Privacy Policy

1. Terms and Definitions

Company / Zambulay — the Zambulay fintech platform, providing access to the Platform and related financial services.

Arbitration Team — a group of individuals or an organization engaged in the purchase and resale of internet traffic, serving as the target audience for using the credit lines and deposits of the Platform.

Platform — the website zambulay.com, the personal account, software interfaces, and other related services of Zambulay.

Policy — this Privacy Policy, including all its amendments and additions.

User / Client — an individual, a representative of a legal entity,

a business client, a visitor to the Platform, or any other person interacting with the Company.

Personal Data — any information relating to a directly or indirectly identified natural person.

Processing of Personal Data — any action or set of actions performed with personal data, including collection, recording, systematization, storage, modification, use, transfer, restriction, anonymization, and deletion.

Personal Data Controller — the person who determines the purposes and means of processing personal data; within the framework of this Policy — Zambulay.

Consent — a voluntary, specific, informed, and unambiguous indication of the User’s will concerning the processing of their personal data.

KYC — the customer identification and verification procedure (Know Your Customer).

AML (Anti-Money Laundering) — the policy and set of internal procedures of the Platform aimed at identifying, preventing, and suppressing operations related to the legalization (laundering) of proceeds from crime and the financing of illegal activities.

Account / Account — a registered User account on the Platform, through which they gain access to services.

Team Account — a multi-user account for an organization or team with distributed access rights.

Card — a virtual card issued to the User through the Platform and financial partners.

BIN / BIN — the first digits of a payment card number, identifying the payment system, issuer, and specific card issuance parameters.

Partner Bank — a bank or other financial organization involved in the issuance, servicing of cards, or transaction processing.

Payment System — an organization and a set of rules and technologies ensuring the execution of card transactions.

Acquiring Bank — a bank or payment provider that processes payment acceptance on the merchant’s side.

Merchant — a seller, service provider, internet service, or other entity accepting card payments.

Transaction / Operation — an action using a card or account, including payment, transfer, top-up, refund, cancellation, or an attempted charge.

Decline Rate — the percentage of declined payments out of the total number of payment attempts using the User’s cards.

Unusual (High-Risk) Activity — actions by the User that go beyond the established permitted use of the service, including multi-accounting, mass account registration on the service, intentional card blocking to avoid payment, first-billing, or exceeding the permissible Decline/Refund Rate thresholds.

Rates / Tariff Plan — a document or section on the Platform establishing the amounts of fees, limits, interest rates, and the cost of the Company’s services.

Refund Rate — the percentage of refunded payments out of the total number of successfully processed payments using the User’s cards.

Overdraft / Negative Balance — a debt arising from the debiting of an amount exceeding the available balance, or resulting from fees, adjustments, conversion, or pending transactions.

Loan — targeted borrowed funds that the Platform provides to the User for a specific period under agreed terms.

Credit Line — an established limit within which the User may receive credit funds under agreed terms.

Deposit — funds placed by the User for a specific term and under interest accrual conditions.

USDT — a digital asset whose value is typically pegged to the US dollar and which may be used within certain products of the Platform.

Cookie — a small data file stored on the User’s device when visiting the website to ensure its operation, analytics, and personalization.

First-bill — the intentional use of a Card or its details for initial bindings and activation of trial services without the intention of subsequent payment.

2. General Provisions

2.1 The fintech platform Zambulay (hereinafter — “Company”, “we”, “us”, or “our”) is committed to protecting the privacy of natural persons (“you”, “your”, or “user”) whose personal data we process. This Privacy Policy (hereinafter — the “Policy”) describes how we collect, use, store, and protect personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (hereinafter — “GDPR”) and other applicable data protection legislation on our platform, including our website zambulay.com and related services (hereinafter — the “Platform”).

2.2 This Policy is intended to inform you — business clients, representatives, visitors to the Platform, or other individuals interacting with us — about:

what personal data we collect;
how and why we process it;
your data protection rights under applicable law;
how we ensure the security of your data.

2.3 We recommend that you read this Policy carefully to understand our views and practices regarding your personal data and how we handle it.

2.4 We reserve the right to update or amend this Policy at any time to reflect changes in our practices, legal obligations, or the scope of services offered. Any updates will be published on this page, and if necessary, we will notify you of significant changes. We encourage you to periodically review this Policy to stay informed about how we protect your data.

