Data Subject Request Form

Last Amended: January 21, 2024

GENERAL INFORMATION:

Zesty Tech Ltd. and its affiliated companies (collectively, “Company”, “we”, “our” or “us”) value privacy rights. As required under applicable data protection laws, individuals are permitted to submit a request to exercise certain rights regarding their personal data. Depending on your place of residence and your interaction with us, this Data Subjects Request Form (“DSR”) details and explains your effective privacy rights and provides you with detailed information on how to exercise such rights.

This DSR is provided to you pursuant with and in compliance with all applicable data protection laws (hereinafter as the “Data Protection Laws”), including, but not limited to, the EU General Data Protection Regulations and the UK General Data Protection Regulation (collectively referred to as “GDPR”), the Israeli Protection of Privacy Law (“IPPL”), the California Consumer Privacy Act of 2018 as amended and revised by the California Privacy Rights Act of 2020 (collectively referred to as “CCPA”), the Virginia Consumer Data Protection Act of 2021 (“VCDPA”), the Colorado Consumer Protection Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”), the Oregon Consumer Privacy Act (“OCPA”), the Montana Consumer Data Privacy Act (“MCDPA”), the Texas Data Privacy and Security Act (“TDPSA”), the Florida Digital Bill of Rights (“FDBR”) along with any additional data protection laws that may be enacted and applied from time to time in the U.S.,

PROCESS:

Please complete this form and substantiate you request with sufficient details which will allow us to properly understand, evaluate, and respond to it.

In order to submit a request to exercise individual rights pursuant to the Data Protection Laws, please complete this form and send it to our privacy team at: privacy@zesty.co.

For EU, UK and Swiss data subjects, you can also submit a Request to our representative:

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact.
Prighter gives you an easy way to exercise your privacy-related rights as detailed herein below. If you want to contact us via our representative – Prighter, please visit the following website: prighter.com/q/17277710417

Upon receipt of your completed request, we will process it and respond within the timelines required under the applicable Data Protection Laws. If additional information is necessary, we will contact you using the contact information you provided in this form. Information provided in connection with your request will be processed only for the purpose of processing and responding to your request and will be deleted immediately thereafter. For more information, please review our Privacy Policy.

1) CONTACT INFORMATION:

Full Name: __________________________________________________________________________
Address: ___________________________________________________________________________
Email Address: _______________________________________________________________________

2) WHAT IS YOUR RELATIONSHIP WITH US?

Customer
Website Visitor
Employee
Candidate
Vendor
Other: _________

3) YOUR REQUEST:

Detailed below are various rights granted under Data Protection Laws. Note that you might not be eligible to exercise all or part of the rights detailed below – this depends on your jurisdiction, our relationship, and our rights to refuse or retain data under applicable Data Protection Laws.

A. CALIFORNIA:

Please check the applicable right(s) you are requesting to execute:

Right to Know or Access the Personal Information;
Right to Deletion of the Personal Information (the right to delete is not absolute and in certain cases we will have the lawful right to maintain the Personal Information – see the “Deletion Rights Under U.S. Data Protection Laws” below);
Right to Data Portability (to obtain a portable copy of the Personal Information);
Right to Non-Discrimination;
Right to Rectification;
Right to Limit the Use and Disclosure of Sensitive Personal Information;
- Right to Opt-Out of:
- Sale of Personal Information;
- Sharing for Cross-Contextual Behavioral Advertising; or
- Use of Automated Decision Making; or
Other _______________________________________________________________________.

CCPA Opt-Out Rights:

The Right to Opt-out of Sale; Opt-Out of Sharing for Cross-Contextual Behavioral Advertising; can be executed without filling the form:

a) Through our website footer: You can opt-out from processing of online identifiers or other marketing data, for analytics or marketing purposes, at any time, by using the cookie settings banner available through our website footer.
b) Through Device-Level Choices: If you do not want to receive interest-based advertisements, you can limit the collection of certain information through your device settings.
c) Designated CCPA Opt-Out Tools: California resident who wishes to opt-out of having their data used for interest-based advertising, may exercise such right through designated CCPA opt-out tools such as the tool available at: https://optout.privacyrights.info/.
d) Use the Global Privacy Control (“GPC”) signals.

Please know that opting out of interest-based advertising does not mean that you will not receive advertising. You may still receive ads, but those ads may be less relevant to your interests.

