Avantor Commercial Data Privacy Statement

Last Updated: March 30, 2023

Your privacy is important to you and therefore, it is important to Avantor. This Commercial Data Privacy Statement, referred to throughout as the Privacy Statement, provides three important pieces of information:

1. How Avantor collects personal data from you;
2. What personal data Avantor collects from you through our interactions with you or through our marketing of products and services to you, whether directly or through our affiliated companies; and
3. How we use that personal data.

Avantor, Inc. and all of its affiliated organizations are referred to in this Privacy Statement as “Avantor” and also as “we,” “us,” or “our.” We may refer to a particular affiliate by name, but unless we do that, this Privacy Statement applies to all of Avantor’s affiliates. The term “personal data” is used in this Privacy Statement to refer to any information that can be used, alone or in combination with other information, to identify an individual.

Avantor offers many products and services so we can be a trusted partner to you, supporting your goals by providing discovery‐to‐delivery solutions for the global life sciences and advanced technology industries. This Privacy Statement applies to Avantor’s interactions with you, the products and services described in this Privacy Statement, and other Avantor products and services that display this Privacy Statement.

How We Collect Personal Data

Avantor collects personal data from you so that we can operate effectively and provide you the best services and products. You provide some of this personal data directly, such as when you create an account on our websites or our mobile applications, when you browse or order products or services through our websites, when you interact with our customer contact centers or our sales representatives, when you order products or services on your own behalf or on behalf of your organization, upload information to SciTivity.com or similar websites, respond to our direct mail solicitations, electronic and Internet marketing campaigns, newsletters, and promotional campaigns, when you contact us to request literature, information, or support, and when you respond to satisfaction surveys. We also collect some personal data by recording how you interact with us by using different technologies, such as through small text files stored on your device(s) that are commonly known as “cookies,” and by collecting your personal ordering history to better predict the products and services that you might purchase in the future.

We also obtain certain personal data from third parties. Those third parties include:

• Social networks when you follow, like, connect, or otherwise engage with our presence on different social media platforms;
• Shipping, transport, customs, freight‐forwarding and other logistics companies, distributors, sub‐distributors and other channel partners, suppliers, vendors, third parties that verify or supply credit, location, or address information;
• Payment processors;
• Service providers, including Internet service providers, that provide us with your IP address, their identifying information, browser type, operating system and language, referring and exit pages, uniform resource locators, date and time, amount of time spent on particular pages, the sections of our websites that you visit, number of links you click while on our websites, and the search terms that you use;
• Suppliers and other business partners with which we offer co‐branded or other services, or engage in joint marketing activities; and
• Publicly‐available sources such as open government databases or other personal data in the public domain.

Personal Data We Collect

You have choices about the personal data we collect. The data we collect depends on the context of your interactions with Avantor, the choices you make, including your privacy choices, and the products and services you use. When you are asked to provide personal data, you may decline. If you choose not to provide personal data that is necessary to provide a product or service, we may not be able to provide that product or service to you.

The personal data we collect can include the following:

Name and Contact Data. We collect your first and last names, e‐mail address, job title or role, billing and delivery addresses, name of the organization you represent, telephone and fax numbers, and other similar contact data.

Credentials. We collect passwords, password hints, user names, account numbers, and similar security information used for authentication and account access.

Demographic Data. We collect personal data about you such as the country where you live or work, your department in the organization you represent, your industry, your professional interests, and your preferred language.

Payment Data. We collect personal data necessary to process your payment if you make purchases, such as your payment instrument number (for example, a credit card number or purchase order number), the security code associated with your payment instrument, if required, and the expiration date of your payment instrument.

Usage Data. In addition to the data we collect both directly and from third parties about your usage of our websites and mobile applications, we collect personal data about how you and your organization purchase and use our products and services. For example, we collect:

• Product Use Data. We collect data about the products and services you view or purchase, the web pages you visit, and the products you put in your shopping cart. This data includes your search queries, the settings and preferences you select, and technical requirements.
• Device, Connectivity and Configuration Data. We collect data about your device and the network you use to connect to our products. This includes data about the operating systems, browser, and other software installed on your device and also includes IP addresses and device identifiers.
• Warranty, Returns, and Other Performance Data. We collect data about the performance of the products and services that you purchase and your experiences with them. We also collect feedback you give to us, product reviews you write, and questions and information you provide to customer support. When you contact us, such as for customer support, we monitor and record telephone phone conversations or chat sessions with our representatives, unless monitoring or recording is prohibited by law. We also collect data on the performance of our websites and if they are functioning properly. This data helps us to identify problems in the products you use, and to improve our products, services, and purchasing options.