2.5 By continuing to use our Platform or services, you confirm that you have read and understood this Policy, including any updates or amendments that may be made from time to time.

3. Personal Data Controller

3.1 The personal data controller responsible under applicable data protection legislation is: Zambulay Email: info@zambulay.com

4. Legal Bases for Processing Personal Data

4.1 We process personal data only when we have a lawful basis for doing so. The legal bases we rely on may include:

performance of a contract — when processing is necessary to fulfill our contractual obligations to you, for example, providing the services you request or responding to your inquiries;
compliance with legal obligations — when we must process data to comply with applicable legal or regulatory requirements;
legitimate interests — when processing is necessary for the purposes of our legitimate business interests, provided that such interests do not override your fundamental rights and freedoms. This may include improving our services, ensuring the security of our IT systems, or informing you about our offers;
consent — when you have given us explicit permission to process your data for a specific purpose. If consent is the basis, you have the right to withdraw it at any time, and the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal;
public interest — when processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

4.2 In some cases, we are required by law or for the conclusion/performance of a contract with you to collect certain personal data. If you do not provide such information upon request, we may be unable to conclude the contract or provide the services agreed with you. This may result in the suspension or cancellation of service provision. In relevant cases, we will notify you of the occurrence of such a situation.

5. Purposes of Processing Personal Data

5.1 We collect and process your personal data only for specific, explicit, and legitimate purposes. These purposes include:

providing and managing our services — including responding to your inquiries, communicating with users, and directly providing our financial services, including the issuance of virtual and physical payment cards (including cards issued in various countries), executing fast transfers, secure storage of funds in accounts, managing team accounts, providing credit lines, processing online payments, and financial assistant services;
maintaining and improving our Platform and operations — analyzing Platform usage and diagnosing technical issues to enhance the functionality and security of our system;
managing customer relationships — including managing accounts (including team accounts), providing user support, and conducting business communications;
complying with legal and regulatory obligations — for example, fulfilling tax reporting requirements, anti-fraud and anti-money laundering (AML) requirements, as well as complying with data protection laws and other applicable regulations;
sending informational or marketing messages — if you have given us consent to do so or if permitted by applicable law, we may contact you regarding relevant news, offers, or updates to our services;
protecting our rights and interests — including detecting and preventing fraud, unauthorized access, and other security risks, as well as protecting our legal rights (for example, to prevent non-payment and collect debts, where applicable).

5.2 We do not carry out automated decision-making or profiling concerning your personal data without notifying you of this and obtaining your explicit consent, if such consent is required by law.

6. Categories of Personal Data Collected

6.1 The Company may collect, use, store, and transfer various types of personal data about you, which may include, but are not limited to:

identification and contact data — such as your first name, last name (including maiden name, if applicable), date of birth, residential address, username or similar identifier, gender, phone number, email address;
identification documents and verification data — such as copies of identity documents (passport, national ID card, or driver’s license), identification numbers (e.g., TIN), information about citizenship or country of residence, and other information necessary for identity verification or compliance with regulatory requirements (e.g., KYC/AML requirements);
financial and transaction data — including information about bank accounts and details, payment card numbers issued to you (virtual or physical) and related details (e.g., BIN of the issuing country, expiration date), account balances, transaction history and operations, top-up and withdrawal amounts, as well as information about payment recipients;
credit and financial information — if you apply for credit products (e.g., a credit line), we may collect data about your financial situation, such as income level, employer details, financial liabilities, credit history, and other information necessary to assess your creditworthiness;
team account data — if you use team (multi-user) accounts, we may collect information about the organization (e.g., company name, registration data) and personal data of members of your team or other authorized persons to whom you grant access to your account (their names, contact details, and access rights);
survey data and preferences — including your preferences, feedback, and responses to surveys or questionnaires that you may complete as part of using our services;
technical data — including your IP address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technologies on the devices you use to access the Platform;
usage data and marketing data — including information about how you interact with our Platform, its content, and services; your preferences for receiving marketing communications from us and your preferences regarding communication methods.

