Overview
Zanbato, Inc. and its affiliates (collectively, “Zanbato”) provide services that
help users engage in private securities transactions efficiently, securely, and lawfully.
Although our services mainly process information concerning legal entities, we also sometimes
have to handle information about natural persons like yourself. To that end, personal
information collected by Zanbato is used solely for providing the services for which you have
engaged Zanbato.
This Privacy Policy covers Zanbato services provided through zanbato.com
and related Zanbato mobile applications (the "Websites"). It describes how Zanbato collects,
uses, shares, and secures the personal information you provide. It also describes your choices
regarding the use, access and accuracy of your personal information.
What kinds of Personal Data does Zanbato use?
For all site visitors
Regardless of whether you’re signed into Zanbato, we collect basic information associated
with your browsing session, such as your IP address, browser type, and preferred language, to
effectively display the site for you. We also use cookies provided by Google Analytics solely to
track your browsing session’s movement within the Websites. (For more information about
what cookies are and how you can control them, check out the section below titled “Cookies
and Tracking Technology.” For more information about how Google uses and processes Google
Analytics data, see www.google.com/policies/privacy/partners).
We use this data to identify usage patterns and improve our site’s design. In this context,
your IP address is used purely as a geographic indicator assigned to an anonymous user. As long
as you aren’t signed in, we can’t link this information back to you as an individual.
We do not knowingly collect personal information from minors without proper consent from a parent
or legal guardian. If you believe that we may have collected personal information from a minor
without the requisite consent, please contact us at privacy@zanbato.com.
For ZX ATS and ZXData Users
The ZX ATS is the Alternative Trading System platform located at zx.zanbato.com, and ZXData is
the data platform located at zxdata.zanbato.com. These services (collectively, "ZX") are only
accessible by secure login to users authorized by Zanbato staff. To use ZX, we need to collect
and process some of your personal information for a few purposes.
On the ZX ATS, you will have the ability to chat with other ZX ATS users and Zanbato market
operators to conduct relevant ZX ATS business. Conversation participants and ZX staff will be
able to see your full name in those chats. When a deal has been agreed to and transaction
documents are required to be signed, you'll exchange further personal information as needed.
On both platforms (ZX ATS and ZXData), your personal information may be used by ZX staff for
other specific purposes detailed below. In this section, we describe each of our processes, and
how we handle the data.
How does ZX use my personal information?
Fraud Prevention and Legal Compliance
When you register for access to the ZX ATS, several financial regulatory agencies require us to
collect certain personal information. This "registration information" includes full name,
employer, title, business address, business telephone number, and business email address. In
addition, before you close a transaction, we are required by the same agencies to have you fill
out a "confidential customer questionnaire" which requires the disclosure of further personal
information, such as a copy of your driver's license, passport, or similar government-issued ID.
This information is used to prevent fraud and to comply with applicable law, rules, and regulations.
- GDPR Legal Basis: Legitimate Interests (fraud prevention and to allow you to use ZX to transact legally); Legal Obligation.
- To Access or Update Info: Some information may be updated at
zx.zanbato.com/accounts/settings/ (ZX ATS) or
zxdata.zanbato.com/accounts/settings/ (ZXData),
but we may be required to preserve other registration information/customer questionnaire data, as prescribed
by applicable law, rules, or regulations. You may contact us at privacy@zanbato.com if
you want more details.
Account Management/Secure Login
Your email address, combined with a password of your choosing, will allow you to sign into ZX
securely. We may also send you emails where necessary to help you manage your account, for
example, if you need to reset your password, or to notify you of a material change to one of our policies.
You can use the ZX ATS to chat with other ZX ATS users and Zanbato market operators to conduct
relevant ZX ATS business. Conversation participants will be able to see your full name in the
chats. Any conversations you have on our platform will be associated with your account and will
be captured and stored to comply with applicable law, rules, and regulations or for archival purposes.
Usage Analytics
When signed in, your activity on ZX is logged and linked to your user id. This data includes
information about what pages under zx.zanbato.com or zxdata.zanbato.com you've visited, and when
such access occurred. ZX staff review this data to better understand usage patterns on ZX. We
also review this data periodically to prevent fraud, to monitor suspicious activities, or to
comply with applicable laws, rules, and regulations.
- GDPR Legal Basis: Legitimate Interests (Improving ZX services, fraud prevention).
