ZEVRA APPLICANT AND WORKER PRIVACY NOTICE

SCOPE

This Privacy Notice applies to employees, contractors, contingent and other personnel (collectively, “Workers”) and applicants and prospective Workers (collectively, “Applicants”) whose personal information Zevra may collect and process during its Human Resources operations, from submission of an application, throughout the course of an individual’s tenure with the Company, and following such employment or services (collectively, the “Human Resources Operations”). As used in this Privacy Notice, “personal information” has the meaning given to it under the law where you live, but typically refers to information that can be used to identify you as an individual; our activities taken with respect to your personal information are referred to as “processing.”

The terms “Zevra,” “we,” “us,” and “our” means Zevra Therapeutics, Inc., and its affiliates. This Privacy Notice explains the kinds of personal information we may collect, how we intend to use and share that information, and the rights you may have related to these processing activities.

An Important Note: This Privacy Notice only applies to data that we collect and process when interacting with you in your capacity as an Applicant or Worker. Unless otherwise indicated on a specific website page or form, this Privacy Notice does not apply to any of the personal information that we process through your use of our public-facing websites, applications, or services, which are subject to our user Privacy Policy governing those properties.

PERSONAL INFORMATION WE COLLECT

Zevra collects personal information from Applicants and Workers as described below.

Personal Information We Collect from You Directly. We may collect the following personal information that you provide to us:

• Profile/Demographic Information. Name, address, phone number, email address, date of birth, passport number, driver’s license number, driving record, Social Security number or other government-issued identification number, employment history, education information, professional qualifications, salary information, financial information related to credit checks, bank details for payroll, language abilities, contact information of third parties in case of an emergency, beneficiaries under any benefit program, and other information that you may provide on a resume/CV or application form. We may also collect other sensitive personal information such as details of health and disability, including medical information, health insurance information, mental health, medical leave, and maternity leave; information about national origin or immigration status; and optional demographic information such as race or veteran status, to helps us to comply with our reporting obligations and provide insight into equity and inclusion objectives.
• Communications with Us. Personal information such as personal contact information when an Applicant or Worker communicates with us, for example to inquire about employee benefits.
• Intra-Group Communications. Zevra may offer, enable, or require Workers to utilize Zevra-provided intra-company accessible sites, video-enabled meetings, pages, messaging channels, apps, blogs, or forums (“Intra-Company Communication Channels”). Zevra and other individuals who use the Intra-Company Communication Channels may collect personal information and other information you submit or make available when using or participating in the Company Communication Channels. Personal information collected or generated about you when using Intra-Company Communication Channels may be considered “public” and may not be subject to the same privacy protections set forth herein.

Personal Information We Collect Automatically.

• Worker Use of Zevra Information Technology Systems and Networks. Zevra may collect certain information automatically through the course of its Workers’ employment or services, such as Internet protocol (IP) address, inferred location based on IP address or activities, device identifiers associated with a computer or device (whether owned or authorized by us), mobile carrier and related information, activity logs, and other information about activities Workers may engage in on Zevra property, equipment, accounts, systems and networks. Zevra may monitor and review Workers’ uses of Zevra equipment, accounts, information technology systems and networks, including its phone networks, computer networks, including those used to access the Internet, videoconferencing systems and other Intra-Company Communications Channels. Zevra may access and review Workers’ video-recordings, transcripts, electronic files, chat and other forms of real-time messages, and emails sent or stored on its information technology systems, including accounts, computers and devices provided to Workers, or on Workers’ devices on which Zevra systems or tools are enabled subject to Zevra’s internal IT terms and policies. Workers should have no expectation of privacy while on Zevra premises or using Zevra information technology systems, devices, networks, and electronic communication tools regardless of location. This privacy notice does not establish that all workers will have access to, or will participate in, the systems, networks, data, programs, and other business activities described in this privacy notice.
• CCTV Footage. Zevra may monitor its premises using CCTV cameras.
• From time to time, we may ask you to give us your feedback, opinion, or participate in optional surveys or polls. If you decide to participate, you may be asked to provide certain information, which may include personal information.
• Promotional Activities. Occasionally, Zevra may run promotional activities for the benefit of its Workers. Workers who elect to participate may be asked to provide personal information to administer the activity and award prizes or other types of recognition.

