Last Updated: December 10, 2018
Our Privacy Statement
Your privacy is important to us at Five Prime Therapeutics, Inc. (“FivePrime”, “we” or “us”). To underscore our commitment to the safeguarding and secure handling of your personal data (which we may also refer to as your “personal information” or “information”), FivePrime has established a privacy program designed to protect the privacy rights of individuals whose personal data we may collect, receive or otherwise process during the course of our business operations.
FivePrime is committed to complying with all national, state and local privacy laws, rules and regulations that apply to FivePrime’s collection and processing of personal data (“Applicable Laws”), and we have designed our privacy program to allow us to comply with such Applicable Laws. FivePrime uses a self-assessment approach to monitor compliance with this Policy and will periodically review this Policy to ensure that it is accurate, comprehensive, prominently displayed and accessible, properly implemented, and in compliance with Applicable Laws.
Please review this Policy closely. If you do not agree with the terms of this Policy, please do not engage with any aspect of our business or access or use any FivePrime Sites (as defined below).
Types of Personal Information We Collect
Depending on how you are interacting with us and in what context, we may collect or otherwise receive different types of information from you.
FivePrime’s or its Partners’ Clinical Trials
If you are screened for or participate in one of FivePrime’s or our partners’ clinical trials, we will collect different types of information from you as required to conduct the trial for its intended purpose. This information may include sensitive personal information about you, including biological, medical and health information.
Potential and Actual Employment with FivePrime
If you contact us regarding potential employment with FivePrime, or apply for employment with FivePrime, we will collect certain information from you as necessary to enable us to contact you, interview you, and consider you for employment. FivePrime may obtain this information through various channels, including when you view certain open positions within the careers section of FivePrime’s main webpage. The information we collect may include your contact information (including full name, phone number, mailing address and email address), information obtained from social media accounts that are linked to any third party services that we use in our recruiting processes, your interest in a particular FivePrime job posting, information regarding your employment history, and, with your consent, information obtained from running a criminal background check.
If you are an employee of FivePrime, we may collect additional information about you as necessary to fulfill the employment relationship and for business management purposes.
If you interact with FivePrime through one or more websites owned or operated by FivePrime (each, a “FivePrime Site”), we may collect information that you voluntarily submit to us through such FivePrime Sites, including, for example, contact information to receive information regarding FivePrime or its clinical trials. The FivePrime Sites may also employ various technologies that collect certain information, as further described in this Policy.
Other FivePrime Business Operations
If you interact with FivePrime through any other method or channel, the information we collect from you will depend on the nature and purpose of the interaction, and may include the following types of information:
- Contact information for individuals working at third parties with whom we interact in the ordinary course of business, including contractors, consultants, vendors, business partners, collaborators, and clinical trial sites; and
- Information required for payment to contractors and consultants with whom we contract in the ordinary course of business.
Legal Basis for Processing Information
We may process your personal information where you have voluntarily provided such information to us and where we have obtained your express consent to process such information for one or more specified purposes. If you have provided consent, you may have the right to withdraw your consent. However, please note that withdrawal of your consent will not affect FivePrime’s right to process your personal data based on consent before you withdrew such consent. Additionally, FivePrime may otherwise have the right, under Applicable Law, to preserve or to continue using your personal data after you withdraw your consent, including based on the legal grounds described below. To learn more about making a request to withdraw your consent to processing in a particular case, please contact FivePrime’s DPO at firstname.lastname@example.org.
In the absence of your express consent, there may be other legal grounds on which FivePrime may process your personal information, including the following:
- Contract: the processing of your personal data is necessary for the performance of a contract between you and FivePrime (or between you and one of FivePrime’s affiliates, vendors, business partners or third-party administrators).
- Legal obligation: the processing is necessary, or legally required, in order to establish, exercise or defend legal claims; or the transfer or processing is required in order to comply with certain Applicable Laws.
- Vital interests: the processing is necessary to protect your vital interests or those of another individual.
- Public task: the processing is necessary to perform a task in the public interest or for an official function, and such task or function has a clear basis in law.
- Legitimate interests: the processing is necessary for FivePrime’s legitimate interests or the legitimate interests of a third party, unless the need to protect your personal data overrides those legitimate interests.
