Last Updated: December 10, 2025

Zymeworks Biopharmaceuticals Inc. and its affiliates (collectively, “Zymeworks,” “we,” “us,” “our,” or the “Company”) respect your privacy. This California Privacy Notice (“Notice”) applies to Personal Information that we collect as a Business from or about our current and former employees, contractors, job applicants, owners, directors, and officers who are California residents (collectively, “you,” or “employees”) in the context of their employment or other similar relationship with us.

For the purposes of this Notice, “Personal Information” and other capitalized terms not otherwise defined in this Notice have the meanings provided in the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (California Civil Code §§ 1798.100 to 1798.199) and its implementing regulations, as amended or superseded from time to time (“CCPA”).

Personal Information does not include information that is:

• Publicly available, as defined by the CCP
• Deidentified or aggregated.
• Otherwise excluded from the scope of the CCP

1. 1. Sources of Personal Information We Collect 

In the preceding twelve months since this Notice was last updated, we have collected Personal Information from the following categories of sources:

• You/Your Zymeworks devices: you or your Zymeworks devices directly
• Affiliates
• Public: publicly available databases

2. 2. Collection and Disclosure of Personal Information

The chart below provides the categories of Personal Information we have collected and disclosed for a Business Purpose in the preceding twelve (12) months since this notice was last updated.

Zymeworks does not:

• “Sell” employees’ Personal Information or “Share” (for Cross-context Behavioral Advertising) employees’ Personal Information, as those terms are defined by CCPA;
• Have actual knowledge that Zymeworks Sells or Shares Personal Information of employees under sixteen (16) years of age; or
• Use or disclose employees’ Sensitive Personal Information for purposes other than those set forth in the CCPA.

3. Disclosures of Personal Information

In the preceding twelve (12) months since this Notice was last updated, we have disclosed Personal Information to the following categories of third parties:

• Vendors: Vendors and service providers.
  • Personal Information we disclosed: Identifiers; Categories of Personal Information in Cal. Civ. Code Section 1798.80(e); Characteristics of Protected Classifications under California or Federal Law; Internet or Other Electronic Network Activity Information; Audio, Electronic, Visual, or Similar Information; Professional or Employment-related information; Beneficiary and Dependent Information; Sensitive Personal Information
• Affiliates: Our affiliate companies.
  • Personal Information we disclosed: Identifiers; Categories of Personal Information in Cal. Civ. Code Section 1798.80(e); Characteristics of Protected Classifications under California or Federal Law; Internet or Other Electronic Network Activity Information; Audio, Electronic, Visual, or Similar Information; Professional or Employment-related Information; Beneficiary and Dependent Information; Sensitive Personal Information
• Third Parties as Legally Required: Third parties as required by law and similar disclosures.
  • Personal Information we disclosed: Identifiers; Categories of Personal Information in Cal. Civ. Code Section 1798.80(e) Characteristics of Protected Classifications under California or Federal Law; Internet or Other Electronic Network Activity Information; Audio, Electronic, Visual, or Similar Information; Professional or Employment-related Information; Beneficiary and Dependent Information; Sensitive Personal Information
• Third Parties in Merger/Acquisition: Third parties in connection with a merger, sale, or asset transfer.
  • Personal Information we disclosed: Identifiers; Characteristics of Protected Classifications under California or Federal Law; Professional or Employment-related Information; Sensitive Personal Information
• Third Parties with Consent: Other third parties for whom we have obtained your permission to disclose your Personal Information.
  • Personal Information we disclosed: Identifiers; Categories of Personal Information in Cal. Civ. Code Section 1798.80(e) Characteristics of Protected Classifications under California or Federal Law; Internet or Other Electronic Network Activity Information; Audio, Electronic, Visual, or Similar Information; Professional or Employment-related Information; Beneficiary and Dependent Information; Sensitive Personal Information

4. Use of Personal Information

We collect, use, or disclose your Personal Information in accordance with the specific business purposes below:

• Employment or Work-Related Purposes: Undertake activities to manage our working relationship with you, such as administering compensation and benefits, verifying your identity, establishing emergency contact information, recording performance reviews and evaluations, monitoring the use of information technology and other equipment and property for security purposes, protecting against fraud, ensuring compliance with our policies and procedures, sending notifications and information to you, and processing work-related claims.
• Diversity and Inclusion-Related Purposes: Monitor equal employment opportunities and uphold our commitment to diversity and inclusion.
• Health and Safety Purposes: Protect the health and safety of our employees.
• Law-Related Purposes: Comply with laws and regulations, including collecting and disclosing employees’ Personal Information as required by law (e.g., for tax, health and safety, anti-discrimination laws), under judicial authorization, or exercise or defend our legal rights.

