Privacy Policy

Updated as of October 15, 2025

Celldex Therapeutics, Inc. ("Celldex," "we," "us," or "our") provides this Privacy Policy because we know that you care about how your information is collected, used, shared and retained. This Privacy Policy applies to information collected when you visit, request publications or otherwise contact us via, our website at https://celldexpatients.com (the "Site").

Separate privacy policies apply to the processing of your personal information in the context of activities not mentioned here, for example when you enroll or otherwise participate in a clinical trial or an expanded access/compassionate use program, or in the context of pharmacovigilance and safety data reporting for one of our Products. As of the date of this Privacy Policy indicated above, Celldex does not have any marketed Products, however, the term "Product" can refer to both marketed and investigational drugs.

Celldex complies with the EU-U.S. Data Privacy Framework ("EU-U.S. DPF"), the UK Extension to the EU-U.S. DPF and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce. For information on our certification to these Frameworks please see our Data Privacy Framework Policy.

By visiting our Site, or using our Products, you are agreeing to the terms of this Privacy Policy and the accompanying Terms of Use. Capitalized terms not defined in this Privacy Policy have the meaning ascribed to them in the Terms of Use.

I. Collection of Personal Information: Categories, Sources, and Uses

In the past 12 months, we have collected the following categories from the indicated sources, for the indicated purposes:

1. Identifiers

• Contact Information. We collect contact information on our Site from visitors who wish to obtain information, scientific publications, subscribe to our email alerts and contact us with questions. Contact information is provided via browser forms and may include first name, last name, e-mail address, job title, name of the organization, country, state/region, phone numbers (fax, cell and/or landline), IP address, and other information necessary for us to properly respond. This contact information is used by our public relations, investor relations, service and product teams to contact our Site visitors, and to compile and deliver our responses. We also use this information, in addition to Operations information described below, to respond to general inquiries, solicit feedback regarding our Site, provide relevant content on our Site and to communicate with you via email regarding our current and future Products.

2. Internet or other electronic network activity information

• Information collected by Cookies and Similar Tracking Technologies. We, including through third-party service providers, such as Google Analytics, may collect information about your interactions with the Site and Products using "cookies" and other similar technologies. This information may include IP addresses, internet service provider, browser type, operating system and language, referring and exit pages and URLs, date and time, amount of time spent on particular pages, what sections of the Site you visit, number of links clicked, search terms and other usage data.

Some of this information may be disclosed to third parties for purposes described in Section II below, including for cross-context behavioral advertising, which may be considered "sharing" under the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA").

For a detailed mapping of the cookies and similar technologies used on our Site to the categories of personal information under the CCPA/CPRA, including the purposes for which they are used and the third parties involved, please see our Cookie Policy.

• Operations. We also collect site health diagnostics and technical logging information, which may include IP address, browser type, operating system, access times, and error logs, and may fall under the categories of "Identifiers" and "Internet or other electronic network activity information" as defined by the CCPA. We use this information to monitor the security and stability of our Site, diagnose technical issues, and improve the overall performance and reliability of our services.

3. Aggregate Data

In an ongoing effort to better understand our users and the Site, we might analyze your information in aggregate form to operate, maintain, manage, and improve the Site. This aggregate information does not identify you personally. We may share this aggregate data with our affiliates, agents, and business partners. This does not include SMS opt-in data or mobile information, which is never shared with affiliates or third parties. We may also disclose aggregated user statistics in order to describe our Products and the Site to current and prospective business partners and to other third parties for other lawful purposes.

II. Disclosure and Sharing of Personal Information to Third Parties

We do not sell personal information for monetary value. However, we may "share" personal information for cross-context behavioral advertising as defined by the CCPA/CPRA. This sharing does not include SMS opt-in data or mobile phone numbers provided for text messaging purposes. See Section III to learn how to opt out of such sharing.

