NuCana plc Privacy Notice

This Privacy Notice (“Notice”) explains how we process personal data of the users of our website.

For the purposes of applicable data protection and privacy laws, NuCana plc ("NuCana", "us", "we"), with its registered offices at 77-78 Cannon Street, London, United Kingdom, EC4N 6AF is considered the “data controller” in respect of the personal data that it collects, uses and manages in accordance with this Notice.

1. What is personal data?

Personal data is any information which relates to an identified or identifiable living individual. It may include a name, address, email address, phone number, IP address, location data, or cookies.

2. How we collect your personal data

We obtain personal data which you knowingly and voluntarily disclose to us in an online context. We collect personal data when you:

• visit our website and / or complete one of our web forms; or

• request information from us in any other way.

3. What personal data we collect

NuCana may collect a range of personal data from you, such as your name, job title, email address and other contact details, details of your business, and communications with you.

When you use our website, we collect certain standard information that is sent by your browser to our website. This includes technical information, such as your IP address, browser type, operating system, language, time zone setting, access times and any referring website addresses.

4. The purposes for which we process your personal data

We process your personal data for the following purposes:

• to provide you with information requested by you;

• to communicate with you and third party contacts;

• to carry out analytics in relation to the use of our website; and

• to comply with applicable laws and regulations.

5. The legal basis for NuCana processing your personal data

In order to comply with applicable data privacy laws, NuCana is required to set out the legal basis for the processing of your personal data. In accordance with the purposes for which we collect and use your personal data, as set out above, the legal basis for NuCana processing your personal data will typically be one of the following:

• your consent;

• the performance of a contract that we have in place with you or other individuals;

• NuCana’s or our third parties’ legitimate business interests; or

• compliance with our legal obligations.

6. Who we share your personal data with

NuCana may share your personal data:

• with people within the company who have a “need to know” that data for business or legal reasons (e.g., to direct a query that you have submitted to the relevant person within NuCana);

• with third parties including the authorities, NuCana's advisors, suppliers of IT services and third parties engaged by NuCana, under the legal bases set out above.

We may disclose your personal data to third parties in the event that we sell, buy or merge any business or assets, including to the prospective seller or buyer of such business or assets.

Because NuCana operates in the UK and the US, we may share the personal data you submit to us with our US office.

7. Transfers of personal data

Please note that any person to whom NuCana may disclose your personal data under this Notice may be situated in a country other than your own and that such country may provide a lower level of data protection requirements than your own country.

Whenever we transfer personal data across borders, we take legally required steps to ensure that appropriate safeguards are in place to protect your personal data and to make sure it is treated in accordance with this Notice. If you are located in the EEA or the UK, you can request a copy of the safeguards which we have put in place to protect your personal data and privacy rights in these circumstances. Contact information can be found on the Contact page of our website.

8. Records retention

Your personal data is not kept for longer than is necessary for the purposes for which it is collected. Data and records (including personal data) are deleted from our systems when no longer required. Please contact us if you would like more information on applicable retention periods.

9. Your rights

Data protection law may give you rights in respect of personal data that we hold about you. If you wish to:

• request a copy of the personal data that we hold about you; or

• request that we rectify, delete, or limit the processing of your personal data,

please submit your written request to The Director of Operations via

10. Questions and complaints

If you have a concern or complaint about how NuCana has used your personal data, as a first step, you should raise this in writing with NuCana. Please see the Contact page on our website.

If you are not satisfied with the handling of your concern or complaint by NuCana, you can escalate this to your national Data Protection Authority.

11. Cookies

A cookie is a small data file that a website may write to your hard drive when you visit. A cookie file can contain information (such as a user ID) that the website can use to track the pages you have visited. The only personal data a cookie can contain is information you personally supply. A cookie cannot read data from your hard disk or read cookie files created by other websites.

NuCana uses cookies to track user traffic patterns and to provide a better service for users when they visit the website.

Users can set their browsers to provide notification when a cookie is received, and the opportunity to accept or reject the cookie. Users can also refuse all cookies by turning the function off in their browsers. However, to ensure the full functionality of the NuCana website, the use of cookies is required.

Last Updated: September 2020