1. General Principles

Zultys has designed this Privacy Policy to be consistent with our core company principles:

• Privacy policies should be human-readable and easy to find and understand.
• We believe that data collection, storage, and processing should be simplified as much as possible to enhance security, ensure consistency, and make our data processing and privacy practices easy for users to understand.
• Data collection practices should always meet the reasonable expectations of users.
• We always endeavor to collect the least amount of Personal Data and information possible.
• We are complying with key data protection laws and privacy standards such as GDPR and CCPA (each as further defined below).
• We do not sell or share your personal data or information as further described below in our “CCPA Practices” section (see Section 11).

In this Privacy Policy, we use the terms “Personal Data” and “Personal Information” interchangeably. Under the California Consumer Privacy Act (“CCPA”) as modified by the California Privacy Rights Act of 2020 and as further defined by its accompanying Regulations, “Personal Information” means information that can identify, relate to, describe, be associated with, or be reasonably capable of being associated with a particular consumer or household.

Under the European Union’s General Data Protection Regulation ((EU) 2016/679) (“GDPR”), “Personal Data” means any information relating to an identified or identifiable natural person.

In any reference to CCPA requirements and practices in this Privacy Policy, the use of the term “Personal Data” is replaced using the term “Personal Information”.

2. Responsible Entity

A reference to “Zultys”, “we”, “us”, “our” or the “Company” is a reference to Zultys, Inc., a legal entity incorporated under the laws of Delaware, and its relevant affiliates involved in the collection, use, sharing, or other processing of Personal Data for or on behalf of Zultys.

Except for Personal Data collected by Zultys in connection with its employment and candidate recruiting activities where Zultys acts as a controller or business concerning that Personal Data or as otherwise specified in this Privacy Policy, Zultys is a “service provider” or “processor” of your Personal Data as described in this Privacy Policy and applicable data privacy laws such as CCPA and GDPR.

A large portion of our commercial activity with customers and end users involves Zultys’ direct contractual relationship with our channel partners, such as our value-added resellers, sales agents, and other third parties who in turn contract directly with customers and their end users.  Our channel partners may also offer additional products and services to these customers.  Zultys is not responsible for the data collection practices of its reseller and channel partners; each of whom publishes their own privacy policies.

Our Privacy Policy applies only to Personal Data Zultys collects and processes from identifiable and authorized users (such as our customers’ users, their guests, and other authorized individuals) who use and access Zultys Services.  An “authorized user” is an individual who is entitled to log in to Zultys Services through a customer account.

This Privacy Policy only applies to the extent we process Personal Data in the role of a processor or service provider on behalf of our customers when we directly collect Personal Data while providing Zultys Services to those customers and their end users, including where we offer various software products and services to our customers. Where our customers (or their affiliates) in turn also collect, use, share, or process Personal Data directly from their own customers, employees, guests, or other end users even using Zultys products, our customers are solely responsible for their own data collection practices and privacy policies.

For detailed privacy information related to a Zultys customer or partner and their affiliates who use the Zultys software products and services as a controller or processor, please contact those Zultys customers or partners directly.

3. Processing Activities Covered

This Privacy Policy applies to the processing of Personal Data collected by us when you:

• Visit our Websites that display or link to this Privacy Policy;
• Visit our branded social media pages;
• Request information from us about our products and Zultys Services, obtain technical support, complete an online form, or send us any correspondence including by one of our “Contact Us” options (e.g., email or by US mail)—See Section 15 below;
• Use our products and Zultys Services (whether offered by Zultys directly or by one of our channel partners); or
• Apply for employment opportunities with us, or are employed by Zultys or one of its affiliates.

4. What Personal Data Do We Collect and Process?

The Personal Data we collect from you includes the following categories:

• personal and device identifiers
• professional or employment-related information
• certain limited financial account information related to your account subscriptions or other purchases
• commercial information
• internet activity information, and
• inferences drawn from any of these categories.

Please see our “CCPA Practices” in Section 11.1 below for the specific categories of Personal Information that we collect and our separate “Notice of Collection” link that describes our California and other U.S. state data collection practices and compliance commitments.

