California Privacy Notice

This California Privacy Notice (“California Notice”) supplements the Privacy Notice and applies solely to visitors, users, counterparties, and others who reside in the State of California (“you”). We adopted this California Notice to comply with California privacy laws, including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (the “CPRA”).

Collection of Personal Information

We may collect information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household (“personal information”). In certain instances, we may also collect certain categories of sensitive personal information.

Uses of Personal Information

We may use your personal information for the following purposes:

Onboarding and trading activities
Communication about services for legal, regulatory and servicing purposes
Managing complaints, undertaking remediation activities and resolving queries
Monitoring communications to check your instructions to us, analyze and improve our services and for training and quality purposes
Undertaking checks for security, fraud prevention, anti-money laundering and verifying identity (both before providing services and when communicating to ensure we are dealing with the correct person)
Recovering debt and enforcing other obligations as our agreement entitles us, as well as to protect our rights and property interests
Providing payment initiation services for accounts you hold with other providers
Complying with regulatory and legal obligations and cooperating with regulators and law enforcement
Preparing high-level anonymized statistical reports. The information in these reports is never personal and you will not be identifiable from it. We may disclose these reports to service providers or we may use them for our own analytical purposes
Website related activities (e.g., dealing with inquiries, running analytics)
Marketing communications
Processing sensitive data to comply with regulatory and legal obligations and cooperate with regulators and law enforcement

We will not use personal information for materially different, unrelated, or incompatible purposes without providing you with notice or obtaining your consent, as may be required.

Disclosure of Personal Information

We may disclose personal information as follows:

Service Providers: Your personal information may be disclosed, transferred, or otherwise made available, to our affiliates, and other third parties who provide services, such as identification and background checks, cloud-based information hosting and maintenance, website hosting, record keeping, and analytics, and to exchanges, trading platforms and financial institutions.
Legal and Compliance: We and our service providers may provide your personal information in response to a search warrant or other legally valid inquiry or order, or to another organization for the purposes of investigating a breach of an agreement or contravention of law or detecting, suppressing or preventing fraud, or as otherwise required or permitted by applicable law or legal process. Your personal information may also be disclosed where necessary for the establishment, exercise or defense of legal claims, and to investigate or prevent actual or suspected loss or harm to persons or property.
Sale of Business: Your personal information may be provided to third parties in connection with a business transaction, including a merger or sale (including transfers made as part of insolvency or bankruptcy proceedings) involving all or part of Cumberland or as part of a corporate reorganization, or stock or asset sale, or other change in corporate control, including for the purpose of determining whether to proceed or continue with such transaction or business relationship.

Processing of Personal Information

We may collect, use, and disclose (including in the past 12-months) the following categories of personal information:

