1. Name and contact details of the persons responsible pursuant to Article 4 No. 7 GDPR

Pulmonx UK Ltd.
Suite 4, 7th Floor
50 Broadway
London, United Kingdom
SW1H 0DB
Phone: +44 (0) 808 234 0376

Pulmonx GmbH
Fürstenrieder Straße 263
81377 München
E-Mail: info@pulmonx.de
Tel.: 0800/1888089

Pulmonx International Sàrl
Rue de la Treille 4
2000 Neuchâtel, Switzerland
Phone: +41 32 475 20 70

Email address: info@pulmonx.com

2. When do we process personal data on our website
We process personal data about you in the following context:

• Visiting our website (Chapter 3.1);
• Contact via our contact form (Chapter 3.2);
• Newsletters and electronic information materials (Chapter 3.3);
• Facebook Fanpage and Page Insights (Chapter 3.4 and 3.5);
• Application to Pulmonx (Chapter 3.6);
• Integration of cookies and third-party content and services (Chapter 3.7).

3. Description of data processing as well as purpose and legal basis

3.1. Visiting our website

When you visit our website, the following information is automatically collected from you and processed:

• IP Address
• Browser type and version
• Device
• Operating system
• Date and time of access
• Country
• Language

The processing of the above information is based on our legitimate interests in providing you with our website and ensuring the stability and security of our website, Article 6(1)(f) GDPR. In addition, based on our legitimate interests (Article 6(1)(f) GDPR) in troubleshooting and optimising our website, we process the information for analysis purposes (e.g. to identify possible technical errors of the website or to determine when the website is used particularly heavily). You have the possibility of objecting to the above processing based on our legitimate interests at any time by sending us a short message to one of the communication channels in Chapter 1.

3.2. Contact via our contact form

In addition to the contact options mentioned in Chapter 1, you can also get in touch with us via our contact form. In this case, we will process your name, e-mail address and request. The processing of your data is carried out for the purpose of processing your enquiry on the basis of your consent, which you express by pressing the “Submit” button or by sending us your e-mail, Article 6 (1)(a) GDPR.

3.3. Newsletter and electronic notifications
Within the framework of our contact form as well as the ordering of information material, you have the option of consenting to receive notifications on our products, services as well as information on our surveys and events by e-mail (newsletter). In this case, we process your name, your e-mail address, other data entered by you and the time of your consent on the basis of your consent (Article 6(1)(a) GDPR).

By giving us your consent to receive electronic notifications, you also consent to the measurement and analysis of e-mail open rates and click-through rates of the newsletters sent. We perform these measurements and analyses with the help of an external service provider (processor) for the purpose of better understanding the activities of our readers and providing appropriate content. In the event of your withdrawal of consent (see below), this will also be deemed to be a withdrawal of your consent to our measurement and analysis activities.

You can revoke your consent to receive electronic notifications and the aforementioned data processing at any time with future effect by sending us a short e-mail to info@pulmonx.com or by clicking the unsubscribe link in the newsletter e-mail.

3.4. Facebook Fan Page and Page Insights
We use a Facebook fan page at https://www.facebook.com/Zephyr.Valve to provide visitors and interested parties with information about our company and our products. Facebook provides us with page insights for this fan page. Page Insights is aggregated data that allows us to understand how users interact with our fan page. Page insights may be based on personal data collected in connection with a visit to or interaction with our fan page and its content by individuals. Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Facebook”) and we act as joint controllers of insights data and have entered into an agreement with Facebook Ireland for this purpose. They can be found at https://www.facebook.com/legal/terms/page_controller_addendum. The legal basis for the processing of page insights is our legitimate interest in responding to the interests of visitors to our fan page in a more targeted manner in accordance with the interaction on our fan page (Article 6(1)(f) GDPR). You have the possibility of objecting to the above processing based on our legitimate interests at any time by sending us a short message to one of the communication channels in Chapter 1.

