Privacy Policy

Responsible Body

GenScript Biotech Corporation ("we") as the operator of this website https://www.genscript.com ("GenScript") is the responsible body for the handling of personal data of users of the GenScript information services ("you").

We take the protection of your personal data seriously. We have taken technical and organizational steps to ensure that the data protection regulations are observed by ourselves and our service providers. In accordance with the applicable data protection regulations, we have provided information below on the type, extent and purpose of the collection, processing and use of data obtained in connection with your use of GenScript.

Your information is important to GenScript. We respect your privacy and endeavour to protect your privacy. This Privacy Policy provides information about the personal information that GenScript collects, the ways in which we share and use, and what choices are available to you before you decide to provide us with your information. This Privacy Policy is available on GenScript home page and at the bottom of every GenScript web page. We encourage you to carefully and fully read the Privacy Policy before you use our website. We further welcome your questions and are glad to answer your concerns and suggestions.

Sites Covered by This Privacy Policy

GenScript is a global organization, with legal entities, research and development, supply and distribution, management structures, and manufacturing facilities that cross borders. This Privacy Policy applies to all webpages on the www.genscript.com domain. However, if a privacy policy or statement is posted on specific webpages for particular products or services, those separate policies will apply instead of this Privacy Policy. We may also provide links to third-party websites. When you click the link to those third-party websites, you will be directed and informed of leaving our websites. This Privacy Policy does not apply to any information you may provide when visiting those third-party websites. We do not endorse or make any representations about third-party websites, except that the third-party belongs to GenScript. The information you decide to provide or that is collected by those third parties is not covered by this Privacy Policy. We encourage you to read the Privacy Policy or statement of any company before submitting your personal information.

Personal Information Collection

Personal information is collected for necessary purposes and also to better understand and serve you as a customer or a user of our websites. We promise to collect, share, transfer, and use personal information only after providing adequate notice and obtaining explicit consent.

Personal information will be collected on various occasions, including when you register as a user, place an order, subscribe to newsletters, marketing and support materials, participate in reward or promotion programs, surveys, or apply for a job at GenScript. The types of personal information collected may include:

• Contact Information: your name, organization, address, phone and fax number, and email address;
• Website Usage Information: data about your visits to or use of our websites, such as visiting history, hit counts and timestamps;
• Transaction Information: personal contact and financial information, including credit card details and bank account information;
• Subscription Information: data provided for subscribing to newsletters, products updates, marketing and support materials, reward or promotion programs, and surveys;
• Employment Information: contact preferences, educational background, employment history, and job interest data for job applications;
• Cookies and Similar Technologies. During navigation, "cookies" may collect information such as the browser version, IP address, IP ports, visit timestamps, size of data transferred, pages visited and clickstream data. Cookies can be disabled in browser settings, but doing so may limit website functionality;
• Third-Party or Public Information: data provided by third parties or publicly available sources;
• Any other information you send to GenScript.

Explicit Opt-In Consent

We do not collect or use any personal information unless we obtain explicit consent from you. This means that we will only process your data when you have expressly agreed to it.

Before collecting your data, we will clearly outline the purpose, scope, and legal basis for processing. You may withdraw your consent at any time, except in cases where processing is required by law.

Request for Data Transfer to Other Service Providers

You have the right to request a copy of the personal data we hold about you or to have it transferred to another service provider, where technically feasible. Please submit such requests to bhamap@genscript.com.

Upon written request, we can provide your personal data in a portable format and facilitate its transfer to another provider, ensuring compliance with technical feasibility standards.

Using Personal Information

The information we collect helps us to better serve you as a customer and user, meet your needs and suit your interests. The information collected will help us deliver a consistent high-quality product and service to you. We may use the information to:

• administer and improve our websites;
• publish your testimonials;
• enable your access to and use of the website services;
• send you products that you purchase;
• supply to you services that you purchase;
• send you statements and invoices;
• contact you and collect payments;
• send you marketing communications, updates, rewards programs, services and product information;
• send you information about your account, changes to any relevant agreements, statements and policies;
• assist us to implement a rewards program and/or other promotions;
• compile and analyze aggregate statistics and trends;
• conduct market and customer analyses;
• respond to your request and improve the content, services, and products.

You will be provided the opportunity to choose your privacy preferences regarding the communications we send.

Before we publish your testimonials on our websites, we will seek express permission from you. The testimonials will be only posted on our websites with the express permission of the individual or company who provides that testimonial.

Credit card information is used only for payment processing and fraud prevention. Credit card information and other sensitive personal information required to process a transaction on credit will not be used for any other purpose by our financial services providers or GenScript. We will not keep the credit card information longer than necessary for processing the transaction or providing the services, unless you permit us to retain such information for future purchases or services.

We will take all necessary and practical steps to ensure that your personal data will not be kept longer than necessary. We are committed to compliance with all statutory and regulatory requirements concerning the retention and use of personally identifiable information.

We may also contract with a certain third party which provides data collection and analysis service to collect and analyze clickstream data utilizing anonymous data collection from cookies. Such third party will comply with this Privacy Policy regarding any information we provide to them. Where we disclose your personal information to our agents or sub-contractors for above identified purposes, the agent or sub-contractor in question will be contractually obligated to use that personal information in accordance with this Privacy Policy. Under these circumstance your consent is not necessary for those external parties to process your data. We reserve the right to make full use of information that is not in personally identifiable form.

In addition to the disclosures reasonably necessary for the purposes identified above, we may disclose your personal information to the extent that it is required by law, in compliance with court order in any legal proceedings, and in order to establish, claim, exercise or defend our legal rights.

Sharing Personal Information

We will not sell, rent or lease your personally identifiable information you provide to us to any external parties without your explicit consent, except where required by law or governmental or judicial bodies with proper authority.