7. Your Rights

7.1 Under applicable law, you have a number of important rights regarding your personal data. These rights are designed to give you control over how your data is collected, used, and processed. You have the right to:

request access to your personal data — you are entitled to request confirmation of processing, access to the personal data we hold about you, and receive a copy of this data;
request rectification — if you believe that any personal data we hold about you is inaccurate or incomplete, you may request its correction or updating;
request erasure (“right to be forgotten”) — you may request the deletion of your personal data if we have no compelling legitimate grounds for continuing to process it;
object to processing — you may object to the processing of your personal data if we rely on our legitimate interest as the basis for processing and there are circumstances in your particular situation that give grounds for such objection;
request restriction of processing — you have the right to request the suspension of processing your personal data under certain circumstances (for example, while verifying the accuracy of the data or the lawfulness of our processing);
request data portability — you are entitled to receive your personal data in a structured, commonly used, and machine-readable format, and to request the transfer of this data to another controller, where technically feasible;
withdraw consent — if we rely on your consent as the legal basis for processing personal data, you have the right to withdraw this consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal;
lodge a complaint — if you believe that your data protection rights have been violated, you may lodge a complaint with the competent data protection supervisory authority in your country of residence or in another jurisdiction, according to applicable law.

7.2 To exercise any of the rights listed above, please contact us using the contact information provided in this Policy.

8. Data Retention and Security

8.1 We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including complying with legal, regulatory, accounting, or reporting requirements. We may also retain data for a longer period if necessary to address a complaint or if we reasonably believe that legal claims may arise in connection with our relationship with you.

8.2 When determining the appropriate retention period for personal data, we consider the nature, scope, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, the purposes of processing, the possibility of achieving these purposes by other means, and applicable legal retention requirements.

8.3 In some cases, you may request the deletion of your personal data. If data is deleted at your request, we may retain limited copies necessary to protect our or third-party legitimate interests, fulfill legal obligations, resolve disputes, fix technical problems, or enforce any agreements. We may also anonymize your personal data so that it is no longer associated with you, and in such cases, we may use such data indefinitely without further notice.

8.4 To protect your data, the Company applies appropriate technical and organizational security measures to prevent unauthorized access, disclosure, loss, or misuse of personal data. Access to personal data is granted only to those employees, contractors, agents, or other third parties who need it to perform their official or contractual duties and who are bound by confidentiality obligations.

8.5 We maintain internal procedures and action plans for suspected personal data breaches and will notify both you and the relevant supervisory authority of any material personal data breaches if required by law and within the prescribed timeframes.

9. Disclosure and Transfer of Personal Data to Third Parties

9.1 The Company may disclose your personal data to third parties only when necessary and in accordance with applicable data protection legislation. Such third parties may include:

service providers and contractors supporting our operations (e.g., in information technology, hosting, software maintenance, and system administration), as well as our financial partners — banks, payment systems, processing companies, and card issuers that participate in card issuance and processing your payments to provide you with our services;
specialized data verification services, such as identity verification services or credit assessment companies, if required when providing you with certain services (e.g., when processing an application for a credit line or other financial product);
legal, supervisory authorities, or government agencies, if disclosure is necessary to comply with applicable law, execute a court order, or participate in legal proceedings (e.g., responding to requests from regulators, law enforcement, or tax authorities);
professional advisors — including lawyers, auditors, accountants, or insurance agents, if disclosure is necessary to establish, exercise, or defend our legal rights and interests (e.g., in the course of an audit or when handling disputes);

business partners or affiliates — if disclosure is required in the context of providing services to you or fulfilling contractual obligations (e.g., if any part of our services is provided jointly with a partner, or in the event of reorganization or any kind of merger/acquisition of our company, your data may be disclosed to a potential successor subject to confidentiality requirements).

9.2 All third parties to whom we disclose personal data are required to maintain confidentiality and ensure the security of your data. Such parties are bound by contractual obligations to process personal data only in accordance with our instructions and in compliance with applicable data protection legislation. We do not sell your personal data or provide access to it to an indefinite number of persons.

10. International Transfer of Personal Data

10.1 In some cases, your personal data may be transferred, stored, or otherwise processed in countries outside the European Economic Area (EEA). Such countries may have different data protection regimes that may not provide the same level of protection for personal data as provided for by the GDPR. For example, such data transfer may occur when we cooperate with banking or payment partners located outside the EEA to issue cards or process transactions as part of providing our services to you.

