Contents

• Introduction
• Who we are
• The data we collect about you
• Legal basis for processing your personal data
• Disclosures of your personal data
• International cross-border data transfers
• Data security
• Data retention
• Your legal rights
• Changes to the Notice
• Your duty to inform us of changes
• Consequences of not providing Personal information to us
• Providing Mereo with other people’s data
• Third-party links
• Questions
• Glossary
• REVISION HISTORY

1. Introduction

This Privacy Notice (this “Notice”) is made available by Mereo Biopharma Group plc and its affiliated entities (referred to as “Mereo”, “we”, “us” or “our”), and is intended to assist you in understanding how we collect, process, secure, and transfer personal data you share with us. We also describe how you can contact us to learn more information about our privacy practices. The terms “you”, “your” or “user” refer to the person interacting with Mereo as a supplier or business partner, and any entity on whose behalf such supplier or business partner may be acting.

It is important that you read this privacy notice together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy notice supplements any other notices and privacy policies we may provide to you and is not intended to override them.

2. Who we are

Mereo Biopharma Group Plc is the Data Controller and is responsible for the processing of your personal data.

3. The data we collect about you

Mereo will collect and may utilize your personal data for the purposes described below:

Category of Data	Purpose for Data Processing
Contact details (Example, your name, nationality, postal address, telephone number, e-mail address)	• Facilitating communications. • Communicating to provide you with information. • Responding to your requests or communications. • To carry out due diligence on you and/or your company as a prospective counterparty to Mereo. This includes assessing financial standing, HSSE profile, technical & quality standards and corruption/money laundering risk.
Identification information such as passport ID, date of birth, other paper copies of identity	• Verifying your identity as part of our vendor onboarding process, where applicable. • Facilitating compliance with applicable laws, regulations or other requirements.
Data about your directors, employees and/or agents	• To consult private risk intelligence databases and publicly available sources of information, such as sanction lists, in order to comply with its internal anti-money laundering, and bribery and corruption prevention processes, and to prevent, detect or investigate dishonesty, malpractice or seriously improper conduct, where applicable.
Relationship Data e.g. your connection/ relationship with Mereo and your mode of interaction with Mereo.	• Maintaining records of your relationship with Mereo • Assessing, analysing and improving your service and training our staff. • Managing our relationship with you.
Payment Transactions Data (e.g. bank account details, payment order or other financial data including information regarding your tax status or the source of your assets)	• Billing, maintaining accounts, and preparing invoices. • Managing and administering your accounts and holdings. • Facilitating compliance with applicable laws, regulations, or other requirements.
Other Financial Data including investment portfolio/fund details, investment fund details and Market Trades data including information about ownership by individuals or organisations.	• Keeping track of all financial transactions connected to Mereo.
Communications Data including e-mail information, third party information, chat information, instant messages, corporate and media broadcasts, disputes or litigation, correspondence between solicitors and stakeholders and transcripts or minutes.	• Keeping track of our communication with you, managing our relationship with you. • Maintaining a technology-related log or monitoring significant events. • To check your instructions to us, assess, analyse and improve our service, train our staff, manage risk or to prevent and detect fraud and other crimes.
Information about your use of communication systems, for example data obtained through electronic means such as swipe card records* Note – this information will be collected if you have been provided with a Mereo account and office access as part of your service delivery)	• To monitor our network to prevent and detect unauthorised or malicious activity. • Facilitating compliance with applicable laws, regulations, or other requirements.
Special Categories of Personal Data about you (example, details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health or about criminal convictions and offences) Note – this information may be collected if you are likely to spend a significant amount of time at Mereo BioPharma offices.	• To comply with our legal obligations, including to ensure health and safety in the workplace. • To meet our legitimate interests in ensuring the health and safety of vendors who work at Mereo site, for example information about allergies or any reasonable adjustments required.