Information from Other Sources. We may collect or receive information about Applicants and Worker from other sources, including through third-party services and organizations to supplement information provided by you. For example, where relevant to the role in question and as permitted by law, we may conduct background and credit checks on Applicants prior to employment with Zevra.

Miscellaneous Information. We may receive or collect other miscellaneous information (for example, information an Applicant chooses to disclose during the interview process, whether in oral or written form, opinions generated during the interview process, and information provided to us during performance reviews).

HOW WE USE YOUR INFORMATION WE USE YOUR INFORMATION

We process personal information for a variety of business purposes including:

• To assess your suitability, aptitude, skills, qualifications, and interests for employment with or provision of services to Zevra;
• To communicate with you about the application process and/or your application;
• To assist you with obtaining an immigration visa or work permit (where required and requested by you);
• To take steps at your request prior to entering into a relationship with you (for example, after we have sent you an offer, to process certain personal information to enter into and commence employment);
• Workflow management, including assigning, managing and administering projects;
• Human Resources Operations administration and communication;
• Payroll and the provision of benefits;
• Compensation, including bonuses and long-term incentive administration, stock plan administration, compensation analysis, including monitoring overtime and compliance with labor laws, and company recognition programs;
• To pursue our legitimate interests (for example, fraud prevention, network and information security, disclosure to affiliated organizations for administrative tasks, Worker monitoring for safety or management, whistleblowing schemes, enforcement of legal claims, and research purposes);
• Job grading activities;
• Performance and Worker development management;
• Organizational development and succession planning;
• Benefits and personnel administration;
• Absence management;
• Helpdesk and IT support services;
• Internal and/or external or governmental compliance investigations;
• Internal or external audits;
• Where it is necessary for the establishment, exercise or defense of legal claims;
• Diversity and inclusion initiatives;
• Restructuring and relocation;
• Emergency contacts and services;
• Worker safety;
• To comply with our legal obligations;
• Processing of Worker expenses and travel charges;
• Acquisitions, divestitures, and integrations; and
• As you otherwise offer, agree or consent.

HOW WE DISCLOSE YOUR INFORMATION

We may share personal information as described in this Privacy Notice (e.g., with our third-party service providers; to comply with legal obligations; to protect and defend our rights and property) or with your permission.

Vendors and Service Providers. Zevra may share personal information we receive pursuant to this Privacy Notice with vendors and service providers. The types of service providers to whom we entrust personal information include service providers for: (i) maintaining our Human Resources Operations; and (ii) the provision of IT and related services.

Affiliates and Subsidiaries. Zevra may share personal information with our corporate affiliates and subsidiaries for our and their internal business purposes.

Other Zevra Workers. If Workers elect to share personal information or other information through Intra-Company Communication Channels, other Workers may be able to see some or all this information. In addition, Worker name and photo may be made available through the Intra-Company Communication Channels to facilitate collaboration and workplace communications.

Disclosures to Protect Us or Others. We may access, preserve, and disclose your personal information if we believe doing so is required or appropriate to: (i) comply with law enforcement or national security requests and legal processes, such as court orders or subpoenas; (ii) protect your, our, or others’ rights, property, or safety; (iii) enforce our policies or contracts; (iv) collect amounts owed to us; or (v) assist with an investigation or prosecution of suspected or actual illegal activity.

Merger, Sale, or Other Asset Transfers. If we are involved in an actual or proposed merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another entity, your information may be transferred as part of such a transaction as permitted by law and/or contract.

INTERNATIONAL DATA TRANSFERS

All information collected via or by Zevra may be transferred, processed, and stored anywhere in the world, including, but not limited to, the United States, to carry out our Human Resources Operations. We take all commercially reasonable measures to safeguard personal information consistent with the requirements of applicable laws.

