Latest revision of 07 November 2024

MILESTONE ONE (“MILESTONE ONE” “we”), is a global site support organization that aims to improve patient services and supports sites in their clinical trial delivery.

We will need to collect and use information about your professional qualifications and other personal data to ensure that your engagement with us is administered in compliance with the laws and MILESTONE ONE’s legitimate business interests. MILESTONE ONE will act as a data controller responsible to ensure that your personal data are processed in compliance with the applicable data protection laws and policies of MILESTONE ONE.

This Data Protection Notice (this “Notice”) explains how MILESTONE ONE collects, uses, stores, and shares your personal data.

---

Which of your personal data Milestone One needs to collect

Personal data that we may need to process about you may relate to the following categories:

Contact:
Name, e-mail address, phone number, position, department, business location, etc.

Qualification:
Eeducation, work experience, language skills, CV, former employment, certificates, licenses, professional membership, awards, publications, professional opinions, advice, consultation, etc.

Passport and business travel:
Date of birth, gender, birth country, birth city, national ID type, national ID, citizenship status, citizenship country, nationality, travel details, national and international passport, visa applications, visa details, etc.

User data:
Data required to provide you with access to company computer systems and networks, e.g., IP address, user password, user login name IDs assigned in the system, etc.

These are a few examples of the data that we process. You can request the complete list of processed via sending your request at privacy@milestoneone.com.

---

Which of your personal data Milestone One needs to collect

MILESTONE ONE will process your personal data to ensure that we meet our respective contractual obligations in accordance with the service agreement that you entered into with us. The legal basis for this processing is the execution and fulfilment of the above referenced service contract.

In some specific cases, we will reach out for your consent to data processing. For instance, when we would like to share photographs picturing you and taken at a business or other related event via MILESTONE ONE’s public media accounts.

MILESTONE ONE has the legitimate interest to use your personal data for a number of purposes. Some examples of such processing purposes are provided below.

• Engaging you to provide services related to MILESTONE ONE’S business activities as a global site support organization, including related to a clinical project/study or for general activities necessary for supporting the medical institution (site) and managing your engagement related thereto and other projects in accordance with the services contract.
• We will need to use your data to arrange project-related and corporate trainings as appropriate for the services that you deliver to MILESTONE ONE.
• In order to ensure appropriate security, MILESTONE ONE may need to monitor the activity of the users on the corporate network and other corporate resources, including e-mail and access to the internet.
• We are constantly working to improve our internal business processes, for which we might need to have an overview of information about our service providers

MILESTONE ONE may need to share photographs picturing you and taken at business-related events via MILESTONE ONE public media accounts. For such specific data uses, we will reach out for your consent, in which case your consent will be the legal basis for the processing of your personal data by MILESTONE ONE.

You can request the complete list of activities and respective legal basis for data processing via sending your request at privacy@milestoneone.com.

---

Who will access your personal data

Personnel of MILESTONE ONE:
As MILESTONE ONE is a global company with worldwide presence, we need to share information, including personal information of our contractors, within MILESTONE ONE, to manage our business operations and comply with the applicable laws. This means that all MILESTONE ONE staff may have access to your intranet business profile and/or personnel rosters, as well as to other personal data as needed to enable them to carry out their job responsibilities.

Site personnel:
When your job responsibilities require you to work as a member of clinical trial site team or/and support the medical site for any of their activities, MILESTONE ONE will share your contact data, information about your professional qualifications and other relevant personal data with the site personnel.

Sponsors, CROs:
When your job responsibilities require you to work as a member of a site team for different clinical studies, MILESTONE ONE will share your contact data, information about your professional qualifications and other relevant personal data with the study sponsors and CROs involved in the study.

Authorities:
When we collect information for some of the purposes, we may do so in response to a statutory requirement. In such cases, to comply with the law, we will have to share your data with the authorities. In addition, regulatory authorities will have access to your personal information when these data make part of the study file. There may be other cases when disclosure of your data will be required. We will follow the applicable laws in this regard.

When the parties with whom we need to share your data are located abroad, information about you will need to be sent or/and accessed from abroad, including to/from countries where the personal data protection laws may be less strict as compared to the countries of the European Economic Area, Switzerland, and the UK. When MILESTONE ONE shares your data with such entities, we ensure that these external recipients, regardless of their location, commit to protect your personal information. We implement technical and organizational measures to safeguard your data. Such efforts include technical and organizational measures, as well as certain contractual protections to safeguard your personal data. You can ask MILESTONE ONE to tell you more about these safeguards, including a review of any applicable protective measures.

---

How long your personal data will be kept

MILESTONE ONE will retain your personal data for as long as the services agreement is in force. After the termination of the agreement, we may keep your data during the legally established timeframes and to comply with the legal obligations to which MILESTONE ONE is subject.

When you are engaged in a study as a site team member or you support the site in the general activities of the site, some of your personal data contained in your CV(s), study-related communication, etc., may be retained as part of the study file or/and of internal systems of the site acting as data controllers in accordance with the laws applicable to clinical trials.

---

How to exercise your rights regarding your personal data

You have the right to request access to, rectification or erasure of your personal data, restriction of processing, as well as object to processing in some cases. You can request a digital copy of the personal data that you provided to MILESTONE ONE. You can also withdraw your consent to processing for some purposes, if you initially consented to have your data processed, however please note that in such case the use of your data before you changed your mind, remains lawful.

You may ask for more information, request execution of your rights and send any other enquiries at privacy@milestoneone.com.

If you are based in the EU and UK, you have the right to lodge a complaint to the competent supervisory authority. You may find a list of the EU national data protection authorities and their contact details at https://edpb.europa.eu/about-edpb/board/members_en, and contact the UK Information Commissioner’s Office at https://ico.org.uk/make-a-complaint.

If you are a resident of California, please read PSI’s California-Specific Description of Privacy Rights.

---

How to exercise your rights regarding your personal data

MILESTONE ONE reserves the right to modify this Notice as needed to reflect changes in laws, MILESTONE ONE’s practices and procedures, or requirements imposed by data protection authorities. If changes occur, MILESTONE ONE will notify you of the changes to this Notice that can have an impact on your obligations and rights.