4. Legal basis for processing your personal data

Processing for any of the above purposes is necessary to enable us to pursue our legitimate business interests (or the legitimate interests of one or more of our affiliates) for example to contact you following your enquiry where you have provided your contact information and to reply to any questions, suggestions, issues, or complaints, including any Data Subject Requests, about which you have contacted us. We will only use your personal data when the law allows us to. We may also use your personal data, where necessary in the following circumstances:

● to perform our obligations under our contract with you;

● to comply with legal and regulatory obligations;

● to establish, exercise or defend our legal rights and/or for the purpose of (or in connection with) legal proceedings (including for the prevention of fraud); and

● with your consent.

Generally, we do not rely on consent as a legal basis for processing your personal data in circumstances where: (i) the law specifies that we have to process your personal data; (ii) we need to process your data to perform a contract with you; (iii) we have a public interest to do so; or (iv) we have a legitimate business reason for doing so.

Where we do rely on your consent, you have the right to withdraw it any time in the manner indicated when your consent was provided.

5. Disclosures of your personal data

Where necessary to fulfil the purposes described in this Notice, Mereo may disclose your personal data to certain third-parties, other vendors and service providers or affiliated employees, contractors and entities as described below.

Whenever Mereo shares your personal data with companies acting as our authorized agents and service providers, these companies agree to use your personal data only for specified purposes. Furthermore, the recipient will implement and maintain reasonable security procedures and practices appropriate to the nature of your information to protect your personal data from unauthorized access, destruction, use, modification or disclosure.

We will transfer and disclose your personal data to the following categories of recipients where it is lawful to do so, and subject to the implementation of appropriate protections:

Category of Third-Party	Purpose for Disclosure
Subsidiaries and affiliated entities	• Internal research and statistical analysis purposes.
Service Providers who work for, or provide services to us (including their employees, sub-contractors, directors, officers or any professional service provider, such as accountants, auditors, lawyers, IT systems providers and IT contractors, credit and criminal record checks)	• To support Mereo’s commercial/business objectives. • To render professional advice where there is a dispute over a transaction. • IT performance-related monitoring, maintenance, or security. • Performing analytics to help in website or application planning and development.’
Cloud storage solutions	• To store Mereo data. • To ensure the safety and security of our data.
Other vendors or suppliers	• Billing, maintaining accounts, and preparing invoices.
Law enforcement, government, courts or regulators, or fraud prevention agencies	• To verify your identity. • Mereo’s public or legal duty to assist with detecting fraud and tax evasion, financial crime prevention, regulatory reporting, litigation or defending legal rights.
Professional Consultants	• To provide professional/expert advice in connection with Mereo’s business objectives.
Other financial institutions, fraud prevention agencies, tax authorities, trade associations, credit reference agencies and debt recovery agents.	• To meet our legal, regulatory and compliance obligations.
Any prospective or new Mereo companies (e.g. if we restructure, or acquire or merge with other companies) or any businesses that buy part of or all of a Mereo company.	• In relation to compliance / due diligence If this occurs the new owners of the business will only be permitted to use your information in the same or similar way as set out in this privacy notice.

6. International cross-border data transfers

Because Mereo operates globally, your data may be transferred outside of the country in which you interact with Mereo, including to countries whose data protection laws substantially differ from the country in which you work or reside. To accomplish the purposes described in this Notice, we may also disclose and transfer personal data to personnel and other departments throughout Mereo. For example, your personal data may be transferred or accessed by Mereo and its affiliate entities in the United States of America.

Whenever we transfer your personal data out of the UK or EEA, we ensure a similar degree of protection is afforded to it by ensuring that at least one of the following safeguards is implemented:

· We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission. For further details, see here.

· Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe. For further details, see here or here, for transfers from the United Kingdom.

Please contact us here if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.

7. Data security

Mereo will implement appropriate technical and organizational security measures necessary to adequately safeguard your personal data. These safeguards will include, for example:

Security Measures

• Access to Personal Data is limited and provided only where necessary, to those employees, agents, contractors and other third parties who have a business need to know.