Interests and Affiliations. We collect data about your professional interests, such as the industry where you work, the categories and types of products and services that you are or might be interested in, and our publications that you subscribe to. In addition to the personal data you explicitly provide to us, we may infer your interests from other data that we collect.

Contacts and Relationships. We collect data about your contacts if you use one of our laboratory management websites or applications, such as SciTivity.com and communicate or interact with other people or organizations through those platforms.

Location Data. We collect data about your location when you provide your billing and delivery addresses. We also collect data about your location when you use our websites and mobile applications or certain location‐based products or features in our mobile applications through Global Navigation Satellite System (GNSS) data. Your IP address as well as city, country, and postal code information also provides us with imprecise location data about you.

Personal Content. We collect the content of your files and other communications when necessary to provide you with information about products and services and support for those products and services. For example, if you transmit a file containing picture of a damaged shipment, we collect the content of that file to assess your claim. For example, if you upload a list of laboratory equipment and personnel to SciTivity.com, we collect that list of equipment and personnel to provide equipment scheduling services. Other data we collect to provide communication services to you include the:

• subject line and body of an email,
• text or other content of an instant message,
• audio and video recording of a video message, and
• audio recording and transcript of a voice message you receive.

Video Images. If you enter our corporate, manufacturing, or distribution locations or other facilities, or attend an Avantor event, your image may be captured by our security cameras.

How We Use Personal Data

Avantor uses the personal data we collect from you or about you for two primary purposes:

1. to operate our business and provide you with the products and services we offer and you purchase; and
2. to communicate with you, including through our efforts to promote, educate and make you aware of our business, products, and services.

In carrying out these purposes, we use the personal data that we collect to provide you with a better customer experience and to provide you with access to our products and services. For example, if you are logged into your account and browse certain types of laboratory equipment or a certain grade of chemicals, we can use that information and other information associated with your account to make recommendations or inform you when new products that you may be interested in are available. We may also use provide information about the products you viewed on our website to our sales personnel so they can determine if you are interested in purchasing those products. As another example, if you and other customers in the same geographic area order a high volume of a certain product or service, we can make sure that we have adequate stocks of that product or adequate resources to fulfil that service in that geographic area.

Providing and improving our products and services. We use data to provide and improve the products and services that we offer and to perform operations that are essential to our business. This includes sourcing, manufacturing and distributing the products, maintaining and improving the performance of the products, developing new products, conducting research, providing customer support, and developing and improving services. Examples of such uses include the following:

• Providing products and services. We use data to carry out your transactions with us and to provide our products and services to you.
• Customer support. We use data to repair, replace, or refund products or services, provide required regulatory information, and provide other customer support services.
• Product and service improvement. We use data to improve the performance of our products and services and to develop new products and services. For example, we use warranty claims to identify manufacturing errors and work with our suppliers to remedy those claims and develop improved products.
• Business operations. We use data to develop, aggregate, and analyze information so we can operate and make informed decisions about our business.

Communications. We use the data that we collect from you to communicate with you and personalize our communications with you. For example, we may contact you by e‐mail or other means to remind you that you placed products in your online shopping cart and those products are ready for purchase, to notify you when a product that you frequently purchase has been updated or improved or when we have special pricing on products you have shown an interest in, to update you on the status of your order, to invite you to participate in a survey, or to send you a publication relevant to your areas of professional interest.

Marketing. We use data we collect through our business interactions with you and through our websites to market products and services. For example:

• We may use your data to select and deliver additional information about products and services that you might be interested in.
• We may share aggregated and anonymous data we collect with third parties to help us analyze product and service purchases so we can more effectively market products that you may want to purchase.

The marketing and promotional items that you see may be selected based on data we have collected about you, such as your professional interests, your transactions, or the content you view while logged into our websites. For example, if you are interested in chromatography, we may market chromatography products and services to you.