3.5. Facebook Lead Ads

Pulmonx uses Facebook Lead Ads of Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, (“Facebook”) to collect and process certain personal data of interested parties via a contact form displayed on Facebook websites (so-called “instant forms”). Content and scope of the data requested in this form depends on the focus of the lead of the respective campaign, but it will most likely contain your name and your email address.
The data provided to COPD Emphysema Help by Facebook via Facebook Lead Ads will only be processed by Pulmonx and is strictly bound to the purposes pursued by the respective lead ad campaign. These purposes are clearly stated in the Lead Ad or on the form provided before the data is transmitted. Depending on the orientation of the Lead Ad campaign the legal basis for the data processing is your consent.

Your personal data will not be forwarded to third parties.

In the context of the aforementioned services, data transmitted via instant forms may be stored on servers of Facebook Inc, 1601 Willow Rd, Menlo Park, CA 94025 USA.
Further information on the data processing via Facebook Lead Ads can be found at Facebook’s Data Policy.

You have the option to revoke your consent to the aforementioned data processing at any time with future effect by sending us a short e-mail to info@pulmonx.com.

3.6. Application to Pulmonx

If you decide to apply to us, we will process the information we receive from you as part of the application process. This information includes your contact details, details in the letter of application, in particular your education and qualifications, curriculum vitae, references, correspondence and telephone or verbal details (applicant data). We use your applicant data for the purpose of checking, processing and implementing the respective application process and – if your application is successful – for the establishment, implementation and termination of an employment relationship with our company.

Your applicant data is processed on the basis of Section 26 BDSG in conjunction with Article 6(1)(f) GDPR, insofar as this is necessary (i) for the decision on the establishment of an employment relationship with Pulmonx and (ii) in the event of success of your application for the establishment, implementation and termination of the employment relationship with our company.

If, in the event of a rejection, you decide that you would like us to take your applicant data into account for future job advertisements, the further processing of your applicant data will be based on your consent, which we will ask for separately Article 6(1)(a) GDPR.

3.7. Integration of cookies and third-party content and services

Pulmonx uses tracking technologies such as its own and external cookies in connection with the provision and operation of the website (Chapter 3.7.1) as well as contents and services of third parties (Chapter 3.7.2).

3.7.1 Integration of cookies

Cookies are small text files that are stored on the end device you use (e.g. computer, tablet, smartphone) during your visit and specific activities on our website and store various information, such as device information or IP addresses. In addition to cookies, we also use comparable tracking technologies such as tracking pixels (hereinafter referred to collectively as “cookies“).

On the one hand, we use cookies in connection with the technical provision of our website. On the other hand, we use cookies to better understand visitor flows and activities on our website, to display external content or to use user information for advertising-related purposes. On our website we distinguish between:

• Essential cookies
• Statistical cookies
• Marketing cookies
• External media

Legal basis for the use of cookies:

Your consent is not required for the integration of essential cookies. Likewise, the processing of information collected by means of essential cookies in connection with the storage of user input (e.g. cookie opt-in) or the technical provision and guarantee of the security of the website is carried out on the basis of Article 6(1)(f) GDPR. You may object to these processing operations at any time by using one of the communication channels mentioned in Chapter 1.

For the integration of statistics and marketing cookies as well as external media and the associated collection of device and user information for the purposes indicated in the cookie settings, we ask for your prior consent, Article 6(1)(a) GDPR. In our cookie settings, you have the option at any time of giving your consent to the integration of these cookies or revoking it with effect for the future.

Storage period of the cookies:

The storage period of the cookies can be found in the specific cookie information in our cookie settings.

Provider of the cookie and further information on data protection:

In our cookie settings, in addition to the purpose of the integration, you will also find information on the respective provider and – where available – further information on the data protection of the respective provider.

3.7.2 Third-party content and services

The majority of the following third-party content and services that we have integrated into our website (e.g. analysis services, social media buttons) also work with the prescribed cookie technology or comparable tracking technologies. The integration of the following contents and services therefore requires the collection of device and user information by means of cookies by the providers named below.

