PRIVACY POLICY

Last updated October 4, 2026

1. INTRODUCTION

This Privacy Policy describes how Athens Bioscience, Inc. (“Athens,” “we,” “our,” or “us”) collects, uses, discloses, and protects personal information you provide through our website at www.athensbioscience.com and any related services including sales, marketing, and events (collectively, the “Services”). It also describes the choices and rights available to you regarding your personal information and how you can exercise those rights.

Athens is a United States-based company headquartered in Athens, Georgia, that manufactures native human and animal proteins for the global life sciences industry. We serve customers in the United States, Europe, Asia, Canada and other regions worldwide. Our Services are directed to businesses, research institutions and the professionals who work for them; we do not market to consumers for personal, family or household purposes.

We encourage you to read this Privacy Policy carefully. By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. If you have questions or concerns, please contact us at legal@athensbioscience.com.

2. DATA CONTROLLER

The data controller responsible for your personal information is:

Athens Bioscience, Inc. 110 Trans Tech Drive Athens, Georgia 30601 USA

Email: legal@athensbioscience.com Telephone: +1.706.546.0207

If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland and have questions about how we process your data, please contact us at the address above.

3. INFORMATION WE COLLECT

We collect personal information in several ways depending on how you interact with our Services. The categories of personal information we have collected in the preceding twelve (12) months include the following:

3.1 Information You Provide Directly

• Contact Information: Name, email address, mailing address, and phone number, collected when you create an account, place an order, request a quote, or contact us.
• Billing and Payment Information: Billing address and payment details. Credit card numbers and financial account information are entered directly into forms hosted by, and processed directly by, our PCI-compliant third-party payment processor (Braintree) and are not collected or stored on Athens’ systems.
• Account Credentials: Username, account number, and password used to access your account.
• Business Information: Company name, company size, business type, job title, and role, collected to better serve your professional needs.
• Demographic Information: Education, professional interests, and zip code.
• Communications: Information contained in emails, contact forms, survey responses, and other communications you send to us.

Providing contact, billing and shipping information is necessary for us to accept and fulfill an order or to open an account; if you do not provide it, we will be unable to do so. All other information you provide is voluntary.

3.2 Information Collected Automatically

When you visit our website, we automatically collect certain technical information, including:

• Device and Browser Data: IP address, browser type and version, operating system, device identifiers, and screen resolution.
• Usage Data: Pages visited, referring and exit pages, time spent on pages, click patterns, and navigation paths.
• Location Data: Approximate geographic location inferred from your IP address.

This information is collected through cookies, web beacons, pixels, tags, scripts, and similar tracking technologies, as described in Section 9 (Cookies and Tracking Technologies) below.

3.3 Information from Third Parties

We may receive information about you from third-party sources including our distributors, business partners, and publicly available databases, which we may combine with the information we collect directly. Information we receive from distributors is limited to the contact, shipping and order details needed to fulfill, support and warrant products you have purchased through them.

4. HOW WE USE YOUR INFORMATION

We use the personal information we collect for the following business and commercial purposes:

• Order Fulfillment and Service Delivery: Processing and tracking transactions, shipping orders, managing your account, and providing customer support.
• Communications: Sending order confirmations, invoices, technical notices, security alerts, and administrative messages.
• Marketing: Sending newsletters, promotional communications, and product recommendations that we believe will be of interest and value to you. You may opt out of marketing communications at any time.
• Website Improvement and Analytics: Analyzing trends, administering the site, understanding how users interact with our Services, and improving user experience.
• Security and Fraud Prevention: Detecting, investigating, and preventing fraudulent transactions, unauthorized access, and other illegal activities.
• Legal Compliance: Complying with applicable laws, regulations, legal processes, and enforceable governmental requests.