Why We Share Personal Data

We share your personal data with your consent or as necessary to complete the transactions that you initiated with us so that we can provide the products and services that you requested or authorized. For example, we share your name, delivery address, and other relevant contact information with third parties, such as our suppliers, when you order products from us that are shipped directly from the supplier’s facility to you. We also share your name, delivery address, and other relevant information with our subcontractors that provide services to you that you ordered through us. Also, when you provide payment data to make a purchase, we will share payment data with banks and third‐party payment processors so that we can receive payment and to protect you and us from fraud and credit risk.

In addition, we share personal data among Avantor‐controlled affiliates and subsidiaries so that we can provide products and services to you or your organization across the globe. We also share personal data with our vendors or other third parties that work on our behalf in ways that are consistent with the purposes described in this Privacy Statement. For example, we have entered into contracts with companies to store and secure data in their facilities or to provide software to help us run and manage the data generated by our business. The data that these companies store, secure, and help us manage contains your personal data. These companies must agree to follow data privacy protections and security requirements imposed by law and by the contracts that we have signed with these companies, and they cannot use the personal data that they receive from us for any other purpose other than the specific purposes related to our business. We may also disclose personal data as part of a corporate transaction such as a merger or sale of assets.

Finally, we will access, transfer, disclose, and preserve personal data when we have a good faith belief that doing so is necessary to comply with applicable law or respond to a valid legal process, including from law enforcement or other government agencies; to help prevent the loss of life or serious injury of anyone; and other reasons permitted by data privacy laws.

Many processing activities that we conduct on your personal data are done with your consent. You may revoke your consent at any time with future effect. We request that you send an e‐mail to the e‐mail address in this Privacy Statement in order to revoke your consent. The data processed before we receive your request may still be legally processed, and any data processed as part of performance of a contract to which you are a party or that is processed for the purposes of legitimate interests will also still be processed.

How to Access and Control Your Personal Data

You always have the right to request information about the personal data that we store and process, its origin, its recipients, and the purpose of its collection. This information will be provided to you at no charge. You also have the right to request that your personal data be corrected, blocked, or deleted. You can contact us at any time using the e‐mail addresses provided in this Privacy Statement, or by writing to our Data Protection Officer at the address provided below. You may also, of course, file a complaint with the data protection authority in your country.

You can also make choices about Avantor’s collection and use of your data. How you can access or control your personal data will depend on which websites you use. For example:

• Online account. If you wish to access, edit, or remove certain profile information in your Avantor or VWR account, change your password, or add security information, you can do so by visiting our websites.
• Anonymous Browsing. To afford privacy protection, you have the option to browse our websites or use our applications without revealing certain personal data to us, such as your first or last names, e‐mail address, or telephone number, although special features such as product availability, contract pricing and ordering will require you to register or log in to your account.

If you cannot access certain personal data collected by Avantor via our websites, you can always contact Avantor or any of our affiliated companies, using the e‐mail address below. We will take action on your request or notify you that we need an extension of time to take action on your request without undue delay and in any event, within one month of receipt of your request.

DPO@avantorsciences.com

Your Communications Preferences

You can choose whether you wish to receive promotional communications from Avantor by e‐mail, physical mail, and telephone. If you receive promotional e‐mails from us and would like to opt out, you can do so by following the directions in that message. You can also make choices about the receipt of promotional e‐mail, telephone calls, and postal mail by signing into your account and viewing your communication and mailing preferences where you can update contact information, manage contact preferences, opt out of subscriptions, and choose whether we can share your contact information with third parties for promotional and marketing purposes. If you do not have an account through one of our websites, you can manage your contact preferences by speaking with our customer service teams. These choices do not apply to mandatory communications that are part of certain Avantor businesses, such as order acknowledgement, shipping notices, or order approval requests, or to other informational communications that have their own unsubscribe method.

Your Right to File Complaints with European Union Regulatory Authorities

Citizens of the European Union Member States have the right to initiate a complaint with a supervisory authority in the EU Member State where they live, where they work, or where they think the alleged infringement of their data privacy rights occurred. Citizens of the European Union Member States also have the right to initiate a complaint and to receive an effective judicial remedy if they think that their data privacy rights were infringed because we did not comply with data privacy laws when processing of their personal data. European Union citizens can initiate a claim for a judicial remedy in the courts of the EU Member State where we are established or where a citizen lives.

