Privacy Policy

1. About this policy

RaptMAb Biotechnology Inc. ("RaptMAb," "we," "us," or "our") is a Canadian business-to-business provider of laboratory and analytical services to organizations in the life sciences. RaptMAb is responsible for the personal information described in this policy and acts as the data controller where that term is used by applicable law. This policy explains how we handle personal information through our website, inquiries, business communications, marketing choices, and service relationships.

This policy applies to visitors and business contacts worldwide. Sections 10, 11 and 12 provide additional information for individuals in Europe, Quebec and the United States. If a jurisdiction-specific provision conflicts with a general provision, the jurisdiction-specific provision applies to the extent required by law.

This policy does not replace confidentiality, non-disclosure, services, or data-handling terms agreed with a client. Scientific data, samples, and project materials are primarily governed by those agreements. Business contact information contained in project correspondence remains subject to this policy.

2. Personal information we collect

2.1 Information you provide

When you contact us, submit a website inquiry, request a consultation, or communicate with us about a potential or active engagement, we may collect:

• your name, business email address, telephone number, organization, and role;
• the RaptMAb service that interests you and a high-level description of your needs;
• the content of correspondence, meeting requests, proposals, and related business records; and
• billing, contracting, and project-contact details where needed for a client engagement.

Please do not submit confidential, proprietary, patient, clinical, or other sensitive scientific information through the public website form. Where confidential information is needed to evaluate or perform a project, the parties should first put an appropriate confidentiality agreement in place.

2.2 Information collected through the website

When you visit our website, we and our service providers may collect information such as browser and device type, approximate location derived from network information, referring source, pages viewed, interactions with page features, dates and times, and cookie or device identifiers. Google Analytics 4 does not log or store individual IP addresses, although network information may be processed transiently to provide functions such as approximate geolocation and security.

2.3 Information we receive from business sources

We may receive business contact information from your organization, a colleague, a professional event, a referral, or a publicly available professional source when it is reasonable and lawful to do so. We use that information only for relevant business communications and relationship management.

3. How we use personal information

We use personal information for purposes that a reasonable person would consider appropriate in the circumstances, including to:

• respond to inquiries and schedule consultations;
• assess project fit and prepare proposals, quotations, and agreements;
• communicate with client and partner contacts and deliver contracted services;
• administer invoicing, records, quality, and business operations;
• measure and improve website content, usability, and performance;
• protect our website, systems, personnel, clients, and business against misuse, fraud, and security threats; and
• meet legal, regulatory, tax, accounting, and contractual obligations.

We may send service-related communications in response to your inquiry. If you select the optional checkbox on our inquiry form, we may also send occasional scientific updates and service announcements from RaptMAb. You may unsubscribe from those communications at any time using the link in a message or by contacting us. We do not use website inquiry information for unrelated third-party marketing.

4. Cookies, analytics, and website technologies

4.1 Google Analytics

We use Google Analytics 4 (GA4) to understand website traffic and engagement. GA4 may use first-party cookies and similar identifiers to measure events such as page views, scrolling, link clicks, downloads, and form interactions.

Our GA4 property is currently configured with a 14-month retention period for user-level and event-level data. We do not currently use Google Analytics User-ID or user-provided data collection. We do not currently use Google Analytics data for Google Ads remarketing or advertising personalization. We use analytics information to understand website performance, not to identify visitors by name.

4.2 HubSpot

We use HubSpot for customer relationship management, website inquiry handling, marketing communications, and visitor analytics. Information submitted through our inquiry form is retained in both HubSpot CRM and our Supabase database. HubSpot may set cookies or similar technologies and record page visits and interactions. Depending on consent, cookie availability, and configuration, HubSpot may associate earlier or later website activity from the same browser with the contact record.

4.3 Google reCAPTCHA

Our inquiry form uses Google reCAPTCHA solely to protect the form and website against spam, automated abuse, and fraudulent activity. When you use the inquiry form, reCAPTCHA may process technical and interaction information, including IP address, device and browser information, and user interactions, and may set the _GRECAPTCHA cookie.

We classify reCAPTCHA as a necessary security technology. It is not controlled by our Cookie settings tool, and rejecting non-essential cookies does not prevent you from submitting the inquiry form. Google processes reCAPTCHA Customer Data on our behalf under the applicable Google Cloud Terms of Service, Cloud Data Processing Addendum, and reCAPTCHA Service Specific Terms.