- To Access or Update Info: Contact us at privacy@zanbato.com if
you would like more information about the information we hold.
Email Platform Activity Updates
We'll use your email address to provide you with a variety of updates about Zanbato. These
include feature announcements, platform activity notifications, policy updates, and others. We
only send these emails if you have an active user account. Additionally, you can configure your
email preferences on the Websites (see below).
- GDPR Legal Basis: Legitimate Interests (providing relevant activity updates & marketing based on your preferences).
- To Access or Update Info: Configure your Email Notification Settings by signing in,
clicking your name in the top right corner, and clicking the “Email Notification Settings”
option in the dropdown. The emails you receive also have hyperlinks to the notification settings page.
- Note: certain important emails, such as policy update notifications, will always be sent as
long as you have an active user account; please contact us at privacy@zanbato.com if
you have concerns with or objections to this.
For Private Label Users (sites “Powered by Zanbato”)
Zanbato licenses a tool called Private Label ("PL") to clients. When you use a Private Label
platform, the private label licensee ultimately makes the decisions about how your data is
handled. We describe what our tools do in this section, but be sure to consult the licensee's
Privacy Policy to get the full picture.
How does Zanbato Private Label handle personal information?
Account Management/Secure Login
You or the licensee can create an account on Private Label for you. Your email address, combined
with a password of your choosing, will allow you to sign in securely. We send you emails whenever
necessary to help you manage your account, for example, if you need to reset your password, or
to notify you of a material change to one of our policies.
Your full name may also be linked with your account at registration.
- GDPR Legal Basis: Legitimate Interests (allowing you to securely authenticate & interact with PL).
- To Access or Update Info: visit /accounts/settings/ on your portal, or contact the controller.
Email Platform Activity Updates
We use your email address to provide you with a variety of updates about Zanbato. These include
feature announcements, platform activity notifications, policy updates, and others. We only send
these emails if you have an active user account. You can configure your email preferences on the
Websites (see below).
- GDPR Legal Basis: Legitimate Interests (providing relevant activity updates & marketing based on your preferences).
- To Access or Update Info: Configure your Email Notification Settings by signing in,
clicking your name in the top right corner, and clicking the “Email Notification Settings”
option in the dropdown. The emails you receive also have hyperlinks to the notification settings page.
- Note: certain important emails, such as policy update notifications, will always be sent as
long as you have an active user account; please contact us at privacy@zanbato.com if
you have concerns with or objections to this.
Closing Room & NDAs
Features such as Closing Room and NDA may use names and/or emails as necessary to create
relevant paperwork for signature. This data is processed by a third party digital signature
service (described below). We ensure that this service only uses this data for providing the
tool as described.
- GDPR Legal Basis: Legitimate Interests (allowing users to create their own digital contracts).
- To Access or Update Info: Visit the page for the relevant feature, or email us at
privacy@zanbato.com
- Third Party Transfers: The Zanbato digital signature service is provided by HelloSign,
a Data Privacy Framework certified U.S. organization. Their privacy policy can be found at
https://www.hellosign.com/privacy.
Cookies and Tracking Technologies
Zanbato and its partners use cookies or similar technologies to analyze trends, administer our
Websites, track users' movements around the Websites, and gather demographic information about
our user base as a whole. You can control the use of cookies at the individual browser level,
but if you choose to disable cookies, it may limit your use of certain features or functions on
our Websites or service.
In the future, we may partner with a third party to manage our advertising on other sites. Such
a third party partner may use cookies or similar technologies to provide you advertising based
upon your browsing activities and interests. To opt out of interest-based advertising
click here or if located in
the European Union click here.
Please note you would continue to receive generic ads.
Your Rights under GDPR
You have certain rights with respect to your personal data, as described below. You will not
have to pay a fee to exercise any of these rights.
Accessing and Updating information
At any time, you can request from us information about whether we store, use or share any of
your personal data and what kinds of personal data we hold about you.
If you have an account on a Zanbato platform, you may sign into your account at any time to
view your profile and review commonly processed personal information. Your account profile will
allow you to update some of your personal information directly.
To request information or request changes, contact us at privacy@zanbato.com
and we'll respond to your request within a reasonable timeframe (no longer than 30 days from receiving your request).