We also collect and process your Personal Data in the following situations:

• If you express an interest in obtaining additional information about our Services through a Website form for example; request customer support; use our “Contact Us” option, including by sending us an email, or similar Services or Website-related features. When you register to use our Services as a customer-authorized user or as a guest on behalf of our customers, we may require that you provide us with your contact information, such as your name, job title, company name, address, phone number, email address or username and password;
• If you obtain our products or Services directly from us (as opposed to directly from a reseller), we may require that you provide us your financial and billing information, such as billing name and address, credit card number, or bank account information; we do not retain either credit card or bank account information, however, as this sensitive financial information is stored and processed only by our third party, payments processing partner and not by Zultys.
• If you interact with our Websites or send us emails, we automatically collect information about your device and your usage activities on our Websites (such as Internet Protocol (IP) addresses, MAC ID, or other identifiers), which may include Personal Data (please see, the “What Device and Usage Data Do We Process?” in Section 5, below), or by using cookies, web beacons, or similar technologies;
• If you use and interact with our Services or mobile applications, we automatically collect information about your device and your usage of our Services through log files and other technologies, some of this information collected may also qualify as Personal Data (please see the “What Device and Usage Data Do We Process?” in Section 5, below);
• If you communicate with us by way of a phone call, we may record and store that call for the limited purpose of responding to your requests including technical support needs; and
• If you voluntarily submit certain information to our Services, such as completing online forms, responding to surveys, or interacting with our webchat feature, we collect the information you have provided as part of that request or interaction, which may also include Personal Data.

If you believe that your Personal Data has been provided to us improperly, or want to exercise any of the rights described in this Privacy Policy relating to your Personal Data, please contact us by using the information in the “Contact Us” Section 15 below.

5. What Device and Usage Data Do We Process?

We use common information-gathering tools, such as tools for collecting usage data, cookies, web beacons, pixels, and similar technologies to automatically collect information that may contain Personal Data as you navigate our Websites, use our Services, or interact with emails we have sent to you.  Please see also our Cookie Policy here: https://www.zultys.com/cookies-policy/.  You can configure your privacy settings when you visit our Website or use our Services, and you can opt out of marketing communications we send you.

• Device and Usage Data

As is true of most websites, we gather certain information automatically when individual users visit our Websites. This information may include identifiers, commercial information, and internet activity information such as IP address (or proxy server information), device and application information, identification numbers and features, location, browser type, plug-ins, integrations, Internet service provider identity, mobile carrier identity, the pages and files viewed, searches, referring website, app or ad, operating system, system configuration information, advertising and language preferences, date and time stamps associated with your usage, and frequency of visits to the Websites. This information, which may include limited Personal Data, is used solely to analyze overall visitor use trends, to help us provide and improve our Websites, to offer a tailored experience for Website users, and to secure and maintain our Websites.

In addition, we gather certain information automatically as part of your use of our software products and Services. This information, which may also be provided to us by our channel partners, may include identifiers, commercial information, and internet activity information such as IP address (or proxy server), mobile device number, device and application identification numbers, location, browser type, Internet service provider identity or mobile carrier identity, the pages and files viewed, website and webpage interactions including searches and other actions you take, operating system and system configuration information and date and time stamps associated with your usage. This information which may include limited Personal Data, is used solely to maintain the security of the Services, to provide necessary functionality, to improve the performance of the Services, to assess and improve customer and user experience of the Services, to review compliance with applicable usage terms, to identify future opportunities for development of the Services, to assess capacity requirements, to identify customer opportunities, and for the security of Zultys generally (in addition to the security of our products and Services). Some of the device and usage data collected by the Services, whether alone or in conjunction with other data, could be Personal Data. Please note that this device and usage data is primarily used to identify the uniqueness of each user log-in session (as opposed to the identification of specific individuals), apart from where it is strictly required to identify an individual for security purposes or as required as part of our provision of the Services to our customers.

• Cookies, Web Beacons, and Other Tracking Technologies

To make our Websites and Services work properly, we sometimes place small data files called cookies on your device. A cookie is a small text file that a website saves on your computer or mobile device when you visit the website. It enables the website to remember your actions and preferences (such as login, shopping cart, or other preferences) over some time, so you do not have to keep re-entering this information whenever you come back to the website or browse from one page to another. To learn more about how Zultys manages cookies, please see our Cookie Policy.

• Google Analytics. We may use Google Analytics. We use the information we get from Google Analytics only to improve the Websites. We do not combine the information collected through the use of Google Analytics with Personal Data that we collect. Please refer to Google’s Privacy Policy for more information. You may also choose to download the Google Analytics opt-out browser add-on.