5. Data Retention

We retain Personal Information for as long as needed or permitted in light of the purpose(s) for which it was obtained and consistent with applicable law. The criteria used to determine our retention periods for each category of Personal Information include:

• The length of time we have an ongoing relationship with you and the length of time thereafter during which we may have a legitimate need to reference your Personal Information to address issues that may arise;
• Whether there is a legal obligation to which we are subject that requires us to retain information for, or delete information after, a certain period of time;
• The length of time we use the information to detect and prevent fraud and security incidents.

6. Your California Privacy Rights

You may exercise the following rights.

Right to Opt Out. We do not sell your Personal Information or share (for cross-context behavioral advertising) your Personal Information.

Right to Limit Use and Disclosure of Sensitive Personal Information. We do not use or disclose your Sensitive Personal Information for purposes other than the limited purposes permitted by the CCPA.

Right to Know and Access. You may submit a verifiable request for information regarding the: (1) categories of Personal Information collected or disclosed by us; (2) purposes for which categories of Personal Information are collected by us; (3) categories of sources from which we collect Personal Information; (4) categories of third parties to whom we disclosed Personal Information; and (5) specific pieces of Personal Information we have collected about you.

Right to Delete. Subject to certain exceptions, you may submit a verifiable request that we delete Personal Information about you that we have collected from you.

Right to Correct. You have the right to correct inaccurate Personal Information that we maintain about you.

Verification. Requests to know or access, delete, or correct Personal Information are subject to our ability to reasonably verify your identity in light of the information requested pursuant to relevant CCPA requirements, limitations, and regulations. We may need to take reasonable steps to verify your identity before responding to your request. Specifically, we (or our third-party service provider acting on our behalf) may need to collect a copy of your photo ID and any other information necessary to confirm your identity. Such information will be securely Processed in accordance with this Notice and only used for the purpose of verifying your identity.

Right to Equal Treatment. You have the right not to receive discriminatory treatment for the exercise of your CCPA privacy rights, subject to certain limitations.

Submit Requests. To exercise your rights to know or access, correct, or delete, please submit your request by emailing us at privacy@zymeworks.com or by submitting an online form here.

We will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the Personal Information subject to the request. In some instances, we may decline to honor your request where the law or right you are invoking does not apply or where an exception applies. We may need to request additional Personal Information from you, such as name and email address, in order to verify your identity and protect against fraudulent requests.

We will only use the Personal Information you provide to verify your identity and to process your request, unless you initially provided the information for another purpose. You may make a request on behalf of a child who is under 13 years old if you are the child’s parent or legal guardian. If you make a request to delete, we may ask you to confirm your request before we delete your Personal Information, and we might retain a back-up of your Personal Information to the extent allowed by applicable law, for example as necessary to preserve the integrity or security of our systems or for other purposes that are aligned with our employees’ expectations. There may be circumstances under which we will be unable to delete your Personal Information, such as if we need to comply with our legal obligations or complete a transaction for which your Personal Information was collected. If we are unable to comply with your request for deletion, we will let you know the reason why, as required by applicable law.

Authorizing an Agent. If you are acting as an authorized agent to make a request to know or access, delete, or correct on behalf of a California resident, please submit your request by emailing us at privacy@zymeworks.com or by submitting an online form here. Please note that we will require you to attach proof of power of attorney or a written authorization signed by the employee whose Personal Information will be subject to the request.

7. Contact Us

We may update this Notice at any time to reflect changes to the Personal Information we collect and how we use it. If you have any questions about this Notice, please contact privacy@zymeworks.com.