How We Use Your Information
We may undertake various processing activities, both electronic and manual, with respect to your personal data based on one or more of the legal grounds identified above. These processing activities may include processing of your personal data related to the following:
- FivePrime’s or our partners’ clinical trials
- Screening of potential subjects for inclusion in FivePrime’s or our partners’ clinical trials;
- Enrollment of patients in and the conduct of such clinical trials; and
- Evaluation of data from such clinical trials.
- Potential or actual employment with FivePrime
- Evaluating applicants for employment with FivePrime;
- Facilitating the onboarding process for new employees; and
- Facilitating the employment relationship for employees, including with respect to payment and benefits.
- The operation of the FivePrime Sites
- Providing individuals with information regarding FivePrime’s business, including its clinical trials, upon request through a FivePrime Site; and
- Compiling usage and other statistical information regarding the operation of the FivePrime Sites.
- Other FivePrime business operations generally
- Responding to inquiries from individuals regarding FivePrime’s business;
- Communicating with representatives from third parties with whom FivePrime works or interacts, including pursuant to contracts between FivePrime and such third parties (such as service providers and collaborators);
- Processing payment transactions with contractors and other third-party service providers; and
- Complying with Applicable Laws.
Additional Information Regarding Collection and Processing of Personal Information for Clinical Trials
Additional information regarding FivePrime’s collection, use and processing of personal data in connection with its and its partners’ clinical trials will be provided to potential clinical trial participants before they enroll in the clinical trial. At that time, the clinical trial site will provide each potential participant with a comprehensive consent form that includes information regarding the applicable clinical trial, referred to in the US and elsewhere as an “informed consent form” or “ICF”. Each ICF or comparable document will provide information regarding FivePrime’s practices with respect to the collection, use and processing of personal information in connection with the applicable clinical trial and must be read and signed by each individual prior to participation in the clinical trial. For more information about the types of personal information FivePrime collects in the screening portion of, or during the enrollment in and conduct of, its and its partners’ clinical trials, please contact FivePrime’s DPO at email@example.com.
Disclosure of Personal Information to Third Parties
FivePrime may disclose your personal information to third parties as set forth below:
- Service Providers, Partners and Collaborators: We may disclose your personal information to service providers that we engage in relation to various aspects of our business, as well as to our research and development partners and collaborators. FivePrime takes reasonable measures, including by imposing contractual obligations and taking other assurance measures as appropriate, to ensure that these third parties comply with Applicable Laws and FivePrime’s obligations, standards and practices with respect to the protection of personal data while they perform processing activities on FivePrime’s behalf.
- Business Transactions: If FivePrime is involved in a bankruptcy, merger, acquisition, reorganization or sale of all or part of its assets, your information may be sold or transferred as part of that transaction. We will take reasonable measures to ensure that the terms of this Policy will apply to your personal data when and as it is transferred to any such new entity.
- Legal and Regulatory Requirements: FivePrime may disclose your personal information to the extent we believe such disclosure is reasonably necessary to comply with Applicable Law, to comply with any court order or government or regulatory request, or to otherwise protect or defend FivePrime’s or another party’s rights.
We do not sell your personal information to any third parties, such as marketers, without your express consent. We do not provide any personal data to "people finder," "public directory" or "white pages" sites.
Personal Information of Children and Minors
FivePrime does not knowingly collect data from or about anyone under the age of 16 without seeking appropriate parental or guardian consent. If we learn that we have collected personal data from a person under 16 without obtaining the appropriate parental or guardian consent, we will delete that information. If you believe that we might have any information from a person under the age of 16, and that we have obtained such information without appropriate parental or guardian consent, please inform FivePrime’s DPO immediately by emailing firstname.lastname@example.org.
How We Store and Secure Your Personal Information
FivePrime uses data hosting service providers located in the United States. Additionally, certain third-party service providers that we engage in the ordinary course of business may store data or otherwise use data hosting service providers outside of the United States. We use appropriate technical and organizational measures, including administrative, physical, and technical safeguards, to protect the personal data we collect, store and otherwise process. These measures, such as encryption of personal data while in transit, are designed to protect personal data against loss or theft, as well as unauthorized access, disclosure, copying, use or modification. While we design, implement and maintain these measures with the goal of completely protecting and securing personal data, we cannot guarantee that these measures will always be effective.
