Data & Privacy Policy

GLPG is a trading name of GLPG Limited (company no. 09871398) and GLPG Finance Limited (company no. 12754335) (together, "GLPG", "we", "us"). Each company is a data controller under the UK GDPR and the Data Protection Act 2018. In general, GLPG Limited is the controller of personal data processed in connection with its agency, development and consultancy activities, and GLPG Finance Limited is the controller of personal data processed in connection with its capital advisory and finance activities. Where you engage with a particular division or opportunity, the GLPG company carrying on that business is the controller of the related personal data. Responsibility for shared website functions, including accounts, analytics and ChatGLPG, depends on which company determines the purposes and means of the processing; shared branding or systems do not by themselves establish joint controllership. Contact our data protection contact to identify the responsible company and exercise your rights. If the companies jointly determine a particular activity, you may exercise your rights against either controller and request the essence of their joint-controller arrangement.

Both companies are registered with the Information Commissioner's Office: GLPG Limited under registration number ZA162816 and GLPG Finance Limited under registration number ZA780804. The registered office of both companies is 101 New Cavendish Street, 1st Floor South, London, W1W 6XH.

Correspondence address: 3 Fitzhardinge Street, Marylebone, London, W1H 6EF. Telephone: +44 (020) 3640 6420. Email: team@glpg.co.uk.

Data protection enquiries, including requests to exercise your rights, may be sent to team@glpg.co.uk and marked for the attention of the data protection contact. We will direct your request to the responsible company; you do not need to identify the controller before contacting us.

This policy explains what personal data we collect through this website, why we collect it, the lawful bases on which we rely, who we share it with, how long we keep it and the rights available to you. It applies to visitors to the website, registered account holders, enquirers, subscribers, applicants for roles with us and parties who access confidential deal information through the website.

The terms on which you may use the website, including provisions about intellectual property, property particulars and limitations of liability, are set out in our separate Website Terms of Use.

Separate arrangements may apply where we act for you under a professional engagement. Where a client engagement letter or a confidentiality agreement contains data protection terms, those terms supplement this notice for that relationship and do not override your statutory data protection rights.

We collect the following categories of data.

• Enquiries: your name, email address, telephone number, company and the content of your message when you complete a contact or division enquiry form.
• Mailing list: your name and email address when you subscribe to updates, together with a record of your subscription and any preferences you set.
• Careers applications: your contact details, CV, covering information and the role you applied for.
• Accounts: your name, email address, telephone number, company and the details you choose to add to your profile.
• Activity and engagement data: pages and properties you view, how long you spend on them, searches you run, documents you view or download, opportunities you shortlist, alerts and preferences you set, and your interactions with ChatGLPG. Where you are signed in, this activity is associated with your account.
• Technical data: your device type, browser, approximate location derived from your IP address, pages viewed and referring pages.

We do not seek to collect special category personal data through this website, and we ask you not to submit it (see section 9 in relation to ChatGLPG).

The table below summarises the main categories of personal data we process, the purposes for which we process them and the lawful bases we rely on under the UK GDPR. Where we rely on legitimate interests, the processing must be necessary and balanced against your rights and expectations; you may request details of the relevant assessment, and you may object to processing based on legitimate interests at any time (see section 18).

Registering an account requires a valid email address. We send a one-time verification code to that address and the account is only created once the code has been entered. Verification codes are short-lived and are deleted after use or expiry.

Account passwords are handled by our authentication service for verification; GLPG staff do not have access to stored plaintext account passwords. Never send your password in an enquiry or chat message. Where social sign-in is available, you may instead register using a third-party identity provider. In that case we receive your name and email address from the provider so that we can create your account. We do not receive your password for that provider.

We record account events such as sign-in times and password resets for security and fraud prevention purposes. You may request deletion of your account at any time by contacting team@glpg.co.uk.

If you shortlist an opportunity, set search or alert preferences, or answer the short discovery questions about your investment requirements, we store those answers against your account. We use them to show your saved items, to tailor the opportunities we present, to match you to opportunities we think may interest you and to help our advisers respond to you appropriately.

You can change or clear these at any time from your account, or ask us to remove them.

Where you submit an expression of interest or an offer through the website, we collect the information you provide about the proposed terms, your funding position, your professional advisers and any supporting documents you attach.

