CEPI External Privacy Notice

1. Introduction

This Privacy Notice provides you with information about how the Coalition for Epidemic Preparedness Innovations ("CEPI") processes your personal data during the course of your relationship with us. This includes any external interactions such as:

• browsing our website (www.cepi.net);
• registering your interest in CEPI events or updates;
• filling out an online contact form;
• participating in online events or forums;
• emailing a CEPI employee for business purposes;
• entering into a contract to provide services to, or receive funding from, CEPI;
• visiting CEPI premises or attending a CEPI event;
• any other external engagement with CEPI in which you provide personal data.

In this notice, we detail what personal data we collect, why we process it, and what your rights are. 

CEPI considers the privacy of individuals and the protection of their personal information to be of the utmost importance and is committed to processing data in accordance with the principles of the GDPR and all applicable national legislation. As such, we emphasise the importance of maintaining the accuracy and currency of your personal data in our records. As you continue to interact with CEPI, we kindly ask for your assistance in keeping your personal information up to date. This helps us to ensure both the accuracy and integrity of your personal data and effective communication and service provision throughout your ongoing relationship with us.

If you have any questions about this notice, please contact us using the contact details below. For further information on our commitment to data protection and individual privacy, please see CEPI’s Data Protection and Privacy Policy. This notice may be updated to reflect changes in our practices or applicable legislative changes.

2. Data Controller

The data controller will be CEPI, which is comprised of the following entities:

• The Coalition for Epidemic Preparedness Innovations ("CEPI Norway"), with registered address at Askekroken 11, 0277 Oslo, Norway. 
• The Coalition for Epidemic Preparedness Innovations UK Limited ("CEPI UK"), with registered address at Henry Wood House, 4-5 Langham Place, London, W1B 3DG, United Kingdom.
• The Coalition for Epidemic Preparedness Innovations U.S. ("CEPI US"), with registered address at 1901 Pennsylvania Ave NW, Suite 1003, Washington, D.C., USA.

The relevant data controller will be the CEPI entity with whom you have a relationship, or engage regularly, with. 

CEPI Norway operates ww.cepi.net and is the controller for any personal data processed therein and for any other processing as described below. CEPI UK and CEPI US are controllers for the local processing of personal data as set out in this notice.

3. What personal data we will process

We collect and process your personal data for different purposes in relation our web services and external relationships. Such processing may include, but is not limited to, the following categories of personal data.

1. Information you provide to make enquiries or communicate with us online, such as:
   • your title, name, and full postal, email, or telephone contact details;
   • your job title and role; or
   • any personal data you disclose in your enquiry or communication.
2. Records of communications sent to, and received from, you in relation to any enquiries, business relationship or other aspects of our business activities.
3. Your name and email address for the purpose of sending you our newsletters or other requested updates on CEPI activities and events.
4. Cookies and other personal data such as IP addresses, gathered to improve our website and enhance and tailor your user experience.
5. Information required to manage contractual relationships or funding of projects, which may include personal data contained in contracts, ongoing commercial correspondence, invoices, minutes of meetings and any other data required to facilitate our business and partner relationships.
6. Screening and financial information such as:
   • your job title and role;
   • personal and political relationships;
   • possible sanction listings; and
   • criminal records collected from public sources.
7. Personal data provided by you whilst reporting concerns via CEPI’s whistleblowing channel.
8. Contact or payroll information about employees and consultants engaged by our business partners in order to complete any investigations or audits required by law, contract, or triggered by third party grievances.
9. Curriculum vitae, applications, certifications, references, and other personal data you may provide during the course of applying for a position at CEPI or which we require to verify and assess any application.
10. Identity information you provide to gain access to CEPI premises and CCTV images during your visit.
11. Personal information you provide to attend a CEPI event, for which there is a separate privacy notice. 

CEPI may, on a case-by-case basis, process your personal data for other purposes, in accordance with applicable data protection law, as set forth in an applicable privacy notice and will always notify you of any such processing using the contact details you have provided as required.

The personal data we process is normally collected directly from you. We may also collect personal data from others, such as reference agencies and public authorities. 