Our Data Retention Procedures
The length of time for which we retain your personal data is determined by the legal basis on which we collected and processed that data. However, we may retain such personal data for a longer period if necessary for FivePrime’s legitimate legal or business purposes, including: if such retention is mandated by Applicable Law or contractual or other obligations applicable to our business operations; for preserving, resolving, defending or enforcing our legal or contractual rights; or as necessary to maintain adequate and accurate business and financial records. The applicable data retention period for any particular personal data can vary significantly depending on, among other things, legal and regulatory requirements and the type of personal data at issue. Please contact FivePrime’s DPO at email@example.com for further information about FivePrime’s data retention procedures for particular records or data of interest.
Our Website Practices
This Policy describes what information is collected from visitors to the FivePrime Sites, and how that information is processed, disclosed and used. Please note that if you access a FivePrime Site from a country outside of the United States, your personal information may be transferred across international borders.
We are committed to protecting and securing personal information obtained from visitors to the FivePrime Sites. If we collect any personal data about you in connection with your use of a FivePrime Site, we will use that information in accordance with this Policy.
When you visit the FivePrime Sites, there are multiple ways in which we may collect or have access to your personal information, including the following:
- Our logging practices may capture your IP address and other information.
- We may deploy one or more “cookies” on your computer or device or use other technologies within the FivePrime Sites.
- You may voluntarily provide us with information via open text boxes or submissions.
- If you access certain pages within the careers section of FivePrime’s main webpage, we may collect information regarding the job descriptions you have viewed and may collect information in connection with jobs to which you apply.
Certain of these activities are described in additional detail below.
Our Logging Practices
Web servers that manage certain FivePrime Sites may automatically record the Internet Protocol (“IP”) addresses of visitors to FivePrime Sites. An IP address is a unique number assigned to every computer on the internet. Generally, an IP address changes each time a person connects to the internet (making it a "dynamic" address). However, with certain broadband internet connections, the IP address does not change (making it a “static” address), and that IP address is associated with a specific person’s personal computer. In such cases, the IP address that the server collects may be personal data that is identifiable to a particular individual.
Web servers that operate the FivePrime Sites may also capture and store information that a user’s browser transmits to these FivePrime Sites. This information may include:
- Browser type/version;
- Operating system used;
- Type of device used;
- Media Access Control (MAC) address;
- Screen resolution; and
- Date and time of the server request.
FivePrime uses the information described above only for statistical purposes to find out which pages users find most useful and access most often and to improve and optimize the FivePrime Sites. FivePrime does not use this information to identify any particular individual that has accessed the FivePrime Sites or to deduce any personal information about individuals that have accessed the FivePrime Sites.
Session-based cookies last only for the duration of a visitor’s session on the applicable FivePrime Site. These cookies keep track of user sessions in order to balance the usage of the various FivePrime Sites on the applicable web servers. These cookies are not tied to a specific identifiable individual, and FivePrime does not store any identifiable personal information based on these cookies.
Persistent cookies provide information to FivePrime that enables FivePrime to recognize repeat users and facilitate user access to and use of the applicable FivePrime Site. Unlike session-based cookies, persistent cookies remain on a user’s hard drive, provide information about the user’s current session and wait for the next time that the user accesses the same FivePrime Site. Persistent cookies allow the FivePrime Sites to track user behavior, which helps FivePrime determine what improvements should be made to the content of the FivePrime Site. The FivePrime Sites may use persistent cookies, depending upon the “cookie consent” settings chosen when a user first visits the relevant FivePrime Site. FivePrime does not use persistent cookies to identify users or to track their usage across other websites.
Use of Other Technologies
FivePrime may use standard Internet technologies, such as web beacons (also called "clear GIFs" or "pixel tags") or locally stored objects (often referred to as "flash cookies"), to deliver or communicate with cookies and track use of the FivePrime Sites and content presented. FivePrime also uses various technologies, tools and information services, such as Google Analytics, that facilitate the establishment and maintenance of the FivePrime Sites.
Note Regarding Links to Other Websites
While the FivePrime Sites may contain links to websites operated by third parties, please note that we do not control the content, functionality or any other aspects of those websites and cannot be responsible for the protection and privacy of any information that you provide or that is collected from you when you visit such websites. Such websites are not governed by this Policy. We encourage you to exercise caution and carefully review any privacy statement or policy applicable to any third-party websites that you may access from the FivePrime Sites.
