Privacy Notice for Employees, Job Applicants, and Contractors/Consultant

JOB APPLICANT, CONTRACTOR, CONSULTANT, EMPLOYEE PRIVACY NOTICE (“PRIVACY POLICY”)

EFFECTIVE DATE: August 18, 2023

INTRODUCTION AND SCOPE

This Privacy Policy is directed at individuals (“you”, “your”, “job applicants”, “contractors”, “consultants”, “employee(s)”) who provide Ironwood Pharmaceuticals, Inc. (hereinafter: “Ironwood”, “we”, “us”, “our”) with personal information to apply for and seek employment opportunities with Ironwood or any of Ironwood’s subsidiary companies, have decisions made regarding your employment status with Ironwood or any of Ironwood’s subsidiary companies, are employeed by Ironwood or any of Ironwood’s subsidiary companies, or are contracted to work with Ironwood or any of Ironwood’s subsidiary companies.

Ironwood is the data controller of your job applicant, contractor, consultant, or employee personal information (i.e., the entity that determines how your personal information is used). As such, Ironwood is providing you with this Privacy Policy which describes how Ironwood uses the personal information we collect about you and how you may exercise your rights regarding the use of your personal information.

As you read this Privacy Policy, please keep in mind the following important information about how this Privacy Policy applies to you:

This Privacy Policy contains specific sections that may or may not be applicable to you because of where you are located or the type of personal information we collect and maintain about you.
This Privacy Policy may be complemented or supplanted by other privacy policies or information notices that tell you how your personal information is used and disclosed in certain other contexts. To the extent that those policies or notices are provided, posted and/or referenced, that different privacy policy or notice, and not this one, will apply to the processing of your personal information.
Our websites, web portals, mobile applications or other digital services (together, our “websites”) may contain links to third-party websites that we do not operate, control or endorse. Once you leave our websites, we are not responsible for the protection and privacy of any information you provide. We recommend that you read the privacy policies of these third-party websites, and if needed, contact the third parties directly for information about their privacy practices.

CATEGORIES OF PERSONAL INFORMATION WE COLLECT AND PROCESS ABOUT YOU

Ironwood may collect and process any of the following categories and examples of personal information about you. Please keep in mind that this list includes the most common categories and examples of personal information Ironwood collects about you, and not every category or example of personal information is contained in this list or collected:

Categories	Examples
Identification Information of job candidates, contractors, and third party consultants	First name, middle name, last name, nickname, initials, photographic image(s).
Identification Information of employees and consultants	First name, middle name. last name, nickname, initials, date of birth, photographic image(s), identification numbers (e.g., driver’s license number, passport number, social security number, national identity card number, resident identity card number) and copies of Identification Documents (e.g., driver’s license, identity card, passport).
Contact Details	Email address, postal address, or phone number
Professional Information and Background Check Results	Work experience, job titles, employment status, educational information, professional qualifications, certifications and licenses, professional networks, references, publications, awards, or any other personal information you include in your resume/curriculum vitae and cover letter.To the extent permitted by applicable law, and if needed, subject to your authorization, we will conduct a background check which may include access to additional employment information, educational background information, driving record information and criminal record information.
Information Related To Your Communications With Ironwood	Date and subject of your requests or exchanges with Ironwood’s employees and Ironwood’s advisors, agents, consultants, or representatives.
Demographic Information	To the extent permitted or required by applicable law: demographic data including but not limited to race, sex, national origin, disability and veteran status.
Information From Other Sources	To the extent permitted by applicable law: information about you from other sources, for example, on-line from your social media profile(s) and posts, as well as information shared with us by your references about you. We may also process information about you and your use of our networks and our devices (e.g., use of Ironwood Wi-Fi, websites, telephones and other devices to which you have access, and information collected through card readers or security cameras).

Note, if you include additional information on your resume, CV, or job application that information is also retained.

Sensitive Personal Information. Certain personal information Ironwood collects about you may be considered sensitive personal information under applicable laws. To protect such sensitive personal information, we will:

take appropriate security and technical measures to protect and process your sensitive personal information; and
provide notices and/or obtain your explicit consent for processing your sensitive personal information where required by applicable laws.

