ATAI ONLINE PRIVACY POLICY

Last Revised on 31 May 2023

This Privacy Policy is for atai Life Sciences N.V., and its affiliates and subsidiaries that have not otherwise adopted their own privacy notice (collectively, “atai”, “Company”, “we”, “us” “our”). This Privacy Policy describes how we collect, use and disclose information about U.S. users of our website (https://atai.life/), applications, services, tools and features (collectively, the “Services”).  For the purposes of this Privacy Policy, “you” and “your” means you as the user of the Services, a job applicant or a representative of a company we do business with.

Please note, we may provide additional privacy notices to different categories of individuals at the time we collect their data, including as follows:

• If you are an employee or contractor of atai, please refer to the Data Protection & Privacy Policy we provided to you at the start of your employment/engagement with us (as may be amended and updated from time to time), which can also be accessed on our internal portal.
• If you are a participant in a clinical trial sponsored by atai, please refer to the informed consent document provided to you in connection with your participation in the clinical trial (if needed, ask your physician responsible for the clinical trial for a copy).

Please read this Privacy Policy carefully so that you understand your rights in relation to your personal data, and how we will collect, use and process your personal data.  If you do not agree to this Privacy Policy, please do not use, access or download any of the services or otherwise provide your information to us.

1.                UPDATING THIS PRIVACY POLICY

We may modify this Privacy Policy from time to time in which case we will update the “Last Revised” date at the top of this Privacy Policy. If we make material changes to the way in which we use information we collect, we will use reasonable efforts to notify you (such as by emailing you at the last email address you provided us, by posting notice of such changes on the Services, or by other means consistent with applicable law) and will take additional steps as required by applicable law.  If you do not agree to any updates to this Privacy Policy please do not access or continue to use the Services or otherwise provide your information to us after such update.

2.                PERSONAL INFORMATION WE COLLECT ABOUT YOU

When you access or use the Services, we collect certain categories of information about you from a variety of sources, including (i) directly from you; (ii) automatically (such as from certain tracking technologies like website cookies); (iii) via third-party service providers we engage to assist us in our business; and (iv) from third-parties with your consent.

More specifically, when you use the Services, we may collect certain information about you, including:

• Basic contact details, such as: your name, address, e-mail address, telephone number.
• Information you provide as part of your job application (e.g., resume or CV, references, job history).

• Information we receive about you from third parties (e.g., through career websites and applicant tracking companies, including, but not limited to, Greenhouse). Any information we receive from outside sources will be treated in accordance with this Privacy Policy. We are not responsible or liable for the accuracy of the information provided to us by third parties and are not responsible for any third party’s policies or practices. See Section 5 below for more information.
• Any other information you choose to include in communications with us, for example, when sending a message through the Contact Us web form.

In addition to the foregoing, we may use any of the above information to comply with any applicable legal obligations, to enforce any applicable terms of service, and to protect or defend the Services, our rights, and the rights of our users or others.

3.                COOKIES AND OTHER TRACKING TECHNOLOGIES

We automatically collect certain information about your interaction with the Services as described in the atai Cookies Notice (https://atai.life/privacy-policy/). Most browsers accept cookies automatically, but you may be able to control the way in which your devices permit the use of cookies. If you so choose, you may block or delete our cookies from your browser; however, blocking or deleting cookies may cause some of the Services, including any portal features and general functionality, to work incorrectly.

Your browser settings may also allow you to transmit a “Do Not Track” signal when you visit various websites. Like many websites, our Website is not designed to respond to “Do Not Track” signals received from browsers. To learn more about “Do Not Track” signals, you can visit http://www.allaboutdnt.com.

If you have questions regarding the specific information about you that we process or retain, as well as your choices regarding our collection and use practices, please consult the atai Cookies Notice or contact us using the information listed below.

4.                PURPOSES FOR WHICH WE COLLECT PERSONAL INFORMATION

The personal information we collect about you is used in order to provide certain services to you, such as to provide you with the Services, other content and website functionality.

We collect personal information to communicate with you, improve and develop the Services and our business and to maintain our business relationship, including to train our AI/ML algorithms, we also process your personal information, as a matter of our legitimate interests, in the following ways:

• to respond to your message;
• to improve the Services;
• for internal business analysis or other business purposes consistent with our mission;
• administer the website and Services, and for internal operations, in order to conduct troubleshooting, data analysis, testing, research, statistical and survey analysis;
• maintain the safety and security of our users, the website, our Services, and business;
• send you announcements in relation to security, privacy or administrative related communications (these communications are not marketing orientated, and we do not rely on consent, so you may not opt out);
• to create anonymized and aggregated data sets that may be used for a variety of functions, including research, internal analysis, analytics, and other functions; and
• to carry out other purposes that are disclosed to you via the Services.

Where required by applicable law, we will obtain your consent to provide you with certain services such as updates related to our news / press releases or to send you newsletters.

