PRIVACY POLICY

1. INTRODUCTION

This Privacy Policy describes how Athens Bioscience, Inc. (“Athens,” “we,” “our,” or “us”) collects, uses, discloses, and protects personal information you provide through our website at www.athensbioscience.com, our applications, and any related services including sales, marketing, and events (collectively, the “Services”). It also describes the choices and rights available to you regarding your personal information and how you can exercise those rights.

Athens is a United States-based company headquartered in Athens, Georgia, that manufactures native human and animal proteins for the global life sciences industry. We serve customers in the United States, Europe, Asia, and other regions worldwide.

We encourage you to read this Privacy Policy carefully. By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. If you have questions or concerns, please contact us at legal@athensbioscience.com.

2. DATA CONTROLLER

The data controller responsible for your personal information is:

Athens Bioscience, Inc. 110 Trans Tech Drive Athens, Georgia 30601 USA

Email: legal@athensbioscience.com Telephone: +1.706.546.0207

If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland and have questions about how we process your data, please contact us at the address above. If Athens appoints a representative in the EU under Article 27 of the GDPR, we will update this section with their contact details.

3. INFORMATION WE COLLECT

We collect personal information in several ways depending on how you interact with our Services. The categories of personal information we have collected in the preceding twelve (12) months include the following:

3.1 Information You Provide Directly

• Contact Information: Name, email address, mailing address, and phone number, collected when you create an account, place an order, request a quote, or contact us.
• Billing and Payment Information: Billing address and payment details. Credit card numbers and financial account information are processed directly by our PCI-compliant third-party payment processors and are not stored on Athens’ systems.
• Account Credentials: Username, account number, and password used to access your account.
• Business Information: Company name, company size, business type, job title, and role, collected to better serve your professional needs.
• Demographic Information: Education, professional interests, and zip code.
• Communications: Information contained in emails, contact forms, survey responses, and other communications you send to us.

3.2 Information Collected Automatically

When you visit our website, we automatically collect certain technical information, including:

• Device and Browser Data: IP address, browser type and version, operating system, device identifiers, and screen resolution.
• Usage Data: Pages visited, referring and exit pages, time spent on pages, click patterns, and navigation paths.
• Location Data: Approximate geographic location inferred from your IP address.

This information is collected through cookies, web beacons, pixels, tags, scripts, and similar tracking technologies, as described in Section 9 (Cookies and Tracking Technologies) below.

3.3 Information from Third Parties

We may receive information about you from third-party sources including our distributors, business partners, and publicly available databases, which we may combine with the information we collect directly.

4. HOW WE USE YOUR INFORMATION

We use the personal information we collect for the following business and commercial purposes:

• Order Fulfillment and Service Delivery: Processing and tracking transactions, shipping orders, managing your account, and providing customer support.
• Communications: Sending order confirmations, invoices, technical notices, security alerts, and administrative messages.
• Marketing: Sending newsletters, promotional communications, and product recommendations that we believe will be of interest and value to you. You may opt out of marketing communications at any time.
• Website Improvement and Analytics: Analyzing trends, administering the site, understanding how users interact with our Services, and improving user experience.
• Security and Fraud Prevention: Detecting, investigating, and preventing fraudulent transactions, unauthorized access, and other illegal activities.
• Legal Compliance: Complying with applicable laws, regulations, legal processes, and enforceable governmental requests.

4.1 Legal Bases for Processing (EEA, UK, and Swiss Users)

If you are located in the EEA, UK, or Switzerland, we rely on the following legal bases under the General Data Protection Regulation (GDPR) and equivalent laws to process your personal information:

• Consent (Article 6(1)(a)): Where you have given clear, affirmative consent for us to process your personal information for a specific purpose, such as subscribing to our newsletter or accepting non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Performance of a Contract (Article 6(1)(b)): Where processing is necessary to fulfill our contractual obligations to you, such as processing orders, managing your account, and delivering products.
• Legitimate Interests (Article 6(1)(f)): Where processing is necessary for our legitimate business interests, such as improving our Services, conducting analytics, sending business-to-business marketing communications, and ensuring security—provided these interests are not overridden by your data protection rights.
• Legal Obligation (Article 6(1)(c)): Where processing is necessary to comply with a legal obligation to which we are subject, such as tax reporting and regulatory record-keeping.

5. INFORMATION SHARING AND DISCLOSURE

We do not sell your personal information to third parties for monetary consideration. We share your personal information only in the ways described below:

5.1 Service Providers and Business Partners

We share personal information with companies that provide services on our behalf. These service providers are contractually bound to use your personal information only as necessary to perform services for us and are held to strict confidentiality obligations. Our current service providers and their roles include:

This list may be updated from time to time.

