Contractual Clauses approved by the European Commission; or
• in very limited circumstances, we may rely on an exception, or ‘derogation’, which permits us to transfer personal data to such country despite the absence of an ‘adequacy decision’ or ‘appropriate safeguards’ – for example, reliance on your explicit consent to that transfer.

If you want further information on the specific mechanism used by us when transferring your personal data out of the UK, please contact our Privacy Coordinator (privacy@bicycletx.com).

The Bicycle Therapeutics Group has operations in the USA and in the UK. However, whenever it is being processed within the Bicycle Therapeutics Group, all personal data you provide to us will be stored on servers, which are provided and maintained by our processors, and which are located in the UK.

If members of the Bicycle Therapeutics Group located in the USA have access to information stored on servers in the UK, this will amount to a transfer of your personal data. However, as noted above, we have put in place Standard Contractual Clauses to ensure that appropriate safeguards are in place in respect of personal data that is transferred from members of the Bicycle Therapeutics Group in the UK to members of the Bicycle Therapeutics Group outside of the UK (such as Bicycle Therapeutics, Inc. who is located in the USA).

To establish additional practical safeguards for protection of your personal data, when transferring your information outside of the UK as part of the intragroup transfers described in this section, the transfer is made using an encrypted channel.

Once we have received your information, we will use appropriate technical and organizational measures to prevent unauthorised access, disclosure, loss or damage to your personal data.

We will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting or reporting requirements.

For information that you provide through an enquiry made through the website, we will retain your personal data for no longer than 3 months after the last communication.

When applying for a job opening, if your application does not enter the recruitment process, we will retain your personal data for no longer than 12 months after receiving the information. If your application does enter the recruitment process, your data will be retained in accordance with the Recruitment Candidate Privacy Notice that will be provided to you.

In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case it is no longer personal data.

In some circumstances, we are required to retain personal data by law and to comply with our regulatory obligations. Where this is the case, we will keep such personal data in a form that identifies you only for so long as it is necessary.

Once we no longer require your personal data for the purposes for which it is processed, we will securely destroy your personal data in accordance with applicable laws and regulations and in accordance with our records retention policy.

Where the processing of your personal data is subject to the UK GDPR, you have rights as an individual which you can exercise in relation to the information we hold about you under certain circumstances. These rights are to:

• request access to your personal data (commonly known as a “data subject access request”) and request certain information in relation to its processing;
• request rectification of your personal data;
• request the erasure of your personal data;
• request the restriction of processing of your personal data;
• object to the processing of your personal data; and
• request the transfer of your personal data to another party.

Your consent to processing of your personal data may sometimes form the legal basis of our processing of your personal data. Where this is the case, you can withdraw your consent at any time (without affecting the lawfulness of processing based on consent before your withdrawal of consent).

If you want to exercise one of these rights please contact using the contact details set out below.

By email: privacy@bicycletx.com

BicycleTX Limited; Attention: General Counsel
Blocks A & B Portway Building
Granta Park
Great Abington
Cambridge CB21 6GS

Bicycle Therapeutics Inc; Attention: Office Manager
35 Cambridgepark Drive
Suite 350
Cambridge, MA 02140
USA

You also have the right to make a complaint at any time to the UK data protection regulator, the UK Information Commissioner’s Office – whose contact information is below:

The Information Commissioner’s Office
Water Lane, Wycliffe House
Wilmslow – Cheshire SK9 5AF
Tel. +44 303 123 1113
Website: https://ico.org.uk/make-a-complaint/

Fees

You will not usually have to pay a fee to access your personal data (or to exercise any of your other rights). However, we may charge a reasonable fee if your request for access is manifestly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is to ensure that personal data is not disclosed to any person who has no right to receive it.

Any changes we make to this Privacy Notice in the future will be posted on this page or a successor page we flag as relevant for the purpose.

This website is not intended for, or designed to, attract children.

Our site may, from time to time, contain links to and from the websites of our partners. If you follow a link to any of these websites, please note that these websites have their own privacy policies and terms of use and that we do not accept any responsibility or liability for these policies or terms. Please check these policies before you submit any personal data to these websites.

This Privacy Notice was written with brevity and clarity in mind and is not an exhaustive account of all aspects of our collection and use of personal data. If you require any further information about this Privacy Notice, the practices of this website, or your dealings with this website, please do not hesitate to contact us.