In the future, we may disclose personal information with the following third parties for the purposes described below:

• Advisors or transaction partners in connection with business transactions (e.g., mergers, acquisitions).
• Public authorities and legal counsel as required by law or legal process.
• Vendors, consultants, and service providers (e.g., direct marketing, data storage, hosting, analytics, disaster recovery, sales support, translation) to enable them to provide business and research-related services on our behalf.
• Third-party advertising and analytics providers for the purpose of delivering targeted advertising (cross-context behavioral advertising) and analyzing Site usage. This includes sharing information collected via cookies and similar technologies. You have the right to opt out of such sharing; see Consent Preferences on our website.
• Affiliates, resellers, and distributors to support the marketing, sale, and delivery of Products. SMS opt-in data and mobile information are never shared with affiliates for marketing purposes.

III. Your Privacy Choices

In addition to any state privacy rights you may have, which are discussed in Section IV, we provide you with the following options to make informed choices about your privacy and the use of your data:

1. Opt-In to Certain Onward Transfers

We will not transfer your personal information to a third party acting as a controller without first providing you with information regarding the identity of such controller or the nature of such controller's business, and obtaining your opt-in consent. You may grant such consent by emailing us at [email protected].

2. Opt-Out for Direct Marketing; Email Management

You may opt out at any time from the use of your personal information for direct marketing purposes, and/or the transfer of your personal information to third parties for direct marketing purposes, by emailing us at [email protected]. Please allow us a reasonable time to process your request. You may also manage your receipt of marketing and non-transactional communications by clicking on the "Manage Email Preferences" link located on the bottom of any Celldex marketing email and following the instructions found on the page to which the link takes you. You cannot opt out of receiving transactional e-mails related to your requests for information or materials.

3. Opting Out Of Tracking Technologies

• You have the right to control how cookies and similar technologies are used on our website. If you do not want us, Google Analytics, or other third-party providers to place cookies on your device, you may adjust your browser settings or use private browsing mode to block cookies; however, some site features may not function properly if you do so.
• Do Not Sell or Share my Personal Information. In addition, California residents may opt out of the sale or sharing of their personal information collected via cookies for behavioral advertising through Consent Preferences on our website. For more information, please see our Cookie Policy.
• Do Not Track. We do not respond to "Do Not Track" settings or other related mechanisms at this time.

4. Access to Personal Information

Upon request to [email protected], we will provide you with confirmation as to whether we are processing your personal information, and have the data communicated to you within a reasonable time. You have the right to access, correct, amend or delete your personal information where it is inaccurate or has been processed in violation of this Privacy Policy. We may require payment of a non-excessive fee to defray our expenses in this regard. Please allow us a reasonable time to respond to your inquiries and requests.

IV. California and Additional State Privacy Rights

Depending on your place of residence, you may have certain rights regarding how we collect, use, and share your personal information. If you are a California resident, you have specific rights under the CCPA as amended by the California Privacy Rights Act (CPRA), including all rights listed below. Residents of other U.S. states may also have similar rights under applicable privacy laws.

Please note that some of these rights are subject to limitations, and your request may be declined in specific situations — for example, if providing the information would compromise another individual's privacy or if we are legally required to withhold it. These rights may include:

1. The right to confirm whether we are processing your personal information, and to access it.
2. The right to request we correct inaccuracies in your personal information.
3. The right to request we delete your personal information.
4. The right to request a copy of the personal information you provided to us.
5. The right to opt out of processing of your personal information for targeted advertising purposes.
6. The right to opt out of profiling and automated decision-making in furtherance of decisions that produce legal or similarly significant effects.
7. The right to opt out of the sale or sharing of personal information.
8. The right to designate an agent to submit a request on your behalf.
9. The right to appeal a decision regarding your rights request.
10. The right to limit the use and disclosure of sensitive personal information.
11. The right to receive equal service and price, even if you exercise your privacy rights.

California Residents — Additional Rights. Pursuant to Section 1798.83 of the California Civil Code, residents of California have the right to obtain certain information about the types of personal information that companies with whom they have an established business relationship (and that are not otherwise exempt) have shared with third parties for direct marketing purposes during the preceding calendar year, including the names and addresses of those third parties, and examples of the types of services or products marketed by those third parties. If you wish to submit a request pursuant to Section 1798.83, please contact Celldex via email at [email protected]. Celldex does not monitor, recognize, or honor any opt-out or do not track mechanisms, including general web browser "Do Not Track" settings and/or signals.