This information is treated as confidential, is stored in restricted storage and is accessible only to authorised GLPG personnel acting on the relevant instruction. Where you have submitted an offer in relation to a property, we may disclose it to our client and to their professional advisers, which is the purpose for which it was submitted.

Certain opportunities include a confidential data room. Access requires a signed-in account and, where an NDA is set for that opportunity, recorded acceptance. We record the accepting account, property, acceptance date and time and a version label. A business email address does not establish authority to bind an organisation; the relevant contracting parties and capacity must be clear in the applicable NDA.

For audit, confidentiality and client reporting purposes we keep a record of data room activity, including which documents were viewed or downloaded, when, and by which account. Summary information about this activity may be shared with our client in connection with the transaction.

Documents made available in a data room remain confidential and may only be used for the purpose of evaluating the relevant opportunity.

ChatGLPG is an AI assistant that answers questions about GLPG, our services and the content published on this website. Where you use it inside a data room you have access to, it can also answer questions about the documents in that room. Confidential data room content is subject to the relevant account and NDA access controls. Authorised administrators may also process documents to prepare extracts and summaries for the data room.

When you send a message, the message, the page you are on and the relevant published or permitted content are processed by a third-party AI service in order to generate a reply. Processing may involve service providers outside the United Kingdom. The applicable provider terms, processing locations and transfer arrangements govern that processing; see section 15. This notice does not promise that providers never retain submitted content or use it for training.

Our website exchange logs, including ratings attached to them, are automatically deleted by a daily cleanup once they are more than ninety days old. We use these logs to monitor quality, correct errors and improve the service. Where you are signed in, conversations are associated with your account. This cleanup does not cover separate conversation history, browser copies, backups or AI-provider records, which may have different retention periods.

Responses are generated automatically and may be incomplete, inaccurate or out of date. They do not constitute professional, financial, legal or investment advice, and you should verify anything material with us directly before relying on it. No decision with legal or similarly significant effect is made about you by automated means.

Please do not submit sensitive personal data, confidential information belonging to a third party, or payment details through the assistant.

Other parts of the website use similar technology to summarise documents or draft content. The same principles apply, and summaries are always subject to the underlying documents.

Where you have subscribed, or where we have an existing relationship and are permitted to do so, we send opportunity alerts, market commentary and occasional updates about our services. Alerts are matched to the preferences held on your account. New subscriptions to our mailing list are confirmed by email before they take effect.

You may unsubscribe at any time using the link in any marketing email, by changing your preferences in your account, or by writing to team@glpg.co.uk. Unsubscribing from marketing does not stop service messages such as verification codes or replies to your enquiry.

Cookies and similar technologies are small files or identifiers stored on your device. We group them as follows.

• Strictly necessary: required for the website to function, including keeping you signed in, remembering your consent choices and protecting forms against abuse. These cannot be switched off.
• Analytics and performance: help us understand how the website is used, including pages viewed, time spent, scrolling, searches and document activity (see section 12).
• Preferences: remember settings such as your display theme and language.
• Marketing: support personalised content and advertising, where used.

The cookie banner offers analytics and marketing choices, including rejection of optional categories through Manage Cookies. Consent is required before non-essential storage or access on your device unless a legal exemption applies; legitimate interests alone do not replace that requirement. Account-linked activity records are also described in section 12 and are not all controlled by the banner. To request a change to a previously saved choice, contact team@glpg.co.uk. You can also block or delete cookies through your browser settings, although parts of the website may then stop working correctly. Withdrawing consent does not affect earlier lawful processing.

We want to be open about the fact that we operate comprehensive analytics on this website. We measure how the website performs and how it is used: which pages and properties are viewed, how long visitors spend on them, how far they scroll, which searches are run, and which documents are opened or downloaded. Where you are signed in, this activity is linked to your account so that we can understand your interests and our advisers can respond to them appropriately.

We use this information to operate, secure and improve the website, to prioritise and tailor content, to match opportunities to the preferences and behaviour of registered users, to build a picture of the likely requirements of individual users through profiling and engagement scoring, and to report to our clients and professional advisers on the level and nature of interest in an opportunity. Where we report on engagement with a particular transaction to the client concerned, that reporting may identify individual registered users who have engaged with that transaction, which is the purpose for which those users engaged with it.

