OricPharma logo
Privacy Policy
September 2026
Introduction
ORIC Pharmaceuticals, Inc. (hereinafter “ORIC”, “we”, “our”, and/or “us”) values the privacy of individuals who use our website (“Site”). This privacy policy (“Privacy Policy”) explains how we collect, use, and disclose personal information from users of our Site. By using our Site, you agree to the collection, use, disclosure, and procedures this Privacy Policy describes. Beyond the Privacy Policy, your use of our Site is also subject to our Terms of Use.
ORIC, as the Controller of the personal data, has committed to comply with:
- Regulation (EU) 2016/679 (hereinafter, the “General Data Protection Regulation” or “GDPR”);
- The General Data Protection Regulation as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (hereinafter the “UK GDPR”) and the UK Data Protection Act 2018 (amended 2020) (hereinafter the “Data Protection Act”);
- The Swiss revised Federal Act on Data Protection 2020 (“FADP”), which is the key act regulating data protection in Switzerland and where applicable, the FADP will be complemented by the revised Swiss Ordinance on Data Protection 2022 (“ODP”), which complement and provide more concrete aspect of the application of the FADP; and
- All EU applicable laws and regulations regarding data protection.
Collectively referred to as “Data Protection Laws”.
General Warning and Use of Social Media
Access to the Website implies the User’s full and unreserved acceptance of this Privacy Policy, as well as its general terms of use and the Cookies Notice. The User acknowledges having read the information below.
This Privacy Policy is valid for all pages hosted on the Website. It is not valid for the pages hosted by third parties to which ORIC may refer and whose privacy notices may differ. ORIC cannot therefore be held responsible for any data processed on these websites or by them. This Privacy Policy also applies to any other website that ORIC may operate, including our company pages on LinkedIn and any other social media platform.
Please, note that for the use of social media, ORIC will be Joint-Controller with LinkedIn and any other social media platform on which ORIC maintains a company page only for the following activities: accessing and processing statistical aggregate data provided by the applicable social media platform. For any other processing on the platform, the applicable social media platform shall be considered as the sole Data Controller.
Facebook, including Instagram, and LinkedIn have created an “addendum” to their user agreements for company pages for the processing for which they are Joint-Controllers with us. Such agreement is not currently provided by Twitter, YouTube, Flickr or Vimeo.
Why, How and For How Long Do We Collect Your Personal Data?
Depending on the purpose for which we process your personal data, we need to process one or other personal data. We will keep them for no longer than necessary to fulfill the purposes for which we collected it, including any legal requirements.
Depending on each case, the processing will therefore be as follows:
| Purposes | Types of personal data | Legal basis | Retention period |
|---|---|---|---|
| To answer your queries either by email or through the contact form | Name, email address
Please note that other Personal Data may be processed by ORIC depending on your request and the information you provide us. |
This processing is based on our legitimate interest in answering the requests or queries raised by you through the existing different contact channels.
We understand that the processing of these data is also beneficial to you to the extent that it enables us to assist you adequately and answer to the queries raised. |
We will process your data for the time necessary to meet your request. |
| To send you newsletters | Name, email address | This processing is based on your consent.
Please, remember that you may unsubscribe from the Newsletter at any time without any cost. |
We will process your data until you unsubscribe to the Newsletter. |
| For job application | Name, email, address, CV, background, education and employment experience | This processing is then based on our legitimate interest for the purpose of our recruitment process in order to administer and appraise job applications.
We understand that the processing of these data is also beneficial to you to the extent that it enables you to get a job by providing a spontaneous application or answering to an offer. |
We will process your data for the time necessary to manage your application. |
| To organize your participation in one of our events | Name, email address, financial details | This processing is based on our contractual obligations | We will process your data related to your subscription and payment for the time necessary for the organization of your participation to one of our events. |
Your Choices
Marketing Communications. You can unsubscribe from our promotional emails via the link provided in the emails. Even if you opt-out of receiving promotional messages from us, you will continue to receive administrative messages from us.
Do Not Track. There is no accepted standard on how to respond to Do Not Track signals, and we do not respond to such signals.
Third Parties
Our Site may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this Privacy Policy does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.
Security
ORIC treats your personal data in a confidential manner and provides for a sufficient and adequate level of protection of your personal data.