Authorized Agency:

You may submit the request by an authorized agency as detailed in the CCPA Notice. Note we may deny a request from an authorized agent that does not submit proof that they have been authorized by you to act on your behalf.

Response Framework & Appeal:

We aim to complete all CCPA verifiable consumer requests as soon as reasonably practicable and consistent with the 45- days timeframe mandated by the CCPA. We have the right to extend the response time by additional 45 days when reasonably necessary, provided we have sent you a notification of the extension within the first 45 days, together with the reasons for the delay. If we refuse to take action on your request, we shall inform you, without delay, and in any case, within the 90 days timeframe mandated by the CCPA, of our decision along with the reasoning for not taking action and your right to appeal our decision.

If you have an account with us, we may deliver our written response to that account or via email at our sole discretion. If you do not have an account with us, we will deliver our written response by mail or electronically. You do not need to create an account for submitting a request. Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

B. VIRGINIA:

Please check the applicable right(s) you are requesting to execute:

Right to Confirm if the Personal Data is Being Processed;
Right to Access the Personal Data;
Right to Deletion of Personal Data (the right to delete is not absolute, and in certain cases we will have the lawful right to maintain the Personal Data – see the “Deletion Rights Under U.S. Data Protection Laws” below);
Right to Data Portability (to obtain a portable copy of the data);
Right to Correct Inaccuracies in the Personal Data;
- Right to Opt-out of the Processing of Personal Data for the purpose of:
- Targeted Advertising;
- Sale of Personal Data; or
- Profiling Used for Decisions that Produce Legal or Similarly Significant Effects on a Consumer;
Right to Non-Discrimination; or
Other _______________________________________________________________________.

Opt-Out Rights:

Except for specific CCPA designated tools, please refer to the CCPA Opt-Out Rights above, explaining the means available to you in order to exercise your opt-out rights without filling out this DSR.

Response Framework & Appeal:

We aim to complete all VCDPA authenticated consumer requests as soon as reasonably practicable and consistent with the 45-days time frame mandated by the VCDPA. We have the right to extend the response time by additional 45 days when reasonably necessary, provided we have sent you a notification of the extension within the first 45 days, together with the reasons for the delay. If we refuse to take action on your request, we shall inform you, without delay, and in any case, within the 90 days timeframe mandated by the VCDPA, of our decision along with the justification for declining to take action and instructions for how to appeal the decision. To the extent you chose to appeal our decision, within 60 days of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, you may submit a complaint to the Virginia Attorney General at https://www.oag.state.va.us/consumercomplaintform.

Note, if you have an account with us, we may require you to use the account to submit the request. If we are unable to authenticate your request using commercially reasonable efforts, we may request additional information reasonably necessary to authenticate you and your request. If we cannot authenticate you and your request, we will not be able to grant your request.

C. COLORADO:

Please check the applicable right(s) you are requesting to execute:

Right of Access the Personal Data;
Right to Correct Inaccuracies in the Personal Data;
Right to Deletion of Personal Data (the right to delete is not absolute and in certain cases we will have the lawful right to maintain the Personal Data – see the “Deletion Rights Under U.S. Data Protection Laws” below);
Right to Data Portability (to obtain a portable copy of the Personal Data);
- Right to Opt-Out of the Processing of Personal Data for the purpose of:
- Targeted Advertising;
- Sale of Personal Data; or
- Profiling Used for Decisions that Produce Legal or Similarly Significant Effects on a Consumer; or
Right to Non-Discrimination;
Other _______________________________________________________________________.

Opt-Out Rights:

Except for specific CCPA designated tools, please refer to the CCPA Opt-Out Rights above, explaining the means available to you in order to exercise your opt-out rights without filling out this DSR.

Authorized Agency:

Please note you may designate an authorized agent on your behalf to exercise your opt out rights detailed above. You may designate such authorized agent by way of, among other things, a technology, including, but not limited to, an Internet link or a browser setting, browser extension or global device setting, indicating your intent to opt out of such processing, all as detailed in the CCPA Notice.

