Privacy Policy

Last updated: October 22, 2026

Kyron Bio respects your privacy. This Privacy Policy explains how we collect and use personal data when you visit our website kyron.bio (the "Website"), contact us, or apply for a position with us. It is provided in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the French Data Protection Act (Loi Informatique et Libertés of 6 January 1978, as amended).

1. Who we are

The data controller is KYRON.BIO, a simplified corporation (SAS) registered with the Paris Trade and Companies Register (RCS) under number 910 245 984, with its registered office at 10 rue de Penthièvre 75008 Paris.

Our offices and laboratory are located at Paris Biotech Santé, Site Cochin, 27 rue du Faubourg Saint Jacques, 75014 Paris, France.

For any question about this policy or your personal data, contact us at hello@kyron.bio. We have not appointed a Data Protection Officer, as this is not required for our activities.

2. Personal data we collect

We only collect the personal data needed for the purposes described below:

• Contact form: your name, email address, organisation and the content of your message.
• Emails you send us: your contact details and any information included in your email or attachments.
• Job applications: when you send us your CV and motivation by email, your identity and contact details, professional background and any other information you choose to share.
• Technical data: when you browse the Website, our hosting provider automatically processes technical information such as your IP address, browser type, pages visited and the date and time of access, for security and performance purposes.

Please do not send us sensitive personal data (for example health information) through the Website or by email. We do not use the Website to collect data from patients or clinical trial participants.

3. Why we use your data and on what legal basis

Answering your enquiries sent through the contact form or by email

• Data: Name, email address, organisation, content of your message
• Legal basis: Our legitimate interest in responding to requests addressed to us (Art. 6(1)(f))
• Retention: 3 years from our last exchange with you

Managing business relationships (partnering, collaboration, investor and media contacts)

• Data: Name, email address, organisation, role, correspondence
• Legal basis: Our legitimate interest in developing our business (Art. 6(1)(f)); steps prior to entering into a contract at your request (Art. 6(1)(b))
• Retention: 3 years from our last exchange, or the duration of the contract plus applicable legal limitation periods

Assessing job and internship applications

• Data: Identity and contact details, CV, cover letter, any information you choose to share
• Legal basis: Steps prior to entering into an employment contract at your request (Art. 6(1)(b))
• Retention: Duration of the recruitment process. If unsuccessful: deleted, or kept for up to 2 years with your consent to consider you for future roles

Operating and securing the website

• Data: IP address, browser type, pages visited, date and time of access (technical logs)
• Legal basis: Our legitimate interest in ensuring the security and proper functioning of the website (Art. 6(1)(f))
• Retention: Up to 12 months, per hosting provider settings

Complying with legal obligations and defending our rights

• Data: Any of the above, as needed
• Legal basis: Legal obligation (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f))
• Retention: Applicable legal limitation periods

Where we rely on our legitimate interest, we make sure that it is not overridden by your interests or fundamental rights. We do not use your data for automated decision-making or profiling, and we do not send marketing emails without your prior consent.

4. Who receives your data

Your data is accessed only by authorised Kyron Bio team members who need it for the purposes above. It may also be processed on our behalf by trusted service providers, bound by contractual confidentiality and data protection obligations:

• Webflow, Inc. (United States), which hosts the Website and processes contact form submissions;
• Microsoft 365, which hosts our email;
• our professional advisers (such as lawyers and accountants), where necessary.

We may also disclose data where required by law or to competent authorities. We never sell or rent your personal data.

5. International transfers

Some of our service providers, including Webflow, Inc., may process data outside the European Economic Area, in particular in the United States. Where this is the case, transfers are protected by appropriate safeguards, such as the provider's certification under the EU-U.S. Data Privacy Framework and/or the Standard Contractual Clauses adopted by the European Commission. You may request more information on these safeguards by contacting us.

6. Cookies

The Website currently uses only cookies and similar technologies that are strictly necessary for its operation and security. Under French law, these do not require your consent. We do not use analytics, advertising or social media tracking cookies.

If we introduce non-essential cookies in the future, we will ask for your consent beforehand through a cookie banner and update this policy. You can also manage cookies at any time through your browser settings.

7. Links to other websites

The Website contains links to third-party websites, such as our LinkedIn page. These are simple links: no data is shared with these platforms unless you click on them. Once you visit them, their own privacy policies apply.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure or alteration, including encrypted connections (HTTPS) and access restricted to authorised personnel.

9. Your rights

Under applicable data protection law, you have the right to:

• access your personal data and obtain a copy of it;
• have inaccurate data corrected or incomplete data completed;
• have your data erased, in the cases provided by law;
• restrict the processing of your data;
• object at any time to processing based on our legitimate interest, for reasons relating to your particular situation;
• receive your data in a structured, commonly used format and have it transmitted to another controller (data portability);
• withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of prior processing;
• give instructions regarding the storage, erasure and communication of your data after your death.

To exercise these rights, email us at hello@kyron.bio. We will respond within one month, which may be extended in certain cases. We may ask you to verify your identity if we have reasonable doubts.
If you believe your rights have not been respected, you may lodge a complaint with the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.

10. Children

The Website is intended for professionals and is not directed at children. We do not knowingly collect personal data from anyone under the age of 15.

11. Changes to this policy

We may update this Privacy Policy from time to time, for example to reflect changes to the Website or to the law. The date at the top indicates when it was last updated. We encourage you to review it regularly.

12. Contact

Kyron Bio, Paris Biotech Santé, Site Cochin, 27 rue du Faubourg Saint Jacques, 75014 Paris, France. Email: hello@kyron.bio