Effective Date: July 1, 2020

This policy describes:

  • how Xpansiv CBL Holding Group, and its affiliates CBL Markets (USA), LLC, Xpansiv Data Systems, Inc., and CBL Markets (Australia) Pty Ltd. (collectively or individually, “XCHG”), as part of providing you with XPV Registry services, Environmental Management Account services and/or Market or Exchange platform services, collects, uses, manages and discloses personally identifiable information (PII) provided to XCHG by you, as an individual (sometimes referred to as a “natural person” or “data subject”);
  • what rights you have with respect to your personally identifiable information (PII) as collected, used, managed and disclosed by XCHG;
  • how to exercise those rights.

If you have any questions about this policy, after reading it, we encourage you to contact our Data Protection Officer, at DPO@xpansiv.com to get answers to your questions so that you make informed decisions.

To What Does This Policy Apply?

This policy applies to each XCHG entity and respective public website(s).

The current version of this policy is always available at https://www.cblmarkets.com/privacypolicy/.

What Personally Identifiable Information Does XCHG Collect?

In the European Union and in other jurisdictions with laws governing the collection and use of PII, XCHG is referred to as a “data controller,” because we collect, retain and process personally identifiable information (PII) that you provide us.

As part of your use of your XCHG-provided services, including Environmental Management Account services, on the CBL Markets website, we collect basic contact information from you, including, potentially, your proper name, your electronic mail (e-mail) address, your cellular and/or landline telephone numbers, your position title and your postal address. In what follows, we will refer to this information as “Personal Information.”

Additionally, our systems collect – automatically – technical details of your interaction with those systems, including your Internet (IP) address, browser type and revision, and operating system. We also collect information on the time and date you interact with our systems, and how you interact with them – what pages, services, features or functions you use, how long you use them, what content you access, and what content you download. If you make requests of us – for example, to download a white paper, or to receive a telephone call from a customer support representative – we record the request, and the date and time it is made. In what follows, we will refer to this as “Metadata.”

We do not knowingly collect or use personal financial information of any kind.

We do not collect or use personal health information of any kind.

Some of the Metadata we collect from you is stored on your computer in the form of browser cookies. Cookies are small files are transferred, during a web interaction, to your computer’s hard drive through your web browser.  Cookies allow us to recognize your browser, and to capture and recall Metadata that assists us in improving your experience of our services.

We use cookies to help us remember you, to process your requests, to provide you with online services, to understand and save your preferences for future website visits and to compile aggregated unidentifiable data about website traffic and interactions, so that we can offer better website experiences and tools in the future.

You can choose, unilaterally, to have your browser warn you each time a cookie is being sent, or to turn off cookies completely. If you turn cookies off, some of our services may not function properly.

How Is Personal Information Transmitted To XCHG?

XCHG follows generally accepted industry standards to protect information submitted to us, both during transmission and once we receive it. We maintain appropriate administrative, technical and physical safeguards to protect Personal Information and Metadata against accidental or unlawful destruction, accidental loss, unauthorized alteration, unauthorized disclosure or access, misuse, and any other unlawful form of processing of the Personal Information and Metadata in our possession. This includes, for example, the use of firewalls, password protection and other access, authentication and authorization controls.

XCHG cannot ensure or warrant the security of any Personal Information you transmit to XCHG or guarantee that your Personal Information may not be accessed, disclosed, altered or destroyed by breach of any of our industry standard physical, technical or managerial safeguards. No method of transmission or method of electronic storage is 100% secure. Therefore, we cannot guarantee the absolute security of your Personal Information.

How Does XCHG Retain Personal Information?

We store Personal Information in our secure online databases, which are housed within secure servers in both the Microsoft Azure and Amazon Web Services cloud environments.

XCHG retains your Personal Information for as long as XCHG has an ongoing commercial relationship with you, as a prospect or customer.

XCHG follows generally accepted industry standards to protect information submitted to us, both during transmission and once we receive it. We maintain appropriate administrative, technical and physical safeguards to protect Personal Information and Metadata against accidental or unlawful destruction, accidental loss, unauthorized alteration, unauthorized disclosure or access, misuse, and any other unlawful form of processing of the Personal Information and Metadata in our possession. This includes, for example, the use of firewalls, password protection and other access, authentication and authorization controls.

XCHG cannot ensure or warrant the security of any Personal Information you transmit to XCHG or guarantee that your Personal Information may not be accessed, disclosed, altered or destroyed by breach of any of our industry standard physical, technical or managerial safeguards. No method of transmission or method of electronic storage is 100% secure. Therefore, we cannot guarantee the absolute security of your Personal Information.

How Does XCHG Use Personal Information?

We do not rent, sell, trade, or lend any personally-identifiable information we collect, ever.

We do not make decisions concerning you, using personally-identifiable information, beyond enforcing the terms of use (ToU) of our services, to which you agree when you begin using those services.

In general, we use your Personal Information to provide you with services that you request, to provide you with information about our company, its mission and its products and services, and to contact you when necessary with commercial, administrative or analytical information you request or require.

More specifically, we use the Personal Information and Metadata you provide us to:

  • Provide, update, maintain and protect our websites, their services and their content, including for the investigation of security incidents.
  • Comply with various local, state and national laws, including the European Union General Data Protection Regulation (GDPR).
  • To personalize the services you receive from us.
  • Provide you with requested services and content via electronic and/or traditional mechanisms that you specify.
  • Communicate with you as required on topics that affect you, or on which you have expressed an interest, including notifications of changes to this policy.
  • Respond to legal and regulatory requests or demands from appropriate regulatory, public safety, law enforcement or governmental entities.