4.1 Legal Bases for Processing (EEA, UK, and Swiss Users)

If you are located in the EEA, UK, or Switzerland, we rely on the following legal bases under the General Data Protection Regulation (GDPR) and equivalent laws to process your personal information:

• Consent (Article 6(1)(a)): Where you have given clear, affirmative consent for us to process your personal information for a specific purpose, such as subscribing to our newsletter, receiving electronic marketing where local law requires your prior consent (for example, in Germany), or accepting non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Performance of a Contract (Article 6(1)(b)): Where processing is necessary to fulfill our contractual obligations to you, such as processing orders, managing your account, and delivering products.
• Legitimate Interests (Article 6(1)(f)): Where processing is necessary for our legitimate business interests, such as improving our Services, conducting analytics, sending business-to-business marketing communications to existing customers and professional contacts where permitted by applicable electronic marketing laws, and ensuring security—provided these interests are not overridden by your data protection rights.
• Legal Obligation (Article 6(1)(c)): Where processing is necessary to comply with a legal obligation to which we are subject, such as tax reporting and regulatory record-keeping.

5. INFORMATION SHARING AND DISCLOSURE

We do not sell your personal information to third parties for monetary consideration. We share your personal information only in the ways described below:

5.1 Service Providers and Business Partners

We share personal information with companies that provide services on our behalf. These service providers are contractually bound to use your personal information only as necessary to perform services for us and are held to strict confidentiality obligations. Our current service providers and their roles include:

Google and Microsoft also act as independent advertising partners, as described in Section 5.2; in that role they are not acting as our service providers. This list may be updated from time to time.

5.2 Sharing for Targeted Advertising

We may share certain personal information (such as cookie identifiers, IP addresses, and browsing activity) with third-party advertising partners including Google and Microsoft for the purpose of delivering targeted advertising. Under certain state privacy laws, this sharing may be considered a “sale” or “sharing” of personal information even though no monetary payment is exchanged. You have the right to opt out of this sharing, as described in Section 7 (Your Privacy Rights and Choices) below.

5.3 Legal and Compliance Disclosures

We may disclose your personal information when we believe in good faith that disclosure is necessary to comply with applicable law, regulation, legal process, or enforceable governmental request; to protect the rights, property, or safety of Athens, our customers, or others; to investigate fraud; or to respond to a lawful request by public authorities, including to meet national security or law enforcement requirements.

5.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or similar transaction, your personal information may be transferred as part of that transaction. Any successor will be bound by this Privacy Policy or will provide you with notice of any material change. Where required by applicable law, we will notify you of such a transfer by posting a notice on our website or by email.

6. SENSITIVE PERSONAL INFORMATION

Under the California Privacy Rights Act (CPRA) and other state privacy laws, certain categories of personal information are classified as “sensitive personal information” or “sensitive data” and are subject to heightened protections.

Athens does not collect “sensitive data” as defined under the Virginia, Colorado, Connecticut and similar state privacy laws (such as racial or ethnic origin, religious beliefs, health data, sexual orientation, citizenship or immigration status, genetic or biometric data, precise geolocation, or data of known children). The only category of “sensitive personal information” under the CCPA that Athens collects is account log-in credentials. Payment card numbers are entered directly with our PCI-compliant payment processor and are not collected or stored by Athens.

We use account credentials solely to authenticate you and to maintain the security of your account. Because we do not use or disclose sensitive personal information for any purpose other than those permitted by the CCPA regulations without a right to limit, we do not offer a separate “Limit the Use of My Sensitive Personal Information” link.

7. YOUR PRIVACY RIGHTS AND CHOICES

Depending on where you reside, applicable privacy laws may grant you certain rights regarding your personal information. Many of these laws apply only to businesses that exceed revenue or volume thresholds, or do not apply to information about individuals acting in a business capacity, and may therefore not apply to Athens. Athens is nonetheless committed to honoring the rights described in this Section for all users regardless of location, to the extent practicable and subject to the exceptions and verification procedures permitted by law.

