This Privacy Policy is provided by Adverum Biotechnologies, Inc. and its affiliates and subsidiaries (collectively “Adverum,” “our,” “us” or “we”). It is intended to describe how we collect, use, share and process information about you (“Personal Information”) when you visit our websites https://adverum.com/ and https://investors.adverum.com/ (“Sites”), when you contact us via our “contact us” form, when we communicate with you in the context of our business activities or when you apply for a job with us. It also informs you about your privacy rights and the measures and processes we put in place to protect your Personal Information.

For the purposes of the General Data Protection Regulation (EU) 2016/679 (“EEA GDPR”), Swiss Federal Act on Data Protection of 25 September 2020 (“FADP”) and the UK General Data Protection Regulation (“UK GDPR”), to the extent applicable, Adverum acts as a data controller for the Personal Information that is processed when you access our Sites or related services.

This Policy applies whether you are a patient, member of the public, visitor, shareholder or investor, member of a regulatory body or authority, vendor or service provider, consultant, healthcare professional, contractor, job applicant, or any other individual with whom we engage or who is involved in our business activities.

If you are an employee, healthcare professional, vendor, consultant or service provider, there may be additional privacy notices that apply to your Personal Information. Please refer to the information you received from us as an employee for additional privacy notice information, and if you are a vendor, consultant, contractor or service provider, please refer to your contractual agreements with Adverum for additional information.

What Personal Information We Collect

We may collect and process the following types of Personal Information:

• Personal Identifiers: Your name, phone number, email address, company or organization you work for.
• Online identifiers: Device ID or Cookie ID.
• Commercial and Financial Information: Payment-related information, such as your bank address or account details and number, tax-related information for business purposes, or other information about you, user account logs, records of services provided, requested documentation, or customer service logs.
• Professional or Employment Information: Employer, job title, academic or research expertise or interests, academic position or title, or affiliated academic institution or entity, CV and resumes.
• Educational Information: Information about education history or background.
• Analytical Information: Pages viewed, referring web page, e-mails from us that you opened, browser type, operating system, IP address, and device information.
• Public Information: We may also collect publicly available information about you from third-party sources, such as the postal service for shipping address verification.
• De-identified and Anonymized Information: Aggregate and/or de-identified information about you; or use suggestions, comments, and ideas that are not personally identifiable.
• Health Information (if permitted by law): We may collect data relating to your health in limited instances, for example, your initials, name, key-coded or pseudonymized data, and other related information necessary for the provision of our products when necessary to protect your health safety or to comply with the law.

We may also receive other Personal Information that you or others provide us or store on our systems, such as in communicating or otherwise interacting with us, providing a reference, or attending an event with us.

Sources of Personal Information

We may collect Personal Information from the following categories of sources:

• From your device or browser
• Directly from you when you provide information (for example, via our “contact us” form)
• From our affiliates, business partners, consultants, vendors, service providers or contractors
• From marketing vendors and advertising networks
• From social media

How We Use the Personal Information We Collect

We may collect and use your Personal information for the following purposes:

• To address your inquiries, concerns, and requests
• To analyze the use of our products and services and improve our products and services
• To develop and provide new products and services
• To conduct research activities alone or together with other third parties
• To conduct our regular commercial activities
• To process job applications
• To maintain the security of our services
• To comply with applicable law
• To protect our or the rights, property, and safety of others

We rely upon legal bases permitted under applicable law to process your Personal Information. The bases upon which we process your Personal Information include the following:

• Pursuance of our legitimate interests, for example, to provide you with information that enables us to answer to inquiries, concerns, and requests, etc. When we process Personal Information to meet our legitimate interests, we put in place robust safeguards to ensure that your privacy is protected;
• Performance of any contract we execute with you;
• Compliance with our legal obligations; for example, to respond to legally binding requests from regulators, law enforcement authorities or other government authorities;
• Collection of your consent, when required.

In certain jurisdictions (e.g., the EEA/ Switzerland / UK), you may have a right to object to the processing of your Personal Information where that processing is carried out for our legitimate interests. However, we may not be able to fulfill this request in all instances. Please contact us using the contact information below to receive more information, including with respect to the balancing test we have performed in this regard.

Cookies and Analytics

As is now common with most websites, we may use cookies or similar technologies to capture information about the use of our Sites and to improve your user experience on our Sites. Accordingly, we may store and retrieve information on your device through the use of cookies and similar technologies. For instance, we may use a session cookie to store form information that you have entered so that you do not have to enter such information again. We may use information stored in such cookies to customize your experience on and analyze use of our Sites. You may be able to set your browser to notify you when you receive a cookie. Many web browsers also allow you to block cookies. If you block strictly necessary cookies, you may not be able to access certain parts of our Sites.

To find out more about what cookies we use and how we use them, please consult our Cookies Policies here (for Investor Relations and Corporate).

