Version 18 June 2020
We, Immatics N.V. (in the following „Immatics“), appreciate your visit to our web site and your interest in our company. The correct handling of your data while respecting your privacy rights as well as the observance of your right to informational self-determination in the use of your personal data is an important concern for us. In this policy we inform you which date we collect for which purpose, how long we store data and which rights under data privacy law you can exercise against us, if we process your data.
In the first section we provide general information on our data protection. In other sections we explain how data are processed on our web site as well as for our business purposes.
(1) General Information
You can contact our Data Protection Officer Katja Steinhardt directly by sending an Email to Datenschutz@immatics.com.”
Of course you can visit our web sites without providing any personal data to us. In any case, when using our web portal, data is automatically collected and processed, which do not allow us to relate them to you in person. Please refer to the sections
- “Web Service Logfiles”
- “Web Analysis Tool Google Analytics”
(1.1) Your rights relating to your personal data
As a data subject you may exercise your right of access to your personal data (Art. 15 GDPR). You may have your data rectified in pursuit of Art. 16 GDPR, or on specific grounds have them erased according to Art. 17 GDPR. In accordance with Art.18 GDPR you have the right to restriction of processing, and on grounds relating to your particular situation, you additionally have the right (in pursuit of Art. 21 GDPR) to object to processing your data generally or in parts. For data that you have provided to us, you have the right to receive them in a commonly used and machine-readable format. You have the right to withdraw your consent with processing of your data at any time, with future effect. That means that your withdrawal can only effect future processing. Consequently, past processing remains in compliance with data protection stipulations.
You have a general right to object our processing of your contact and address data for direct marketing purposes, except where you have solicited such material.
You have the right to lodge a complaint at a supervisory authority.
(2) Processing of your data by Immatics
(2.1) Our processing of personal data of customers, suppliers, service providers
We at Immatics collect data of natural persons, who are contacting us or who belong to or represent a company that is in a business relation with us. This data includes your name, the name and address of your company, your business contact data including email and telephone, and your job title. The legal ground for processing your data is our legitimate interest in communicating with you as a representative of your company, as well as the legitimate interest of your company in establishing the communication with us. Your contrary interests may outweigh our legitimate interest, e.g. after you have left your company.
For the purpose of performing a contract we process your company’s data in our business systems. Depending on your role and responsibility in your company, these data may include the above mentioned personal data, which directly relate to you as a person. However, the purpose of the processing does not relate to you as an individual but to your company instead, as our business partner. Data protection regulations do not apply to business data that do not relate to a natural person.
If you contact us as a natural person, we will process your data on legal grounds of a contractual relationship, since we have to take steps at your request.
In any case, as a data subject you have rights under data privacy law, e.g. the right to withdraw consent, the right of access to your data, and several other rights. Please refer to section (1.1) Your rights relating to your personal data.
(2.2) Our processing of personal data in clinical studies
We process personal data of individual persons involved in clinical studies, may it be sponsor or clinical study center personnel, designated monitors or any other personnel. Our processing observes the regulations and national laws which govern clinical studies. In particular our retention time of study data is governed by these regulations and laws.
As a data subject you have rights under data privacy law, e.g. the right to withdraw consent, the right of access to your data, and several other rights. Please refer to section (1.1) Your rights relating to your personal data.
(2.3) Our processing of personal data of study participants
We process so called “study data” relating to a study participant on legal grounds of the individual’s consent to the study center to participate in the study. This consent expressly includes the necessary processing of health data for the purpose of the study. In pursuit of applicable regulations and laws, study data must be processed in a pseudonymised way. Consequently we at Immatics cannot relate study data to an individual study participant, because we cannot know the participant’s identity. That is why we generally cannot meet your requests for exercising your rights under data privacy law.
(3) Processing of your data on our web site
We never collect personally identifiable information on our web site except where otherwise indicated in this policy. Our web site does provide a menu button “contact”, but this subpage does not deploy a contact form.
(3.1) Web server log data
In order to serve our web site contents to your browser, our web server needs to collect data that relate to you. When you access our website with your browser, the server logs the data required for the operation of a web service in the log files: the name of your browser, the name of your internet service provider, the IP address of your PC, the address of the site from which you accessed our website, the name of your operating system, the web pages you visit, and the date and duration of your visit. This data is automatically collected and will only be used for investigations of malfunctions as well as for technical improvement of our web service. Access to this data has the internet service provider that hosts our web site, and if required, IT service providers that we instruct to do so. The legal ground for this processing is our legitimate interest in maintaining the web services in full function. Log data are automatically overwritten after two weeks time.
Cookies are distinguished on the one hand according to the duration of their storage. Session cookies are automatically deleted when you close their browser. A session cookie can serve to manage an order form or record which services are of particular interest. Permanent cookies, on the other hand, remain stored on your PC. A permanent cookie can be read again on the next visit of our website. To prevent this, you can delete the permanent cookie after visiting our website. Session cookies are deleted automatically when you close your browser.
On the other hand, cookies are differentiated according to their origin. So-called first-party cookies always come from the website, which is indicated in the address bar of your browser. Third-party cookies are from websites that you have not directly accessed, but which have been linked to images or advertisements on the site of the first provider. Your browser can tell you which sources are stored on your PC.
Most browsers are set to accept cookies. To disable this, please change the appropriate settings of your browser. If your browser does not allow cookies, you may not be able to use all pages of our Internet site without problems.
Possibility of Objection
Most browsers are set to accept cookies. To disable this, please change the appropriate settings of your browser.
(3.3) Web Analysis Tool Google Analytics
On legal grounds of legitimate interest in continuous improvement of our web services, this website uses Google Analytics, a web analytics service provided by Google, Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA (“Google”). Google Analytics uses so-called “cookies”, text files which are stored on your computer and which allow an analysis of the use of the website by you. The information generated by the cookies _ga, _gat and _gid about your use of this web site is generally transferred to a Google server in the USA and stored there.
On our website, IP anonymization is activated, which means that your IP address will be shortened by Google prior to transmission to the USA. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and abbreviated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website usage and internet usage against the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.
Possibility of Objection
You can prevent cookies from being saved by setting your browser software accordingly. This may result in impairment of the functionality of our websites. Deleting permanent cookies after visiting our websites does not result in any impairment.
In addition, you may prevent Google’s processing of the data (including your IP address) generated by the cookie and your use of the website (including your IP address) as well as the processing of this data by Google by using the browser plugin https://tools.google.com/dlpage/gaoptout?hl=en download and install.
(4) Processing your data on third party web sites
Our web site links to third party web sites as described in the following. In general, the owner of any thirds party web site is responsible for data protection on their site.
(4.2) Social Media Buttons
On our web site we display XING, LinkedIn and Twitter buttons for easy access to our presences in social media. We have integrated these buttons such that you need to klick on them to open the link. This way your data are collected at the respective third party web site after you’ve opened the link. Please refer to these third party websites’ data privacy policies for information.
Data Protection Officer