4.4 Regional consent controls and your choices

For visitors detected in the European Economic Area (EEA), the United Kingdom, and Switzerland, our consent controls are designed to prevent GA4, HubSpot visitor analytics, and future advertising technologies from operating until the visitor grants the corresponding consent. Visitors can accept all cookies, reject non-essential cookies, or manage categories, and can later revisit their selection through the Cookie settings link in the website footer.

Google Consent Mode v2 communicates the visitor's choices to Google services. Unless the corresponding consent is granted, analytics storage, advertising storage, advertising user data, and advertising personalization are set to denied for these regions. Technologies used for security, form delivery, and recording cookie preferences are handled according to their purpose, applicable legal requirements, and the classification displayed in Cookie settings.

You can also control or delete cookies through your browser settings. Blocking cookies may affect some website functions. You may use Google's Analytics opt-out browser add-on. Geographic detection is not always accurate; therefore, the Cookie settings control remains available to all visitors through the website footer.

5. When we disclose personal information

We disclose personal information only as reasonably needed for the purposes described in this policy, including to service providers that support our website and business operations. Current core providers include:

• Vercel, for website hosting, content delivery, and related operational and security functions. Vercel may process personal information in the United States and other jurisdictions where Vercel or its authorized service providers operate;
• Supabase, for backend services and storage of website inquiries. Information submitted through our inquiry form is retained in our Supabase database and transferred to HubSpot CRM. Our primary Supabase database is hosted in the Canada Central region (ca-central-1). Supabase and its authorized subprocessors may process certain related information in other jurisdictions where necessary to provide, secure, and support the service;
• HubSpot, for customer relationship management, inquiry processing, marketing communications, and website analytics. Our HubSpot account is hosted in Canada using HubSpot's Montreal hosting location. Customer data may be replicated within the Canadian regional hosting environment for backup and disaster recovery. HubSpot, its affiliates, and authorized subprocessors may perform limited processing in other jurisdictions where necessary to provide support, analytics, security, integrations, and related services; and
• Google, for business email and collaboration services, Google Analytics, and reCAPTCHA. Google may process personal information in the United States and other jurisdictions.

We may also disclose information to professional advisers, auditors, insurers, financing parties, or transaction counterparties subject to appropriate confidentiality measures; to authorities where required or permitted by law; or where reasonably necessary to protect rights, safety, and security.

We do not sell personal information. We do not disclose personal information to third parties for their own independent marketing purposes.

6. International processing and transfers

RaptMAb is based in Canada, and our primary storage of website inquiry and customer relationship data is located in Canada, as described in Section 5. Some of our service providers, and their authorized subprocessors, may process personal information in the United States and other jurisdictions in order to provide, secure, and support their services. Information processed outside your jurisdiction may be subject to the laws of the country where it is processed and may be accessible to courts, law enforcement, or national security authorities in accordance with those laws.

RaptMAb remains accountable for personal information transferred to service providers for processing. Where applicable law requires a transfer mechanism, we use an available lawful mechanism appropriate to the transfer, which may include an adequacy decision, approved contractual clauses, or another legally recognized safeguard. Individuals may contact us for additional information about safeguards relevant to their personal information, subject to legal and confidentiality limitations.

7. How long we retain information

We retain personal information only for as long as reasonably necessary for the purposes described in this policy and to meet legal, contractual, accounting, quality, and dispute-resolution requirements. Retention periods vary by record type and context.

• Website inquiries that do not lead to a project are retained for thirty-six months from the date of the inquiry, then deleted or anonymized in both our Supabase database and our HubSpot CRM.
• Client, contracting, billing, and project records are generally retained for six years after completion or termination of the applicable engagement, unless an agreement, legal requirement, claim, or operational need supports a different period.
• GA4 user-level and event-level data is currently configured for 14 months; aggregated reports may be retained longer.
• Information may be retained longer where necessary for a legal claim, investigation, security matter, or other lawful requirement.

8. Safeguards

We use administrative, technical, and physical safeguards appropriate to the sensitivity and amount of personal information, the purposes for which it is used, and the format in which it is stored. Measures may include access controls, authentication, role-based permissions, vendor controls, secure transmission, backups, monitoring, and confidentiality obligations.

No internet transmission or storage system is completely secure. If you believe information submitted to RaptMAb may have been compromised, please contact us promptly using the details below.

We will maintain records of all breaches of security safeguards involving personal information under our control as required by applicable law. If a breach creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as required by applicable law. Where other privacy legislation applies, we will also meet its applicable documentation, reporting, and notification requirements.

9. Your privacy choices and rights

Subject to applicable law and permitted exceptions, you may ask us to:

• explain whether we hold personal information about you and how it has been used or disclosed;
• provide access to personal information we hold about you;
• correct inaccurate or incomplete personal information;
• withdraw consent where our processing depends on consent; or
• delete information that we are not required to retain.