As shown above, we first need your consent to collect this information, which you can give us in the cookie settings.

If we have your consent, your data will be processed downstream for a variety of purposes as set out below (e.g. fraud prevention, reach measurement, advertising). We base these downstream processing activities on our legitimate business interests under Article 6(1)(f) GDPR, i.e. in order to

• design our website in a user- and interest-oriented manner;
• run our website safely and in a business-like manner;
• conduct public relations for our company and communicate with you; and
• increase the reach of our company and our products (Article 6(1)(f) GDPR).

You have the possibility of objecting to the downstream data processing associated with the services at any time by sending us a short message to the communication channels mentioned in Chapter 1.

For the uniform display of fonts, we have integrated “Google Fonts” into our website, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

When you access the website, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly. For this purpose, the browser you use must connect to Google’s servers. This enables Google to know that our website has been accessed via your IP address, whereby this data is used solely for the purpose of displaying the fonts in your browser.

For more information on Google Web Fonts and Google’s privacy policy, please see
https://developers.google.com/fonts/faq
https://www.google.com/policies/privacy/

To prevent misuse of the contact form, our order form and the self-test, we have integrated the “reCAPTCHA” function into our website. reCAPTCHA is a tool provided by the service provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) and is used to detect bots.

The reCAPTCHA function checks whether an entry in the contact form is made by a human or an automated program. For this purpose, Google analyses (e.g. by querying image elements) the behaviour of the website visitor by collecting and evaluating certain user information (e.g. IP address, time spent on our website, mouse movements made by the website visitor on our website).

You have the possibility to object to these processing operations on the basis of our legitimate interests at any time by sending us a short message to one of the communication channels in Chapter 1.

For more information on reCAPTCHA, please see Google’s representations below:

Website: https://www.google.com/recaptcha/ as well as in the Google data privacy notice at: https://policies.google.com/privacy.

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google“). The use includes the Universal Analytics operating mode. This makes it possible to assign data, sessions and interactions across multiple devices to a pseudonymous user ID and thus analyse a user’s activities across devices.

Google Analytics uses cookies that enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. However, in the event that IP anonymisation is activated on this website, your IP address will be truncated beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The data sent by us and linked to cookies, user IDs (e.g. user ID) or advertising IDs are automatically deleted after 24 months. The deletion of data whose retention period has been reached takes place automatically once a month. You can find more information on terms of use and data protection at https://policies.google.com/privacy or at https://policies.google.com/privacy

In addition to your cookie settings, you can also prevent the integration of cookies associated with the use of Google Analytics by setting your browser software accordingly. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) by Google and the processing of this data by Google by downloading and installing the

You can find more information about data processing at Hotjar here: https://www.hotjar.com/legal/policies/privacy

You can consent to the use of Hotjar and the associated integration of cookies at any time or revoke our cookie settings.

When you complete a form on our website, we collect, transfer and securely store that information in our CRM, Salesforce, and utilize it with our marketing automation software, Salesforce MarketingCloud. Your interaction with marketing emails is also recorded to help us improve and deliver relevant content to you in the future. When required by law, we will send you an email to confirm your choice to opt-in to marketing communications. You can choose to opt-out of marketing emails at any time by clicking the “Unsubscribe” button in the footer of any marketing email.

For information related to Salesforce.com and its products, please see the company’s commitment to privacy here.

Social media buttons (“social bookmarks“) from the social networks LinkedIn, Facebook, Twitter and YouTube are used on our website. Social bookmarks are internet bookmarks/links that enable you to access our appearances at the respective providers

• LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland);
• Facebook (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland)
• Twitter (Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland)
• YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)

with one click. By activating the social bookmarks, you will be redirected to our page at the respective provider (e.g. Facebook fan page, see also more detailed explanations in Chapter 3.4).