We may also use personal information to comply with legal and regulatory obligations and assert and defend our legal rights, to cooperate with regulators and law enforcement bodies, to enforce any applicable terms and conditions and/ or terms of service, and to protect or defend our business, our rights, the rights of our users, or others.

As noted above, some features of the Services may require you to directly enter certain information about yourself. You may elect not to provide this information, but doing so may prevent you from using or accessing these features.

5.                HOW WE MAY DISCLOSE YOUR PERSONAL INFORMATION

In certain circumstances, we may disclose your information to third parties for legitimate purposes subject to this Privacy Policy. Such circumstances may include:

• With vendors or other service providers, including our third-party job applicant tracking and recruitment vendors, cloud service providers, IT service management vendors, security vendors.
• With our affiliates or otherwise within our corporate group, in our legitimate interests.
• With third parties for marketing purposes, in our legitimate interests or with your consent.
• With regulators, law enforcement agencies, public authorities, or any other relevant organisations, to comply with applicable law or any obligations thereunder, including cooperation with law enforcement, judicial orders, and regulatory inquiries, in our legitimate interests or as required by law.
• With a prospective buyer, seller, new owner, or other relevant third party as necessary in connection with an asset sale, merger, bankruptcy, or other business transaction, in our legitimate interests.
• With regulators, law enforcement agencies, public authorities, or any other relevant organisations, to enforce any applicable terms of service and ensure the safety and security of the Company and/or its users, in our legitimate interests or as required by law.
• With professional advisors, such as auditors, law firms, or accounting firms, in our legitimate interests or as required by law.

6.                THIRD PARTY WEBSITES AND LINKS

We may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of these sites, including the accuracy, completeness, or reliability of information found on these sites. Information you provide on public or semi-public venues, including information you share on third-party social networking platforms (such as Facebook or Twitter) may also be viewable by other users of the Services and/or users of those third-party online platforms without limitation as to its use by us or by a third party. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services.

7.                CHILDREN’S PRIVACY

Our Services are not directed to children (as defined in applicable law), and we do not seek or knowingly collect any personal information about children. If we become aware that we have unknowingly collected information about a child, we will make commercially reasonable efforts to delete such information from our database. If you are the parent or guardian of a child who has provided us with their personal information, you may contact us using the below information to request that it be deleted.

8.                INFORMATION SECURITY

Please be aware that, despite our reasonable efforts to protect your information, no security measures are perfect or impenetrable, and we cannot guarantee “perfect security.” Any information you send to us electronically, while using the Services or otherwise interacting with us, may not be secure while in transit. We recommend that you do not use unsecure channels to communicate sensitive or confidential information to us.

9.                CALIFORNIA RESIDENTS

This section applies only to California residents (“resident” or “residents”).

Processing of California Resident Personal Information

In the preceding 12 months, we collected and disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *) about residents:

Personal information for purposes permitted by applicable law, or otherwise with your consent. The purposes for which we and our vendors collect your personal information and the categories of sources from which we collect your personal information are described above in Sections 2 and 4. Over the past 12 months, we have disclosed the categories of personal information listed above for business or commercial purposes as described in Section 5 above. Our purposes for using and disclosing personal information may vary based on the circumstances and the nature of the personal information.

Selling and Sharing of Personal Information

We do not “sell” or “share” personal information (as those terms are defined in applicable law), including sensitive personal information, nor have we done so in the preceding 12 months. Further, we do not have actual knowledge that we sell or share for targeted advertising purposes personal information of individuals under 16 years of age.

10.            YOUR US PRIVACY RIGHTS

Depending on where you live in the US and subject to certain exceptions, you may have some or all of the following rights:

• Right to Know. You have the right to request that we disclose to you the personal information we collect, use, or disclose, and information about our data practices. For California residents, you may ask that we provide you with a copy of the following:
  • categories of and specific pieces of personal information we have collected about you;
  • categories of sources from which we collect personal information;
  • the business of commercial purposes for collecting personal information;
  • categories of third parties to whom the personal information was disclosed for a business purpose; and
  • categories of personal information disclosed about you for a business purpose.
• Right to Request Correction. You have the right to request that we correct inaccurate personal information that we maintain about you, subject to certain exceptions.
• Right to Request Deletion. You have the right to request that we delete your personal information that we have collected from or about you.
• Right to Limit Use and Disclosure of Sensitive Personal Information. For California residents, you have the right to limit our use and/or disclosure of sensitive personal information to only what is necessary to perform the services or provide the goods reasonably expected by an average resident. To exercise this right, please contact us using the details provided in the ‘Contact Us’ section below.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of these rights.

As we do not sell or “share” personal information, we do not recognize opt-out preference signals.

Under US privacy laws, you may also designate an authorized agent to make these requests on your behalf. If you use an authorized agent to submit a request, please note that we may need to collect additional information, such as a valid government-issued ID, to verify your identity before processing your request to protect your information and the integrity of our products. In addition, where applicable, we will provide you with more information about our appeal process. When you submit a request or launch an appeal, we will limit our collection of your personal information to only what is necessary to securely fulfil your request or process your appeal. We will not require you or your authorized agent to pay a fee for the verification of your request or appeal.

