Milestone One Employee Spotlight Privacy Policy

Milestone One (“MO1”) is launching the Milestone One Employee Spotlight project (the “Project”), a voluntary spotlight project designed to highlight members of the Milestone One team and their experiences, contributions, collaboration, and impact of their work.

Spotlight stories will be published on the Milestone One website and shared through Milestone One social media channels. Each feature may include a team member profile and a photograph of the employee.

Participation is voluntary. There will be no adverse consequence if you choose not to participate. This notice supplements, and does not replace, the employee privacy notice applicable to your work location.

1. Controller
The controller responsible for the processing of your personal data in connection with the Project is the Milestone One AG, Baarerstrasse 113a, 6300 Zug, Switzerland, together with its affiliates. Contact: privacy@milestoneone.com

2. Data Categories and Legal Basis
2.1 MO1 processes the following personal data in connection with the Project:

• your name, job title, department, and work location, to identify you as the contributor and, where approved, to attribute the story to you;
• the content of the story you submit, to collect, review, edit, select, or reject the story for the Project; and
• a photograph, if you choose to submit one, to accompany your story.

2.2 When you share you story with us, please avoid naming trial participants, doctors or sponsors, and please do not mention particular studies. We would like to encourage you to help us respect confidentiality of other people, even if we want to share positive experience. Please share your experience in a generic way.

2.3 Legal basis. The legal basis for processing your personal data is your explicit consent. In the EU and Switzerland, this is pursuant to Art. 6(1)(a) GDPR. For sensitive personal data voluntarily included in your story, the legal basis is your explicit consent pursuant to Art. 9(2)(a) GDPR or the corresponding provision under applicable local data protection law.

2.4 MO1 may also process limited personal data based on MO1’s obligations to comply with a law e.g., for recordkeeping, legal review, or the establishment, exercise, or defence of legal claims.

3. Purposes of Processing
MO1 needs to process your personal data (identification, images and interview answers) to create stories for the Project and share these stories with the target audience. If we select your story for public posting, MO1 will request your approval of the final version before such publication.

4. Recipients
Depending on the consents you provide, your story may be shared with group companies (including PSI CRO AG and its affiliates), its and their colleagues, investigators, site staff, sponsors, printing agencies, design companies, communications service providers hosting interviews on their online platforms used for the Project, and persons accessing Project content via MO1’s website and social media channels (“Recipients”).

5. International Transfers
MO1 is a global organisation. Your personal data may be accessed by entities and persons in countries other than your own. Where MO1 shares your personal data with Recipients who are outside the EEA, the UK, Switzerland, or your country of residence, MO1 will ensure that appropriate safeguards are in place in accordance with applicable data protection law, including standard contractual clauses or equivalent mechanisms where required. You should know that if people read or listen to your story published on MO1’s website and where such people access your data from abroad, MO1 will not have control over how they use your data.

6. Data Security
MO1 implements appropriate technical and organisational measures to protect your personal data, including access controls and contractual protections with service providers. Access to Project submissions is restricted to authorised MO1 personnel involved in the administration and review of the Project.

7. Retention
Published stories will be retained for the duration of the Project and related publication cycles. Consent records will be retained for as long as necessary to demonstrate compliance with applicable data protection law.

8. Your Rights
You have the right to access, rectify, erase, restrict, port, or object to the processing of your personal data, to withdraw your consent at any time . To exercise any right, contact privacy@milestoneone.com. MO1 will respond within the timeframe required under applicable law. You can also lodge a complaint with your local data protection authority. If you are in the EU, you may find your competent authority here: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.