Website Information. Our websites automatically collect the following information through cookies and other data collection technologies:

IP address
device type
browser type
language
browsing history, and
information about your interaction with our websites and their services

This information is necessary for the proper functioning of our websites and their services, as well as our internal business analytics purposes, such as audience measurement.

For more information on our cookies and other data collection technologies, please read the Cookies Policy applicable to the website you are accessing.

Required Information. The provision of certain types of personal information may be required in order for us to process your personal information for certain purposes. This may be because applicable laws necessitate that certain information is required as part of a job application, work as a contractor, or as an employee.

Required information will be marked as required at the time of collection of your personal information so that you are aware that it is required. If you decide not to provide the required information, Ironwood may not be able to process your personal information.

SOURCES OF YOUR PERSONAL INFORMATION

In most cases, we collect your personal information directly from you, such as when you contact us via phone, electronic mail, mail or in person, when you submit information to us on our websites, send us your resume/CV or cover letter, complete an on-line application, form or survey, register for an account on our websites or when you request to receive materials and information from us.

If you are an employee, we may collect information about you as part of your employment with Ironwood, including personal business contact information and location information, banking, benefits, healthcare, salary and stock information, or any other personal information collected by Ironwood as part of your employment with the company, such as performance reviews, investigation information, etc.

If you are an consultant or contractor, we may collect information about you as part of your engagement at Ironwood, including personal business contact information and location information, banking, or any other personal information collected by Ironwood as part of your engagement with the company, such as payment of applicable invoices for work performed, emergency contact information, etc.

Sometimes we may obtain your personal information from our authorized third-party sources who you direct or authorize to share your personal information with us, such as your current employer, individuals who serve as your references or other authorized representatives or affiliated organizations, such as job recruiters.

In addition, if you use our websites, we may collect information from your computer or other device through our use of cookies and other data collection technologies. For more information on cookies and other data collection technologies, please read the Cookies Policy applicable to the website you are using.

WHY WE PROCESS YOUR PERSONAL INFORMATION

There are many ways we process your personal information, and the ways we process your personal information depends on why we collected it. Depending on your relationship and/or interactions with Ironwood, as well as, applicable laws and our own procedures & requirements, Ironwood may process your personal information for the following reasons and legal bases:

Purposes	Examples of use of your personal data	Legal bases
Manage and Process Your Job Application	to review your job application to make decisions about your job application to contact you to organize an interview to contact our third-party vendors who conduct background checks to contact your references in the event of an employment offer accepted by you, to manage the new-hire process and create an employee file in our HR system	Legitimate Interests of Ironwood and To take steps prior to entering into a contract
Pre-Employment Screening and Background Checks	to check or confirm your background information, references and other information you provided to us during our job application process which may include access to additional employment and educational background information as well as criminal record information (to the extent allowed by law) to prepare an offer of employment and other documents we use at this pre-contract stage of our job application process	Legitimate Interests of Ironwood and To take steps prior to entering into a contract
Ironwood Talent Pool	to identify potential job applicant candidates, including by working with our external recruiters to consider you for current or future job opportunities with Ironwood to let you know about opportunities or to ask you to update your profile	Legitimate interest of Ironwood
Improving Our Recruitment Process and Websites	to evaluate and improve our recruitment process and websites, as well as the effectiveness of our job postings to take steps designed to protect and enhance the security of the websites	Legitimate interest of Ironwood
Pre-litigation or Litigation Management	to take action against any identified breach of confidentiality or our security and technology measures to manage any dispute or litigation	Legitimate interest of Ironwood
Compliance With Legal and Regulatory Obligations	to comply with legal and regulatory obligations to process your requests to exercise your rights	Legal and regulatory obligations to which Ironwood is subject
Other Purposes	for other business purposes such as payment processing and accounting, product development, safeguarding Ironwood property, contract management, archiving, website administration, fulfillment, analytics, fraud prevention and corporate governance, the potential sale or merger of some or all of the company or any of its subsidiary companies, reporting and legal compliance, or as necessary to defend against potential legal claims.	Legitimate interest of Ironwood or legal and regulatory obligations to which Ironwood is subject

We do not undertake decisions based solely on automated processing of your information, including profiling, unless we inform you as required by applicable laws.