You may wish to restrict the use of cookies. Please be aware that some of the features of our Website may not function correctly if you disable cookies.

Most modern browsers allow you to change your cookie settings. You can usually find these settings in the options or preferences menu of your browser. To understand these settings, the following links for commonly used browsers may be helpful:

• Cookie settings in Chrome
• Cookie settings in Firefox
• Cookie settings in Microsoft Edge
• Cookie settings in Safari web and iOS
• Do-Not-Track Signals

Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. DNT is a way for users to inform websites and services that they do not want certain information about their webpage visits collected over time and across websites or online services. Zultys does not recognize or respond to browser-initiated DNT signals, as the Internet industry is currently still working toward defining exactly what DNT means, what it means to comply with DNT and a common approach to responding to DNT. We may recognize and respond to these DNT signals in the future.

6. Our Business Purposes and Lawful Bases for Processing Personal Data

We use Personal Data that we collect only for permitted “business purposes” (as defined in Section 1798.140(e)(1)-(8) of CCPA), or in a manner described in Article 6 of GDPR (“Lawfulness of Processing”).

We collect and process your Personal Data for the following business or lawful purposes:

• Providing our Websites and Services (including necessary functionality for both): We process your Personal Data to perform under our agreements with our customers for the use of our Websites and Services and to fulfill our obligations under these contracts with our customers;
• Promoting the security of our Websites and Services: We process your Personal Data by tracking the use of our Websites and Services, creating aggregated data that anonymizes Personal Data, verifying accounts and user activity, investigating suspicious online activity, and enforcing our terms and policies to the extent it is necessary for promoting the safety and security of our Services, systems, and applications;
• Managing user registrations and your account: If you have registered for an account with us (or our customers have set up an account for you), we process your Personal Data by managing your user account to perform our contractual obligations with our customers according to our agreed upon terms;
• Handling contact and user support requests: If you fill out a web form or request user support, or if you contact us by other means including via a phone call, we process your Personal Data to fulfill our contractual obligations to our customers, and only to the extent it is necessary to respond to our customers’ requests and communicate with you on behalf of our customers;
• Enabling payments: If you have provided financial information to us, we process your Personal Data to verify that information and to collect payments through our payments processing service provider to the extent that doing so is necessary to complete a transaction and perform our contracts with our customers;
• Developing and improving our Websites and Services: We process your Personal Data to analyze trends and to track your usage of and interactions with our Websites and Services to the extent it is necessary for developing and improving our Websites and Services and providing our users with more relevant content and Service offerings;
• Assessing and improving user experience: We process device and usage data as described in Section 5 above, which in some cases may be associated with your Personal Data, to analyze trends and assess and improve the overall user experience to the extent it is necessary for developing and improving the Service offering;
• Identifying customer opportunities: We process your Personal Data to assess new and potential customer opportunities to ensure that we are meeting the demands of our customers and their users’ experiences;
• Recording phone calls: We may record phone calls for training, quality assurance, and administration purposes. If required under applicable law, we will obtain your prior consent or give you the option to object to a call being recorded; and
• Complying with our legal obligations: We process your Personal Data when cooperating with public and government authorities, courts, or regulators by our legal obligations under applicable laws, to protect against misuse or abuse of our Websites, protect personal property or safety, pursue remedies available to us and to enforce our contractual rights, comply with judicial proceedings, court orders or legal processes, respond to lawful requests, or for auditing purposes.

If we need to collect and process Personal Data by law, or under a agreement we have entered into with you as our customer, and you fail to provide the required Personal Data when requested, you may not be able to access and use our Services and we may not be able to provide you the Services you have requested.

7. Do We Share Personal Data That We Collect?

Zultys does not “sell” or “share” your Personal Information as such terms are defined in CCPA.  For that reason, Zultys does not offer California consumers a “right to opt-out” of the sharing and selling of Personal Data, nor does it provide Website visitors a “Do Not Sell or Share My Personal Information” Link on its Website.  We also do not share the Personal Information we collect with service providers who undertake cross-context behavioral advertising.  If Zultys changes its business practices in the future, we will update this Privacy Policy with posted notice communications and will provide consumers the right to opt out of such Personal Information usage that could include the sale or sharing of Personal Information.