Identifiers
- We may collect this category of personal information from you, directly or indirectly, or from third parties.
- The types of personal information we may collect in relation to this category includes your real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, social security number, driver’s license number, passport number, or similar identifiers.
- We may use this category of personal information for purposes 1, 2, 3, 5, 6, 7, 8, 9, 11, and 12, described in the “Uses of Personal Information” section above.
- We may disclose this category of personal information for processing by service providers, for legal and compliance reasons, and in regard to a sale of business.
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))
- We may collect this category of personal information from you, directly or indirectly, or from third parties.
- The types of personal information we may collect in relation to this category includes your name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, education, employment, employment history, bank account number, credit card number, debit card number, and/or any other financial information.
- We may use this category of personal information for purposes 1, 2, 3, 4, 5, 6, 8, 9, 10, and 12, described in the “Uses of Personal Information” section above.
- We may disclose this category of personal information for processing by service providers, for legal and compliance reasons, and in regard to a sale of business.
Characteristics of protected classifications under California or federal law
- We may collect this category of personal information from you, directly or indirectly, or from third parties.
- The types of personal information we may collect in relation to this category includes your age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, and veteran or military status.
- We may use this category of personal information for purposes 1, 5, and 12, described in the “Uses of Personal Information” section above.
- We may disclose this category of personal information for processing by service providers, for legal and compliance reasons, and in regard to a sale of business.
Commercial information
- We may collect this category of personal information from you, directly or indirectly, or from third parties.
- The types of personal information we may collect in relation to this category includes your records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
- We may use this category of personal information for purposes 1, 5, and 8, described in the “Uses of Personal Information” section above.
- We may disclose this category of personal information for processing by service providers, for legal and compliance reasons, and in regard to a sale of business.
Biometric information
- We do not collect, use, or disclose this category of personal information.
Internet or other electronic network activity information
- We may collect this category of personal information from you, directly or indirectly, or from third parties.
- The types of personal information we may collect in relation to this category includes your browsing history, search history, information on your interaction with an internet website, application, or advertisement.
- We may use this category of personal information for purposes 4 and 10, described in the “Uses of Personal Information” section above.
- We may disclose this category of personal information for processing by service providers, for legal and compliance reasons, and in regard to a sale of business.
Geolocation
- We may collect this category of personal information from you, directly or indirectly, or from third parties.
- The types of personal information we may collect in relation to this category includes your approximate location or the location of your electronic device.
- We may use this category of personal information for purposes 1, 5, 8, and 12, described in the “Uses of Personal Information” section above.
- We may disclose this category of personal information for processing by service providers, for legal and compliance reasons, and in regard to a sale of business.
Sensory data
- We may collect this category of personal information from you, directly or indirectly, or from third parties.
- The types of personal information we may collect in relation to this category includes your audio (recordings of phone and web meetings) and your video (video monitoring and recording within DRW facilities and offices).
- We may use this category of personal information for purposes 1, 2, 3, 4, 5, 6, 7, 8, 9, and 10, described in the “Uses of Personal Information” section above.
- We may disclose this category of personal information for processing by service providers, for legal and compliance reasons, and in regard to a sale of business.
Professional or employment-related information
- We may collect this category of personal information from you, directly or indirectly, or from third parties.
- The types of personal information we may collect in relation to this category includes your current or past job history and/or performance evaluations.
- We may use this category of personal information for purposes 1, 5, and 12, described in the “Uses of Personal Information” section above.
- We may disclose this category of personal information for processing by service providers, for legal and compliance reasons, and in regard to a sale of business.
Non-Public Education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99)
- We do not collect, use, or disclose this category of personal information.
Inferences drawn from any of the other personal information (e.g., profile information)
- We do not collect, use, or disclose this category of personal information.
Sensitive personal information
- We may collect this category of personal information from you, directly or indirectly, or from third parties.
- The types of personal information we may collect in relation to this category includes your social security number, driver’s license or state identification number, and passport number (collectively, “government-issued identifiers”), as well as your racial and ethnic origin, trade union membership, and personal information collected and analyzed concerning health (collectively, “demographic information”).
- We may use this category of personal information for purposes 1, 2, 3, 4, 5, 6, 8, 9, and 12, described in the “Uses of Personal Information” section above.
- We may disclose this category of personal information for processing by service providers, for legal and compliance reasons, and in regard to a sale of business.

California Privacy Rights

The CPRA provides California residents with the following rights:

Right to Know. You have the right to request that we disclose certain information about our collection and use of your personal information over the past 12 months. This includes the following:

The categories of personal information we have collected about you;
The categories of sources from which we collected your personal information;
The categories of personal information that we have sold or disclosed about you for a business purpose;
The categories of third parties to whom your personal information was disclosed for a business purpose;
Our business or commercial purpose for collecting or selling your personal information; and
The specific pieces of personal information we have collected about you.

Data Portability. You have the right to request a copy of personal information we hold about you.

Right to Correction. You may have the right to request that we correct inaccuracies in the personal information we hold about you.