WHO WE SHARE YOUR PERSONAL INFORMATION WITH

We may share your personal information within Ironwood and Ironwood subsidiary companies, with all authorized third parties with whom we have contracted, judicial, administrative or regulatory authorities, or as otherwise permitted by applicable laws. The type(s) of personal information we share and our purposes for sharing it depends on the role of the recipient. We do not, however, sell your personal information that we collect about you. For residences of the State of California, U.S.A,, we do not share your personal information for internet-based advertising or targeted marketing (see below section for California Residents).

Here are examples of who we share your personal information with and the purposes for sharing it:

Recipients	Purposes
Ironwood and/or its subsidiary companies and its duly authorized employees (recruiting/HR departments, department and roles responsible for evaluating and/or managing the position for which you are applying, IT department, etc.)	For the purposes set forth in this Privacy Policy: to implement Ironwood’s global job application and job recruiting processes, making decisions on potential employment at Ironwood, onboarding new employees at Ironwood, and managing employees at Ironwood
Authorized service providers (external recruiters, website services, background check providers, etc.)	For assisting Ironwood with administrative, operational and/or technical purposes in the context of Ironwood’s business activities
Authorized service providers who administer benefits and payroll	For assisting Ironwood with administrative, operational and/or technical purposes in the context of Ironwood’s business activities
Authorized security and technology providers (website hosting providers, cloud storage services providers IT service providers, etc.)	For assisting Ironwood with administrative, operational and/or technical purposes in the context of Ironwood’s business activities
Administrative, regulatory or judiciary authorities or agencies and other related third parties	Exclusively to comply with any legal or regulatory obligation and/or in the cases of an express and justified request or in case of an alleged violation of legal or regulatory provisions
Agents, Advisors and Representatives, such as outside attorneys, financial advisors or other similar parties	Management of Ironwood’s business interests and the management of possible disputes or other legal matters
Other authorized third parties	Following or during a restructuring, acquisition, debt financing, merger, transfer, sale of assets of Ironwood or a similar transaction, as well as in case of insolvency, bankruptcy or receivership where personal data are transferred to one or more third parties as assets of Ironwood, subject to your information and/or consent, where applicable.

HOW LONG WE RETAIN YOUR PERSONAL INFORMATION

We retain your personal information for as long as it is necessary for the purposes set out in this Privacy Policy, unless required by our legal obligations to retain it longer. To determine the appropriate retention period for information, we consider the amount, nature and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure of the information, the purposes for which we process the information, whether we can achieve those purposes through other means and all applicable global legal, regulatory, and compliance requirements.

For example, the personal information collected via our job application process is retained in our job applicant database for use in future job searches and applications and for use if you are recruited for a future job opportunity. If you want your information deleted, please reach out to Ironwood at: [email protected].

We will keep a record of your unsubscribe request, if any, for as long as is necessary to comply with that request. We may also retain certain job application information if required to do so by applicable laws or to defend or prosecute our legal rights.

In addition, Ironwood will keep your personal information during:

applicable statutes of limitation, if needed for evidence purposes;
applicable legal retention periods, in particular regarding commercial, compliance and regulatory matters, or any other mandatory retention period (such as a legal hold or for an investigation).

WHERE WE PROCESS YOUR INFORMATION AND HOW WE PROTECT IT

Ironwood operates in many countries around the world and your personal information may be accessible to or be shared with our subsidiary companies, authorized service providers, Judicial, administrative and regulatory parties and agents, advisors, consultants and representatives in various countries for the purposes specified in this Privacy Policy.

Keep in mind that the data privacy and data protection laws or regulations in certain countries may not provide the same level of protection as those in your country or region. When that is the case, and as required by applicable laws, we take legally required steps to protect your personal information when transferred to another country or region, such as entering contracts with recipients of your information and implementing additional safeguards.

While we have established reasonable physical, administrative and technical measures to protect your personal information from unauthorized access or disclosure, but we cannot guarantee its absolute security. You should take special care in deciding what information you transmit, upload, send or otherwise submit to us, unless it is required by Ironwood as part of your contract work or employment.