When you visit our online presences in the social networks of the aforementioned providers (e.g. LinkedIn company profile; Facebook fan page), we process data from you to communicate with you or to better understand your behaviour on our online presence. We may also use your user behaviour on our online presence to serve suitable advertisements within and outside the social network. In order to enable the above data processing, the integration of social bookmarks on our website is associated with the use of cookies from the above providers (see also the cookie information in our cookie settings). By means of these cookies, device and user information about you can be collected and used for the above purposes.

You have the possibility of giving us your consent and/or revocation for the integration of these cookies via our cookie settings at any time.

For further information on this and on the handling of your personal data within the social networks, please see the privacy notices of the respective providers, which we provide below. These also provide you with information on how you can assert your data subject rights against the providers in addition to us and, if available, on an agreement pursuant to Article 26 GDPR that we have concluded with the respective providers (see also Facebook fan page, Chapter 3.4):

• LinkedIn: https://www.linkedin.com/legal/privacy-policy
• Facebook: https://www.facebook.com/about/privacy/ ;
• Twitter: https://twitter.com/en/privacy
• YouTube: https://policies.google.com/privacy

g. Google Maps

On our website we use Google Maps (API) from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). Google Maps is a web service for displaying interactive (land) maps to visually present geographical information. By using this service, you will be shown our location and it will be easier for you to find us.

Information about your use of our website (such as your IP address) is transmitted to Google servers and stored there when you call up those sub-pages in which the Google Maps map is integrated; this information may also be transmitted to Google LLC servers in the USA. This is done regardless of whether Google provides a user account via which you are logged in or whether a user account exists. If you are logged in to Google, your data will be directly assigned to your account. If you do not wish to be associated with your Google profile, you must log out before activating the button. You have the right to object to the creation of these user profiles, and you must contact Google to exercise this right.

If you do not agree to the future transmission of your data to Google in the context of the use of Google Maps, in addition to changing your settings in the cookie settings at any time, you have the option of completely deactivating the Google Maps web service by switching off the JavaScript application in your browser. Google Maps and thus also the map display on this website can then not be used.

You can read Google’s terms of use at https://policies.google.com/terms. The additional terms of use for Google Maps can be found at https://policies.google.com/terms.

Detailed information on data protection in connection with the use of Google Maps can be found here: https://policies.google.com/privacy.

We have also integrated “Facebook Pixel” of Facebook Inc. (“Facebook“) on our website. Similar to the way cookies work, Facebook Pixel allows us and Facebook to collect information about your user behaviour on our website, classify you into interest groups (Custom Audience) and use this information to serve ads within the Facebook network that may be of interest based on your activities on our website.

With the help of Facebook Pixel, we can also track the effectiveness of Facebook ads for statistical and market research purposes by seeing whether you were redirected to our website after clicking on a Facebook ad (“conversion measurement”).

Subject to your consent in the cookie settings, we are jointly responsible for certain data processing operations (here: the collection of information by means of Facebook Pixel and transmission to Facebook) due to the integration of Facebook Pixel and have concluded a corresponding agreement with Facebook to this effect ( https://www.facebook.com/legal/controller_addendum). According to this agreement, you can, for example, address your data subject rights (e.g. information and deletion requests in connection with Facebook Pixel) directly to Facebook.

Please note that the joint responsibility with Facebook is limited only to the initial collection and transmission of your data in connection with the integration of Facebook Pixel. Insofar as Facebook carries out analyses for us on the basis of the Facebook Pixel data and provides us with aggregated reports, this processing is carried out by way of a commissioned data processing agreement which we have concluded with Facebook for these purposes (https://www.facebook.com/legal/terms/dataprocessing).

You have the option of giving or withdrawing your consent for Facebook Pixel via our cookie settings at any time.