V. Retention of Personal Information

We will retain your personal information in a form that identifies you only for as long as it serves the purpose(s) as notified to you. We may continue processing your personal information for longer periods, but only for the time and to the extent such processing reasonably serves the purposes of archiving in the public interest, journalism, literature and art, scientific or historical research and statistical analysis, and subject to the protection of this Privacy Policy. After such time periods have expired, we may either delete your personal information or retain it in a form such that it does not identify you.

VI. How we Protect your Personal Information

Celldex takes very seriously the security and privacy of the personal information that it processes pursuant to this Privacy Policy. Accordingly, we will implement reasonable and appropriate security measures to protect your personal information from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into account the risks involved in the processing and the nature of such personal information.

VII. Children

We do not knowingly collect any personal information from children under the age of 13 through the Site. If you are under 13, please do not give us any personal information. We encourage parents and legal guardians to monitor their children's Internet usage and to help enforce our privacy policy by instructing their children never to provide personal information to us without their permission. If you have reason to believe that a child under the age of 13 has provided personal information to us, please contact us at [email protected], and we will endeavor to delete that information from our databases.

In addition, we do not sell or share the personal information of consumers under 16 years of age. If we become aware that we have collected or shared personal information from a consumer under 16, we will take steps to delete that information as soon as possible.

VIII. Links to External Sites

The Site may contain links to third party websites ("External Sites"). Celldex has no control over the privacy practices of these External Sites. As such, we are not responsible for the privacy policies of those External Sites. You should check the applicable third party privacy policy and terms of use when visiting any External Sites, and before providing any personal information to such External Sites.

IX. Cross-Border Transfers of Personal Information

Please be aware that any information provided to us, including personal information, may be transferred from your country of origin to the U.S. and elsewhere. Except in the case of data transfers under the EU-U.S. DPF, the UK Extension to the DPF and the U.S.-Swiss Data Privacy Framework (collectively, the "Frameworks"), your decision to provide such data to us, or allow us to collect such data through our Site, constitutes your consent to this data transfer.

For transfers of personal information from the European Economic Area, Switzerland and the UK we typically rely on our certification to the Frameworks — unless otherwise notified to you. For information on our certification to the Frameworks please see our Data Privacy Framework Policy.

X. Changes to this Privacy Policy

We may change this Privacy Policy from time to time, and will post any changes on the Site as soon as they go into effect. The date indicated at the top of this Privacy Policy shows the most recent update. If we make material changes to this Privacy Policy, we will notify you by updating the date at the top of the policy and, where appropriate, provide additional notice (such as a banner or email). By accessing the Site after we make any such changes to this Privacy Policy, you are deemed to have accepted such changes. Please refer back to this Privacy Policy on a regular basis.

XI. How to Contact Us

If you have questions about this Privacy Policy, please e-mail us at [email protected].

XII. SMS Communications

Celldex Therapeutics, Inc. operates an SMS text messaging program to communicate with individuals who have consented to receive text messages. Messages may include clinical trial updates, patient advocacy program communications, appointment reminders, and other important notifications related to your participation in the Celldex patient community.

How to opt in: Users opt in to receive SMS messages by submitting the consent form on our website (celldexpatients.com) and checking the SMS consent checkbox. Providing consent to receive SMS messages is not required as a condition of any purchase, service, or programme participation.

Message frequency: Message frequency may vary. Reply STOP at any time to unsubscribe. Reply HELP for assistance. You may also opt out by emailing [email protected]. Message and data rates may apply.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.

Text messaging originator opt-in data and consent will not be shared with any third parties except for aggregators and providers of text messaging services.

No mobile information will be shared for marketing and promotional purposes. Information sharing to subcontractors and support services such as customer service is permitted. All other use cases categories exclude text message originator opt-in and consent. The information will not be shared with third parties.