YOUR CHOICES AND RIGHTS

Under certain laws, such as the European Union’s General Data Protection Regulation (GDPR), The Swiss Data Protection Act, The UK Data Protection Act (UK-GDPR), the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA) or China’s Cybersecurity Law and Personal Information Protection Law (PIPL), including their implementing regulations and national standards, you may have the following rights with respect to your personal information:

Your right of access. You may have the right to ask us to provide clear, transparent and understandable information on how we process your personal information, as well as for copies of your personal information. There are some exemptions, which means you may not always receive access to all the personal information we have and process about you.
Your right to rectification. You may have the right to ask us to correct or rectify information you think is obsolete or inaccurate and the right to ask us to complete information you think is incomplete.
Your right to deletion of your personal information. You may have the right to ask us to delete your personal information in certain circumstances.
Your right to restriction of processing. You may have the right to ask us to restrict the processing of your personal information, during a limited period of time, in certain circumstances.
Your right to object to processing. You may have the right to object to certain processing activities, in which case, Ironwood will no longer process your personal information unless Ironwood demonstrates compelling legitimate grounds for the processing which overrides your interests, rights and freedoms, such as compliance with a legal obligation or for the establishment, exercise or defense of legal claims.
Your right to data portability. You may have the right to ask that we transfer the information you gave us from one organization to another or give it to you to transfer to another organization.
Right to withdraw your consent. If we process your personal information based on your consent, you have the right to withdraw your consent, without this withdrawal affecting the lawfulness of the processing operations previously conducted.
Right to close your account. If you receive our services through online accounts, you have the right to close your accounts. We will then delete or anonymize your personal information associated with your accounts, unless we are otherwise permitted to retain your personal information under applicable laws.

Depending on your country of residence and the country where the Ironwood entity processing your personal information is established, you may have additional local rights with respect to our processing of your personal information. For example, you may also have the right to raise questions or concerns directly with your local data protection authority. Please note that some of the personal information that we collect and process may be exempt from the rights outlined above.

You can submit your request directly to Ironwood by sending us an email at [email protected]

We will respond to your requests within the time period prescribed by applicable laws. Under certain circumstances, Ironwood may ask you for specific information to confirm your identity and ensure the appropriate exercise of your rights. This is a security measure to safeguard personal information. We will notify you when your request is completed, if we deny your request to exercise your rights (because, for example, an exception applies), or if there is a fee associated with processing your request.

You may designate an authorized agent to exercise your rights on your behalf. In such case, we will also need to verify your agent’s identity and obtain proof of your authorization. We may need to deny a request from an agent whose identity or authorization we cannot verify.

If you believe that Ironwood has processed information in a manner that is unlawful or breaches your rights, or has infringed applicable laws, you may have the right to complain directly to your local data protection authority. Without limiting any rights to complain directly to an authority, we are committed to protecting your personal information, and you may also lodge your complaint(s) directly with us.

We will not discriminate against you for exercising any of your rights that you have under applicable data privacy and data protection laws.

REGIONAL AND STATE SPECIFIC PRIVACY NOTICES

GENERAL CALIFORNIA PRIVACY NOTICE

If you are a California resident and a job applicant of Ironwood or a Ironwood subsidiary company, the personal information we collect about you in these circumstances is exempt from the rights that are described in the YOUR CHOICES AND RIGHTS Section of this Policy.

When you are a prospective employee of Ironwood or a Ironwood subsidiary company, we may collect, use and share the following personal information from you:

Categories	Examples	Categories of Third Parties with Whom We Share Your Personal Information
Personal Identifiers	First name, middle name, last name, nickname, initials, email address, postal address, telephone number, social security number, health insurance policy number, internet protocol (IP) address, date of birth, gender and other similar identifiers	Ironwood or Ironwood subsidiary companies; Ironwood service providers; Ironwood advisors, agents, consultants or representatives; Administrative, regulatory or judiciary authorities; and Other third parties.
Personal Information Categories Listed in the California Customer Record Statute (CAL.CIV.CODE§1798.80 (e))	Name, signature, address, telephone number, social security number, insurance policy number, physical characteristics or description, education, employment, employment history, bank account number or any other financial information, health or medical information and health insurance information (Note that some personal information in this category may overlap with other categories.)	Ironwood or Ironwood subsidiary companies; Ironwood service providers; Ironwood advisors, agents, consultants or representatives; Administrative, regulatory or judiciary authorities; and Other third parties.
Characteristics of Protected Classifications Under California or Federal Law (non-exclusive list)	Race, age, medical condition, sex and gender	Ironwood or Ironwood subsidiary companies; Ironwood service providers; Ironwood advisors, agents, consultants or representatives; Administrative, regulatory or judiciary authorities; and Other third parties.
Internet or Electronic Data	Browsing history, search history and information regarding your interaction with an internet website, application or advertisement. Other information as necessary for security and fraud prevention	Ironwood or Ironwood subsidiary companies; Ironwood service providers; Ironwood advisors, agents, consultants or representatives; Administrative, regulatory or judiciary authorities; and Other third parties.
Professional-Related Data	Work history and current and prior employer(s) (Job title, employment status, educational information, professional qualifications, certifications and licenses, work experience and professional networks, references, publications, awards and influence rankings, or other information you include in your resume and cover letter, and potentially, background check information which may include access to additional employment and educational background information as well as criminal record information)	Ironwood or Ironwood subsidiary companies; Ironwood service providers; Ironwood advisors, agents, consultants or representatives; Administrative, regulatory or judiciary authorities; and Other third parties.
Education-Related Data	Schools and dates of graduation, transcripts, recommendation letters from references	Ironwood or Ironwood subsidiary companies; Ironwood service providers; Ironwood advisors, agents, consultants or representatives; Administrative, regulatory or judiciary authorities; and Other third parties.

We collect and share this personal information for a number of purposes including: managing your job application, conducting pre-employment screening and background checks, fulfilling our legal obligations, improving our recruiting processes and websites, and for our everyday business purposes such as processing payroll, safeguarding Ironwood property and defending against misuse or fraud. We may also use your personal information in the event of a sale or transaction of Ironwood or Ironwood subsidiary companies, including some or all of Ironwood’s assets.

We do not sell personal data of California job applicants and we do not share personal data of California job applicants for for internet-based advertising or targeted marketing

If you have questions about this Privacy Policy, you may contact us at [email protected].

ADDITIONAL INFORMATION FOR INDIVIDUALS IN THE EUROPEAN UNION (EU)/EUROPEAN ECONOMIC AREA (EEA), UNITED KINGDOM, OR SWITZERLAND

We are required to comply with the European Union’s and the United Kingdom’s General Data Protection Regulations (“GDPR”), Switzerland’s Federal Act on Data Protection (FADP) and similar applicable local laws with regards to certain personal information we collect. The data controllers of your personal information are the Ironwood entities referenced at the beginning of this Privacy Policy. Please contact us if you have any questions about the controller or controllers of your personal information at: [email protected].

Sensitive Personal Information. We process special categories of personal information (e.g., sensitive personal information that reveals racial, sex or ethnic origin, genetic, biometric and health information, political and trade union affiliations, etc.) only where you give us your explicit consent, or when our processing is for scientific research purposes, necessary to meet a legal or regulatory obligation, in connection with the establishment, exercise or defense of legal claims, or is otherwise expressly permitted by applicable laws.

If we need to collect your sensitive personal information by law or under the terms of a contract we have with you and you do not provide the requested information, we may not be able to process your job application or related requests.

Data transfers. Ironwood is a global company with offices in the United States and the European Economic Area. As such, Ironwood may transfer or provide access to your personal information to its subsidiary companies and affiliates, authorized service providers or collaborators or other third parties in these countries and others that may not provide the same level of protection to your personal information as in your country of residence. When we do so, in the absence of an adequacy decision concerning the recipient country, we rely on safeguards such as approved model contracts (for example the EU’s standard contractual clauses or the UK’s international data transfer agreement), after having carried out an assessment of the level of protection of your rights on the territory of the third country where the recipient of your personal information is established. For more information about Ironwood’s use of the model contracts, please contact us at: [email protected]

Your Data Subject Rights. Rights you may have under the GDPR and related regulations with regards to the personal information we collect and maintain about you are described in the section YOUR CHOICES AND RIGHTS. Under the GDPR, the exercise of these rights may be limited or delayed dependent upon the legal basis for processing your personal information, for example:

Legal Basis	Access	Rectification	Erasure	Restriction	Information portability	Objection
Consent	Yes	Yes	Yes	Yes	Yes	Withdrawal of consent
Steps prior to entering into a contract			Yes		Yes	No
Contract			Yes		Yes	No
Legitimate business interest			Yes		No	Yes
Legal obligation			No		No	No

OUR COOKIE POLICY

Cookies, pixel tags, and other trackers (hereinafter “Cookies”) are small files that allow for storing or retrieving information on your browser or your device (computer, tablet, mobile, etc.) when visiting our websites. Cookies are widely used on websites, mobile applications, software or emails. When you first visit our websites and again if you delete the Cookies or the Cookies expire or change, you will be asked which Cookies you consent to.