You can find more information on data protection at Facebook here: https://www.facebook.com/about/privacy

This website uses Google Ads. Google Ads is also an online advertising program of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Within the framework of Google Ads, we use so-called conversion tracking. When you click on an ad placed by Google, a cookie is set for conversion tracking. These cookies lose their validity after 30 days and are not used to personally identify users. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognise that the user has clicked on the ad and been redirected to this page. Each Google Ads client receives a different cookie. The cookies cannot be tracked through Google Ads customers’ websites. The information collected using the conversion cookie is used to create conversion statistics for Google Ads customers who have opted in to conversion tracking. Customers learn the total number of users who clicked on their ad and were redirected to a page tagged with a conversion tracking tag. However, they do not receive any information with which users can be personally identified.

You have the option of giving or revoking your consent for Google conversion tracking via our cookie settings at any time.

You can find more information about Google Ads and Google Conversion Tracking in Google’s privacy policy: https://policies.google.com/privacy.

This website uses Google Ads Remarketing, an online advertising programme of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). In connection with Google Ads, we use the remarketing function within the Google Ads service. With the remarketing function, we can offer users of our website on other websites within the Google advertising network (in Google Search or on YouTube, so-called “Google Ads” or on other websites) advertisements based on their interests. For this purpose, the interaction of users on our website is analysed, e.g. which offers the user was interested in, in order to be able to display targeted advertising to users on other sites even after they have visited our website. For this purpose, Google – subject to your consent in our cookie settings – marks the end device used by you with a cookie so that your user behaviour can be recorded and used for targeting interest-based advertising in the above networks.

You have the option to revoke your consent to the placement of this marketing cookie in our cookie settings at any time.

For more information about Google’s privacy policy, please visit: https://policies.google.com/privacy.

In addition to the third parties named in Chapter 3.7 for the integration of cookies and third-party content and services, we have also involved external service providers in data processing who support us in the technical provision of the website and other services offered (e.g. operation and maintenance of our website; e-mail marketing).

Taking into account our obligations under data protection law, we have concluded corresponding agreements with these recipients which serve to protect your personal data.

In addition, the personal data concerning you will be passed on to public authorities and other recipients who are entitled to receive this information on the basis of statutory provisions (e.g. tax authorities, tax advisors, law enforcement agencies, legal counsel).

If your personal data is processed by us or the above recipients outside the European Union or the European Economic Area (so-called third countries), we have taken appropriate measures to ensure that, in the event of the transfer and processing of your personal data, an adequate level of data protection is guaranteed at the recipient of your personal data in a third country, e.g. on the basis of a recognised level of data protection on the recipient side (e.g. adequacy decision of the EU Commission) or other guarantees provided for by law. Please contact us via one of the communication channels mentioned above (Chapter 1) if you would like further information or a copy of the measures taken.

We will not retain your personal data for longer than is necessary for the purpose for which it was collected, unless we are entitled or obliged by law or contract to continue to retain it.

You have the following rights in relation to Pulmonx in respect of personal data relating to you:

• Right of access, Article 15 GDPR
• Right to rectification, articles 16, 19 GDPR
• Right to deletion, articles 17, 19 GDPR
• Right to restriction of processing, articles 18, 19 GDPR
• Right to data portability, Article 20 GDPR
• Right of objection, Article 21 GDPR

You have the possibility at any time of revoking your consent(s) to data processing (see chapter with effect for the future) by sending an e-mail to info@pulmonx.com (see also more detailed information in chapters 3.2, 3.3, 3.4, 3.5and 3.6). For your granted consents to the integration of cookies on this website (Chapter 3.7), you can exercise your revocation at any time via the cookie settings.

You also have the right not to be subject to a decision based solely on automated processing (Article 22 GDPR). In connection with your visit to or activity on our website, your personal data will not be subject to any decision based solely on automated processing which produces a legal effect or otherwise affects you (including profiling within the meaning of Article 22 GDPR).

You can exercise your rights by any of the communication channels we offer above in Chapter 1.

You also have the possibility at any time of lodging a complaint against the data processing with the supervisory authority responsible for Pulmonx:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
https://ico.org.uk/global/contact-us/

EMEA-EN-1643-v1 UK Data privacy policy