Response Framework & Appeal:

We aim to complete CPA consumer request as soon as reasonably practicable and consistent with the 45-day timeframe mandated by the CPA. We have the right to extend the response time by an additional 45 days when reasonably necessary, provided we have sent you a notification of the extension within the first 45 days, together with the reasons for the delay. If we refuse to take action on your request, we shall inform you, without delay, and in any case, within the 90 days timeframe mandated by the CPA, of our decision along with the justification for declining to take action and instructions for how to appeal the decision. To the extent you chose to appeal our decision, within 45 days of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. You may also contact the Colorado Attorney General if you have concerns about the result of the appeal as follows: Colorado AG at https://coag.gov/file-complaint/.

If you have an account with us, we may deliver our written response to that account or via email at our sole discretion. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. You do not need to create an account for submitting a request. Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

D. CONNECTICUT:

Please check the applicable right(s) you are requesting to execute:

Right to Confirm if the Personal Data is Being Processed;
Right to Access the Personal Data;
Right to Correct Inaccuracies in the Personal Data;
Right to Deletion of Personal Data (the right to delete is not absolute and in certain cases we will have the lawful right to maintain the Personal Data – see the ”Deletion Rights Under U.S. Data Protection Laws” below);
Right to Data Portability (to obtain a portable copy of the Personal Data);
- Right to Opt-Out of the Processing of Personal Data for the purpose of:
- Targeted Advertising;
- Sale of Personal Data; or
- Profiling Used for Decisions that Produce Legal or Similarly Significant Effects on a Consumer; or
Right to Non-Discrimination; or
Other _______________________________________________________________________.

Opt-Out Rights:

Except for specific CCPA designated tools, and the option to opt-out using universal opt-out mechanisms which will be recognized by us for Connecticut’s consumer’s requests on January 1, 2025, please refer to the CCPA Opt-Out Rights above, explaining the means available to you in order to exercise your opt-out rights without filling out this DSR.

Note, where your consent is required, however revoked, we will cease processing the applicable data set as soon as practicable, but not later than fifteen (15) days after the receipt of your request.

Authorized Agency:

Response Framework & Appeal:

We aim to complete all CTDPA requests within 45 days of receipt. We have the right to extend the response time by additional 45 days when reasonably necessary, considering the complexity and number of DSRs you have submitted, and we shall inform you of such extension within the first 45 days, together with the reason for the extension. If we decline to take action on your request, we shall inform you of our decision without undue delay and no later than within 90 days of receipt of your request. The notification will include a justification for declining to take action and instructions on how you may appeal. To the extent you chose to appeal our decision, within 60 days of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, you may submit a complaint to the Connecticut Attorney General at link: https://www.dir.ct.gov/ag/complaint/ or (860) 808-5318.

If we are unable to authenticate your request using commercially reasonable efforts, we may request additional information reasonably necessary to authenticate you and your request. If we cannot authenticate you and your request, we will not be able to grant your request.

E. UTAH:

Please check the applicable right(s) you are requesting to execute:

Right to Confirm if the Personal Data is Being Processed;
Right to Access;
Right to Deletion of Personal Data (the right to delete is not absolute and in certain cases we will have the lawful right to maintain the Personal Data – see the ”Deletion Rights Under U.S. Data Protection Laws” below);
Right to Data Portability (to obtain a portable copy of the Personal Data);
- Right to Opt-out of the Processing of Personal Data for the Purposes of:
- Targeted advertising;
- Sale of Personal Data; or
Right to Non-Discrimination; or
Other _______________________________________________________________________.

Opt-Out Rights:

Except for specific CCPA designated tools, please refer to the CCPA Opt-Out Rights above, explaining the means available to you in order to exercise your opt-out rights without filling out this DSR.

Response Framework:

We aim to respond to your UCPA requests within 45 days of receipt. We shall have the right to extend such period by additional 45 days when reasonably necessary, considering the complexity and number of DSRs you have submitted, and we shall inform you of such extension within the initial 45 days response period, together with the reason for the extension. If we decline to take action on your request, we shall so inform of our refusal without undue delay, and not later than within 90 days of receipt of your request. The notification will include a justification for declining to take action.

F. OREGON:

*Effective July 2024

Please check the applicable right(s) you are requesting to execute:

Right to Confirm if the Personal Data is Being Processed;
Right to Correct Inaccuracies in the Personal Data;
Right to Deletion of Personal Data (the right to delete is not absolute and in certain cases we will have the lawful right to maintain the Personal Data – see the “Deletion Rights Under U.S. Data Protection Laws” below);
Right to Data Portability (to obtain a portable copy of the Personal Data);
- Right to Opt-out of the Processing of Personal Data for the purposes of:
- Targeted Advertising;
- Sale of Personal Data;
- Profiling Used for Decisions that Produce Legal or Similarly Significant Effects on a Consumer; or
Right to Non-Discrimination; or
Other _______________________________________________________________________.