7.1 Rights Available Under U.S. State Privacy Laws

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Oregon, Montana, Texas, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, or another state with a comprehensive privacy law, you may have the following rights:

• Right to Know / Access: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business or commercial purpose for collection, and the categories of third parties with whom it was shared (or, where your state’s law so provides, a list of the specific third parties).
• Right to Correct: You may request that we correct inaccurate personal information we maintain about you.
• Right to Delete: You may request that we delete your personal information, subject to certain exceptions permitted by law.
• Right to Opt Out of Sale or Sharing: You may opt out of the “sale” or “sharing” of your personal information for targeted advertising purposes, as described in Section 7.4 below.
• Right to Limit Use of Sensitive Personal Information: To the extent applicable (see Section 6), you may request that we limit our use and disclosure of sensitive personal information to purposes that are necessary to perform the Services.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights. We will not deny goods or services, charge different prices, provide a different level of quality, or suggest that you will receive a different price or quality of goods or services as a result of exercising your rights.
• Right to Appeal: If we decline to take action on your request, you may appeal that decision. To submit an appeal, please contact us at legal@athensbioscience.com with the subject line “Privacy Rights Appeal.” We will respond to your appeal within the time period required by applicable law. If your appeal is denied, we will inform you of your right to contact your state’s attorney general.

7.2 Rights Available Under the GDPR (EEA, UK, and Switzerland)

If you are located in the EEA, UK, or Switzerland, you have the following additional rights under the General Data Protection Regulation (GDPR) and equivalent laws:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request that we correct inaccurate or incomplete personal data.
• Right to Erasure (“Right to Be Forgotten”): You may request deletion of your personal data where there is no compelling reason for its continued processing.
• Right to Restrict Processing: You may request that we restrict processing of your personal data in certain circumstances.
• Right to Data Portability: You may request that we provide your personal data in a structured, commonly used, machine-readable format so that it can be transferred to another controller.
• Right to Object: You may object to the processing of your personal data based on our legitimate interests, including direct marketing, which we will honor without justification.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local supervisory authority (data protection authority) if you believe our processing of your personal data infringes the GDPR. You may also complain directly to us at legal@athensbioscience.com; we will acknowledge your complaint within 30 days and respond without undue delay.

We do not currently engage in automated decision-making or profiling that produces legal or similarly significant effects on individuals. If this changes, we will update this Privacy Policy and provide the required disclosures under GDPR Article 22.

7.3 How to Submit a Request

To exercise any of the rights described above, please contact us using one of the following methods:

• Email: legal@athensbioscience.com
• Telephone: +1.706.546.0207
• Mail: Athens Bioscience, Inc., P.O. Box 80785, Athens, Georgia 30608, USA

We will acknowledge receipt of your request within thirty days. We will respond without undue delay.

To protect your privacy, we may need to verify your identity before fulfilling your request. We will not require you to create an account to submit a request. You may also designate an authorized agent to submit a request on your behalf, subject to appropriate verification.

7.4 Do Not Sell or Share My Personal Information

Athens does not sell your personal information for monetary consideration. However, some of our advertising practices, such as sharing browsing data with advertising partners for targeted advertising, may be considered “selling” or “sharing” under the California Privacy Rights Act and other state privacy laws.

You may opt out of such sharing by:

• Enabling a recognized universal opt-out signal in your browser, such as the Global Privacy Control (GPC). Athens recognizes and honors the GPC signal as a valid opt-out request.
• Contacting us at legal@athensbioscience.com with the subject line “Opt Out of Sharing.”

8. CALIFORNIA PRIVACY DISCLOSURES

This section provides additional disclosures required under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”)and the California Online Privacy Protection Act. These disclosures supplement the information provided elsewhere in this Privacy Policy.

8.1 Categories of Personal Information Collected

The following table summarizes the categories of personal information we have collected, the sources, purposes, and categories of third parties with whom we share each category in the preceding twelve (12) months:

8.2 Sale or Sharing of Personal Information

In the preceding twelve (12) months, Athens has not sold personal information for monetary consideration. Athens may have “shared” Internet/electronic activity information (such as cookie identifiers and browsing activity) with advertising partners for purposes of targeted advertising, which constitutes “sharing” under the CCPA. You may opt out of this sharing as described in Section 7.4. We do not knowingly sell or share the personal information of consumers under 16 years of age

8.3 Retention Periods

See Section 11 (Data Retention) for specific retention periods by data category.