Whom We Share Personal Information With

We may share your Personal Information in the following limited circumstances:

• We may share Personal Information with affiliates, consultants, vendors, contractors and other service providers who we employ to perform tasks on our behalf, such as external scientists and healthcare professionals to review and assist us with healthcare compliance activities and institutions and other organizations with whom we collaborate to support our clinical activities (such as for clinical studies, patient support programs, and so on).
• We may share or disclose your Personal Information to regulatory and health authorities, including governmental bodies (such as the FDA, EMA, NHS), data protection authorities, tax authorities, or courts in case of disputes, when permitted or required by applicable law.
• We may also share your Personal Information with third parties to whom Adverum is legally obligated to provide such information, such as other parties in litigation or legal disputes, guardians, conservators, or individuals with powers of attorney.

How Long We Store Personal Information

We store your Personal Information for the period necessary and proportionate for the specific purpose for which it was collected and to enable us to:

• Comply with record retention requirements under the applicable law;
• Defend or bring any existing or potential legal claims;
• Deal with any requests, complaints, or adverse events reports;
• Maintain business records for analysis and/or audit purposes;
• Manage our relationships with affiliates, business partners, consultants, vendors, service providers or contractors.

How We Protect Personal Information

​We aim to protect your Personal Information by implementing and maintaining organizational, technological, contractual, and physical safeguards appropriate to the sensitivity of the Personal Information we hold. We maintain commercially reasonable safeguards to help protect your Personal Information, including assuring that affiliates, consultants, vendors, contractors, and other service providers who access or handle Personal Information on our behalf maintain such safeguards.

Rights Regarding Personal Information

​Persons in certain jurisdictions (e.g., the EEA/ Switzerland / UK) may have rights under data protection laws that may apply to the Personal Information we hold about those persons and which they may exercise subject to the limitations under applicable law such as the EEA GDPR or UK GDPR. These include for the individuals in the EEA and UK the rights:

• To request access to your Personal Information;
• To request rectification of inaccurate or incomplete Personal Information;
• To request erasure of your Personal Information (a “right to be forgotten”);
• To restrict the processing of your Personal Information in certain circumstances;
• To object to our use of your Personal Information, such as where we have considered such use to be necessary for our legitimate interests and/or in the case of direct marketing activities;
• Where relevant, to request the portability of your Personal Information to a third-party;
• Where you have given consent to the processing of your Personal Information, to withdraw your consent;
• To lodge a complaint with the competent supervisory authority of your country of residence. You may find a list of the contact details of competent authorities in the EEA here: https://edpb.europa.eu/about-edpb/about-edpb/members_en and here for the UK: https://ico.org.uk/.

If you want to access, review, update, rectify, and delete any Personal Information Adverum holds about you, or exercise any other data subject right available under the EEA GDPR, FADP or UK GDPR, where applicable, you should contact us via e-mail: privacy@adverum.com.

Children’s Information

Our Sites are not intended for or directed to individuals under the age of thirteen (13). We do not collect information from any individual we know to be under the age of 13 (or older if your country is more restrictive). If a parent or guardian becomes aware that his or her child has directly provided us with Personal Information, please contact us by using the contact information below.

Other Websites

​If our Sites provide links to other websites, these websites may operate independently from us and may have their own privacy notices or policies, which we advise you to review. To the extent any linked websites or apps are not owned or controlled by us, we are not responsible for their content.

International Data Transfers

Adverum is based in the United States of America (“USA”), and we process and store information in the USA. Your Personal Information may also be shared with or accessed by Adverum’s service providers located in countries that provide less protection than your country (such as the USA). In such instances, whenever your Personal Information is transferred to countries outside of the EEA Switzerland or UK, we will ensure that at least one of the following safeguards is in place:

• The country is one that the European Commission has approved as providing an adequate level of protection for personal data;
• The transfer is subject to a specific derogation in the EEA GDPR, FADP, UK GDPR or national laws;
• European-style data transfer agreements (Standard Contractual Clauses) with the recipients.

If you would like further information about the safeguards Adverum has implemented or would like to obtain a copy of the Standard Contractual Clauses, please contact us using the contact details set out below.

Changes to This Privacy Policy

We reserve the right to amend, alter, or otherwise change this Privacy Policy at our sole and absolute discretion. If we make material changes to the Privacy Policy, we will post notice in this Policy.

Contact Us

Please do not hesitate to contact us if you have any questions regarding the protection of your Personal Information or if you wish to exercise your privacy rights (as described above).

Adverum Biotechnologies, Inc.
100 Cardinal Way, Redwood City, CA 94063

Data Protection Officer: privacy@adverum.com

European Representative: Pursuant to Article 27 of the EEA GDPR, Adverum has appointed European Data Protection Office (EDPO) as its EEA GDPR Representative in the EU. You can contact EDPO regarding matters pertaining to the EEA GDPR:

• by using EDPO’s online request form: https://edpo.com/gdpr-data-request/
• by writing to EDPO at Avenue Huart Hamoir 71, 1030 Brussels, Belgium

UK Representative: Pursuant to Article 27 of the UK GDPR, Adverum has appointed EDPO UK Ltd as its UK GDPR representative in the UK. You can contact EDPO UK regarding matters pertaining to the UK GDPR:

• by using EDPO’s online request form: https://edpo.com/uk-gdpr-data-request/
• by writing to EDPO UK at 8 Northumberland Avenue, London WC2N 5BY, United Kingdom

Last Update: August 2024