1. Who is responsible for your data?
The controller is ΕΞΕΛΙΞΙΣ ΔΙΑΧΕΙΡΙΣΗ ΕΡΕΥΝΑΣ ΚΑΙ ΕΠΙΚΟΙΝΩΝΙΑ Ε.Ε. (trade name: Exelixis Research Management & Communication), a Greek limited partnership.
Registered office: Kleisthenous 187, 153 44 Gerakas, Attica, Greece.
GEMI: 127135503000 · VAT / Greek Tax Identification Number (AFM): 800521378.
Contact: euprojects@exelixisrm.com · +30 210 604 7515.
2. Data we may process
When you contact us, we may process your name, email address, organisation, telephone number, the content of your message and any information you choose to provide. The website’s hosting and security infrastructure may also process limited technical information such as IP address, browser and device information, timestamps, requested pages and security logs.
3. Purposes and legal bases
- To respond to enquiries and take steps you request before entering into a contract, on the basis of Article 6(1)(b) GDPR; where an enquiry is not connected with a possible contract, on the basis of our legitimate interest in responding to professional enquiries under Article 6(1)(f).
- To manage professional and contractual relationships, on the basis of Article 6(1)(b), and to meet related legal obligations under Article 6(1)(c).
- To maintain website security and availability and prevent misuse, on the basis of our legitimate interests under Article 6(1)(f).
- To comply with legal obligations, on the basis of Article 6(1)(c), and to establish, exercise or defend legal claims, on the basis of our legitimate interests under Article 6(1)(f).
4. Recipients and international transfers
Data may be processed by carefully selected website-hosting, security, IT and email service providers acting under appropriate arrangements, and by professional advisers or public authorities where legally required. We do not sell personal data. Some partner and team images are delivered from third-party source or content-delivery hosts; those providers may receive standard connection information when an image is requested. Links to LinkedIn, YouTube and other external websites are activated only when you choose to follow them and are governed by those providers’ own notices.
Where personal data is transferred outside the European Economic Area, EXELIXIS relies on an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, as required. Information about the relevant safeguards may be requested using the contact details above.
5. Retention
Unsuccessful or general enquiries are normally retained for no longer than 12 months after the last meaningful communication. Information connected with clients, contracts, accounting or legal claims may be retained for longer where necessary under the applicable contractual, tax, accounting or legal requirements.
6. Your rights
Subject to the conditions of the GDPR, you may request access, rectification, erasure, restriction, portability or object to processing. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. We normally respond within one month.
To exercise your rights, email euprojects@exelixisrm.com. You may also lodge a complaint with the Hellenic Data Protection Authority or another competent supervisory authority.
7. Information required when contacting us
Your name, email address and message are required so that we can identify and respond to your enquiry. Organisation details are optional. If the required information is not provided, we will not be able to process or respond to the enquiry. EXELIXIS does not use automated decision-making or profiling when handling website enquiries.
8. Updates
We may revise this notice when our services, providers or legal obligations change. The current version is dated 21 August 2026.