Please note: to fulfil our obligations according to any contract we have in place with you, or to facilitate an event and provide you with an acceptable experience, CEPI depends on receiving a variety of information. If CEPI does not receive the required information from you, it may not be able to fulfil its obligations. 

4. Purpose and lawful basis for processing data

   4.1 Purpose of processing

CEPI will collect and process personal data about you for the following purposes:

1. To fulfil any contract or agreement that we have in place with you, or with your employer organisation, or in anticipation of any such contract or agreement.
2. To facilitate investor, board-level, or other business events and ensure that we provide attendees with the appropriate level of service. 
3. To ensure your health, wellbeing, and safety and personal security and that of others whilst you travel to and attend CEPI events, or visit CEPI premises.
4. To improve our website and your user experience whilst engaging with www.cepi.net or with CEPI across social media or via email.
5. To comply with CEPI’s obligations under applicable national laws or regulatory requirements such as anti-corruption legislation or the GDPR.
6. To assess and process employment applications, including reviewing qualifications, skills, and suitability for the role. This involves processing personal data submitted by candidates, such as CVs, cover letters, and employment history.
7. To respond to any enquiries or reports of wrongdoing sent via www.cepi.net or other online channels, including email.

4.2 Lawful basis for processing

The lawful basis we rely on to processing your personal data will depend upon the purpose(s) for which it was collected and the nature of the data. The relevant basis for processing will be one of the following:

1. The processing is necessary for the performance of, or in anticipation of entering, a contract to which you are, or will be, party, such as in your capacity of a CEPI stakeholder, employee, consultant, or employee of a CEPI partner or supplier, as per Article 6(1)(b) of the GDPR and UK GDPR.
2. The processing is necessary for compliance with a legal obligation to which CEPI is subject, as per Article 6(1)(c) of the GDPR and UK GDPR.
3. You have given your explicit consent to the processing for the specific purposes for which it was gathered, such as receiving event invitations or updates on CEPI activities. 
4. The processing is necessary for purposes of ensuring CEPI’s legitimate interests as per Article 6(1)(f) of the GDRP and UK GDPR, in:
   1. Running events.
   2. Keeping stakeholders informed.
   3. Improving our website and other services.
   4. Answering and managing enquiries and other communications.
   5. Entering into business relationships, fulfilling contracts and other related administration such as engaging suppliers.
   6. Ensuring the integrity of CEPI’s decision making and management.
   7. Ensuring the rights of CEPI or third parties to establish, exercise, or defend legal claims in our favour or that are directed towards us by stakeholders, awardees, suppliers, partners, other third parties or public authorities.
   8. Conducting investigations or audits that may impact CEPI or our legal obligations and for the establishment, exercise, or defence of legal claims.

   9. Safeguarding our staff and partners and the integrity of CEPI operations.

      4.3 Special category data

If we process special category data, for example race or ethnicity or health data, we will do so under one of the following bases:

1. You have given your explicit consent to the processing for a specified purpose, as per Article 9(2)(a) of the GDPR and UK GDPR.
2. The processing is necessary for the establishment, exercise, or defence of legal claims in which you or CEPI and its employees, investors, and board-members may be party as per Article 9(2)(f) of the GDPR and UK GDPR.

4.4 Processing of personal data about third parties

Do not provide personal data about others unless you are authorised or required to do so by contract or applicable law. You may provide personal data on behalf of another person if you have provided them with a copy of this notice and any applicable supplemental privacy notice, or if the personal data is provided on other legal grounds. We may ask you to provide evidence of the legal grounds for sharing personal data about others.

If such individuals have questions relating to such processing, they may contact CEPI at [email protected] at any time.

4.5 Additional processing

CEPI may, on a case-by-case basis, process other personal data or do so based on other legal grounds. You will always be notified of this, as and when applicable.

5. Disclosure of personal data

We will only share your personal data to third parties if there is a legal basis for such disclosure. We may share your personal data with our:

• employees and affiliates (CEPI entities) who have a business need to know;
• services providers (including consultants, contractors, vendors, and out-sourced service providers) to process it on behalf of CEPI based on our instructions; and 
• partners that are collaborating with us to fund projects. 

We do not share your personal data with third parties (including our service providers) for marketing purposes. Our affiliated companies will process your personal data to fulfil our directions or to respond to your request, and when doing so they will act as data controller for the processing conducted by them.

