We, Prolacta Bioscience, Inc., (hereinafter "Prolacta", "we" or "us"), take the protection of your personal data very seriously, and we strictly comply with the regulations of the data protection statutes, in particular the Regulation (EU) 2016/679 ("GDPR"). This Privacy Notice provides information about what kind of “personal data” we collect and hold, how and for what purpose we collect and store this information, how you can access it and some other important matters.

With the following information, we would like to inform you as participant (hereinafter "Participant" or "you") about the processing of your personal data with regard to the International Conference on Human Milk Science and Innovation, March 11-12, 2022 (hereinafter "Conference").

The Conference will be an on-site event in Vienna, Austria which will be live-streamed and recorded.

1. Categories of personal data and data sources

   1.1 Registration Process

   Prolacta processes the following categories of personal data when you register for the Conference:

   • Contact details such as: First name, last name, address, email address and telephone number
   • Professional details, including your company, industry, role or job title
   • Food special requests (vegetarian/other)
   • Smoking preference
   • For participants for whom Prolacta will be arranging air transportation:
     • Flight reservation preferences (airline/home departure city/seating)
     • Frequent flyer number
     • Date of birth
     • Gender
     • TSA or Redress number
     • Emergency Contact Information: name, relationship, phone

   1.2 Participation at the Conference

   Prolacta processes the following personal data when you join the Conference as a Participant and decide to ask a question during a discussion. Since the Conference is recorded, you will be recorded when you voluntarily decide to ask a question or make a comment during a discussion at the Conference, or if you are adjacent to a participant at the on-site event who is asking a question or making a comment.

   • Audio and video data, including screenshots and photographs
   • Any personal information you decide to disclose when asking a question or making a comment during a discussion
   • Food special requests that are provided for catering purposes.

2. Purpose and legal basis of the processing of personal data

   • Data processing due to the performance of a contract (Art. 6 Sec. 1 lit. b) GDPR)

     We process your personal data mentioned in Section 1 when the processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract. This includes the processing of your personal data to register you as a participant at the Conference, to contact you for organizational and operational purposes, and to conduct the Conference. This also includes the purpose of recording the Conference, publishing audio and video recordings or screenshots of the Conference on Prolacta's website [http://www.humanmilkscience.org/2022] and on social media platforms such as, but not limited to, Twitter, Facebook and Instagram to promote the Conference when you voluntarily decide to ask a question or make a comment during a discussion at the Conference, or in the event you are adjacent to an individual voluntarily posing a question or making a comment.

   • Data processing due to legitimate interests (Art. 6 Sec. 1 lit. f) GDPR)

     We process the aforementioned data in Section 1 when the processing is necessary for the purposes of the legitimate interests pursued by us, according to Art. 6 Sec. 1 lit. f) GDPR, except where such interests are overridden by the interests of fundamental rights and freedoms of the data subject, which require protection of personal data.

     Our legitimate interest in processing your personal data includes marketing purposes (e.g. processing your data for optimizing the Conference and contacting you to invite you to future conferences and events.)

3. Disclosure of personal data

   We may share your personal information with:

   • External service provider Columbus (RAM Consulting GmbH Florianigasse 60/6, 1080 Vienna, Austria) https://www.ram.at/datenschutz
   • As the conference is live-streamed, speakers' personal data such as first and last name and email address is disclosed to LUXAV Audiovisuelle Kommunikation GmbH (providing the audio, visual, recording, and livecast services); https://www.luxav.de/
   • Other online participants as they will see/hear your name and your image and likeness during the live-stream;
   • Prolacta's website visitors and users of social media platforms, where we publish photos and recordings in the above described way;
   • Our bank to whom payment details are provided in order to process a payment;
   • Co-sponsors or event partners who are involved in the delivery of the event services including EFCNI (https://www.efcni.org/dataprotection/) and Comprehensive Center for Pediatrics – Medical University of Vienna (https://ccp.meduniwein.ac.at/)
   • External service providers of accommodation, airlines, catering, IT and other support services (including, but not limited to: Andaz Vienna Am Belvedere (https://www.hyatt.com/en-US/info/privacy-policy );
   • Any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary to comply with applicable law or regulation, in response to a court order, judicial or other government subpoena or warrant, or to otherwise cooperate with law enforcement or other governmental agencies if we are required to do so.

4. Data Retention

As a matter of principle, we delete or anonymise your personal data as soon as they are no longer required for the aforementioned purposes and there are no other statutory retention obligations or justification reasons for storage. Furthermore, personal data may be retained by us for the period during which claims may be brought against us.

5. International transfer of your personal data

Your personal data will be transferred to and stored on our servers in the USA, pursuant to Art. 49 Sec. 1 lit. b GDPR when the transfer is necessary for the performance of a contract. When the transfer is not necessary for the performance of a contract, we will only transfer your personal data to the USA when you voluntarily consent to the transfer to the USA by signing the Consent Declaration located at the end of this Notice.

6. Rights of the data subject

You have the following rights in regard to your personal data:

You have the right to access, correct, update or request deletion of your personal data and you can object to the processing of personal data, ask us to restrict processing your personal data or request portability. 

If we process your personal data with your consent, you can withdraw your consent at any time by contacting us using the contact details provided at Section 7. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.

If we process your personal data based on our legitimate interest, you can object to this processing insofar as reasons arise from your particular situation that conflict with this data processing. Having received your objection, we will then stop this processing unless we can demonstrate that there are compelling legitimate grounds for the processing which override your interests, rights and freedoms concerned, or the processing serves the purpose of asserting, exercising or defending legal claims.

To exercise these rights or if you have any questions or complaints about data protection, please feel free to contact us. You can find our contact details under point 7 of this Privacy Notice.

In addition, you have the right to lodge a complaint with the competent supervisory authority. For more information, please contact your local data protection authority (contact details for data protection authorities in the EEA are available at: https://www.gdprregister.eu/gdpr/dpa-gdpr/)

7. Contact

   The controller for the processing of your personal data is:

   Prolacta Bioscience, Inc.
   1800 Highland Ave.
   Duarte, CA 91010-2837
   United States of America
   Prolacta's Data Processing Officer:
   Joe Fournell
   privacy@prolacta.com

Consent Declaration for the Transfer of Personal Data

I hereby grant Prolacta pursuant to Art. 49 Sec. 1 lit. a GDPR that my personal data which I provide in the course of registration and participation at the Conference as described above may be transferred to recipients outside the European Economic Area, namely the USA, even if the USA does not impose comparable data protection requirements to the GDPR and may not provide me with equivalent remedies in the event of access to my personal data.

This consent will only cover the transfer of personal data where the processing is based on Prolacta's legitimate interest pursuant to Art. 6 Sec. 1 lit. f GDPR as described in Section 2.2 above, which includes marketing purposes. The transfer of personal data to the USA, which is necessary for the performance of the participation at the Conference, does not depend on consent.

I have the option to revoke this consent at any time with future effect vis-à-vis Prolacta by contacting Prolacta's Data Protection Officer Joe Fournell at privacy@prolacta.com. 

☐ I declare my voluntary consent to Prolacta's transfer of the personal data as described above to the USA 

I have understood that my consent is voluntary and that I can withdraw this consent at any time for the future by contacting Prolacta's DPO at privacy@prolacta.com. The processing of my personal data up to the moment of the withdrawal remains lawful and will therefore not be affected. The withdrawal of consent does not result in any disadvantages for me.