Opt-Out Rights:

Except for specific CCPA designated tools, please refer to the CCPA Opt-Out Rights above, explaining the means available to you in order to exercise your opt-out rights without filling out this DSR.

Authorized Agency:

Response Framework & Appeal:

We aim to respond to all OCPA requests within 45 days of receipt. We have the right to extend such period by additional 45 days when reasonably necessary, considering the complexity and number of the DSRs you have submitted, and we shall inform you of such extension within the initial 45 days response period, together with the reason for the extension. If we decline to take action on your request, we shall so inform you without undue delay, within 45 days of receipt of your request. The notification will include a justification for declining to take action and instructions on how you may appeal the decision. Within 60 days of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, you may submit a complaint to Oregon attorney general.

G. MONTANA:

*Effective July 2024

Please check the applicable right(s) you are requesting to execute:

Right to Confirm if the Personal Data is Being Processed;
Right to Access the Personal Data;
Right to Correct Inaccuracies in the Personal Data;
Right to Delete Personal Data (the right to delete is not absolute and in certain cases we will have the lawful right to maintain the Personal Data – see the “Deletion Rights Under U.S. Data Protection Laws” below);
Right to Data Portability (to obtain a portable copy of the Personal Data);
- Right to Opt-Out of the processing of Personal Data for the purposes of:
- Targeted Advertising;
- Sale of Personal Data;
- Profiling in Furtherance of Solely Automated Decisions that Produce Legal or Similarly Significant Effects on a Consumer; or
Right to Non-Discrimination; or
Other _______________________________________________________________________.

Opt-Out Rights:

Authorized Agency:

Response Framework & Appeal:

We aim to respond to your MTCDPA requests within 45 days of receipt. The response period may be extended by 45 additional days when reasonably necessary, considering the complexity and number of the DSRs you have submitted, and we shall inform you of such extension within the initial 45 days response period, together with the reason for the extension. If we decline to take action on your request, we shall so inform you without undue delay, within 45 days of receipt of your request. The notification will include a justification for declining to take action and instructions on how you may appeal the decision. Within 60 days of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, you may submit a complaint to Montana attorney general at: https://dojmt.gov/consumer/.

If we are unable to authenticate your request using commercially reasonable efforts, we shall provide you with a notice and we may request additional information reasonably necessary to authenticate you and your request. Further, we may deny an opt-out request if we have a good faith, reasonable, and documented belief that the request is fraudulent, and if denied, we shall send you a notice disclosing that we believe the request is fraudulent and therefore may not comply with the request.

H. TEXAS:

*The TDPSA takes effect in July 2024, however, consumers are allowed to exercise their rights using this form from January 2025.

Please check the applicable right(s) you are requesting to execute:

Right to Confirm if the Personal Data is Being Processed;
Right to Access the Personal Data;
Right to Correct Inaccuracies in the Personal Data;
Right to Delete Personal Data (the right to delete is not absolute and in certain cases we will have the lawful right to maintain the Personal Data – see the “Deletion Rights Under U.S. Data Protection Laws” below);
Right to Data Portability (to obtain a portable copy of the Personal Data);
- Right to Opt-Out of the Processing of Personal Data for the purposes of:
- Targeted Advertising;
- Sale of Personal Data;
- Profiling in Furtherance of Solely Automated Decisions that Produce Legal or Similarly Significant Effects on a Consumer; or
Right to Non-Discrimination; or
Other _______________________________________________________________________.

Opt-Out Rights:

Except for specific CCPA designated tools, please refer to the CCPA Opt-Out Rights above, explaining the means available to you in order to exercise your opt-out rights without filling out this DSR.

