Skip to content

Privacy Notice

Last Edited on 08 September 2026

This Privacy Notice applies to the processing of data related to the use of the website https://windwardbio.com/ (hereinafter “the Website”).

Windward Bio AG as the Person responsible for the processing of your personal data (“Controller”), hereinafter as “Windward Bio”, “we”, or “us”, has committed to comply with Data Protection Laws applicable to Windward Bio either because of (i) its place of establishment or (ii) the jurisdiction targeted in the context of clinical research sponsored by Windward Bio.

With this Privacy Notice, Windward Bio wants to make sure that you understand what personal information is collected about you, how your personal information is used, and how it is kept safe.

1. GENERAL WARNING AND USE OF SOCIAL MEDIA

Access to the Website implies the User’s full and unreserved acceptance of this Privacy Notice (hereinafter the “Notice”), as well as its general terms of use and the Cookies Notice. The User acknowledges having read the information below.

The Notice is valid for all pages hosted on the Website. It is not valid for the pages hosted by third parties to which Windward Bio may refer and whose privacy notices may differ. Windward Bio cannot therefore be held responsible for any data processed on these websites or by them. This Notice also applies to any other website that Windward Bio may operate, including our Company pages on LinkedIn.

Please, note that for the use of social media, Windward Bio will be Joint-Controller with LinkedIn Ireland Unlimited Company only for the following activities: accessing and processing statistical aggregate data provided by LinkedIn. For any other processing on the platform, the social media platform shall be considered as the sole Data Controller.

LinkedIn has created an “addendum” to their user agreements for company pages for the processing for which they are Joint-Controllers with us.

2. WHY, HOW, AND FOR HOW LONG DO WE COLLECT YOUR PERSONAL DATA?

Depending on the purpose for which we process your personal data, we need to process one or other personal data. We will keep them for no longer than necessary to fulfill the purposes for which we collected it, including any legal requirements.

Depending on each case, the processing will therefore be as follows:

Purpose Type of personal data Legal basis Retention period

To answer your queries either by email or through the contact form

Name, email address

Please note that other Personal Data may be processed by Windward Bio depending on your request and the information you provide us.

This processing is based on our legitimate interest in answering the requests or queries raised by you through the existing different contact channels or to fulfill our contractual obligations to address any relevant concerns about which you have contacted us.

We understand that the processing of these data is also beneficial to you to the extent that it enables us to assist you adequately and answer to the queries raised.

We will process your data for the time necessary to meet your request and as required by statutory limitation periods.

To send you newsletters

Name, email address

This processing is based on your consent.

Please, remember that you may unsubscribe from the Newsletter at any time without any cost.

We will process your data until you unsubscribe to the Newsletter.

For job applications

Name, email, address, contact details, application information you provided to us e.g., CV, education, professional background, pat remuneration, job preferences, social media profile information, facial image.

This processing is based on contractual obligations towards you and to take pre-contractual steps, to comply with legal or regulatory obligations and on our legitimate interest for the purpose of our recruitment process in order to administer and appraise job applications.

We understand that the processing of these data is also beneficial to you to the extent that it enables you to get a job by providing a spontaneous application or answering to an offer.

We will process your data for the time necessary to manage your application and as required by statutory limitation periods.

For statistical purposes

Aggregate statistical data (e.g., Company page on LinkedIn)

We consider that we have lawful interest to understand the way our page is consulted (e.g., how many times our page is consulted, from which country).

Statistical information is stored by LinkedIn and consequently subject to their retention policy. We may export statistical reports, but we guarantee that this is only in an anonymous form.

Use of cookies for the functioning and managing of our website

Cookies may store in certain circumstances personal data which may include: IP addresses, browser type, location, operating system.

Please, see our Cookies Notice for more information.

Please, see our Cookies Notice.

Monitoring and tracking of adverse events and quality complaints

Information you provide us, e.g., name, email address, health data and other information related to adverse events and quality complaints.

Compliance with legal obligations regarding the safety of medicinal products and medical devices and/or to ensure the safety of medicines in the substantial public interest.

To protect the vital interests of an individual or individuals.

We will retain the personal data only for as long as we reasonably deem necessary to fulfill this purpose and as required by applicable laws.