5.2 Sharing for Targeted Advertising

We may share certain personal information (such as cookie identifiers, IP addresses, and browsing activity) with third-party advertising partners including Google and Microsoft for the purpose of delivering targeted advertising. Under certain state privacy laws, this sharing may be considered a “sale” or “sharing” of personal information even though no monetary payment is exchanged. You have the right to opt out of this sharing, as described in Section 7 (Your Privacy Rights and Choices) below.

5.3 Legal and Compliance Disclosures

We may disclose your personal information when we believe in good faith that disclosure is necessary to comply with applicable law, regulation, legal process, or enforceable governmental request; to protect the rights, property, or safety of Athens, our customers, or others; to investigate fraud; or to respond to a lawful request by public authorities, including to meet national security or law enforcement requirements.

5.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or similar transaction, your personal information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

6. SENSITIVE PERSONAL INFORMATION

Under the California Privacy Rights Act (CPRA) and other state privacy laws, certain categories of personal information are classified as “sensitive personal information” and are subject to heightened protections.

Athens collects the following categories of information that may be considered sensitive: account login credentials (username and password combinations) and payment information (credit card or debit card numbers in combination with required security codes or passwords). As noted in Section 3.1, credit card numbers are processed directly by our PCI-compliant payment processors and are not stored by Athens.

We use sensitive personal information solely for the purposes of providing and fulfilling your orders, maintaining the security of your account, and processing transactions. We do not use or disclose sensitive personal information for purposes beyond what is necessary to provide the Services or as otherwise permitted by law. You have the right to limit the use and disclosure of your sensitive personal information as described in Section 7 below.

7. YOUR PRIVACY RIGHTS AND CHOICES

Depending on where you reside, applicable privacy laws may grant you certain rights regarding your personal information. Athens is committed to honoring these rights for all users regardless of location, to the extent practicable.

7.1 Rights Available Under U.S. State Privacy Laws

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Oregon, Montana, Texas, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, or another state with a comprehensive privacy law, you may have the following rights:

• Right to Know / Access: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business or commercial purpose for collection, and the categories of third parties with whom it was shared.
• Right to Correct: You may request that we correct inaccurate personal information we maintain about you.
• Right to Delete: You may request that we delete your personal information, subject to certain exceptions permitted by law.
• Right to Opt Out of Sale or Sharing: You may opt out of the “sale” or “sharing” of your personal information for targeted advertising purposes, as described in Section 7.4 below.
• Right to Limit Use of Sensitive Personal Information: You may request that we limit our use and disclosure of sensitive personal information to purposes that are necessary to perform the Services.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights. We will not deny goods or services, charge different prices, provide a different level of quality, or suggest that you will receive a different price or quality of goods or services as a result of exercising your rights.
• Right to Appeal: If we decline to take action on your request, you may appeal that decision. To submit an appeal, please contact us at legal@athensbioscience.com with the subject line “Privacy Rights Appeal.” We will respond to your appeal within the time period required by applicable law. If your appeal is denied, we will inform you of your right to contact your state’s attorney general.

7.2 Rights Available Under the GDPR (EEA, UK, and Switzerland)

If you are located in the EEA, UK, or Switzerland, you have the following additional rights under the General Data Protection Regulation (GDPR) and equivalent laws:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request that we correct inaccurate or incomplete personal data.
• Right to Erasure (“Right to Be Forgotten”): You may request deletion of your personal data where there is no compelling reason for its continued processing.
• Right to Restrict Processing: You may request that we restrict processing of your personal data in certain circumstances.
• Right to Data Portability: You may request that we provide your personal data in a structured, commonly used, machine-readable format so that it can be transferred to another controller.
• Right to Object: You may object to the processing of your personal data based on our legitimate interests, including direct marketing.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local supervisory authority (data protection authority) if you believe our processing of your personal data infringes the GDPR.

We do not currently engage in automated decision-making or profiling that produces legal or similarly significant effects on individuals. If this changes, we will update this Privacy Policy and provide the required disclosures under GDPR Article 22.

7.3 How to Submit a Request

To exercise any of the rights described above, please contact us using one of the following methods:

• Email: legal@athensbioscience.com
• Telephone: +1.706.546.0207
• Mail: Athens Bioscience, Inc., P.O. Box 80785, Athens, Georgia 30608, USA

We will acknowledge receipt of your request within ten (10) business days. We will respond substantively to verified requests within forty-five (45) days for requests under U.S. state privacy laws, or within one (1) month for requests under the GDPR. If we require additional time, we will notify you of the extension and the reason for it, as permitted by applicable law.