Third-party service providers are only authorised to use your personal data as necessary to provide its services to us. When CEPI uses data processors to collect, store, or otherwise process personal data on our behalf, the relationship to such service suppliers is governed by legal framework agreements, which, among other things, ensures the security and integrity of your personal data. CEPI entities and third-party service providers may be located within or outside the EU/EEA.

We may also share personal data with government agencies or authorities, or other third parties if and to the extent required by applicable law.

If you believe personal data you provided to us is being misused by a third party, please contact [email protected] right away.

6. Transfer of personal data outside the EEA/EU

The personal data that we collect from you may be transferred to and processed by a third-party service provider established in a country outside the EU/EEA/UK (i.e. a so-called third country), including countries which the EU Commission does not consider having an adequate level of protection for personal data. 

In such cases, CEPI will ensure that the personal data is subject to appropriate safeguards by, for example: 

• transferring personal data to countries approved by the EU Commission;
• entering the EU Standard Contractual Clauses;
• additional measures (if required) for such transfers or ensuring other appropriate safeguards.

7. Protection of personal data

CEPI will take appropriate technical and organisational measures to protect personal data. The measures will be consistent with applicable privacy and data security laws and regulations and will include requiring service providers to use appropriate measures to protect the confidentiality and security of personal data.

Whilst we take the protection of personal data seriously and take have put in place appropriate technical and organisational measures to safeguard the personal data that you provide to us, no transmission over the Internet can ever be guaranteed secure. Consequently, please note that we cannot guarantee the security of any personal data that you transfer over the Internet to us.

8. Retention of personal data

CEPI stores your personal data for as long as it is necessary to achieve the purposes for which the personal data was collected. CEPI will process your personal data until, at the very least, the conclusion of any relationship or interaction, and for a period after that period, to the extent this is necessary to;

• fulfil CEPI’s obligations pursuant to a contract or other agreements with you;
• establish, exercise, and defend a legal claim’
• safeguard CEPI’s legitimate interests; and 
• fulfil statutory obligations to which CEPI is subject, such as continued storage pursuant to accounting legislation. 

After such time, we will either delete or anonymise your personal data.

If any processing is, at any time, based on consent then the processing will cease when you withdraw your consent. You can withdraw your consent at any time. We may dispose of any data at our discretion without notice, subject to applicable law, or in accordance with a specific data processing agreement governing our processing of the personal data. 

9. Links to other websites and social media

Please note that our website may contain links to non-CEPI websites. CEPI is not responsible for the privacy policies or practices of such websites, and we recommend that you read the privacy policy and notice of any third-party site.

Your activity on our pages on social media, such as content you post and posts you like, will be shared on the relevant platform. The relevant platform will be responsible for the personal data it collects and processes through the platform. More information about how these platforms process personal data can be found in the relevant platform's privacy policy.

10. Automated Decisions

Automated decision making is the process of making decisions by automated means without any human involvement. These decisions are typically based on algorithmic processing of data, and they can include profiling, which is a form of automated processing of personal data to evaluate certain personal aspects relating to an individual.

CEPI does not envisage that you will be subject to decisions that will have a significant impact on you based solely on automated decision-making. CEPI will notify you in writing if this position changes using the contact details you provide.

11. Your rights

You have the following rights in relation to any personal data we process or store about you:

1. To access the personal data.
2. To correct inaccurate personal data.
3. To have personal data erased (right to be forgotten).
4. To restrict the processing of your personal data
5. To receive personal data you have provided to CEPI in a structured, commonly used, and machine-readable format for onward transmission (data portability).
6. To object to the processing. 

If the processing is based on your consent, you may at any time withdraw your consent.

You also can file a complaint with your local data protection supervisory authority. We encourage you to contact us first in order to address any objections against CEPI’s processing of personal data.

12. Contact information

If you have questions related to CEPI's processing of your personal data, this Privacy Notice, or want to exercise any of your rights, please contact [email protected].
 

13. Changes to this privacy notice

This Notice may be updated from time to time as and when we make changes to our processing of personal data. An updated copy will always be made available on CEPI’s website.