INDIVIDUAL RIGHTS IN PERSONAL DATA

In accordance with applicable law, you may have the right to:

• Access to and portability of your personal information, including: (i) confirming whether we are processing your Personal Information; (ii) obtaining access to or a copy of your personal information; (iii) receiving an electronic copy of Personal Information that you have provided to us, or asking us to send that information to another company (the “right of data portability”);
• Request correction of your personal information where it is inaccurate or incomplete. In some cases, we may provide self-service tools that enable you to update your personal information, or we may refer you to the controller of your Personal Information who is able to make the correction;
• Request deletion of your personal information, subject to certain exceptions prescribed by law; and
• Request restriction of or object to our processing of your personal information, including the right to (i) withdraw your consent to processing, (ii) object to, or restrict, processing of your sensitive personal information for certain purposes, or (iii) opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you, if applicable, where each such requests are permitted by law.

If you would like to exercise any of these rights, contact us as set forth below. We will process such requests in accordance with applicable laws. To protect your privacy, Zevra will take measures to verify your identity before fulfilling your request. You have the right to not receive discriminatory treatment or be retaliated against for exercising these rights. An agent authorized to act on your behalf, may make a verifiable consumer request to exercise the rights described above related to your personal information. You may also make a verifiable request on behalf of your minor child. To authorize an agent, provide written authorization signed by you and your designated agent and contact us as set forth for additional instructions

DATA RETENTION

Zevra retains the personal information we receive as described in this Privacy Notice for as long as necessary to fulfill the purpose(s) for which it was collected, carry out our Human Resources Operations, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, comply with applicable laws, or based upon other criteria, including, but not limited to, the sensitivity and volume of such data. Additionally, we endeavor to retain all such personal information in accordance with legal requirements.

SECURITY OF YOUR INFORMATION

We take steps to ensure that your information is treated securely and in accordance with this Privacy Notice. Unfortunately, we cannot ensure or warrant the security of any information you provide to us. To the fullest extent permitted by applicable law, we do not accept liability for unauthorized disclosure.

THIRD-PARTY WEBSITES/APPLICATIONS

Various resources and sites at Zevra may contain links to third party websites/applications and other websites/applications may reference or link to Zevra that we do not control. We do not control these third-party services. We encourage Applicants and Workers to read the privacy policies of each website and application with which they interact. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.

CHANGES TO OUR PRIVACY NOTICE AND PRACTICES

We may revise this Privacy Notice from time to time at our sole discretion. If there are any material changes to this Privacy Notice, we will notify you as required by applicable law. You understand and agree that you will be deemed to have accepted the updated Privacy Notice if you continue your employment with or services to the Zevra after the new Privacy Notice takes effect.

SUPPLEMENTAL NOTICE FOR RESIDENTS OF SPECIFIC US STATES

The following table describes the categories of personal information Zevra has collected and the categories of third parties to which such information has been disclosed:

Category of Personal Information Collected by Zevra	Category of Third Parties to which Personal Information is Disclosed
Identifiers A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number or other similar identifiers.	Government entities Service providers
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.	Government entities Service providers
Sensitive Personal Information A social security, driver’s license, state identification card, or passport number, an account log-in, financial account, debit card or credit card number in combination with any required security or access code, password, or credentials allowing access to an account, precise geolocation, racial or ethnic origin, citizen or immigration status, religious or philosophical beliefs, or union membership, contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication, or genetic information.	Service providers Government entities
Protected classification characteristics under California or federal law Age (40 years or older), race, color, ancestry, national origin, citizenship, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	Service providers Government entities
Sensory data Audio, electronic, or visual information.	Service providers
Professional or employment-related information Current or past job history or performance evaluations.	Service providers

The categories of sources from which we collect personal information are described above in the section titled “Personal Information We Collect.”

We use the data we collect about you for the business purposes described above in the section titled “How We Use Your Information.” In addition, we may share any data we hold about you with the parties described above.

Your personal information is not (i) “sold” or (ii) “shared” (for purposes of targeted advertising) by us, nor do we have actual knowledge that we share or sell Personal Information of persons under 16 years of age.

Data Retention. The Data Retention section above outlines the criteria we utilize for determining how long to retain data.

Sensitive Personal Information. Processing of sensitive personal information is carried out exclusively for the purposes outlined above, to the extent permitted under law. This processing activity may include service providers and government entities.

CONTACT US

If you have any questions about our privacy practices or this Privacy Notice, please contact us by email at [email protected].