Some of our data processing activities may involve artificial intelligence (AI). In limited cases, we may also use a small amount of your personal data to train or fine-tune our AI systems – for example, to improve accuracy or performance. We do this only where it falls within our legitimate interests or where we have obtained your consent, and always with care to protect your privacy and rights. Any use of AI at Windward Bio is governed by applicable law and guided by principles of human oversight, transparency, and responsible use, supported by appropriate security safeguards.

We may combine, aggregate, or anonymize your personal data with information from other sources. These may include public databases, demographic data providers, joint marketing partners, public social media platforms (limited to information you have made publicly available), and other third parties. We may also use your personal data for routine business purposes, such as internal audits, monitoring for fraud, detecting misuse of our products or services, addressing intellectual property concerns, and improving or modifying our offerings.

In general, your data may be used where necessary to (i) comply with applicable laws and regulations and to respond to requests from governmental authorities, courts, subpoenas and regulators; (ii) enforce our terms and conditions; (iii) protect our legal rights, support criminal or legal investigations/proceedings; (iv) protect the security and integrity of this website; or (v) facilitate the negotiation, evaluation, or completion of a corporate or commercial transaction.

3. DATA SHARING AND DATA TRANSFER

We do not sell or trade to outside parties your personal data.

Nevertheless, Windward Bio may need to share your personal data with authorized recipients (e.g., employees, service providers such as IT system providers, potential acquirers and other entities the event of a merger, joint venture, acquisition, assignment, spin-off or divestiture) for the purposes described above. We ensure the protection of your personal data by imposing adequate contractual obligations on the authorized recipients.

In certain situations, your personal data may be transferred to third parties through the use of products or services integrated on our Website. For further information, please consult our Cookie Notice.

Sharing your personal data as explained above may involve a transfer of personal data to a country outside your place of residence. Windward Bio is therefore committed to complying with the transfer rules under Data Protection Laws and therefore ensure to:

  • Transfer your data to countries that have been recognized as adequate by the relevant national or international authority (“Competent Authority”); or
  • Where a country has not received an adequacy decision from the Competent Authority, to implement appropriate safeguards, such as the standard contractual clauses or model clauses developed, issued or recognized by the relevant authorities.

You can contact our Data Protection Officer, hereinafter as DPO, (see contact details below), if you want to have more details about the mechanism supporting the data transfer.

Under Swiss provisions: The list of all the third countries and related safeguards are further described in the Annex I.

4. HOW DO WE PROTECT YOUR INFORMATION?

Windward Bio treats your personal data in a confidential manner and provides for a sufficient and adequate level of protection of your personal data.

Your personal data are contained behind secured networks and are only accessible by a limited number of persons who have special access rights to such systems and are required to keep the information confidential.

5. YOUR PERSONAL DATA RIGHTS

According to Data Protection Laws, you have the following rights subject to limitation as set forth by applicable law:

  • Access. You have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, information related to the processing of data and a copy of the data being processed.
  • Rectification. You have the right to require rectification of inaccurate or incomplete data about you.
  • Right to be forgotten. To obtain the deletion of your personal data under certain specified circumstances.
  • Restrict processing. You have the right to restrict processing of data under certain specified circumstances.
  • Data portability. You have the right to request for the receipt or the transfer to another organization, in a machine-readable form, of your personal data.
  • Object to processing. You have the right to object, on grounds relating to your particular situation, at any time to the processing of your data.
  • Right to withdraw consent. When you have given your explicit consent for the processing of your data, you can withdraw it at any time without any cost nor justification.

Under CCPA/CPRA provisions: please note that you have several rights that are further described in the Annex II.

Please note that all these rights are not absolute and will be assessed on a case-by-case basis by our DPO.

If you would like to exercise your rights, please let us know by contacting our DPO, windwardbio.privacy@mydata-trust.info.

You have also the right to lodge a complaint if you consider that your personal data is not processed in accordance with the Data Protection Laws.

Please find the contact information of all Authorities in section 6 “Contacts”.

6. CHANGES TO THIS PRIVACY NOTICE

This Notice is effective as of the date stated at the top of this page. We may change this Notice from time to time. Please refer to this Notice on a regular basis.