• All employees handling Personal Data receive security and privacy awareness training, will only process your personal data on our instructions and are subject to a duty of confidentiality.

• Employees with access to Personal Data are given the least privilege necessary

• We have robust procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

• A disciplinary policy is enforced to prevent unauthorized access

• Where technically feasible, data is encrypted in transit and at rest

8. Data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. By law, we have to keep basic information about our vendors (including contact, identity, financial and transaction data) for six years after they cease being suppliers for tax purposes.

In some circumstances you can ask us to delete your data: see your legal rights below for further information.

In some circumstances we will anonymise your personal data (so that it is no longer your personal information as it cannot be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

9. Your legal rights

You may have rights relating to your Personal Data. Depending on the applicable data privacy law, you may have the right to direct Mereo to take certain actions related to your personal data. You may have the right to request confirmation as to whether Mereo is processing your personal data, and if so:

• You may have the right to request information relating to the categories of data involved, purposes of processing, recipients of your data, retention periods/criteria, and your rights as a Data Subject.

• You may have the right to access any of your personal data that Mereo is processing.

• You may have the right to rectify any inaccurate or incomplete personal data that Mereo is processing.

• You may have the right to request erasure or restriction of any personal data that Mereo is processing, subject to certain exceptions.

• You may have the right to obtain a copy of your personal data in a commonly-used and machine-readable format.

• You may have the right to request your information not be sold or otherwise disclosed to a third-party.

• You may have the right to lodge a complaint with your local Data Protection Authority or Supervisory Authority.

To exercise the rights described above, please email [email protected] with a description of your request.

10. Changes to the Notice

We keep our privacy notices under regular review. We reserve the right, at our discretion, to change, modify, add or remove sections of this Notice at any time. You are encouraged to review this Notice from time to time for updates, or to contact Mereo for more information.

11. Your duty to inform us of changes

It is important that the personal data we hold about you is accurate and current. You are responsible for making sure the information you give us is accurate and up to date. You must tell us if anything changes, as soon as possible.

12. Consequences of not providing Personal information to us

Providing your personal data to Mereo is voluntary for you. Should you choose not to provide your personal information to us, your interaction with us may be adversely impacted. Also, the provision of your personal information may be necessary to allow us to perform a contract with you and/or to provide services to you.

13. Providing Mereo with other people’s data

If you give us any personal information that does not relate to you (e.g., information about your financial adviser and/or your employees), you must ensure that you have the required legal basis to collect and share such personal information. You must also tell them what information you have given to us, and make sure they agree we can use it as set out in this policy. You must also tell them how they can see what information we have about them and correct any mistakes.

14. Third-party links

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

15. Questions

If you have any questions about this Notice, the use of your data, or if you would like to make a request to exercise your data protection rights, please contact the Data Protection Officer using the details set out below.

Email: [email protected] and mark your query “For the urgent attention of the Data Protection Officer”.

Post: Data Protection Officer, Mereo Biopharma Group Plc, 1 Cavendish Place, London, W1G 0QF, United Kingdom.

You have the right to make a complaint at any time to the Information Commissioner’s Office(ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

16. Glossary

“Data Controller” means the person or organisation that determines how and why your data is being collected and used.

“Personal data” refers to any information relating to an identified or identifiable natural person, whether that information can be used alone or in conjunction with other information to identify a natural person.

“Aggregated Data” means summarised data derived from your personal data. Examples are statistical or demographic data. It is not considered personal data in law as this data will not directly or indirectly reveal your identity.

“Process” (or “Processing”) means any operation or set of operations which is performed on personal data or sets of personal data, whether by automated means, such as collection, use, and erasure.

REVISION HISTORY

Effective Version	Description of changes	Effective date
1.0	First Version	21 March 2023
1.1	Amended to include processing information related to vendors with additional system access	15 April 2023
1.2	Amendments to scope of the Policy	18 July 2023