We may share your Personal Data only for the business purposes as described above in Section 6 and as further defined in this Section 7:

• Service Providers: With our contracted service providers as required to offer you our products and Services. The service providers we use help us to run, operate, and maintain our Services through third-party platforms and software tools; perform content moderation and crash analytics; run email and mobile messaging campaigns; provide payment attribution; and provide technical and customer support. Some external service providers may also collect information directly from you (for example, a payment processor may request your billing and financial information) in accordance with their own privacy policy. These external service providers do not share your financial information, like payment card numbers, with us, but may share limited information with us related to your purchase, like your zip code.
• Professional Advisers: In individual instances, we may share your Personal Data with professional advisers acting as service providers, processors, or joint controllers – including lawyers, bankers, auditors, and insurers who provide consultancy, banking, legal, insurance, and accounting services; and
• Third Parties Involved in a Corporate Transaction: If we are involved in a merger, reorganization, dissolution, or other fundamental corporate change, or sell a Website or business unit, or if all or a portion of our business, assets, or stock are acquired by a third party. In accordance with applicable laws, we will use reasonable efforts to notify you of any transfer of Personal Data to an unaffiliated third party.

We may also share anonymous and de-identified usage data with Zultys’ service providers to help Zultys in the analysis and improvement of its products and Services. Additionally, Zultys may share such anonymous and de-identified usage data on an aggregate basis in the normal course of operating our business; for example, we may share information publicly to show trends about the general use of our Services.

We will not share your opt-in to an SMS campaign with any third party for purposes unrelated to providing you with the services of that campaign. We may share your Personal Data, including your SMS opt-in or consent status, with third parties that help us provide our messaging services, including but not limited to platform providers, phone companies, and any other vendors who assist us in the delivery of text messages.

For more information on those entities with whom we share your Personal Data or if you wish to opt out of direct marketing communications that we manage, please contact us by using the information in the “Contact Us” Section 15, below.

8. International Transfer of Personal Data

Any Personal Data that you provide to us may be accessed, shared, or processed by our offices, located in the United States, and service providers located in the United States, if such data transfer is necessary for the specific business purpose for which you submitted your data (such as the provision of Zultys products or Services under a written agreement). Zultys also conducts its business operations in many regions throughout the world, and our reseller and channel partners provide related or complementary products and services in any number of global locations. These commercial activities may entail a transfer of your Personal Data across international borders. Please be aware that the data protection standards in the geographic locations in which Zultys or its service providers, partners, resellers or sub-processors perform the Services and collect Personal Data, may differ and be lower than the standards enforced in your jurisdiction.

See Sections 11.1 and 11.2 below for our CCPA and GDPR Practices.   See also the section entitled “How We Secure Your Personal Data” in Section 12 below.

9. Children and Persons the Age of 16 and Under

Our Websites are not directed at individuals under the age of 16. We do not knowingly or intentionally collect Personal Information from children under 16. If you become aware that a child has provided us with Personal Information, please contact us using the contact details provided in the “Contact Us” Section 15 below. If we become aware that a child under 16 has provided us with Personal Information, we will take steps to delete such information.

10. How Long Do We Keep Your Personal Data?

Zultys retains Personal Data for as long as necessary to provide the products and Zultys Services, and to fulfill the transactions you have requested, or for other legitimate purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements. Because these needs can vary for different data types, the context of our interactions with you, or your use of products or Services, actual retention periods can vary significantly. We maintain specific records management and retention policies and procedures so that Personal Data is deleted after a reasonable time according to the following retention criteria:

• We retain your Personal Data as long as we have an ongoing relationship with you (in particular, if you and/or our customer have an account with us).
• We will only keep the Personal Data while your account is active or for as long as needed to provide Zultys Services to you.
• We retain your Personal Data for as long as needed to comply with our global legal and contractual obligations.

11. Your Rights Relating to Your Personal Data
    • CCPA Practices

These additional disclosures for California residents (e.g. “consumers”) apply only to individuals who reside in California. The CCPA provides consumers additional rights to know, delete, correct, and opt-out, and requires businesses collecting or disclosing Personal Information to provide notice of rights California residents have and can exercise.

California Notice of Collection.  See our separate California Notice of Collection (“Notice of Collection”) under CCPA located here: https://www.zultys.com/notice-of-collection/. In this Notice of Collection, we provide you with all the details for privacy policies required under 11 CCR § 7011 (California Code of Regulations).