Data Subject Rights
In addition to an individual’s right to withdraw his or her consent to the processing of his or her personal information, as described under the heading “Legal Basis for Processing Information,” where required by Applicable Law and upon request, FivePrime recognizes and will respond to the following rights of individuals with respect to their personal information:
- The right to access personal information that FivePrime holds about them under certain circumstances. Where those circumstances exist, FivePrime will comply with Applicable Law in providing individuals with access to such information, including details regarding our processing of that information.
- The right to be informed about the collection, use and other processing of their personal data at or following the time the personal data is collected, including being informed regarding the purpose of processing such personal data, retention periods for such personal data, and with whom such personal data will be shared.
- The right to request correction of errors or inaccuracies in personal data that FivePrime holds about them under certain circumstances. In the event of any such error or inaccuracy that is brought to FivePrime’s attention, we may ask the affected individual to provide information or documentation in order to identify which of FivePrime’s records contain the incorrect information. We will take steps to correct such errors within the time periods required by Applicable Law and will take reasonable steps notify the affected individual once the correction has been completed.
- The right to request erasure of their personal data held by FivePrime under certain circumstances. Where those circumstances exist, FivePrime will comply with Applicable Law in erasing such information.
- The right to request that FivePrime restrict the processing of their personal data held by FivePrime under certain circumstances. Where those circumstances exist, FivePrime will comply with Applicable Law in restricting the processing of such information.
- The right to request to obtain a copy of their personal data held by FivePrime under certain circumstances. Where those circumstances exist, FivePrime will comply with Applicable Law in providing such information in a safe and secure way, without hindrance to usability.
- The right to object to the processing of personal data held by FivePrime under certain circumstances. Where those circumstances exist, FivePrime will comply with Applicable Law to adequately respond and remedy the relevant processing activities based on the objection.
- The right to oppose automated decision-making under certain circumstances. FivePrime generally does not render any automated decisions that affect individuals. In those exceptional cases in which FivePrime does render automated decisions, FivePrime will notify the affected individuals about the occurrence and such individuals will be allowed to comment on the relevant decision. If an individual comments on or otherwise disputes such a decision, FivePrime will review the decision again.
In certain circumstances, if you maintain an account within a FivePrime Site (including, for example, an account that allows you to submit an employment application to FivePrime through the careers section of its main webpage), you may be able to take certain actions with respect to your personal data on your own, as permitted by the functionality of the FivePrime Site. For example, you may be able to correct, amend, or delete certain personal data, including by deleting the account entirely.
Procedure for Exercising Data Subject Rights
Upon receipt of a request from an individual exercising his or her rights with respect to personal data, FivePrime will seek to confirm the identity of the individual making such request. FivePrime will generally respond to such requests within 30 days after receipt of the request, or otherwise in accordance with Applicable Law. If you wish to make such a request, please make such request in writing and include the following information:
- Your full name, US postal mailing address and email address;
- Your daytime telephone number;
- Names of specific files or types of records relevant to your request, including specific dates of those records, where possible; and
- Any additional details that would assist FivePrime in responding to your request.
All written requests should be submitted by US postal mail or by email to:
Five Prime Therapeutics, Inc.
Attention: Data Protection Officer
111 Oyster Point Boulevard
South San Francisco, CA 94080
Attention: Data Protection Officer
In general, FivePrime will not charge a fee for responding to data subject requests, unless the request requires significant time or expense by FivePrime personnel, in which case FivePrime reserves the right, in compliance with Applicable Law, to charge a reasonable fee for responding to such requests. FivePrime’s DPO will review each request to determine whether FivePrime will comply with the request. FivePrime will notify you once it has made such a determination, including whether any exemptions apply to FivePrime’s obligation to comply with your request.
Review and Ratification of this Policy
FivePrime reserves the right to change this Policy from time to time. We recommend that you periodically review this Policy, a link to which is available on FivePrime’s main webpage, so that you are informed of any such changes. Your continued use of any FivePrime Site constitutes your agreement to this Policy, including any future updates to this Policy.
If you have questions regarding how FivePrime collects, uses or otherwise processes personal information, or if you believe that we are not abiding by this Policy, you may contact FivePrime’s DPO by postal mail or electronic mail at the following addresses:
Five Prime Therapeutics, Inc.
Attention: Data Protection Officer
111 Oyster Point Boulevard
South San Francisco, CA 94080
Attention: Data Protection Officer