Filing a complaint with a supervisory authority or seeking a judicial remedy does not prevent a citizen of the European Union from seeking any other remedies for in infringement of his or her data privacy rights.

Cookies and Similar Technologies

A cookie is a piece of code associated with your device when you visit a website or application. A cookie often consists of a string of numbers and letters that uniquely identifies your computer, but it can contain other information as well. Avantor uses cookies, plug‐ins, links to third party websites and applications, and similar technologies to provide our websites and online services and to collect personal data. Third parties also collect personal data on our behalf using cookies and similar technologies so that those third parties can provide services and information to us.

Our Use of Cookies and Similar Technologies

We use cookies and similar technologies for several purposes, depending on the product or services, including:

• Storing your preferences and settings. Settings that enable our websites to operate correctly or that maintain your preferences over time may be stored on your computer or other device. For example, we save preferences, such as language and browser settings, so those do not have to be reset each time you return to our website. If you opt out of interest‐based marketing, we store your opt‐out preference in a cookie on your device.
• Sign‐in and authentication. When you sign into a website using your account, we store unique identifiers on your device so you can move from page to page within the website without having to sign in again on each page. You may also be able to save your sign‐in information so you do not have to sign in each time you return to the website.
• Security. We use cookies to improve the security of our websites and services.
• Storing information you provide. When you provide information, or add products to a shopping cart, we store the data in a cookie to remember the products and information you have added.
• Feedback. Avantor uses cookies to enable you to provide feedback on our websites.
• Analytics. In order to provide our products and services, we use cookies and other identifiers to gather usage and performance data. For example, we use cookies to count the number of unique visitors to a web page and to develop other statistics about the operations of our products. This includes cookies from Avantor and from third‐ party analytics providers.
• Performance. We use cookies for load balancing to ensure that websites remain functional.

In addition to the cookies Avantor sets when you visit our websites, third parties may also set cookies when you visit our websites. In some cases, that is because we have hired the third party to provide services on our behalf, such as site analytics.

How to Control Cookies

On Avantor website, a banner about cookies notifies web users that Avantor’s website may use cookies with the possibility for the web user to have more information if needed on clicking on a link. In certain countries, web users can select their cookies preference on the Cookie Preferences Page. If they continue to use the website without selection, only cookies essential to website function will remain in place. Web users have the possibility to accept all cookies or accept only essential cookies. Web users can update their preferences at any time. Our web browser provides controls so that you can block, delete or select cookies. .Certain features of our websites and your ability to purchase or browse products depend on cookies. Please be aware that if you choose to refuse all cookies, you may not be able to sign in or use certain features, and preferences that are dependent on cookies may be lost. If you choose to delete cookies, settings and preferences controlled by those cookies will be deleted and may need to be recreated.

Our Use of Analytics Services

Our websites often contain technologies from third‐party analytics providers, which help us compile aggregated statistics about the effectiveness of our website, marketing efforts, or other operations. These technologies enable the analytics providers to set or read their own cookies or other identifiers on your device, through which they can collect information about your online activities across applications, websites or other products. The analytics of your activity while on our website is usually anonymous, but third parties may have the capability to combine this information with other information collected about you from other websites or from other third parties to identify you and develop a profile about your activities on the Internet.

Third Party Services

Some of our websites and applications contain plug‐ins or other features that connect you to websites or other platforms owned or operated by third parties. We have listed those third parties, provided some information about the services those third parties provide to us and how those third parties may access or collect your personal data, and provided you with information about how to contact those third parties below. Connecting to such third‐party websites could result in those third parties collecting your personal data and you will be subject to those third party’s privacy policies when you are on those platforms.

The services provided by Twitter, Inc. have been integrated into some of Avantor’s websites and mobile applications. When you use the services provided by Twitter, Inc. and the “retweet” function, the websites you visit are connected to your account with Twitter, Inc. and made known to other users of its services. Personal data will also be transferred to Twitter, Inc. Avantor has no knowledge of the content of the data transmitted or how it will be used by Twitter, Inc. Please visit the Twitter, Inc. privacy policy, available through its website or via its physical address: 1355 Market Street, Suite 900, San Francisco, CA 94103, USA for more information on how Twitter, Inc. processes your personal data and how you can modify your account settings.