In general, a California consumer has the following rights under CCPA: Right to Know, Delete, and Correct. If You are a California resident, you have the right to know certain information about our data practices in the preceding 12 months. In particular, you have the right to request the following from us:

• The categories of Personal Information we have collected about you;
• The categories of sources from which the Personal Information was collected;
• The categories of Personal Information about you that we disclosed for a business purpose or sold;
• The categories of third parties to whom the Personal Information was disclosed for a business person or sold;
• The business or commercial purpose for collecting or selling the Personal Information; and
• The specific pieces of Personal Information we have collected about you.

In addition, you have the right to delete the Personal Information we have collected from You. However, this is not an absolute right and we may have legal grounds for keeping such data.  You also have the right to correct the Personal Information we have collected from you if you can demonstrate that such Personal Information is inaccurate.

To exercise any of these rights, please submit a request to privacy@zultys.com. In the request, please specify which right you are seeking to exercise and the scope of the request. We will confirm receipt of your request within ten (10) business days. We may require specific information from you to help us verify your identity and process your request. If we are unable to verify your identity, we may deny your requests to know or delete.

Sensitive Personal Information.  We only collect Personal Information from consumers that under CCPA is considered to be “sensitive personal information” for the limited purposes described in our Notice of Collection.

Authorized Agent. You can designate an authorized agent to submit requests on Your behalf. However, we will require written proof of the agent’s permission to do so and verify your identity directly.

Right to Non-Discrimination. You have the right to non-discriminatory treatment by Zultys, should you exercise any of Your rights.

• GDPR Practices

Data Sub-processor. If you are a Zultys Website or Services user, Zultys and its service providers act as your data processors or sub-processors. Zultys primarily processes and stores your Personal Data, on servers located and operated within the United States. If you reside or are located outside of the U.S., we may send to and store your Personal Data in the United States to provide and operate the Zultys Services platform. If your Personal Data that is being processed by Zultys is subject to the EU General Data Protection Regulation (“GDPR”), we shall maintain an adequate level of protection of the personal data transferred outside the EEA, either by us and/or our service providers, in accordance with applicable laws.

If you wish to exercise any of your privacy rights under GDPR, or if you need further information regarding those privacy rights, please contact us at privacy@zulty.com.

12. How We Secure Your Personal Data

Zultys has implemented reasonable physical, technical, and organizational security measures to protect and safeguard Personal Data that Zultys processes against accidental or unlawful destruction, or accidental loss, alteration, unauthorized disclosure, or access, in compliance with applicable law. However, no product or service can fully eliminate security risks. If a data breach involving Personal Data occurs, we will post a reasonably prominent notice to the Websites and comply with all other applicable data privacy requirements including, when required, personal notice to you if you have provided and we have maintained an email address for you.

13. Third Party Sites

Our Websites or our Services may provide links to a wide variety of third-party websites. You should consult and review the respective privacy policies of these third-party websites. This Privacy Policy does not apply to, and we cannot control the activities of, such other websites. This Privacy Policy does not apply to the privacy practices of any companies we don’t own or control, any persons we don’t manage, or any third-party website, software, or service that we don’t control (including, concerning our extensions and integrations, the underlying third-party software). If you choose to visit another website by clicking on a hyperlink or otherwise, you will be directed to that third party’s website. The fact that we link to a website is not an endorsement, authorization, or representation of our affiliation with that third party. We do not exercise control over third-party websites. These other websites may place their cookies or other files on your computer, collect your data, or solicit Personal Data from you. This Privacy Policy only addresses the use and disclosure of information that we collect from you through our Websites and Services. Other websites may follow different rules regarding the use or disclosure of the information you submit to them. We encourage you to read the privacy policies or statements of other websites you visit, before providing your information to them.

14. Changes to This Privacy Policy.

We may change this Privacy Policy from time to time. If we make changes, we will notify you by revising the date at the top of this Privacy Policy, adding a statement to our Website homepage, sending you an email, and/or by some other means.  If you use our Website and Services after any changes to the Privacy Policy have been posted, that means you agree to all of the changes. We encourage you to review this Privacy Policy periodically to stay informed about our practices.

Under CCPA, we are obligated to review and update our Privacy Policy annually, and we intend to comply with that requirement.

15. Contact Us

All notices under this Privacy Policy shall be sent to the following Zultys contacts:

Email: legal@zultys.com | privacy@zultys.com

Telephone: +1-408-328-0450

Direct Written Correspondence: Zultys, Inc. 785 Lucerne Drive, Sunnyvale, CA 94085 USA.