Right to Erasure and Restriction of Processing
You may request that your personal information be removed from Zanbato's systems, or that
Zanbato restrict all further processing of your data. Please note that our ability to comply
with your request will depend on the specifics of your circumstances, including if processing
your personal data is required for us to continue providing a service, or to comply with
applicable law, rules, and regulations, but we will assist you as best we can.
To request data erasure or processing restrictions, contact us at privacy@zanbato.com and
we'll respond to your request within a reasonable timeframe (no longer than 30 days from receiving your request).
Right to Object
You may object to processing of your personal data where such processing was carried out under
the basis of legitimate interest. Please note that our ability to comply with your request will
depend on the specifics of your circumstances, including if processing your personal data is
required for us to continue providing a service, or to comply with applicable law, rules, and
regulations, but we will assist you as best we can.
To object to processing of your personal data, contact us at privacy@zanbato.com and
we'll respond to your request within a reasonable timeframe (no longer than 30 days from receiving your request).
Right of Data Portability
You have the right to receive an electronic copy of the personal data that you have provided to
us, or ask us to send that information to another company (the "right of data portability"). If
you wish to receive or send such data, please contact us at privacy@zanbato.com.
Right to Withdraw Consent
Where we are relying on consent to process your personal data, you have the right to withdraw
that consent at any time. However, withdrawing consent will not affect the lawfulness of any
processing carried out before you withdraw your consent. If you withdraw your consent, we may
not be able to provide certain products or services to you. We will advise you if this is the
case at the time you withdraw your consent.
Direct Marketing and Email Preferences
Note that in the case of direct marketing emails, we provide an Unsubscribe link which allows
you to opt-out automatically. You can also configure your email preferences by signing into your
Zanbato account and visiting your account settings page, or by contacting us at
privacy@zanbato.com.
Special Notice For Private Label Users
Zanbato acknowledges that you have the right to access your personal information. In the case
of Private Label platforms, Zanbato may not have a direct relationship with the individuals
whose personal data it processes.
To access, correct, amend, or delete inaccurate data, you should direct your query or request
to the data controller responsible for operating the Private Label portal. If requested by the
controller to remove data, we will respond within a reasonable timeframe (no longer than 30 days
from receiving your request). Please note that our ability to comply with the request will depend
on certain circumstances, including if processing your personal data is required for us to
continue providing a service, or to comply with applicable law, rules, and regulations.
Special Categories of Personal Data
We do not, unless you explicitly consent, process any of your personal data in the following
special categories: (i) personal data revealing your racial or ethnic origin, political opinions,
religious or philosophical beliefs, or trade union membership; (ii) genetic data; (iii) biometric
data for the purpose of uniquely identifying you; or (iv) data concerning your health, sex life,
or sexual orientation.
If personal data is to be used in a way not previously disclosed or shared with external parties
not covered in this Privacy Policy, you will be provided the opportunity to opt-out.
Automated Processing
We do not use your personal data to make automated decisions about you without any human input.
If we ever begin to do so, if and as applicable, and to the extent required by applicable laws,
rules, or regulations, we will endeavor to implement suitable safeguards, including, for example,
an opportunity for you to request human intervention, express your point of view, contest any
decisions made, and request that we restrict the use of your personal data for the purposes of
these automated decisions.
Data Security
Zanbato follows industry-standard best practices to protect your personal information. On a
Zanbato platform, all data is encrypted both in-transit and at-rest. Access to sensitive systems,
physical or digital, is secured and limited to qualified systems administrators.
Note that no data transmission over the Internet can be fully guaranteed to be completely secure.
Accordingly, we cannot ensure or warrant the security of any information that you transmit to us,
so you do so at your own risk.
If you have any questions about security on any Zanbato platform, please contact us at
support@zanbato.com.
Other Third Party Services Used by Zanbato
We utilize the services of third parties to power the Websites. As a result, your personal data
may be transferred to the entities listed below, in addition to any already listed above, or
other service providers as necessary to provide the relevant service.
In all cases, through our service agreements with our service providers, we make sure that our
service providers only process personal data as necessary to provide the relevant service, and
that they provide at least the same level of protections Zanbato provides for your personal data
of similar nature; these requirements also apply to any third parties used by our service providers.
- Amazon Web Services provides the backbone for ZX and PL, hosting our databases, web servers, and other related systems.
- Personal data processed: All personal data processed through ZX and PL (as described above).