In some cases, third parties provide us with services that help us service you: for example, to send you a text message, or to ensure that a white paper you have requested is delivered to you. Those third parties, known as “processors” in the European Union’s regulations, are bound by contractual agreements with us that include Data Processing Addenda (DPA) requiring those processors to protect your Personal Information, and to refrain from making use of your Personal Information for any purpose other than that specified in their contracts with us. XCHG will not independently cause your Personal Information controlled by XCHG to be transferred or otherwise made available to third parties, except to third party subcontractors who may process such data on behalf of XCHG in connection with XCHG’s services to you, and then only under the terms of a valid and reasonable Data Protection Addendum in force between XCHG and that processor, and according to permissions given to XCHG by you.

In compliance with applicable law, XCHG hereby states that it does not currently read, recognize or respond to Do Not Track signals received from browsers.

In compliance with laws in various jurisdictions, XCHG affirms that:

  • our services are not directed to children under the age of 18;
  • we do not knowingly collect or retain any Personal Data from persons under the age of 18;
  • if we learn that XCHG has inadvertently collected personally identifiable data from persons under 18 years of age without verifiable parental consent, we immediately delete that information.

If you are a parent or guardian with concerns in this area, please contact our Data Protection Officer, as described below.

Your Privacy Rights

Depending on your country of residence, your privacy rights may include the right to:

  • Know what Personal Information XCHG collects, how that information is transmitted and retained, and to what uses that information is put, generally
  • Know what Personal Information XCHG retains concerning you, specifically.
  • Receive a machine-readable copy of the Personal Information XCHG retains concerning you, solely.
  • Change Personal Information XCHG retains concerning you, specifically.
  • Request the deletion of Personal Information XCHG retains concerning you, solely.
  • Know what permissions and processing authorizations you have given XCHG, with respect to your Personal Information.
  • Change or revoke permissions and processing authorizations you have given XCHG in the past, with respect to your Personal Information.
  • Receive notification in the unlikely event that your Personal Information or personally-identifiable Metadata is inadvertently breached by XCHG.

Periodically, when you use our services, we will ask you to acknowledge, actively, your consent for us to use Personal Information you provide to perform specific activities. If you do not actively acknowledge that you consent to the use of your Personal Information to perform these activities, we will either [a] attempt to perform them without use of your Personal Information, if that is technically or procedurally feasible, or [b] inform you that we cannot perform the activities without authorization to use your Personal Information.

On all such occasions, we will record electronically your active consent to, or active dissent from, specific processing activities involving your Personal Information, and the date and time that consent or dissent was provided, as required by applicable law, including the European Union’s General Data Protection Regulation.

If you receive unwanted commercial emails from us, you may unsubscribe from these at any time by following the instructions contained within the received email, by sending an email to the address provided in the “Contact Us” section of the CBL Markets Environmental Management Account services website, or by contacting the XCHG Data Protection Officer, as described below. If you decline to receive commercial email from us or otherwise modify the nature or frequency of promotional communications you receive from us, it may take up to ten (10) business days for us to process your request. Additionally, even after you decline to receive commercial messages from us, you may continue to receive either [a] administrative messages from us regarding our services or [b] informational messages from us, regarding your use of our services, if you have not also declined to receive those messages.

At any time, you may:

  • Know what Personal Information XCHG collects, how that information is transmitted and retained, and to what uses that information is put, generally;
  • Know what Personal Information XCHG retains concerning you, specifically;
  • Receive a machine-readable copy of the Personal Information XCHG retains concerning you, solely;
  • Change Personal Information XCHG retains concerning you, specifically;
  • Request the deletion of Personal Information XCHG retains concerning you, solely;
  • Know what permissions and processing authorizations you have given XCHG, with respect to your Personal Information;
  • Change or revoke permissions and processing authorizations you have given XCHG in the past, with respect to your Personal Information;
  • Ask any questions you may have concerning XCHG’s use, processing, transmission or retention of your Personal Information

by contacting XCHG’s Data Protection Officer (DPO) as indicated below:

Data Protection Officer
dpo@xpansiv.com
Xpansiv CBL Holding Group
2 Bryant Street, San Francisco, CA 94105

XCHG’s DPO will acknowledge all requests made by you within 72 hours of receipt, using the contact information you provide, will subsequently work with you to verify your identity (and your rights to your Personal Information), and will make all reasonable efforts to assist you in obtaining your desired outcome.

If you are a data protection authority and require information from XCHG within your organization’s legal or regulatory remit, please contact XCHG’s Data Protection Officer, as described above.

How XCHG Will Notify You of Relevant Events

XCHG’s DPO will acknowledge all requests made by you within 72 hours of receipt, using the contact information you provide, and will make all reasonable efforts to assist you in obtaining your desired outcome.

In the event that any Personal Information or personally-identifiable Metadata is compromised as a breach of XCHG‘s security, XCHG will promptly notify you in compliance with applicable law.

For other purposes, XCHG provides notifications, whether such notifications are required by law or are for marketing or other business related purposes, to you via email, written or hard copy notice, or through conspicuous posting of such notice on our public website https://www.cblmarkets.com/privacypolicy/, as determined by XCHG at its discretion.

© 2020 CBL Markets
The world’s leading spot exchange for commodity markets