Authorized Agency:

Response Framework & Appeal:

We aim to respond to all TDPSA request within 45 days of receipt. The response period may be extended once by 45 additional days when reasonably necessary, taking into account the complexity and number of requests, and we shall inform you of such extension within the initial 45 days response period, together with the reason for the extension. If we decline to take action regarding your request, we shall inform you without due delay and within 45 days of receipt of your request, of the justification for declining to take action and provide instructions on how to appeal the decision. If we are unable to authenticate your request using commercially reasonable efforts, we may request additional information reasonably necessary to authenticate you and your request. If you decide to appeal, we will inform you in writing within 60 days of our receipt of your appeal of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, you may submit a complaint to the Attorney General of Texas at: www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint.

I. FLORIDA:

Effective July 2024

Please check the applicable right(s) you are requesting to execute:

Right to Confirm if the Personal Data is Being Processed;
Right to access to the Personal Data;
Right to Correct Inaccuracies in the Personal Data;
Right to Delete Personal Data (the right to delete is not absolute and in certain cases we will have the lawful right to maintain the Personal Data – see the “Deletion Rights Under U.S. Data Protection Laws” below);
Right to Data Portability (to obtain a portable copy of the Personal Data);
- Right to Opt-Out of the Processing of Personal Data for the purposes of:
- Targeted Advertising;
- Sale of Personal Data; or
- Profiling in Furtherance of Solely Automated Decisions that Produce Legal or Similarly Significant Effects on a Consumer;
Right to Opt-Out of the Collection of Sensitive Data, including Precise Geolocation Data, or the Processing of Sensitive Data;
Right to Opt-Out of the Collection of Personal Data Collected through the Operation of a Voice Recognition or Facial Recognition Feature;
Right to Non-Discrimination; or
Other _______________________________________________________________________.

Opt-Out Rights:

Except for specific CCPA designated tools, please refer to the CCPA Opt-Out Rights above, explaining the means available to you in order to exercise your opt-out rights without filling out this DSR.

Authorized Agency:

Response Framework & Appeal:

We aim to respond to all FDBR requests within 45 days of receipt. The response period may be extended once by 15 additional days when reasonably necessary, taking into account the complexity and number of requests, and we shall inform you of such extension within the original 45-day timeframe, together with the reason for the extension. If we decline to take action regarding your request, we shall inform you without due delay and within 45 days of receipt of your request, of the justification for declining to take action and provide instructions on how to appeal the decision. If we are unable to authenticate your request using commercially reasonable efforts, we may request additional information reasonably necessary to authenticate you and your request. If you decide to appeal, we will inform you in writing within 60 days of our receipt of your appeal of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.

DELETION RIGHTS UNDER U.S. DATA PROTECTION LAWS:

Deletion rights under U.S. Data Protection Laws are not absolute – we may deny your deletion request, in full or in part, if retaining the information is necessary for us or our service provider(s) for any of the following reasons: (1) complete the transaction for which we collected the Personal Data, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you; (2) detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities; (3) debug products to identify and repair errors that impair existing intended functionality; (4) exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law; (5) comply with the law or legal obligation; (6) engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent; (7) enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us; (8) make other internal and lawful uses of that information that are compatible with the context in which you provided it. We will delete or de-identify Personal Data not subject to one of these exceptions from our records and will direct our processors to take similar action.

J. EU, UK, EEA AND OTHER JURISDICTIONS:

Please check the applicable right(s) you are requesting to execute:

Right to be Informed About the Processing of Personal Data;
Right to Access to Your Personal Data;
Right to Rectification and Amendment;
Right to Deletion/Erasure (the right to delete is not absolute and in certain cases we will have the lawful right to maintain the Personal Data);
Right to Restrict Processing of Personal Data;
Right to Data Portability (to obtain a portable copy of the data);
Right to Object to the Processing of Personal Data;
Right to Withdraw Consent;
Rights Related to Automated Decision-Making and Profiling; or
Other _______________________________________________________________________.

4) VALIDATION, REPRESENTATIVE & CONFIRMATION

You shall provide enough information to allow us to reasonably verify you as the person about whom we collected Personal Data or an authorized representative. We cannot respond to your request if we cannot verify your identity or authority to make the request and confirm the Personal Data is related to you.

Please Substantiate your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________

Representatives: (complete if you are acting as the representative for a data subject)

Note, we may still need to contact the data subject where proof of authorization or identity are required.

Representative’s Name:	Relationship to data subject:
Email:
I confirm that I am the authorised representative of the named data subject:
Representative’s Name: ____________________		Signature: __________________

Confirmation:

Data Subject Name
Signature
Date