- Transfer destination: United States (under Data Privacy Framework)
- Google provides our communications management infrastructure through G Suite.
- Personal data processed: Email addresses and email content.
- Transfer destination: United States (under Data Privacy Framework)
- Global Relay provides an archiving solution for platform communication to comply with applicable law, rules, and regulations.
- Personal data processed: Chat conversation participants and message content.
- Transfer destination: Canada (Canada is recognized by the European Commission as an "adequate" jurisdiction that offers a level of data protection similar to the EEA).
Legally Required Information Disclosure
We reserve the right to disclose your personal data as required by applicable laws, rules, and
regulations or when we believe that disclosure is necessary to protect our rights and/or to
comply with a judicial proceeding, court order, or legal, regulatory, governmental, or
administrative process or request. In certain situations, Zanbato may disclose personal data in
response to lawful requests by public authorities, including to meet national security or law
enforcement requirements.
If Zanbato is involved in a merger, acquisition, or sale of all or a portion of its assets,
including transfers made as part of insolvency or bankruptcy proceedings, personal data may be
one of the transferred business assets. You will be notified by email (sent to the e-mail address
specified in your account) or by means of notice on the relevant Website of any change in
ownership or uses of your personal data, as well as any choices you may have regarding your
personal data.
EU-U.S. Data Privacy Framework with UK Extension, and Swiss-U.S. Data Privacy Framework
Zanbato and our U.S. affiliates, including Zanbato Securities LLC, comply with the EU-U.S. Data
Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy
Framework as set forth by the U.S. Department of Commerce. Zanbato has certified to the U.S.
Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles with
regard to the processing of personal data received from the European Union in reliance on the
EU-U.S. DPF and from the United Kingdom (and Gibraltar) under the UK Extension to the EU-U.S.
DPF. Zanbato has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S.
Data Privacy Framework Principles with regard to the processing of personal data received from
Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in
this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the
Principles shall govern. To learn more about the Data Privacy Framework program, and to view our
certification, visit the U.S. Department of Commerce's
Data Privacy Framework List.
Zanbato is responsible for the processing of personal data it receives, under the EU-U.S. DPF,
the UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF, and subsequently transfers to a third
party acting as an agent on its behalf. Zanbato complies with the EU-U.S. DPF, the UK Extension
to the EU-U.S. DPF, and Swiss-U.S. DPF for all onward transfers of personal data from the EU,
UK, and Switzerland, including the onward transfer liability provisions.
With respect to personal data received or transferred pursuant to the Data Privacy Framework,
Zanbato is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. In
certain situations, Zanbato may be required to disclose personal data in response to lawful
requests by public authorities, including to meet national security or law enforcement requirements.
In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S.
DPF, Zanbato commits to refer unresolved complaints concerning our handling of personal data
received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the
Swiss-U.S. DPF to TRUSTe, an alternative dispute resolution provider based in the United States.
If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or
if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit
https://feedback-form.truste.com/watchdog/request
for more information or to file a complaint. These dispute resolution services are provided at no cost to you.
For complaints regarding EU-U.S. DPF, the UK Extension to the EU-U.S DPF, and Swiss-U.S. DPF
compliance not resolved by any of the other DPF mechanisms, you have the possibility, under
certain conditions, to invoke binding arbitration. Further information can be found on the
official DPF website:
https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction.
Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes to our information practices. If we make
any material changes we will notify you by email (sent to the e-mail address specified in your
account) or by means of a notice on the relevant Website prior to the change becoming effective.
We encourage you to periodically review this page for the latest information on our privacy practices.
If you have any questions or concerns related to this Privacy Policy, you may contact us in
writing at Zanbato, Inc., 715 N. Shoreline Blvd., Mountain View, CA 94043 or email us at
support@zanbato.com (general inquiries) or
privacy@zanbato.com (for questions about personal data).
In addition, if you are a resident of the European Union, Switzerland, or the UK, you have the
right to complain to a Data Protection Authority if you believe that your personal data has been
collected or used in violation of relevant privacy requirements.
GDPR Designated Representative
For the purposes of GDPR, our designated representative based in the EU is Christopher
Fenichell. Our representative may be reached in writing at Zanbato UK Ltd., 52 Debden Road,
Saffron Walden, Essex, CB11 4AB, United Kingdom, or by email at
cfenichell@zanbato.com.