Website Privacy Policy

Introduction

This privacy policy is meant to inform any natural person whose personal data are processed by ADC Therapeutics SA or its affiliates (“ADCT”) in the conduct of their business activities, including, activities that ADCT may perform in connection with the browsing of any websites that ADCT administers (www.adctherapeutics.com; www.adctmedical.com; www.zynlonta.com; www.zynlontahcp.com; www.advancingpatientsupport.comwww.medicalaffairs.adctcongresshub.com).

The protection of personal data is important to ADCT. Please read this entire Policy to be informed of the processing activities that ADCT performs.

Personal Data refers to any information related to an identified or identifiable natural person (“Data Subject”), such as, but not limited to, name, mailing address, e-mail address, telephone number, IP address, CV/resume.

ADCT will be the data controller responsible for the processing of the Personal Data collected in connection with the conduct of its business, as detailed below.

Processing Activities

General Request

If a Data Subject decides to contact ADCT, ADCT may process some Personal Data contained in the contact request. This processing will be made only if and to the extent needed for the purpose of responding to such request, as permitted by ADCT’s legitimate interest in informing the public about its business or its products. ADCT will retain the Data Subject’s Personal Data for as long as necessary to fulfill the purpose for which it was collected or to comply with legal requirements. All other Personal Data will be deleted, unless otherwise required by applicable law.

Subscription to ADCT’s newsletters

If a Data Subject decides to subscribe to any of ADCT’s newsletters, ADCT will process the following Personal Data: name, state, email and specialty. This processing is necessary for ADCT to be able to provide the Data Subject with the newsletter. This processing is based on Data Subject’s consent, which needs to be provided at the time of the subscription. ADCT will retain Data Subject’s Personal Data as long as (i) the Data Subject remains subscribed, or (ii) the newsletters are provided; or until the Data Subject withdraws her/his consent to such processing. Please note that withdrawal of consent will automatically terminate the subscription.

Product Complaints

If a Data Subject decides to report to ADCT any issue encountered with its products, ADCT will have to process certain Data Subject’s Personal Data in order to record, investigate and report, if necessary, this issue. This processing is necessary for ADCT to comply with its legal safety obligations relating to the safety of its products. In the context of this processing ADCT may have to process the following Personal Data: name, age, gender, contact details, location, whether the Data Subject is a health care practitioner or a person using the product, product used, health or medical status before and after the issue and any other Personal Data that needs to be processed for ADCT to comply with its legal obligations. ADCT will process such Personal Data as long as required for ADCT to comply with its legal obligations. In the context of this processing and in addition to the persons mentioned under section 3 below, the following persons may have access to such Personal Data: any public authority responsible for ensuring drug safety (e.g. FDA, EMA…). These persons may be located worldwide.

Patient Assistance Programs

If a Data Subject enrolls in any patient support program (“PSP”) offered and implemented by ADCT, ADCT will process certain Data Subject’s Personal Data that are necessary in order to enroll the Data Subject in the PSP and provide the Data Subject with the different supports available under the PSP that the Data Subject selected. Such Personal Data may include: name, address, telephone number, medical records, health information, health insurance coverage, and financial information. This processing is based on Data Subject’s consent, which will be obtained by ADCT at the time of enrollment. ADCT will retain Data Subject’s Personal Data as long as (i) the Data Subject remains enrolled, or (ii) the PSP is provided; or until the Data Subject withdraws her/his consent to such processing. Please note that withdrawal of consent will automatically terminate Data Subject’s enrollment in the PSP.

Marketing Communications

ADCT may offer Data Subjects the option to receive certain of ADCT’s marketing communications relating to its product. If a Data Subject consents to such receipt, ADCT will process the following Data Subject’s Personal Data: name, state, email and specialty. This processing is necessary for ADCT to be able to provide the Data Subject with such marketing communications. This processing is based on Data Subject’s consent, which will be asked for at the time of Personal Data collection. ADCT will retain Data Subject’s Personal Data as long as the communications are provided; or until the Data Subject withdraws her/his consent to such processing. Please note that withdrawal of the consent will automatically terminate the sending of marketing communications.

Other processing activities

Other processing activities than those described above may be performed by ADCT in conducting its business. Data Subjects that are concerned by such processing activities will be provided with specific information notice regarding the processing at the time of collection of their Personal Data.

Persons that may have access to Data Subject’s Personal Data

If and to the extent needed for achieving the purpose(s) for which Data Subject’s Personal Data are processed, Data Subject’s Personal Data may also be processed on behalf of ADCT by third parties. Such third parties may include ADCT’s affiliates or contractors, which may be located worldwide, including in countries not offering an adequate level of personal data protection within the meaning of applicable personal data protection law. In such event, ADCT will ensure that the processing by such third party is subject to adequate safeguards as required by applicable personal data protection law. For further information about these safeguards or to obtain a copy of the same, please contact ADCT as set forth under section 6, “Contacts”.

Personal Data collected from Data Subjects may also be processed by third parties in the event that the business of ADCT or a part of it is sold, assigned or transferred, in which case ADCT would take necessary measures to ensure continued compliance with personal data protection law and this Policy. Also, Personal Data may be disclosed to third parties if ADCT is required to do so because of an applicable law, court order or governmental regulation, or if such disclosure is otherwise necessary in support of any criminal or other legal investigation or proceeding here or abroad.

Personal Data Rights

In connection with all these processing activities, Data Subjects have the right to access, modify or delete their Personal Data, object or restrict the processing of their Personal Data by ADCT or, in case the processing of their Personal Data is based on their consent, withdraw such consent to further processing of their Personal Data by ADCT at any time. However, please note that exceptions and restrictions to exercise those rights may exist under applicable personal data protection law. In addition, Data Subjects have the right to file a complaint with the competent supervisory authority according to applicable personal data protection law.

Selling of Personal Data

ADCT confirms that it does not sell or resell Personal Data that it collects in connection with conducting its business.

Contacts

Controller: ADC Therapeutics SA, route de la corniche 3B, 1066 Epalinges

Legal Representative in Europe: ALG MANOUSAKIS LAW FIRM 16, Laodikias Str., 11528, Athens, Greece, Email: [email protected] Attn: Alexandros Manousakis

Data Protection Officer: ADC Therapeutics SA, route de la Corniche 3B, 1066 Epalinges, Attn: Data Protection Officer

If you have any queries about this Policy or want to exercise your rights, contact: ADC Therapeutics SA, Attn.: Data Privacy Officer, at Biopôle, Route de la Corniche 3B, 1066 Epalinges, Switzerland.