We may share information about you with our affiliates, successors, and agents/representatives, but such affiliate, successor, agent/representative will be required to treat the information in accordance with this Privacy Policy or otherwise with your further permission. We have the right to determine the specific method to release the restriction aforementioned.

We may also disclose information provided by you in connection with corporate restructuring, sale or assignment of substantial assets, merger, acquisition, and other changes of control or financial status. If such circumstances arise, we will require the recipient to use the information in accordance with this Privacy Policy thus your further express permission is not necessary here.

We may disclose your personal data under the following conditions:

• To comply with applicable laws and regulations;
• To trusted vendors and third-party service providers under strict confidentiality agreements;
• When you provide explicit consent.

Auditor-compliant standards will be used to ensure third-party adherence to privacy obligations.

Security of Personal Information

We are committed to safeguarding the personal information you provide to us. We will take reasonable technical and organizational safety measures to prevent the loss, misuse or alteration of your personal information. We will store all personal information you provide on our secure servers.

We use the standard known as Transport Layer Security (TLS) encryption for any transmission of personal or financial information from your PC to our servers. Beyond the TLS barrier, your data is protected once it reaches our network through the use of secure multi-tiered firewalls. We implement Role-Based Access Control (RBAC) to ensure that your information is only accessible to authorized personnel. Additionally, we have deployed a Web Application Firewall (WAF) to enhance website security and protect against unauthorized access and cyber threats. Whole or parts of your data may also be encrypted on our storage server for additional security.

We have established a Data Compliance Committee responsible for defining the overall objectives and direction of data compliance initiatives. The committee facilitates the implementation of data compliance requirements, oversees compliance risk assessments and corresponding mitigation efforts, and closely monitors changes in laws, regulations, and business needs. It conducts regular evaluations of data compliance management practices to ensure continuous improvement. Additionally, the committee is responsible for formulating and reviewing relevant policies and standards, as well as supervising their effective implementation.

We regularly conduct internal and external audits of our information security management system and key control points to ensure ongoing compliance with ISO 27001 and other international standards. We also establish and maintain communication mechanisms with relevant stakeholders to ensure that our management system and controls are continuously updated in response to evolving risks and regulatory changes. Access to personal data is strictly controlled and limited to authorized personnel with a legitimate business need. In addition, we proactively identify and comply with applicable laws and regulations across jurisdictions, with particular attention to the legal requirements for cross-border transfers of personal data.

We have established a dedicated management system, procedures, and organizations to ensure the security of personal information. For example, we strictly restrict the scope of persons who can access information, require them to comply with confidentiality obligations and conduct audits, and impose penalties on the persons violating obligations according to the internal procedures.

We also conduct occasional reviews of such management systems and procedures to prevent unauthorized personnel from accessing, using, or disclosing personal information.

Retention Period of Personal Information

We retain your personal information only for as long as necessary to provide our website and services, support our business operations, or fulfill the purposes for which it was collected.

We may also retain your information for legitimate reasons, such as complying with legal or contractual obligations, or if necessary to address ongoing or anticipated legal matters or disputes.

Cross-Border Data Transfers

Information that we collect may be stored and processed in and transferred between any of the countries in which GenScript operates to enable the use of the information in accordance with this Privacy Policy. In addition, personal information that you submit for publication on our websites will be published on the Internet and may be available around the world. You agree to such cross-border transfers of personal information.

We will comply with all local laws/regulations that restrict cross-border data transfer when we perform such transfers.

Your Rights

Access to Information You Provided

You may at any time request access to your personal information held by us. You may review, edit, correct, delete, or update that information at any time. All requests for access to, correction, or deletion of personal information should be made via email to bhamap@genscript.com.

We reserve the right to charge a reasonable fee for processing any personal information access request. We will, upon making reasonable efforts to verify your identity, endeavour to handle and respond to such requests promptly.

Choice to Opt-Out of Processing

You have the option to opt-out of the processing of your personal data for non-communication purposes, including but not limited to analytics, profiling, or personalization. You can exercise this choice by:

• Declining the service offered during registration or at other information collection points on our websites.
• Unchecking the relevant check boxes provided in forms or communications.
• Informing us directly if you no longer wish to have your data processed for these purposes.

For further assistance or to express your preferences, please contact us at bhamap@genscript.com.

Right to Rectification

If any personal information we have collected about you is incomplete or inaccurate, you have the right to request its correction or update.

Right to Erasure

You may request the deletion of all or part of your personal information under certain conditions, such as:

• Our processing of your personal information violates applicable laws and regulations.
• We collected or used your personal information without your consent.
• Our processing of your personal information breaches our agreement with you.
• The purpose for processing your personal information has been fulfilled, is impossible to fulfill, or is no longer necessary.
• You have withdrawn your consent for us to process your personal information.

Unless otherwise required by law, we will respond to your request within 15 business days. To protect your privacy, we may need additional information to verify your identity before processing your request.

Children's Privacy

GenScript does not target its websites to children under 13 and does not knowingly collect personal information from children under the age of 13.

Privacy Policy Updates

We reserve the right to revise this Privacy Policy from time to time by posting the new versions on this website. You should check this page periodically to ensure you are familiar with any changes.

English Version

The Privacy Policy is written in English. If this Privacy Policy appears in another language, this means this document is a translation of the English version. In case of discrepancies between the English version and any version in another language, the English version shall apply and prevail.

Contact Us

If you have any requests, questions, concerns, or suggestions about this Privacy Policy or our treatment of your personal information, please contact us:

• By email to: bhamap@genscript.com;
• By post to: Customer Relations, GenScript USA Inc., 860 Centennial Avenue, Piscataway, NJ 08854, USA.