The services provided by LinkedIn Corporation have been integrated into some of Avantor’s websites and mobile applications. Your browser establishes a direct connection to the LinkedIn Corporation network when one of our website pages containing features created by LinkedIn Corporation is accessed. LinkedIn Corporation is informed that you have visited our website from your IP address. If you “recommend” our website or business while you are logged into your LinkedIn Corporation account, it is possible for LinkedIn Corporation to associate your visit to our website to your LinkedIn Corporation account. Avantor has no knowledge of the content of the data transmitted or how it will be used by LinkedIn Corporation. Please visit the LinkedIn Corporation privacy policy, available through its website or via its physical address: 2029 Stierlin Court, Mountain View, CA 94043, USA for more information on how LinkedIn Corporation processes your personal data and how you can modify your account settings.

Services provided by Facebook Inc. have been integrated into some of Avantor’s websites and mobile applications and can be recognized by the Facebook logo or “like” button on our websites. Your browser establishes a direct connection to the Facebook Inc. network when you connect to Facebook via one of our website pages containing the plug‐in created by Facebook Inc. Facebook Inc. is informed that you have visited our website from your IP address. If you “like” our website or while you are logged into your Facebook account, it is possible for Facebook Inc. to associate our website and your visit to our website to your user Facebook account. Avantor has no knowledge of the content of the data transmitted or how it will be used by Facebook Inc. Please visit the Facebook Inc. privacy policy, available through its website or via its physical address: 1 Hacker Way, Menlo Park, California 94025, USA for more information on how Facebook Inc. processes your personal data and how you can modify your account settings.

Our websites use services and features provide by subsidiaries of Alphabet Inc., namely Google Inc. and YouTube LLC. Descriptions of these services and their relationship to your personal data are further described below.

Some of our websites include the Google+ button. If you engage the Google+ button on our websites, Google Inc. will store the information about our website and the page you were visiting when you engaged the Google+ button. This information can be displayed with your Google profile information, including a photograph, on various Google platforms.

We use website analytics services provided by Google Inc. on many of our websites. The analytics service uses cookies to collect and transmit information to Google Inc. where it is stored on its servers. The analytics services provided by Google Inc. collects much of the information outlined earlier in this Privacy Statement, including your IP address, Internet service provider, browser type, operating system and language, referring and exit pages and URLs, date and time, amount of time spent on particular pages, what sections of our websites you visit, the number of links you click while on our websites, and the search terms you use.

Google Analytics Remarketing allows advertising to be displayed based on your personal interests, identified based on your previous usage and website usage behavior on your devices. Google Inc. will associate your web and application browsing history with your Google Inc. account for the purposes of advertising across your devices. Google Inc. collects and authenticates identifying information of users that are temporarily linked to our Google Analytics data to define and create audiences for cross‐device advertising.

We also use Google Adwords, an online advertising program provided by Google Inc. In connection with Google Adwords, we use conversion tracking, which sets a cookie when you click on an advertisement served by Google. If you visit certain websites while that cookie is still effective, Google and the website can tell that you clicked on the advertisement and proceeded to that website. We receive information from Google Inc. about the number of users that clicked on our advertisements and were redirected to a conversion tracking page. We do not obtain any information that can be used to personally identify users through this process.

Some of our websites use Google AdSense, a service that uses cookies and web beacons (a small, often transparent graphic) to evaluate user traffic to websites. The information generated by the cookies and web beacons, which includes your IP address, relating to the use of our websites is transmitted to Google and then provided to us so we can determine the effectiveness of our advertising.

Some of our websites use plugins developed by YouTube LLC. If you visit one of our websites featuring a YouTube plugin, a connection to the YouTube servers is established and the YouTube server is informed about which of our website pages you have visited. If you are logged in to your YouTube account, YouTube allows you to associate your browsing activity directly with your account profile.

We also feature videos hosted by Vimeo Inc., on some of our websites. Vimeo operates similarly to other third‐party video services listed in this Privacy Statement. The privacy policy for Vimeo Inc. can be found on its website or by contacting Vimeo Inc. at 555 West 18^th Street, New York, New York, 10011, USA.

A number of our sites use Google Maps, a map service developed by Google Inc., via an application programming interface. Google Maps saves your IP address and transmits it to a Google server to determine location data to provide geographic information. We use Google Maps on our websites to make our websites more appealing and facilitate the location of our facilities.