10.2 When transferring your personal data outside the EEA, we take necessary measures to ensure an equivalent degree of protection for such data by implementing one or more of the following safeguards:

transfer to countries that have been recognized by the European Commission as providing an adequate level of protection for personal data;
application of standard contractual clauses (model contractual provisions) approved by the European Commission, which ensure that personal data receives the same level of protection as in Europe;
where necessary — ensuring that the data recipient is certified under an approved data protection framework (e.g., compliance with data protection framework agreements between the EU and other countries, if applicable).

10.3 You may contact us for further information about the mechanisms we use when transferring your personal data outside the EEA.

11. Cookies

11.1 Our website uses cookies and similar technologies to improve user experience, analyze traffic, and maintain the functionality of the service. Cookies are small text files that are placed on your device when you visit a website.

11.2 We use the following types of cookies:

essential (necessary) cookies — these are necessary for the basic operation of our website and cannot be disabled in our systems. They are generally set only in response to actions taken by you, such as logging into your account, filling out forms, or setting privacy preferences. Without these cookies, some parts of the site will not function properly;
analytical/performance cookies — these cookies help us understand how visitors interact with the Platform by collecting anonymous information (e.g., about the number of visitors, pages visited, traffic sources). This allows us to evaluate and improve the Platform’s performance and offer a more user-friendly service;
functional cookies — these cookies allow our website to remember choices you have made (e.g., language or region selection) and provide enhanced, more personalized features. They may be used to provide functions you have requested, such as playing videos or using social media.

11.3 By continuing to use our website, you consent to the use of cookies in accordance with this Policy, unless you have disabled them through your browser settings. Please note that disabling certain cookies may affect the usability and functionality of the site.

11.4 You can manage or delete cookies at any time through your browser settings. For more information on how to manage or delete cookies, please refer to your browser’s help section or visit www.allaboutcookies.org.

12. Obligations

12.1 Zambulay is not responsible for unauthorized, illegal, or prohibited use of issued cards. The User is obliged to comply with these Terms, the requirements of applicable law, payment systems, banks, and other financial partners.

12.2 Zambulay has the right to monitor transactions carried out using the cards and to take necessary measures if suspicious, fraudulent, or illegal activity is detected.

12.3 If, as a result of the User’s actions, an overdraft, debt, fine, penalty, or other financial claim arises from the bank, payment system, or financial partner, the User is obliged to reimburse the corresponding amount in full. Zambulay has the right to deduct such amount from the User’s balance, restrict servicing, or take other measures to recover the debt and damages caused.

13. General Rules for Working with Cards

13.1 It is prohibited to use cards and the Zambulay service for payment or conduct of activities related to:

gambling, bookmaking services, and lotteries;
brokerage services and trading in derivative financial instruments;
illegal circulation of cryptocurrencies and digital assets;
providing loans, debt collection activities, and network marketing;
goods, services, and content of a pornographic nature;
illegal circulation of alcohol, tobacco, narcotic and psychotropic substances;
weapons, ammunition, military equipment, and explosives;
radioactive, toxic, and other hazardous materials;
special means for covert information gathering;
illegal trade in personal data and databases;
fraud, mass account registration, multi-accounting, and intentional card blocking to avoid payment;
mass activation of trial subscriptions without subsequent payment;
other goods, services, and types of activities prohibited by law or the rules of financial partners. Certain BINs may have restrictions on merchant categories, countries, and types of operations. Information on the availability of payment with a specific merchant should be clarified through Zambulay support.

13.2 The permissible level of Decline Rate and Refund Rate is no more than 15%.

13.3 Exceeding the established level may result in a warning, restriction of card issuance, temporary suspension of operations, forced closure of cards, or complete termination of access to the service.

13.4 Before blocking, freezing, or closing a card, the user must delete it from all personal accounts and merchant services. Repeated attempts to charge a blocked or frozen card may increase the Decline Rate.

13.5 A high level of declined or refunded payments may be considered a sign of suspicious or illegal activity.

13.6 If violations are detected, Zambulay has the right to temporarily restrict access to the service, operations, and financial assets of the user until explanations and documents confirming the legality of the activity are provided.

