Last updated: July 18, 2025

Invitrolize S.A. (“Invitrolize”, “we”, “our”, or “us”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable national data protection laws.

This Privacy Policy applies to:

• visitors to our website,
• individuals with whom we engage for business development and outreach purposes,
• existing and prospective clients, partners, suppliers, and collaborators.

1. Who We Are

Invitrolize S.A. is a société anonyme incorporated in Luxembourg, with registered offices at 25, rue de Remich, L-5471 Wellenstein, Luxembourg, registered with the Luxembourg Trade and Companies Register under number B268923.

We operate in the biotechnology sector, offering in vitro models and related services. For the purpose of the GDPR, we are the data controller of personal data collected through our website, outreach activities, and CRM systems.

1. What Personal Data We Collect

We may collect and process the following categories of personal data:

Contact and Identity Data: Name, email address, phone number, company name, position/title.

Professional and Business Data: Details of your professional background, business interests, interactions with Invitrolize.

Communication Data: Content of email or messaging interactions, including metadata.

Technical and Usage Data: IP address, browser type, device identifiers, cookies and analytics via our website.

1. How We Collect Your Data

We collect personal data through:

• Direct interactions: e.g., when you contact us or respond to our outreach.
• Automated technologies: e.g., cookies and tracking pixels on our website or in emails.
• Third-party tools: e.g., outreach and emailing tools, our CRM platform (HubSpot).

1. How We Use Your Data

We process your personal data for the following purposes:

If we rely on consent, you have the right to withdraw it at any time.

1. How We Share Your Data

We do not sell your data. We may share it with:

• Internal teams within Invitrolize on a strict need-to-know basis.
• Service providers and processors: including outbound emailing platforms, HubSpot (CRM), IT providers, analytics and hosting providers.
• Legal or regulatory authorities where required by law or to protect our rights.

We ensure all processors provide appropriate safeguards and comply with GDPR obligations through binding contractual terms (e.g., Data Processing Agreements).

1. International Transfers

Some of our service providers (e.g., HubSpot) may process data outside the European Economic Area (“EEA”). When this occurs, we ensure that:

• The third country has an adequacy decision from the European Commission; or
• Standard Contractual Clauses (SCCs) or equivalent legal mechanisms are in place.

1. Data Retention

We retain your personal data only for as long as necessary for the purposes described above, or as required by applicable laws.

• Marketing and outreach data: retained for up to 24 months from last interaction.
• Contractual and client records: retained for 10 years (legal compliance).
• Analytics data: per cookie policy or consent.

1. Your Rights

Under GDPR, you have the right to:

• Access your personal data.
• Request rectification or erasure.
• Object to or restrict processing.
• Data portability.
• Withdraw consent at any time.
• Lodge a complaint with a supervisory authority (e.g., CNPD in Luxembourg).

Requests can be submitted to: hello@invitrolize.com

1. Data Security

We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, misuse, loss, or alteration. This includes access controls, encryption, secure storage, and regular audits.

1. Cookies and Tracking Technologies

Our website and outreach emails may use cookies and similar technologies to improve functionality and track engagement. For more information, refer to our Cookie Policy.

1. Changes to This Privacy Policy

We may update this policy from time to time to reflect changes in legal requirements or our practices. Any significant changes will be communicated via our website or direct notification.

1. Contact

If you have questions about this Privacy Policy or our data protection, please contact: hello@invitrolize.com, invitrolize S.A. 25, rue de Remich, L-5471 Wellenstein, Luxembourg.