We rely on your consent for any non-essential cookies or similar technologies where consent is legally required, and otherwise, where applicable, on legitimate interests in improving our services, understanding investor requirements and administering transactions. Necessary account security and confidentiality audit records are distinct from optional analytics. Each purpose requires an appropriate lawful basis; legitimate interests require a balancing assessment and do not bypass device-consent requirements. You may object to processing based on legitimate interests at any time (see section 18), or contact us to withdraw consent or change saved cookie choices.

As a professional advisory business, we maintain client relationship records. Information you provide through the website, together with your engagement history and stated requirements, may be recorded in our client relationship management systems and used to manage our relationship with you, to match you to suitable opportunities, to progress enquiries and instructions, and to support our professional advisory work.

This processing is carried out on the basis of our legitimate interests in operating and developing our business, steps taken at your request before entering into a contract, and the performance of any engagement we have with you. This policy does not extend to the terms of any specific professional engagement, which are governed by the relevant engagement letter.

We do not sell personal data. We share it only where necessary, with the following categories of recipient.

• Providers of website hosting, database and file storage.
• Providers of email delivery and marketing distribution.
• Providers of AI model, mapping and search services.
• Providers of analytics and security services.
• Our clients and their professional advisers, where you have engaged with an opportunity we are instructed on.
• Our own professional advisers, auditors, insurers and regulators, and law enforcement where we are required to disclose.

Service providers act on our instructions under written terms that require them to keep your information secure and to use it only for the purposes we specify.

Our service providers, including AI services, may process personal data outside the United Kingdom. A restricted transfer requires a valid UK adequacy basis or other lawful safeguard, such as the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, with any required risk assessment and supplementary measures. The appropriate mechanism depends on the provider, destination and processing arrangements. Contact team@glpg.co.ukfor details of the recipients, locations and safeguards applicable to your data; this notice does not establish that any particular contractual safeguard has been executed.

We keep personal data only for as long as necessary for the purposes set out in this policy, and then delete or anonymise it. In general:

• Enquiries are kept for up to two years after our last contact.
• Mailing list records are kept until you unsubscribe, and a suppression record is kept afterwards so that we do not contact you again.
• Unsuccessful careers applications are kept for up to twelve months.
• Accounts are kept for as long as the account is open.
• When an account is closed, a minimal record (name, contact details and dates) is kept for up to six years so that offers and other transaction records remain attributable.
• Records of administrative and security actions on our platform are kept for up to six years, with access restricted to authorised personnel. This is not a guarantee that records are technically incapable of alteration.
• Records of data room access and document activity are kept for up to twelve months, and longer where a transaction requires it.
• General website activity records are kept for around ninety days.
• Website ChatGLPG exchange logs and their attached ratings are deleted by a daily cleanup once more than ninety days old. Separate conversation history, browser copies, backups and provider records are not covered by that cleanup (see section 9).
• Verification codes and similar security tokens are deleted shortly after use or expiry.

Longer periods may apply where we are required to retain records to comply with legal, regulatory, tax or accounting obligations, or to establish, exercise or defend legal claims.

We maintain appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure and loss. These include encryption of data in transit, access controls that limit information to those who need it, restricted storage for confidential documents, monitoring and logging, and staff confidentiality obligations. No method of transmission or storage is completely secure, and you are responsible for keeping your account password confidential and for notifying us promptly if you believe your account has been misused.

Subject to the conditions in the legislation, you have the right to be informed about how we use your data, to request a copy of it, to have inaccurate data corrected, to request erasure, to restrict or object to processing (including processing based on our legitimate interests), to data portability, and to withdraw consent at any time where we rely on consent. You also have the right to object to direct marketing at any time.

To exercise any of these rights, contact team@glpg.co.uk. We will respond within one month, and will tell you if we need longer because the request is complex. We may ask you to confirm your identity before we act on a request.

If you are not satisfied with our response, you may complain to the Information Commissioner's Office at ico.org.uk, or by telephone on 0303 123 1113. We would encourage you to raise the matter with us first.

This website is intended for professional and business users. It is not directed at children and we do not knowingly collect personal data from anyone under the age of eighteen. If you believe a child has provided us with personal data, please contact team@glpg.co.uk and we will delete it.

The website contains links to third-party websites, maps and documents. We are not responsible for the content of those sites or for their privacy practices, and this policy does not apply to them. We recommend reading the privacy notice of any website you visit through a link from this one.

We review this policy regularly and may update it to reflect changes to the website, to our practices or to the law. The date at the top of this page shows when it was last updated. Where changes are significant, we will bring them to your attention through the website or by email.