Google reCaptcha is used on some of our websites to determine if the user of a website is an individual or an automated computer program. Various information, including your IP address, how long you have been on the website, and cursor movements, are collected, forwarded to Google Inc., and used to determine if you are a human or computer program. Your ability to perform certain functions on the website is limited by the determinations made by reCaptcha.

You can prevent certain cookies developed by Google from being stored on your device by selecting the appropriate settings in your browser. You can also prevent the data generated by cookies about your use of the website from being transferred to and processed by Google Inc. by downloading and installing browser plugins available from Google or by opting out of data collection activities by disabling Google Analytics. Opting out of Google Analytics will place a cookie on your device that indicates your opt out preference. Google Inc.'s privacy policy can be found at the following link https://support.google.com/analytics/answer/6004245?hl=en. or by contacting Google Inc. at 1600 Amphitheater Parkway, Mountain View, CA 94043, USA.

Some of our websites use a third‐party service provided by Marketo, Inc. to organize and analyze the distribution of newsletters. Information such as your e‐mail address that you provide to us when you subscribe to our newsletters will be transmitted to Marketo, Inc. and stored on its servers. Marketo’s privacy policy and cookie policy are available at the Marketo, Inc. website or by writing to Marketo, Inc. at 901 Mariners Island Boulevard, San Mateo, California 94404 USA.

This website uses Clarity. The provider is the Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, https://docs.microsoft.com/en-us/clarity/ (hereinafter referred to as “Clarity”).

Clarity is a tool to analyze user patterns on this website. Clarity records in particular cursor movements and compiles graphics that show on which parts of the website users are scrolling with great frequency (heatmaps). Clarity can also record sessions so that we can watch the use of the site in the form of videos. Moreover, we receive information on the general user conduct within our website.

Clarity uses technologies that make it possible to recognize users for the purpose of analyzing user patterns (e.g., cookies or use of device fingerprinting). Your personal data will be archived on Microsoft servers (Microsoft Azure Cloud Service) in the United States.

If your approval (consent) has been obtained the use of the abovementioned service shall occur on the basis of Art. 6(1)(a) GDPR and § 25 TTDSG (German Telecommunications Act). Such consent may be revoked at any time. If your consent was not obtained, the use of the service will occur on the basis of Art. 6(1)(f) GDPR; the website operator has a legitimate interest in the effective analysis of user patterns.

For more details on Clarity’s data privacy policy, please see: https://docs.microsoft.com/en-us/clarity/faq . We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.

Notice to End Users

Many Avantor products and services are purchased and intended for use by businesses and other organizations and are purchased by your employer, school, agency, or other organization. Your use of Avantor’s websites may be subject to your organization's policies, if any, and may also be subject to your organization’s (or a third party selected by your organization) business‐to‐business platform. If your organization controls your access to the Avantor websites, either directly or through a third‐party platform, please direct your privacy inquiries to your organization’s administrator. The privacy and security practices of your organization may differ from those set forth in this Privacy Statement.

If you use an e‐mail address provided by an organization, such as an employer or school, to access Avantor websites, the owner of the domain (e.g., your employer) associated with your e‐mail address may control and administer your Avantor account and access and process your data.

Security of Personal Data

Avantor is committed to protecting the security of your personal data. We use a variety of security technologies and procedures to help protect your personal data from unauthorized access, use or disclosure. For example, we store the personal data you provide on computer systems that have limited access and are in controlled facilities. When we transmit highly confidential data (such as a credit card number) over the Internet, we protect it through the use of measures required by the Payment Card Industry Data Security Standard. Our websites use SSL or TLS encryption for the protection of the transmission of confidential information and personal data. You can recognize an encrypted connection in your browser's address line when it changes from "http://" to "https://" and the lock icon (or a similar indicator, depending on the browser you choose to use) is displayed in your browser's address bar. If SSL or TLS encryption is activated, the information you transfer to via our websites cannot be read by third parties.

Once the data that we obtain from third parties is received in our systems, it is treated the same way that we treat data that we collect directly from you, and also according to any restrictions or special circumstances required by those third parties.