Your personal data are contained behind secured networks and are only accessible by a limited number of persons who have special access rights to such systems and are required to keep the information confidential.
Your Rights
According to the GDPR, UK GDPR, and FADP you have the following rights subject to limitation as set forth by applicable data protection law:
- Access. You have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, information related to the processing of data and a copy of the data being processed.
- Rectification. You have the right to require rectification of inaccurate or incomplete data about you.
- Right to be forgotten. To obtain the deletion of your personal data under certain specified circumstances.
- Restrict processing. You have the right to restrict processing of data under certain specified circumstances.
- Data portability. You have the right to request for the receipt or the transfer to another organization, in a machine-readable form, of your personal data.
- Object to processing. You have the right to object, on grounds relating to your particular situation, at any time to the processing of your data.
- Right to withdraw consent. When you have given your explicit consent for the processing of your data, you can withdraw it at any time without any cost nor justification.
Please note that all these rights are not absolute and will be assessed on a case-by-case basis by our Data Protection Officer (“DPO”).
If you would like to exercise your rights, please let us know by contacting our DPO, oricpharma.dpo@mydata-trust.info.
You also have the right to lodge a complaint if you consider that your personal data is not processed in accordance with the GDPR, the UK GDPR, and the FADP.
If you are an EEA resident: You have the right to lodge a complaint with the Supervisory Authority in the Member State of the European Union of your habitual residence, place of work or place of the alleged infringement.
If you are a UK resident: you may file a complaint with the Information Commissioner’s Office (“ICO”), the Supervisory Authority of UK, following the instructions available in the service channels.
If you are a Swiss resident: you may lodge a civil claim in case of personality rights’ infringements, in particular, regarding the exercise of your rights of access, rectification and object but also regarding infringements related to data privacy principles. The competent Supervisory Authority in Switzerland is the FDPIC.
Please find the contact information of all Authorities in the section “Contact Information”.
Children’s Privacy
We do not knowingly collect, maintain, or use personal information from children under 16 years of age, and no part of our Site is directed to children. If you learn that a child has provided us with personal information in violation of this Privacy Policy, then you may alert us at info@oricpharma.com.
International Visitors and Data Sharing
ORIC has contracted with the following Services Providers to manage the Website that may have access to your personal data:
- Notified for the management of ORIC’s investor relations webpage.
- Smartrecruiters for employment inquiries.
Sharing your personal data as explained above may involve a transfer of personal data to a country outside the European Economic Area (EEA), the UK and Switzerland. ORIC is therefore committed to complying with the transfer rules under applicable Data Protection Laws and therefore ensure to:
- Transfer your data to countries where the data recipient is located that has been recognized as adequate by the European Commission, by the UK secretary of state, by the Swiss Federal Council; or
- Where a country has not received an adequacy decision from the European Commission, or the UK secretary of state, to implement appropriate safeguards, such as the EU Standard Contractual Clauses (“SCCs”) (and the UK addendum), and/or the International Data Transfer Agreement (“IDTA”), and the Swiss Addendum.
You can contact our DPO (see contact details below) if you want more details about the mechanism supporting data transfer.
Under Swiss provisions: the list of all the third countries and related safeguards are further described in Annex A.
Information about our participation in the EU-U.S. Data Privacy Framework, the UK Extension and the Swiss-U.S. Data Privacy Framework is set out in Annex B.
Questions About Our Privacy Practices
If you have questions about your privacy on our Site or this Privacy Policy, please contact us at info@oricpharma.com.
Changes to This Privacy Policy
We will post any changes to the Privacy Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we collect, use, or disclose personal information previously collected from you through our Site, we will attempt to notify you through our Site, by email, or other means where appropriate.
Contact Information
If you have any questions, comments, or concerns about our processing activities, please email us at info@oricpharma.com or write to us at:
240 E. Grand Ave
2nd Floor
South San Francisco, CA 94080.