To protect your privacy, we may need to verify your identity before fulfilling your request. We will not require you to create an account to submit a request. You may also designate an authorized agent to submit a request on your behalf, subject to appropriate verification.

7.4 Do Not Sell or Share My Personal Information

Athens does not sell your personal information for monetary consideration. However, some of our advertising practices, such as sharing browsing data with advertising partners for targeted advertising, may be considered “selling” or “sharing” under the California Privacy Rights Act and other state privacy laws.

You may opt out of such sharing by:

• Enabling a recognized universal opt-out signal in your browser, such as the Global Privacy Control (GPC). Athens recognizes and honors the GPC signal as a valid opt-out request.
• Contacting us at legal@athensbioscience.com with the subject line “Opt Out of Sharing.”

8. CALIFORNIA PRIVACY DISCLOSURES

This section provides additional disclosures required under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”). These disclosures supplement the information provided elsewhere in this Privacy Policy.

8.1 Categories of Personal Information Collected

The following table summarizes the categories of personal information we have collected, the sources, purposes, and categories of third parties with whom we share each category in the preceding twelve (12) months:

8.2 Sale or Sharing of Personal Information

In the preceding twelve (12) months, Athens has not sold personal information for monetary consideration. Athens may have “shared” Internet/electronic activity information (such as cookie identifiers and browsing activity) with advertising partners for purposes of targeted advertising, which constitutes “sharing” under the CCPA. You may opt out of this sharing as described in Section 7.4.

8.3 Retention Periods

See Section 11 (Data Retention) for specific retention periods by data category.

9. COOKIES AND TRACKING TECHNOLOGIES

9.1 Types of Cookies We Use

We use the following categories of cookies and similar tracking technologies:

• Strictly Necessary Cookies: Essential for the operation of our website, including shopping cart functionality, authentication, and security features. These cookies cannot be disabled.
• Functional Cookies: Used to remember your preferences and settings, such as language preference and display options.
• Analytics Cookies: Used to understand how visitors interact with our website, including page views, traffic sources, and navigation paths. We use Google Analytics and similar tools for this purpose.
• Advertising and Targeting Cookies: Used by our advertising partners (including Google and Microsoft) to deliver relevant advertisements based on your browsing activities and interests, both on our website and on other sites.

9.2 Cookie Consent

When you first visit our website, you will be presented with a cookie consent banner that allows you to accept or decline non-essential cookies. For visitors in the European Economic Area, United Kingdom, and Switzerland, we obtain your affirmative opt-in consent before deploying any non-essential cookies, as required by the GDPR and the ePrivacy Directive. For visitors in the United States, you may opt out of non-essential cookies through the consent banner or by adjusting your browser settings.

You may also manage your cookie preferences at any time by clicking the “Cookie Settings” link in the footer of our website.

9.3 Behavioral Analytics and Session Replay

We may partner with third-party service providers to analyze how visitors use and interact with our website through behavioral metrics, heatmaps, and session replay technology. Session replay may capture mouse movements, clicks, scrolls, and form interactions on our website pages.

Important: We implement safeguards to protect your privacy during session replay, including masking or excluding sensitive form fields (such as payment and password fields), excluding checkout and payment pages from session recording, and applying data retention limits to session recordings. Providers currently used for these purposes are identified in our service provider list. These analytics are conducted for the purpose of site optimization and improving user experience, and we conduct data protection assessments for these activities where required by applicable law.

9.4 Opting Out of Targeted Advertising

In addition to the opt-out mechanisms described in Section 7.4, you may opt out of targeted advertising through the following tools:

• Digital Advertising Alliance (DAA): www.aboutads.info/choices
• Network Advertising Initiative (NAI): www.networkadvertising.org/choices
• Your browser’s cookie settings or “Do Not Track” preferences

Please note that opting out of targeted advertising does not mean you will no longer see advertisements; rather, the advertisements you see will be less relevant to your interests.

10. SECURITY

We have implemented appropriate technical and organizational security measures designed to protect the personal information we process against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit using TLS (Transport Layer Security) encryption, access controls, and regular security assessments.

When you enter payment information on our order forms, the transmission is encrypted and processed by our PCI-compliant third-party payment processors. Athens does not store your complete credit card number on its systems.

Despite our best efforts, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, and transmission of personal information to and from our Services is at your own risk. We encourage you to access our Services only within a secure environment and to use strong, unique passwords for your account.