Where We Process Personal Data

Personal data collected by Avantor may be processed in your country, in the United States, and in any other country where Avantor or its affiliates, subsidiaries or service providers operate. Avantor or its affiliates, subsidiaries or service providers maintain major data centers in the United States, India, Mexico, Canada, Switzerland, and the countries of the European Economic Area and the European Union. Typically, the primary storage location is in your region or in the United States, often with a backup to a data center in the same or another region. The storage location(s) are chosen in order to operate efficiently, to improve performance, and to create redundancies in order to protect the data in the event of an outage or other problem.

Upon request to DPO@avantorsciences.com, we will provide you with confirmation as to whether we are processing your personal data, and have the data communicated to you within a reasonable time. You have the right to access, correct, amend or delete your personal data where it is inaccurate or has been processed in violation of this Privacy Policy. We may require payment of a non-excessive fee to defray our expenses in this regard. Please allow us a reasonable time to respond to your inquiries and requests. If your personal data has been provided to us by one of our clients, we will work with the client to respond to your access request.

We provide an individual with the opportunity to opt-out before we share your personal data with third parties other than our agents, or before we use it for a purpose materially different from which it was originally collected or subsequently authorized. To request to limit the disclosure of such personal data, please submit a written request to DPO@avantorsciences.com.

We will not disclose your sensitive personal data to any third party without first obtaining your opt-in consent and shall also obtain your opt-in consent before we use sensitive data for a purpose other than which it was originally collected or subsequently authorized.

In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. We may also disclose personal data to other third parties when compelled to do so by government authorities or required by law or regulation including, but not limited to, in response to court orders and subpoenas.

Avantor commits to resolve complaints about your privacy and our collection or use of your personal data transferred to the United States pursuant to applicable law. European Union and Swiss individuals inquiries or complaints should first contact Avantor by email at DPO@avantorsciences.com.

Our Retention of Personal Data

We retain personal data for as long as necessary to provide the products and services and fulfill the transactions you have requested, or for other essential purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements. Because these needs can vary for different data types in the context of different products and services, actual retention periods will vary significantly. The criteria used to determine the retention periods include:

• We evaluate the need to maintain our products, especially products used in regulated industries, and services and maintain appropriate business and financial records. This is the general rule that establishes the baseline for most data retention periods.
• Legal, contractual, or similar obligations to retain the data, including mandatory data retention laws, government orders to preserve data relevant to an investigation, or data that must be retained for the purposes of litigation.

In many cases, we maintain the data until you actively delete it or until deletion is permitted by our records retention policies.

Collection of Personal Data of or from Children

Avantor websites do not knowingly collect personal information relating to a customer’s age, and we do not knowingly collect any personal information from children under the age of thirteen through or websites. If you are under thirteen years of age, please do not give us any personal information. We encourage parents and legal guardians to monitor their children's Internet usage. If you have reason to believe that a child under the age of thirteen has provided personal information to us, please contact us at any one of our privacy e‐mail addresses in this Privacy Statement.

Changes to This Privacy Statement

We will update this Privacy Statement when necessary to reflect your feedback and changes in our products, services, and the law. When we post changes to this statement, we will revise the "last updated" date at the top of this Privacy Statement. If there are material changes to this Privacy Statement or in how Avantor will use your personal data, we will notify you either by prominently posting a notice of such changes before they take effect or by directly sending you a notification. We encourage you to periodically review this Privacy Statement to learn how Avantor uses and is protecting your information.

How to Contact Us

If you have a privacy concern, complaint, or a question for Avantor’s Data Privacy Officer, please contact us via e‐mail at DPO@avantorsciences.com. We will respond to questions or concerns or notify you that we need an extension of time to take action on your request without undue delay and in any event, within one month of receipt of your request.

Unless otherwise stated, Avantor is a data controller for personal data we collect through the marketing and delivery of products and services subject to this Privacy Statement. Our mailing address is Avantor Data Privacy, c/o VWR International, LLC; One Radnor Corporate Center, Suite 200; 100 Matsonford Road; Radnor, Pennsylvania, USA. Telephone: (+1) 610‐386‐ 1700.

VWR International Management Services GmbH & Co. KG, Hilpertstrasse 20 A, D ‐ 64295 Darmstadt, Germany is the mailing address of our data protection representative for the European Economic Area, the European Union, and Switzerland.