Avenue Biosciences ("we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Notice explains how we collect, use, and share your personal data when you interact with our services in compliance with Regulation (EU) 2016/679, the European Union's General Data Protection Regulation ("GDPR"). This Privacy Notice is adopted to align with the California Consumer Privacy Act (“CCPA”).
Who collects my data?
Data Controller: Avenue Biosciences Oy
Address: Arabiankatu 12, 00560 Helsinki, Finland
VAT number: FI33729877
Personal data we collect
We collect and process the following types of personal data:
- Name
- Job title
- Phone number
- Work address
- Professional and business profile information obtained from third-party data providers (such as organisation, role, email)
- Technical data: IP address, browser type and similar information collected via cookies. For more details, please refer to our Cookie Policy.
- Usage data: Information about how you use our website, collected via cookies. For more details, please refer to our Cookie Policy.
If you are a job applicant, your data is processed under our recruitment privacy policy at careers.avenuebiosciences.com/data-privacy.
How do we collect your data?
You directly provide us with most of the data we collect. We collect and process data when you:
- Fill out an online form or sign up to a webinar
- Allow us to capture your details at conferences, trade shows, seminars and industry events (including event organizer's lead-capture services)
- Request a quote for any of our products or services
- Voluntarily complete a customer survey or provide feedback on our company channels (website, social media) or via email.
- Use or view our website via your browser’s cookies. For more information on cookies, please see our Cookie Policy.
We may also receive your data indirectly from the following sources:
- Third-party B2B data and sales-intelligence providers (for example, life-science prospecting and market-intelligence services), which compile business contact details and professional information from publicly available and other sources.
- Publicly available professional sources, such as company websites, professional networking sites, conference and event listings, and scientific publications.
- Web analytics providers, which provide technical and usage data about how visitors interact with our website (see Cookie Policy).
When we obtain your data from third-party providers or public sources, we will tell you the source of the data and your right to object.
We may use your data for the following purposes:
- To process your orders and to fulfill your requests
- To communicate with you regarding our products and services
- To identify and contact potential collaborators
- To improve our website and services through analysis of your interactions with us
- To comply with legal and regulatory requirements
Legal basis for processing
We rely on the following legal bases for processing your personal data:
- Performance of a contract: When we need to process your data to fulfill our contractual obligations.
- Consent: For example, for email marketing, certain cookies, and invitations to our webinars. You may withdraw consent at any time.
- Legitimate interests, specifically to
- identify and contact relevant professionals and collaborators through direct outreach. This processing does not override your interests and rights, and you may object at any time (see "Your rights");
- analyse and improve our website and services.
- Legal obligations: When processing is necessary to comply with the law.
Further information is available per request.
Data sharing, disclosures and transfers to third parties
We use a limited number of subcontractors who process your personal data, such as data storage providers, customer relationship management services and accounting services for billing purposes. Our subprocessors are bound by contract to protect your data and may only use it as specified.
Unless required by law or authorized by you, we will not share your personal data with anyone else.
Data retention
We retain your personal data to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements. When we no longer need to process your data, we will securely delete or anonymize it. In the absence of services provided or contractual requirements, our baseline retention period for personal data is 2 years from last activity. You can request all your Personal Data and account deletion at any time from support@avenuebiosciences.com.
If you are a job applicant, data is processed under our recruitment privacy policy and there are automated tools at your disposal for requesting a copy or complete removal of your data. Visit: careers.avenuebiosciences.com/data-privacy.
International data transfers
Avenue Biosciences Oy and laboratory and R&D operations are based in Finland, therefore we strive to process your personal data within the EU/EEA. However, our US parent, Avenue Biosciences Holding, Inc. is located outside the EU/EEA, which means your personal data may be transferred outside the EU/EEA. Our website analytics data (such as cookie identifiers and usage data) is processed by analytics providers in the US.
When we transfer personal data outside the EU/EEA, we rely on a safeguard recognised by the GDPR, namely:
a) an adequacy decision by the European Commission (for example, the adequacy decision for the United Kingdom, and the EU-US Data Privacy Framework where the US recipient is certified under it);
b) the European Commission's Standard Contractual Clauses, together with appropriate technical and organisational measures that we follow.
Further information is available per request at support@avenuebiosciences.com.
Data security
We implement appropriate technical and organizational measures to protect your personal data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. These include for example:
- Access controls
- Technical and physical safeguards of our systems and premises
- Data handling policies and subprocessor evaluation
- Regular assessment and development of measures and controls
- Implementing function-specific data privacy and information security practices
- Regular training of our employees and subcontractors
Your data protection rights
Under the GDPR, you have the following rights and we are responsible for fulfilling these rights:
- Right to access: You have the right to request access to the personal data we hold about you.
- Right to rectification: You have the right to request that we correct any inaccurate or incomplete data.
- Right to erasure: You have the right to request that we delete your personal data, under certain conditions.
- Right to restrict processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
- Right to object: You have the right to object to our processing of your personal data.
- Right to data portability: You have the right to request that we transfer your data to another organization, or directly to you.
- Withdraw consent at any time, where processing is based on consent
- Right to object to direct outreach. You have the right to object at any time to our use of your data in direct outreach. If you object, we will stop contacting you for that purpose without exception. The easiest way to object is to reply to any message you receive from us, or email us at support@avenuebiosciences.com.
- Right to be informed. At any time, you may request information about the source from which your business contact information was obtained.
If you wish to exercise any of these rights, please contact us at support@avenuebiosciences.com
Right to lodge a complaint. If you have concerns about how we process your personal data, you have the right to lodge a complaint with a supervisory authority. The lead authority for Avenue Biosciences Oy is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) in Finland (tietosuoja.fi). If you are based elsewhere in the EU, you may also contact your national data protection authority; if you are in the UK, the Information Commissioner's Office (ICO).
Your rights under CCPA/CPRA
If you are a California resident, you may request that we:
- Disclose the categories and specific pieces of personal information we have collected about you, the sources, the business or commercial purposes for collecting it, and the categories of third parties with whom we disclose it (covering the 12 months preceding your request)
- Correct inaccurate sensitive personal information we hold about you
- Delete personal information we collected from you (subject to legal exceptions)
- Limit the use and disclosure of personal information, e.g. only using your contact information to provide you with our services
- Opt out of "sale"/"sharing." We don't sell your data, but certain ad cookies (e.g., LinkedIn Insight Tag) may count as "sharing" for cross-context behavioral advertising. Manage this in our cookie preferences tool; we honor GPC signals.
To exercise your rights, submit a “verifiable consumer request" to support@avenuebiosciences.com. Only you, or your authorized agent, may make a verifiable consumer request related to your personal information. California residents may also contact the California Privacy Protection Agency or the California Attorney General with complaints.
We do not discriminate against consumers for exercising their CCPA/CPRA rights.
Cookies
We use cookies and similar technologies on our website to enhance your experience and analyze usage. For more information, please refer to our Cookie Policy.
Changes to this Privacy Notice
We may update this Privacy Notice from time to time. Any changes will be posted on this page, and where appropriate, notified to you via email. We encourage you to review this page periodically.
Contact us
If you have any questions or concerns about this Privacy Notice or our data practices, please contact us at support@avenuebiosciences.com. We will look into and respond to any complaints we receive without undue delay, however no later than within 30 days.
This document was updated June 11, 2026.