11. DATA RETENTION

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, as described in this Privacy Policy, unless a longer retention period is required or permitted by law. The following table summarizes our retention periods by data category:

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if deletion is not immediately possible (for example, because your information has been stored in backup archives), we will securely store and isolate your personal information from further processing until deletion is possible.

If you wish to cancel your account or request that we stop using your information to provide Services, please contact us at legal@athensbioscience.com.

12. INTERNATIONAL DATA TRANSFERS

Athens is based in the United States. If you are accessing our Services from outside the United States, including from the EEA, UK, or Switzerland, please be aware that your personal information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

When we transfer personal data from the EEA, UK, or Switzerland to the United States, we rely on appropriate transfer mechanisms to ensure that your personal data receives an adequate level of protection, including:

• EU-U.S. Data Privacy Framework: Where applicable, we rely on the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce.
• Standard Contractual Clauses (SCCs): Where required, we enter into the European Commission’s Standard Contractual Clauses with our data processors and partners to provide adequate safeguards for the transfer of personal data.

For more information about the safeguards we use for international data transfers, please contact us at legal@athensbioscience.com.

13. CHILDREN’S PRIVACY

Our website and Services are intended for business professionals in the life sciences industry and are not directed at children under the age of sixteen (16). We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at legal@athensbioscience.com. If we learn that we have collected personal information from a child under 16 without verification of parental consent, we will take steps to delete that information promptly.

14. REFERRAL PROGRAM

We may from time to time offer a referral feature that allows you to share information about our products and Services with a colleague or associate. If you choose to use a referral feature, we will provide you with a unique shareable link or message that you can send directly through your own email, messaging, or social media applications. Athens does not collect the name, email address, or other personal information of the referred individual through this feature. If the referred individual visits our website and chooses to provide their personal information, that information will be collected and processed in accordance with this Privacy Policy.

15. SOCIAL MEDIA WIDGETS

Our website may include social media features and widgets, such as the LinkedIn button or similar sharing tools. These features may collect your IP address and information about the page you are visiting on our site and may set a cookie to enable the feature to function properly. In some implementations, these widgets may transmit data to the social media platform even if you do not interact with the widget. Social media features are either hosted by a third party or hosted directly on our site, and your interactions with them are governed by the privacy policy of the company providing the feature.

16. LINKS TO OTHER WEBSITES

Our website may include links to other websites whose privacy practices may differ from those of Athens. If you submit personal information to any of those sites, your information is governed by their privacy policies. We encourage you to read the privacy policy of any website you visit.

17. SURVEYS

From time to time, we may invite you to participate in voluntary surveys on our website or through other channels. If you choose to participate, we may request contact information (such as name and email address) and professional or demographic information (such as company name, role, and zip code). Participation in surveys is entirely voluntary. We use survey responses to improve our products and Services, collect customer testimonials (with your consent), and better understand the needs of our customers.

18. CUSTOMER TESTIMONIALS

We may post customer testimonials on our website that may contain personal information such as your name and company. We obtain your written consent prior to posting any testimonial that includes your personal information. If you wish to update or remove your testimonial, please contact us at legal@athensbioscience.com.

19. PCI COMPLIANCE

We require our payment processing providers to comply with the Payment Card Industry Data Security Standard (PCI DSS), which provides a framework for the safe handling of cardholder data, including prevention, detection, and response to security incidents. Athens does not store complete credit card numbers on its systems; all payment processing is handled by PCI-compliant third-party processors.

20. DATA PROTECTION ASSESSMENTS

Where required by applicable law, Athens conducts data protection impact assessments for processing activities that present a heightened risk to the rights and freedoms of individuals. These include processing activities involving targeted advertising, behavioral analytics, session replay technology, and the processing of sensitive personal information. We review and update these assessments periodically or when there are material changes to our data processing practices.

21. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We review this Privacy Policy at least annually. If we make material changes to how we use your personal information, we will notify you by email (sent to the email address associated with your account) or by means of a prominent notice on our website prior to the change becoming effective.

We encourage you to review this Privacy Policy periodically. The “Last Updated” date at the top of this policy indicates when it was most recently revised. Prior versions of this Privacy Policy are available upon request by contacting us at legal@athensbioscience.com.

22. CONTACT US

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Athens Bioscience, Inc.

Attn: Privacy Inquiries

P.O. Box 80785

Athens, Georgia 30608, USA

Email: legal@athensbioscience.com

Telephone: +1.706.546.0207

Website: www.athensbioscience.com

If you have an unresolved privacy concern that we have not addressed satisfactorily, you may have the right to lodge a complaint with your local data protection authority or state attorney general, as applicable.