EU Data Protection Representative
Rue de Rennes, 140b, 75006 Paris (France)
oricpharma.dpr.eu@mydata-trust.info
UK Data Protection Representative
Uxbridge, England, UB8 (United Kingdom)
oricpharma.dpr.uk@mydata-trust.info
Data Protection Officer
oricpharma.dpo@mydata-trust.info
For other EU Data Protection Authorities
https://edpb.europa.eu/about-edpb/about-edpb/members_en
For UK Supervisory Authority (“ICO”)
Tel: +55 (0)3 03 12 31 11 3
Website: https://ico.org.uk/global/privacy-notice/your-right-to-complain/
For CH Supervisory Authority (“FDPIC”)
Phone: +41 (0)58 462 43 95 (mon.-fri., 10-12 am)
Website: https://www.edoeb.admin.ch/edoeb/en/home.html
Annex A: List of the Third Countries and Related Appropriate Safeguards in Case of Data Transfers
| Third countries | Appropriate Safeguards |
|---|---|
| United States | EU SCCs recognized by the FDPIC, with Swiss amendments |
| Canada | Adequacy decision by the Swiss Federal Council |
Annex B: Data Privacy Framework Policy
Effective date: July 2026
This Privacy Policy applies to ORIC Pharmaceuticals, Inc. (referred to as “ORIC”, “We”, or “Us” or “Our”) where personal data is collected from or about individuals in the European Economic Area (“EEA”) in the United Kingdom (“UK”) (and Gibraltar) and in Switzerland. The U.S. Department of Commerce’s International Trade Administration (ITA) requires Us to inform You about Our participation to the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”) and the EU-U.S. DPF Principles as applied under the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF Principles (hereinafter collectively referred to as the “DPF Principles”).
We comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. We have certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. We have certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.
Personal Information We Collect
The type(s) of personal information we may process vary depending on the purpose(s) for which it is processed. See the section above for information about why, how and for how long we process your personal information.
Data Sharing
We do not sell or trade to outside parties your personal information.
Additionally, we have contracted with some Services Providers to manage the Website that may have access to your personal information, as explained above under section “International Visitors and data sharing”.
We comply with the DPF Principles for onward transfers to third parties of personal information from the EEA and the UK (and Gibraltar) and Switzerland. We remain liable under the DPF Principles if a Third Party/Service Provider processes personal information covered by this Privacy Policy in a manner inconsistent with the DPF Principles, except where we can demonstrate that it is not responsible for the event giving rise to the damages.
Under certain conditions, we may be required to disclose personal information in response to lawful requests by U.S. public authorities, including to meet national security or law enforcement requirements. You can find information about how to submit a complaint regarding related to U.S. National Security access to data here.
Your Rights to Access, to Limit Use, and Limit Disclosure under the DPF
You have the right to access personal information about you, to limit use of your personal information and disclosure to Third Parties. Our DPF certification attests to our commitment to respect these rights. You have the right to obtain confirmation of whether we are processing personal information related to you, the right to have access to that data, and the right to obtain information about the purpose of the processing, the categories of personal information being processed and the (categories of) recipients to whom that data is disclosed. We also provide you with the option to correct, amend, or delete that data where it is inaccurate.
You can exercise these rights by contacting legal@oricpharma.com.
Where Can You Submit Your Inquiries or Complaints?
In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, we commit to resolve DPF Principles-related complaints about our collection and use of your personal information. If you have any inquiries or complaints, please contact us at legal@oricpharma.com. We will ensure to get back to you promptly.
In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, we commit to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Gibraltar Regulatory Authority (GRA) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF. Please contact your local Data Protection Authority for more information or to file a complaint.
You can also submit a complaint directly to your local data protection authority (i.e., EU/EEA Member State data protection authority; UK Information Commissioner’s Office (ICO) or Gibraltar Regulatory Authority (GRA); or the Swiss Federal Data Protection and Information Commissioner (FDPIC)). Your data protection authority may refer your complaint directly to the U.S. Department of Commerce’s International Trade Administration (ITA) on your behalf. In that case, the DPF team will work alongside us to seek to resolve your concern.
If your complaint regarding a possible violation of DPF principles is not appropriately resolved after following the previously mentioned mechanisms, you may be entitled to seek binding arbitration through the Data Privacy Framework Panel (more information here). You can find additional information about this possibility here if you are a EU/EEA and UK (and Gibraltar) resident and here if you are a Swiss resident.
As we are under the enforcement authority of the Federal Trade Commission (FTC), you can also submit a complaint before the FTC using this link, but keep in mind that the FTC does not resolve individual complaints. Keep in mind, however, that the FTC does not resolve individual complaints.