Effective date: 24 May 2026 Mytos is committed to protecting your privacy. This Privacy Policy explains what personal data we collect when you visit our website, contact us, apply for a role, or otherwise interact with us, how we use that data, and the rights you have over it. It applies to mytos.bio and related pages we operate. It does not cover third-party websites we link to.

Mytos Bio Limited ("Mytos", "we", "us", "our") is the data controller responsible for your personal data in connection with this website. Registered office: Translation and Innovation Hub, 84 Wood Lane, London W12 0BZ, United Kingdom. Company number: 09957823. Contact for privacy matters: info@mytos.bio. If you have any questions about this policy or how we handle your data, please use the contact details above. We have not appointed a statutory Data Protection Officer; privacy enquiries are handled by our team and can be reached at the contact details above.

We collect personal data in the following ways:

• Website visitors. When you browse our site we may collect technical data such as your IP address, device and browser type, operating system, referring page, the pages you view, and the dates and times of your visits. Most of this is collected through cookies and similar technologies (see the Cookie Policy below).
• Business and partnership enquiries. When you contact us through a form, by email, or by phone, we collect the information you provide, such as your name, employer, job title, email address, phone number, and the content of your message.
• Newsletter and updates. If you sign up to receive news or updates, we collect your email address and any other details you choose to give us.
• Job applicants. When you apply for a role, we collect the personal data in your application, including your CV, contact details, work history, and any information you share during the recruitment process. Applications are processed through our recruitment platform, Lever, which acts as a processor on our behalf.
• Correspondence. We keep records of communications you have with us so we can respond and maintain our business relationship.

We use your personal data only where we have a lawful basis to do so under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our purposes and lawful bases are:

• To respond to your enquiries and provide the information or services you request. Lawful basis: our legitimate interests in operating our business and responding to you, or steps taken at your request before entering a contract.
• To manage partnerships, clients, and supplier relationships. Lawful basis: performance of a contract, or our legitimate interests in managing those relationships.
• To send newsletters and marketing communications where you have asked to receive them. Lawful basis: your consent, which you may withdraw at any time.
• To assess and process job applications. Lawful basis: steps taken at your request before entering a contract, and our legitimate interests in recruiting staff.
• To operate, secure, and improve our website and understand how it is used. Lawful basis: your consent for non-essential cookies, and our legitimate interests in keeping our site secure and effective.
• To comply with legal and regulatory obligations. Lawful basis: compliance with a legal obligation.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can ask us about this balancing at any time.

Our website uses cookies and similar technologies. Some are strictly necessary for the site to function; others help us understand how the site is used so we can improve it. Where the law requires it, we ask for your consent before setting non-essential cookies through a consent banner shown to visitors in the UK and EU. Full details are set out in the Cookie Policy below.

We do not sell your personal data. We share it only where necessary, with:

• Service providers who process data on our behalf under written agreements. These include our website hosting provider (Vercel), our video delivery provider (Mux), our recruitment platform (Lever), and other analytics, communications, and service providers that help us operate the site and respond to enquiries. These processors may act only on our instructions.
• Professional advisers such as lawyers, accountants, and auditors where reasonably required.
• Authorities, regulators, or other parties where we are required to do so by law, or to establish, exercise, or defend legal claims.
• A successor entity in the event of a reorganisation, merger, or sale of our business.

We require all processors to keep your data secure and to use it only for the purposes we specify.

Some of our service providers are located outside the United Kingdom. Where we transfer personal data outside the UK, we make sure it is protected by an appropriate safeguard, such as a UK adequacy decision, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for more information about the safeguards we use.

We keep personal data only for as long as we need it for the purposes set out in this policy, or for as long as the law requires. Retention periods vary by context:

• Enquiry and contact records are kept for as long as needed to handle your request and for a reasonable period afterwards.
• Job application data is kept for the duration of the recruitment process and, where relevant, for a limited period afterwards in case a similar role arises, unless you ask us to delete it sooner.
• Marketing data is kept until you unsubscribe or withdraw consent.

When we no longer need your data, we securely delete or anonymise it.

Under UK data protection law you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased in certain circumstances.
• Restrict or object to our processing in certain circumstances.
• Receive certain data in a portable format.
• Withdraw consent at any time where we rely on it.

To exercise any of these rights, contact us using the details above. We will respond within the time limits set by law. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk. We would, however, appreciate the chance to address your concerns first.

We take appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure, or alteration. No method of transmission or storage is completely secure, but we work to keep our safeguards under review and to limit access to personal data to those who need it.

Our website and services are intended for business and professional audiences and are not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices or the law. When we do, we will revise the effective date at the top of this page. We encourage you to review this page periodically.

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us at: Mytos Bio Limited 80 Wood Lane, London W12 0BZ, United Kingdom info@mytos.bio

Effective date: 24 May 2026 This Cookie Policy explains how Mytos uses cookies and similar technologies on mytos.bio. It should be read alongside the Privacy Policy above.

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work, to remember your preferences, and to give site owners information about how their site is used. We also use similar technologies such as pixels and local storage, which we refer to collectively as "cookies" in this policy.

We use the following categories of cookies:

• Strictly necessary cookies. These are required for the website to function and cannot be switched off. They include cookies that remember your cookie preferences and that keep the site secure.
• Analytics and performance cookies. These help us understand how visitors use our site, such as which pages are visited most, so we can improve it. They are only set with your consent where the law requires.
• Functional cookies. These remember choices you make to give you a better experience. They are only set with your consent where the law requires.

We do not use cookies for advertising or to build profiles for third-party marketing.

For visitors in the UK and the EU, we display a consent banner the first time you visit, so you can accept or reject non-essential cookies before they are set. Strictly necessary cookies do not require consent. You can change or withdraw your consent at any time by reopening the cookie settings from the banner or footer, or by clearing cookies in your browser. Most browsers also let you block or delete cookies through their settings. If you block strictly necessary cookies, parts of the site may not work properly.

Some cookies may be set by third parties that provide services on our site, such as our video delivery provider and analytics providers. These third parties are responsible for their own use of cookies, and we recommend reviewing their privacy and cookie notices. We only allow non-essential third-party cookies where you have consented.

We may update this Cookie Policy from time to time. When we do, we will revise the effective date above. Please check back periodically to stay informed about our use of cookies.