Cookies do not recognize you personally, but rather the device you use. Cookies simply give information about your browsing activities in order to recognize the device later on in order to improve the browsing experience, save your preferences or even adapt the services offered to you on the websites. To find out more about cookies, including how to see what cookies have been set, visit www.aboutcookies.org or www.allaboutcookies.org .

We may use the following types of cookies on our websites:

Necessary Cookies – enable the proper functioning of the websites (security, facilitate browsing, display of the webpage). You may disable Necessary Cookies by changing your browser settings as described below. If you do so, you will still be able to navigate the websites, but some of the websites’ functions may be affected;
Analytics Cookies – are used to collect information about how visitors use our websites and to improve the websites by collecting information on how you interact with the websites; The cookies collect information in a way that does not directly identify anyone, rather they collect information in an aggregated or generalized statistical form, including the number of visitors to the website and where visitors have come to the website from and the pages they visited. One of the analytic cookies we use is Google Analytics. Google’s overview of privacy practices and data safeguards is available at: https://support.google.com/analytics/answer/6004245 . To opt out of being tracked by Google Analytics across all websites, visit http://tools.google.com/dlpage/gaoptout .

Social Media Cookies – enable you to interact with social plugins on the websites and share content on social networks; and
Advertising Cookies – enable the placement of advertisements, to measure their effectiveness and to adapt their content to your browsing and your profile.

Most web browsers allow some control of most cookies through the browser settings. For example, there are simple procedures in most browsers that allow you to delete existing cookies. If you want to set your computer or mobile web browser to reject all cookies by default, please visit the home page for your browser for instructions. If you reject all cookies, you may still use our websites; however, this may affect the functionality of some areas of our websites.

In addition, your Internet Protocol (IP) address (an identifying number that is automatically assigned to your computer by your Internet Service Provider) is identified and logged automatically in our server log files whenever you visit our websites, along with the time(s) of your visit(s) and the page(s) that you visited. We use the IP addresses of all visitors to our websites to calculate website usage levels, to help diagnose problems with the website servers, and to administer the websites. We may also use IP addresses to communicate with or block access by visitors who fail to comply with our Terms of Use.

We do not track our website users over time or across third-party websites to provide targeted advertising. At this time, we do not respond to “Do Not Track” signals from your web browser due to the lack of an established industry standard. For more information about “Do Not Track” signals, please visit https://allaboutdnt.com/.

CONTACTING US

You may contact us at any time if you have questions or concerns about this Privacy Policy or our practices. Please send an email to: [email protected].

We will endeavor to respond to your request as soon as reasonably possible in compliance with applicable laws.

To protect your privacy and security, we take reasonable steps to verify your identity before granting access to or making corrections with your personal information. Note that despite any requested removal of or change to your personal information there may be residual information that will remain within our databases and other records.

We strive to accommodate all individuals regardless of disabilities. If you need to receive the information contained in this document in a different format, please contact us at: [email protected].

If you are located in the EU, EEA, UK or Switzerland, you may also contact our appointed Data Protection Representative (DPR), DPO Consultancy. If you have any questions about our Privacy Policy, if you wish to exercise your rights, or if you wish to lodge a complaint, you may either contact Ironwood Pharmaceuticals directly at: [email protected] or contact our DPR at: [email protected] or by sending mail to the following addresses:

DPO Consultancy (EEA)
Australiëlaan 12A
5232 BB ‘s-Hertogenbosch
The Netherlands

DPO Consultancy (UK)
1 Lyric Square
Hammersmith, London, W6 0NB

CHANGES TO THIS PRIVACY POLICY

We aim to regularly update this Privacy Policy to reflect our practices. Therefore, we recommend that you periodically review this Privacy Policy. In case of material changes, we may take steps to notify you before they become effective.