Right to Deletion. You may have the right to request that we delete the personal information we have collected from you and maintained, subject to certain exceptions. Please note that if you request deletion of your personal information, we may deny your request or may retain certain elements of your personal information if it is necessary for us or our service providers to:

Complete the transaction for which the personal information was collected, provide a good or service requested by you, or reasonably anticipated within the context of an ongoing business relationship with you, or otherwise perform a contract with you.
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity.
Debug to identify and repair errors that impair existing intended functionality.
Exercise free speech, ensure the right of another person to exercise his or her right of free speech, or exercise another right provided for by law.
Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.
Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when deletion of the information is likely to render impossible or seriously impair the achievement of such research, if you have provided informed consent.
To enable solely internal uses that are reasonably aligned with your expectations based on your relationship with the us.
Comply with a legal obligation.
Otherwise use your personal information, internally, in a lawful manner that is compatible with the context in which you provided the information.

Right to Opt-Out. You may have the right to opt-out of the sale and sharing (for cross-context behavioral advertising) of your personal information, as may be applicable. However, we do not and have not sold or shared your personal information.

Right to Limit the Use and Disclosure of Sensitive Personal Information. You may have the right to limit the use and disclosure of sensitive personal information. However, we do not and have not used or disclosed sensitive personal information for any purpose other than those reasonably expected, as described in this California Notice.

Right to Non-Discrimination. As required by the CPRA, we will not discriminate against you for choosing to exercise your rights under the CPRA.

Submitting a Verified Consumer Request

In order to exercise your California privacy rights, you must email us at privacy@cumberland.io and provide us with sufficient information to allow us to verify your identity, and describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. Once we receive the information you provide to us, we will review it and determine if more information is necessary to verify your identity.

Only you or a person authorized by you to act on your behalf, may make a verifiable consumer request related to your personal information.

You may only make a verifiable consumer request for Right to Know or data portability twice within a 12-month period. The verifiable consumer request must:

Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative. To protect your personal information, we may need to verify your identity with multiple separate pieces of information, such as name, address, unique identifier, date of birth, phone number, or other information we know about you.
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We may deny your request if we are unable to verify your identity or have reason to believe that the request is fraudulent.

Consumer Request by an Authorized Agent

If any authorized agent submits a consumer request on your behalf, in order to confirm that person or entity’s authority to act on your behalf and verify the authorized agent’s identity, we require an email be sent to privacy@cumberland.io, along with all of the below items:

To verify the authorization to request on behalf of a California resident, one or more of the following: 1) California Secretary of State authorization, 2) written permission from the California resident, or 3) power of attorney.
Sufficient information to verify the authorized agent’s identity, depending on the nature of the request.
To verify the identity of the California resident for whom the request is being made, provide the information set forth above to comply with the requirements for “Submitting a Verified Consumer Request.”

We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or the authority to make the request.

We will acknowledge receipt of the request within 10 days of its receipt. We will respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will provide the responsive information in a portable and, to the extent technically feasible, in a readily useable format that allows you to transmit the information to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

In the preceding 12-months we have not sold or shared your personal information.

Personal Information of Minors

We do not knowingly collect, sell, or share the personal information of minors under the age of 16 without affirmative authorization.

Opt-Out Preference Signals

Our Website does not respond to opt-out preference signals as part of global privacy controls.

Modifications and updates to this California Notice

We may update this California Notice from time to time to reflect changes to our privacy practices. We encourage you to periodically review this page for the latest information on our privacy practices, and any use of our Website after any updates constitute your acknowledgement that you have read the updated California Notice.

Additional Information and Assistance

If you have any questions or concerns about this California Notice and/or how we process personal information, please contact us by email at privacy@cumberland.io or by mail at the following address:

540 West Madison Street
Suite 2500
Chicago, IL 60661

The Leadenhall Building
122 Leadenhall Street
36th Floor
London, England, EC3V 4AB

Last updated: January 1, 2023