7. CONTACTS

Windward Bio AG, acting as Controller or any equivalent term in Data Protection Laws
Aeschenplatz 6, 4052 Basel, Switzerland

EEA Data Protection Representative:

MyData-TRUST France
Rue de Rennes, 140b, 75006 Paris (FRANCE)
Email: windwardbio.dpr.eu@mydata-trust.info

UK Data Protection Representative:
MyData-TRUST LTD
Belmont Building, Belmont Road – Uxbridge, UB8 1HE (UNITED KINGDOM)
Email: windwardbio.dpr.uk@mydata-trust.info

Data Protection Officer
windwardbio.privacy@mydata-trust.info

Data Protection Authorities

ANNEX I: List of the third countries and related appropriate safeguards in case of data transfers

Third countries Appropriate safeguards

European Union & European Economic Area

Adequacy decision

United States of America

Swiss-U.S. / EU-U.S. Data Privacy Framework (for DPF-certified recipients) and standard contractual clauses

United Kingdom

Adequacy decision

ANNEX II: Additional information for California residents

Depending on your residency, you may have certain additional information and certain rights. In the United States, these rights vary by state.

If you are a California resident, additional information should be provided as follows:

Do Not Track (“DNT”) requests. DNT is an optional browser setting that allows you to express your preferences regarding tracking by advertisers or other third parties. Some web browsers may allow you to transmit a “Do Not Track” signal to online services and websites. If a website receives such signal, the web browser can block that website from collecting certain Personal Information about you. We will try our best to respond to global privacy controls, including DNT signals. However, we do not assume liability for failure to comply with DNT signal by our partners and / or providers.

Children’s Online Data. It is not our intention to collect personal information from children under the age of 13 through our Website. If you are under 13, please do not give us any personal information through our Website. We encourage parents and legal guardians to monitor their children’s internet usage and to help enforce our Notice by instructing their children never to provide us personal information. If you have reason to believe that a child under age 13 has provided personal information to us through our Website, please contact us and we will endeavor to delete that personal information from our records, unless other applicable law requires us to retain that information.

If you are a California resident, you have the following rights with respect to your Personal Information:

“Shine the Light” and “Eraser” Laws. You may request a list of all third parties to which we have disclosed certain information for those third parties’ direct marketing purposes.

The right to know. You may have the right to request that we disclose to you the personal information we have collected or sold about you and how it is used and shared. Here is the information you may have access to:

  • the categories of personal information collected;
  • the categories of sensitive personal information collected;
  • the categories of sources from which the personal information or sensitive personal information is collected;
  • the business purpose for such collection, sharing, or selling;
  • the categories of third parties to whom to personal information or sensitive personal information is disclosed to;
  • the specific pieces of personal information collected;
  • the length of time that the business intends to retain each category of personal information and sensitive personal information.

The right to access. You may have the right to access personal information which we may collect or retain about you free of charge (for which we have 45 days to respond). If requested, we shall provide you with a copy of your personal information which we collect. You also have the right to receive your personal information in a structured and commonly used format so that it can be transferred to another entity (“data portability”).

The right to opt-out of sale/share of my personal information. You have the right to opt-out from selling of your personal information, which means that any third party who has received your personal information as part of their ‘sale’ may only further sell that personal information if you have provided “explicit notice” and the opportunity to opt-out of that subsequent sale. This right to opt-out of the sale is absolute. Further, you have the right to opt-out for sharing your personal information. This right can be exercise by emailing windwardbio.privacy@mydata-trust.info and cannot be re-solicited before a period of 12 months for additional purposes.

The right to limit use of sensitive personal information. You have the right to direct us to limit the use of your sensitive personal information to what’s necessary or reasonably expected to perform the service or provide the goods. This right can be exercise by emailing windwardbio.privacy@mydata-trust.info.

The right to correct inaccurate personal information. You have the right to require rectification of inaccurate personal information about you. Upon verifying the validity of a verifiable consumer correction request, we will use commercially reasonable efforts to correct your personal information as directed within 45 days (with the possibility to extend the period once), taking into account the nature of the personal information and the purposes of maintaining your personal information.

The right to request deletion of personal information. You have the right to request the deletion of your personal information collected, or maintained by us, subject to certain exceptions permitted by law. In the event of a request for deletion, we will acknowledge receipt of your request within ten (10) business days and will endeavor to respond substantially within forty-five (45) days.

The right to not be subject to discrimination (“right to equal service and price”). You have the right not to be denied of goods or services, to be charged for different prices or rates for goods or services or provided a different level or quality of goods or services.