EEA Privacy Policy
Last update: June 2026
1. Introduction
These EEA Additional Privacy Disclosures (the “Disclosures”) supplement the Cytel Privacy Notice and apply only to individuals located in the European Economic Area (“EEA”) whose Personal Data is collected through our Online Platforms, where Cytel acts as a Data Controller within the scope of the European Union (EU) General Data Protection Regulation (“GDPR”), Regulation (EU) 2016/679.
These Disclosures should be read alongside the Cytel Privacy Notice and Cookie Policy. They set out information that is specific to EEA residents only. In the event of any conflict between these Disclosures and the main Privacy Policy in respect of EEA individuals, these Disclosure shall prevail.
“Cytel”, “we” or “us” means Cytel Inc. and our family of companies, including affiliates and subsidiaries.
“Online Platforms” means the websites, mobile applications and digital properties owned and operated by Cytel that link to these Disclosures.
2. Data Controller and EU Representative
2.1 Data Controller
The data controller responsible for your Personal Data processed under these Disclosures is:
| Controller | Cytel Inc. |
| Registered Address | 675 Massachusetts Avenue, Cambridge, MA 02139, United States |
| Data Protection Officer (DPO) | DPO@cytel.com | Privacy@cytel.com |
2.2 EU Representative (Article 27 GDPR)
Cytel Inc. is established in the United Staes of America. As a non-EEA controller offering services to EEA individuals, Cytel Inc, has designated an EU Representative under EU GDPR. EEA data subjects and Supervisory Authorities may contact Cytel France Sarl on all data protection matters.
| EU Representative (Art. 27 GDPR) | Cytel France Sarl |
| Registered / Postal Address | 5th Floor, 39 Rue d’Aboukir, 75002 Paris, France |
| Representative Contact | DPO@cytel.com | Privacy@cytel.com |
| Member State of Establishment | France |
| Lead Supervisory Authority | Commission Nationale de l’Informatique et des Libertes (CNIL) |
3. How We Collect, Use and Retain Personal Data
This section sets out EEA-specific information about how we collect and use your Personal Data. For full details of the Personal Data we collect, the purposes for which we use it, how we share it, our approach to profiling and automated decision-making, and our data retention practices, please see the Cytel Privacy Notice at cytel.com/privacy-policy
3.1 Lawful Basis for processing
For details of the lawful bases, we rely on to process your Personal Data, please see the Lawful Basis for Processing section of the Cytel Privacy Notice at cytel.com/privacy-policy.
3.2 Cookies and Tracking Technologies
For EEA residents, the use of cookies is governed by two distinct legal instruments: the EU GDPR, which governs the processing of personal data collected through cookies, and the EU ePrivacy Directive (2002/58/EC) as implemented in each Member State’s national law, which requires prior opt-in consent before any non-essential cookies are placed on your device.
| Cookie Category | GDPR Lawful Basis | Consent Required (ePrivacy) |
| Necessary | Legitimate interests (Art. 6(1)(f)) | No — exempt as strictly necessary |
| Analytics | Consent (Art. 6(1)(a)) | Yes — prior opt-in required |
| Functional | Consent (Art. 6(1)(a)) | Yes — prior opt-in required |
| Advertisement | Consent (Art. 6(1)(a)) | Yes — prior opt-in required |
For the full cookie inventory, descriptions and expiry periods please see our Cookie Policy at https://cytel.com/cookie-policy/
3.3 Data Retention
For details of our data retention practices please see “Section Data Retention” of the Cytel Privacy Notice at https://cytel.com/privacy-policy/
For EEA residents, retention is also governed by the storage limitation principle under Article 5(1)(e) of the GDPR.
4. International Data Transfers
Cytel is headquartered in the United States and operates globally. Your Personal Data may be transferred outside the EEA. We rely on the following safeguards:
| Transfer Mechanism | When Used | Further Information |
| EU Standard Contractual Clauses (SCCs — Commission Decision 2021/914) | Transfers from EEA to countries without an adequacy decision. | You can see the Standard Contractual Clauses adopted by the European Commission on their website. |
| Adequacy Decisions (Art. 45 GDPR) | Transfers to countries with EU adequacy status. | See ec.europa.eu for current list. |
| Intra-group arrangements | Transfers between Cytel group entities across jurisdictions, governed by intra-group data sharing agreements. | Group transfer arrangements enacted by Cytel. |
5. Your Rights Under the GDPR
As an EEA resident, your data subject rights are conferred by the EU General Data Protection Regulation (GDPR). For details of your rights and how to exercise them, please see Section 8 of the Cytel Privacy Notice at https://cytel.com/privacy-policy/
To exercise any of your rights please contact us at DPO@cytel.com. We will respond to all valid requests within one calendar month of receipt. In complex cases this may be extended by two further months with notification.
6. Right to Lodge a Complaint with a Supervisory Authority
If you consider that our processing of your Personal Data infringes the GDPR, you have the right to lodge a complaint with a competent supervisory authority in the EEA — in particular, in the Member State of your habitual residence, place of work or place of the alleged infringement.
| Authority | Jurisdiction | Contact |
| CNIL (France)
Lead Supervisory Authority |
Primary point of contact for cross-border complaints under Art. 56 GDPR, based on Cytel France Sarl as EU Representative. | cnil.fr/en/contact-cnil |
| Your National DPA | You may contact the supervisory authority in the EEA country where you live, work or where the alleged infringement occurred. | edpb.europa.eu/about-edpb/about-edpb/members_en |
| European Data Protection Board (EDPB) | Coordinates enforcement across the EEA and publishes GDPR compliance guidance. | edpb.europa.eu |
We encourage you to contact us in the first instance to resolve any concerns before escalating to a supervisory authority.
7. Contact Us
For any questions, comments or requests about these Disclosures or about how we process your Personal Data as an EEA resident:
| Organization | Cytel Inc. |
| Postal Address | 675 Massachusetts Avenue, Cambridge, MA 02139, United States |
| Data Protection Officer | DPO@cytel.com | Privacy@cytel.com |
| Website | https://cytel.com/eea-privacy-policy/ |