13.7 The user may contact support for verification and restoration of access.

13.8 These measures are applied to ensure the operational stability and financial security of Zambulay, its users, and financial partners.

13.9 Cards are not intended for mass initial bindings, test authorizations, validity checks, or other operations whose purpose is solely to use trial services (trial periods) and/or confirm a payment method without its further full use.

13.10 Systematic performance of such operations may be regarded as unusual or high-risk activity and may lead to restrictions on card issuance, suspension of certain personal account functions, or additional verification by the service and partner bank.

13.11 The card balance may become negative as a result of fees for declined operations, currency conversion, bank adjustments, additional charges, delayed debiting by the merchant, or other operations processed after the actual payment was made.

13.12 The user is obliged to timely repay the resulting debt. Until the negative balance is fully repaid, the service has the right to restrict the issuance of new cards, the execution of certain operations, and access to some personal account functions.

13.13 Card issuance does not guarantee the successful completion of every transaction. The final decision on a payment is made by the partner bank, payment system, acquiring bank, and merchant, taking into account their internal rules, restrictions, and risk management systems.

13.14 Cards must be used exclusively for lawful purposes and in accordance with the intended use of the selected BIN. Transferring the card, its details, or access to it to third parties may result in service restrictions, card blocking, or termination of access to certain service functions.

13.15 If unusual, suspicious, or high-risk activity is detected, the service or partner bank has the right to request additional information and supporting documents, temporarily restrict transactions, suspend the issuance of new cards, or close individual cards.

13.16 Fees, limits, available BINs, and card usage rules may change.

13.17 Violation of the established terms may result in restrictions on the issuance of new cards, closure of existing cards, suspension of certain operations, or the application of other measures by the service or partner bank.

13.18 If you no longer plan to pay for a service to which the card was linked, you must delete it from the personal account of the relevant merchant.

13.19 Closing or blocking a card does not delete its details from the third-party service. The merchant may continue to send charge requests. Such transactions will be declined, and a fee may be charged for each charge attempt in accordance with the current terms of service.

13.20 In the event of a refund from the merchant, the User acknowledges and agrees that Zambulay is not the card issuer and does not independently pay or compensate refunded amounts from its own funds. The refund is processed by the Partner Bank and the Payment System in accordance with their internal regulations and technological timeframes. The Platform is not responsible for delays in the crediting of refunded payments and does not provide early compensation of such funds to the User.

14. Changes

14.1 Zambulay has the right to amend these Terms at any time. Changes come into force after publication on the website or in the personal account. Continued use of the service constitutes the user’s acceptance of the updated version.

15. Working with Loans

15.1 Credit funds are provided to arbitration teams that have been operating in the market for at least 6 months and have a monthly turnover of at least 10,000 USD.

15.2 The available loan amount ranges from 5,000 to 300,000 USD, with a term of up to 120 days. The interest rate starts at 5% and is determined individually based on the amount, term, turnover, and results of the client’s verification.

15.3 Credit funds may be transferred to the user’s account for payment of advertising and other agreed business expenses.

15.4 The user is obliged to timely repay the loan amount, accrued interest, fees, and other stipulated payments. In the event of default, Zambulay has the right to restrict access to the service, suspend operations, and take measures to recover the debt.

15.5 Preliminary calculations on the website are for informational purposes only and do not constitute a guarantee of loan approval. Final terms are determined after consideration of the application.

16. Working with Deposits

16.1 Deposits are available to teams whose expenses amount to at least 10,000 USD per month for at least three consecutive months.

16.2 The deposit amount ranges from 5,000 to 300,000 USD. Available placement terms are 3, 6, 12, or 18 months. The maximum interest rate is up to 19% per annum in USDT and depends on the deposit amount and term.

16.3 Interest is accrued monthly. Product terms may provide for full or partial withdrawal of funds through the personal account.

16.4 In case of early or partial withdrawal of funds, the amount of accrued interest may be recalculated in accordance with the terms of the specific deposit.

16.5 The yield calculation on the website is preliminary and does not constitute a public offer. The final rate, interest calculation procedure, and withdrawal terms are specified when the deposit is opened.

Date of amendment: 01.07.2026