8.4 Do Not Track and “Shine the Light”

Our website does not currently respond to browser “Do Not Track” (DNT) signals, for which no industry standard has been adopted; we do, however, honor the Global Privacy Control signal as described in Section 7.4. Third parties identified in Section 9 may collect information about your online activities over time and across different websites when you use our website. Athens does not disclose personal information to third parties for those third parties’ own direct marketing purposes within the meaning of California Civil Code §1798.83.

9. COOKIES AND TRACKING TECHNOLOGIES

9.1 Types of Cookies We Use

We use the following categories of cookies and similar tracking technologies:

• Strictly Necessary Cookies: Essential for the operation of our website, including shopping cart functionality, authentication, and security features. These cookies cannot be disabled.
• Functional Cookies: Used to remember your preferences and settings, such as language preference and display options.
• Analytics Cookies: Used to understand how visitors interact with our website, including page views, traffic sources, and navigation paths. We use Google Analytics, Microsoft Clarity, Hubspot and similar tools for this purpose.
• Advertising and Targeting Cookies: Used by our advertising partners (including Google and Microsoft) to deliver relevant advertisements based on your browsing activities and interests, both on our website and on other sites.

9.2 Cookie Consent

When you first visit our website, you will be presented with a cookie consent banner that allows you to accept or decline non-essential cookies. For visitors in the European Economic Area, United Kingdom, and Switzerland, we obtain your affirmative opt-in consent before deploying any non-essential cookies, as required by the GDPR and the ePrivacy Directive. For visitors in the United States, you may opt out of non-essential cookies through the consent banner or by adjusting your browser settings.

9.3 Behavioral Analytics and Session Replay

We may partner with third-party service providers to analyze how visitors use and interact with our website through behavioral metrics, heatmaps, and session replay technology. Session replay may capture mouse movements, clicks, scrolls, and form interactions on our website pages.

Important: We implement safeguards to protect your privacy during session replay, including masking or excluding sensitive form fields (such as payment and password fields), excluding checkout and payment pages from session recording, and applying data retention limits to session recordings. We currently use Microsoft Clarity for this purpose. Session recording is treated as an analytics cookie for the purposes of the consent choices described in Section 9.2 and does not begin until you have been shown our cookie banner. These analytics are conducted for the purpose of site optimization and improving user experience.

9.4 Opting Out of Targeted Advertising

In addition to the opt-out mechanisms described in Section 7.4, you may opt out of targeted advertising through the following tools:

• Digital Advertising Alliance (DAA): www.aboutads.info/choices
• Network Advertising Initiative (NAI): www.networkadvertising.org/choices
• Your browser’s cookie settings (see Section 8.4 regarding “Do Not Track” signals)

Please note that opting out of targeted advertising does not mean you will no longer see advertisements; rather, the advertisements you see will be less relevant to your interests.

10. SECURITY

We have implemented appropriate technical and organizational security measures designed to protect the personal information we process against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit using TLS (Transport Layer Security) encryption, access controls, and periodic security assessments.

When you enter payment information on our order forms, the transmission is encrypted and processed by our PCI-compliant third-party payment processors. Athens does not store your complete credit card number on its systems.

Despite our best efforts, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, and transmission of personal information to and from our Services is at your own risk. We encourage you to access our Services only within a secure environment and to use strong, unique passwords for your account. If we become aware of a security breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.

11. DATA RETENTION

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, as described in this Privacy Policy, unless a longer retention period is required or permitted by law. The following table summarizes our retention periods by data category:

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if deletion is not immediately possible (for example, because your information has been stored in backup archives), we will securely store and isolate your personal information from further processing until deletion is possible.

If you wish to cancel your account or request that we stop using your information to provide Services, please contact us at legal@athensbioscience.com.