We may need to verify your identity before responding. We may refuse or limit a request where permitted or required by law, and we will explain the reason where appropriate. Withdrawing consent does not affect processing already completed and may limit our ability to provide the requested service.

Individuals in jurisdictions that provide additional privacy rights may contact us to exercise those rights. We will assess each request under the law that applies to the circumstances.

10. Additional information for the EEA, United Kingdom, and Switzerland

10.1 Legal bases

Where the EU GDPR, UK GDPR, or corresponding Swiss requirements apply, our legal basis depends on the purpose of the processing:

• Inquiries, consultations, quotations, and proposals: steps taken at your request before a contract and our legitimate interests in evaluating and developing business relationships.
• Client services, project communications, billing, and administration: performance of a contract, steps connected with a contract, and our legitimate interests in operating our business and serving organizational clients.
• Website and information security, fraud prevention, and reCAPTCHA: our legitimate interests in protecting our website, forms, systems, and users.
• Non-essential analytics and optional marketing communications: your consent, where consent is required.
• Legal, tax, accounting, regulatory, and dispute records: compliance with legal obligations and our legitimate interests in establishing, exercising, or defending legal claims.

When we rely on legitimate interests, we consider the purpose, necessity, and potential effect on individuals. You may object to processing based on legitimate interests, although we may continue where permitted by law and supported by compelling grounds.

10.2 European privacy rights

Subject to applicable conditions and exceptions, individuals in the EEA, United Kingdom, and Switzerland may request access, correction, deletion, restriction, portability, or objection to certain processing. You may withdraw consent at any time without affecting processing completed before withdrawal, and you may object at any time to direct marketing.

You also have the right to lodge a complaint with the data protection authority in the country where you live or work, or where you believe an infringement occurred. We encourage you to contact us first so that we can try to resolve the concern.

RaptMAb does not currently use personal information collected through the website to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.

10.3 European representatives

RaptMAb is established in Canada. If applicable European or UK law requires RaptMAb to appoint a representative in the EEA or United Kingdom, the representative's contact information will be added to this policy before the relevant processing begins or as otherwise required.

11. Additional information for Quebec residents

Quebec’s Act respecting the protection of personal information in the private sector, as amended, provides individuals in Quebec with additional rights. These include the right to be informed when technology is used to collect personal information or to identify, locate, or profile an individual; the right to request that we cease disseminating personal information or de-index a hyperlink in certain circumstances; and the right to receive computerized personal information in a structured, commonly used technological format.

The person responsible for the protection of personal information at RaptMAb is identified in Section 13. Individuals in Quebec may contact that person to exercise their rights or to raise a concern. Individuals may also contact the Commission d’accès à l’information du Québec.

12. Additional information for United States residents

Depending on your state of residence and whether the applicable law covers RaptMAb, you may have rights to know or access personal information, correct inaccuracies, request deletion, obtain a portable copy, or opt out of certain targeted advertising, sale, sharing, or profiling activities. You may also have the right to appeal a refusal of a request and to use an authorized agent. We will not discriminate against you for exercising an applicable privacy right.

RaptMAb does not sell personal information or share personal information for cross-context behavioural advertising, as those terms are defined under applicable United States privacy laws. If our advertising practices change, we will update this policy and provide any notices or opt-out mechanisms required by applicable US law.

Where required, we will recognize legally valid browser-based opt-out preference signals, such as Global Privacy Control, for the browser or device that sends the signal. Because US privacy rights vary by state and may depend on statutory thresholds, we will assess each request under the law applicable to the circumstances.

13. Privacy contact and complaints

Questions, requests, or complaints about this policy or our handling of personal information may be directed to:

Privacy Officer
RaptMAb Biotechnology Inc.
Email: privacy@raptmab.com
6-2160 Highway 7, Suite 395
Vaughan, ON L4K 1W6
Canada

We will investigate and respond to privacy concerns in a reasonable manner. If you are not satisfied with our response, you may also contact the Office of the Privacy Commissioner of Canada or another privacy regulator with jurisdiction over the matter.

14. Changes to this policy

We may update this policy from time to time to reflect changes in our website, services, providers, or legal obligations. The current version will be posted on our website with its effective or last-updated date. Material changes will be highlighted or communicated where appropriate.

Reference links

Google Analytics opt-out browser add-on: tools.google.com/dlpage/gaoptout

Office of the Privacy Commissioner of Canada: priv.gc.ca