In addition, California law permits users in California to request certain details about how their “personal information” (as defined in California Civil Code Section 1798.83) is shared with third parties for direct marketing purposes. We may from time to time elect to share certain “personal information” about you with third parties for those third parties’ direct marketing purposes. California users may, under certain circumstances, request and obtain certain information regarding our disclosure, if any, of personal information to third parties for their direct marketing purposes. If this applies, you may obtain the categories of personal information shared and the names and addresses of all third parties that received personal information for their direct marketing purposes during the immediately prior calendar year.

To make such a request, please contact us using the information listed below. Please note that we are only required to respond to one request per California resident each year.

11.            YOUR EEA/UK RIGHTS

If you are located in the EEA or the UK, you have certain rights in relation to your information as follows:

• Access: You have the right to access information we hold about you, how we use it, and who we share it with.
• Portability: You have the right to receive a copy of the information we hold about you and to request that we transfer it to a third party, in certain circumstances and with certain exceptions.
• Correction: You have the right to correct any of your information we hold that is inaccurate.
• Erasure: In certain circumstance, you have the right to delete the information we hold about you.
• Restriction of processing to storage only: You have the right to require us to stop processing the information we hold about you, other than for storage purposes, in certain circumstances.
• Objection: You have the right to object to our processing of your information.
• Objection to marketing: You can object to marketing at any time by opting-out using the unsubscribe/ opt-out function in our communications to you.

Please note that a number of these rights only apply in certain circumstances, and all of these rights may be limited by law, for example, where fulfilling your request would adversely affect other individuals or our trade secrets or intellectual property, where there are overriding public interests or where we are required by law to retain your information.

To exercise any of these rights, you can contact us using the details below. We will respond to requests to exercise these rights without undue delay and at least within one month (though this may be extended by a further two months in certain circumstances).

If you think we have infringed data protection laws, you can file a claim with the data protection supervisory authority in the EEA country in which you live or work or where you think we have infringed data protection laws, or with the UK Information Commissioner’s Office, as applicable to you.

After the expiry of the retention periods specified below, we will store your information in an aggregated and anonymised format that does not permit your continued identification.

12.            WHERE WE STORE YOUR INFORMATION

If you are accessing the Services and/or website from the European Economic Area (EEA) or the United Kingdom (UK), your personal information will be stored at/processed in the EEA or UK. Your personal information is also processed by staff operating outside the EEA and the UK who work for us or one of our third party service providers or partners.

As a result, if you are accessing the Services and/or website from the EEA or UK, we may transfer information, including personal information, to a country and jurisdiction that does not have the same data protection laws as your jurisdiction. We will take all steps reasonably necessary to ensure that your personal information is treated securely and in accordance with this Privacy Policy. Where required under applicable laws, you consent to the transfer of information to the U.S. or any other country in which atai or its parent, affiliates or service providers maintain facilities.

For any transfers of personal information outside the EEA or the UK to third parties and/or affiliates, the data transfer will be under the European Commission’s model contracts for the transfer of personal data to third countries (i.e., the standard contractual clauses) (the “Model Clauses”), or any equivalent contracts issued by the relevant competent authority of the UK, as relevant, unless the data transfer is to a country that has been determined by the European Commission or the relevant UK authorities, as applicable, to provide an adequate level of protection for individuals’ rights and freedoms for their personal data. Please contact us at using the details below should you wish to examine a copy of the Model Clauses.

13.            HOW LONG WE STORE YOUR DATA

We retain the information that you provide to us for as long as necessary to provide the Services. If you contact us, we will keep your data in accordance with the reason for contacting us (e.g., for the length of time needed to resolve your request). Specifically, our retention of information is based on many factors such as your relationship with atai; the nature of the information; compliance with our legal obligations; defending or resolving actual or anticipated legal claims; or is otherwise permitted or required by applicable law, rule or regulation. We may further retain information in an anonymous or aggregated form where that information would not identify you personally.

14.            HOW TO CONTACT US

If you are located in the US and have any questions regarding this Privacy Policy or wish to exercise any of your US data subject rights as outlined above, please contact Ryan Barrett at the contact details below:

Address:
atai Life Sciences US Inc.
c/o Industrious NYC
250 West 34th St
New York, NY 10119
Email: [email protected]
Phone: +1 888 245 6184

If you are located in the EEA or UK and have any questions regarding this Privacy Policy or wish to exercise any of your EEA/UK data subject rights as outlined above, please contact us or our Data Protection Officer at the contact details below:

Atai Life Sciences N.V.
Wallstraße 16
10179 Berlin, Germany
Attention: General Counsel
Email: [email protected]

Our registered Data Protection Officer, PROLIANCE GmbH, can be contacted as follows:

Proliance GmbH / www.datenschutzexperte.de
Data Protection Officer
Leopoldstraße 21
80802 Munich
Email: [email protected]