12. INTERNATIONAL DATA TRANSFERS

Athens is based in the United States. If you are accessing our Services from outside the United States, including from the EEA, UK, or Switzerland, please be aware that your personal information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

Where you provide personal data directly to Athens through our website, Athens processes it as a controller that is itself subject to the GDPR, UK GDPR and Swiss Federal Act on Data Protection in respect of that data, and applies the protections described in this Privacy Policy. Where we transfer personal data originating in the EEA, UK or Switzerland to service providers in the United States or elsewhere, we rely on one or more of the following safeguards:

• Data Privacy Framework certification of the recipient: our principal service providers, including HubSpot, Google, Microsoft and BigCommerce, are certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework administered by the U.S. Department of Commerce.
• Standard Contractual Clauses (SCCs): Where required, we enter into the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum or Swiss amendments, as applicable) with our data processors and partners to provide adequate safeguards for the transfer of personal data.

For more information about the safeguards we use for international data transfers, please contact us at legal@athensbioscience.com.

12.1 Canada and Other Jurisdictions

If you are located in Canada, we process your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including Quebec’s Law 25. We send commercial electronic messages to Canadian recipients only with express or implied consent as permitted under Canada’s Anti-Spam Legislation (CASL), and every such message includes an unsubscribe mechanism. You may request access to or correction of your personal information, or withdraw consent, by contacting us as described in Section 7.3. If you are located in another jurisdiction, we will honor the rights available to you under applicable local law upon request.

13. CHILDREN’S PRIVACY

Our website and Services are intended for business professionals in the life sciences industry and are not directed at children under the age of sixteen (16). We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at legal@athensbioscience.com. If we learn that we have collected personal information from a child under 16 without verification of parental consent, we will take steps to delete that information promptly.

14. SOCIAL MEDIA WIDGETS

Our website may include social media features and widgets, such as the LinkedIn button or similar sharing tools. These features may collect your IP address and information about the page you are visiting on our site and may set a cookie to enable the feature to function properly. In some implementations, these widgets may transmit data to the social media platform even if you do not interact with the widget. Social media features are either hosted by a third party or hosted directly on our site, and your interactions with them are governed by the privacy policy of the company providing the feature.

15. LINKS TO OTHER WEBSITES

Our website may include links to other websites whose privacy practices may differ from those of Athens. If you submit personal information to any of those sites, your information is governed by their privacy policies. We encourage you to read the privacy policy of any website you visit.

16. PCI COMPLIANCE

We require our payment processing providers to comply with the Payment Card Industry Data Security Standard (PCI DSS), which provides a framework for the safe handling of cardholder data, including prevention, detection, and response to security incidents. Athens does not store complete credit card numbers on its systems; all payment processing is handled by PCI-compliant third-party processors.

17. DATA PROTECTION ASSESSMENTS

Athens reviews the privacy impact of new tracking, analytics or marketing technologies before deploying them, and conducts and documents formal data protection assessments where applicable law requires them. At present, the scale and nature of our processing do not meet the thresholds that require formal assessments under the GDPR or U.S. state privacy laws; if that changes, we will conduct the required assessments and update this Privacy Policy.

21. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We review this Privacy Policy at least annually. If we make material changes to how we use your personal information, we will notify you by email (sent to the email address associated with your account) or by means of a prominent notice on our website prior to the change becoming effective.

We encourage you to review this Privacy Policy periodically. The “Last Updated” date at the top of this policy indicates when it was most recently revised. Prior versions of this Privacy Policy are available upon request by contacting us at legal@athensbioscience.com.

22. CONTACT US

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Athens Bioscience, Inc.

Attn: Privacy Inquiries

P.O. Box 80785

Athens, Georgia 30608, USA

Email: legal@athensbioscience.com

Telephone: +1.706.546.0207

Website: www.athensbioscience.com

If you have an unresolved privacy concern that we have not addressed satisfactorily, you may have the right to lodge a complaint with your local data protection authority or state attorney general, as applicable.