Effective date: 2 September 2026
Last updated: 2 September 2026

This Privacy Policy explains how zenGate Global Limited, trading as Palmyra and Palmyra Ecosystem ("Palmyra", "we", "us" or "our"), collects, uses, discloses and protects personal data when you visit https://www.palmyraecosystem.com/ and its related webpages (the "Site"), contact us through the Site, or subscribe to the Palmyra newsletter.

This Policy applies to the public-facing Palmyra Ecosystem website. It does not govern personal data processed through a Palmyra customer account, the Palmyra trading platform, a partner deployment, a mobile application, payment or KYC/KYB services, or in an employment context. Those activities may be covered by a separate privacy notice, customer agreement or data processing agreement.

1. Who is responsible for your personal data?

The controller of personal data covered by this Policy is:

zenGate Global Limited
Company number: 716658
Registered office: Ground Floor, 71 Lower Baggot Street, Dublin, D02 P593, Ireland
Email: business@zengate.global

For privacy questions or to exercise your rights, use the subject line "Privacy Request". If Palmyra appoints a Data Protection Officer or creates a dedicated privacy mailbox, the relevant contact details will be added here.

2. Personal data we collect

We may collect the following categories of personal data.

Information you provide

• Contact and professional information, including your name, company name, business email address, telephone number, industry and role.

• Enquiry information, including your preferred project timeline, supply-chain, traceability, compliance or market-access requirements, and anything you include in the project-details field or subsequent communications.

• Newsletter information, including your first name, last name, email address, subscription status, consent record, and interactions with newsletter messages, such as delivery, opens and link clicks, where enabled.

• Communications, including emails, meeting details, feedback and records of our correspondence with you.

• Rights-request information, including the information needed to identify you and respond to a privacy request.

Please do not include special-category or otherwise sensitive personal data in a free-text field unless we specifically ask for it and explain why it is needed.

Information collected automatically

When you use the Site, we and our service providers may collect:

• IP address and approximate location derived from it;

• device, browser, operating-system and language information;

• referring page or advertising source;

• pages viewed, links selected, dates, times and session activity;

• cookie, consent, advertising and similar identifiers;

• form-submission and advertising-conversion events; and

• diagnostic, security and error information.

Some of this information is collected through cookies, tags, pixels, local storage and similar technologies. See section 7.

3. How we obtain personal data

We collect personal data:

• directly from you, including through contact and newsletter forms;

• automatically from your browser or device when you use the Site;

• from our website, CRM, analytics, advertising and communications providers;

• from the organisation you represent, where it provides your business contact details; and

• from referral partners or public professional sources where relevant to a genuine business enquiry and permitted by law.

If you give us personal data about another person, you must be authorised to do so and should direct that person to this Policy.

4. Why we use personal data and our legal bases

Where the GDPR or similar law applies, we rely on the following legal bases:

Purpose Personal data used Legal basis Operate, deliver and maintain the Site; remember privacy choices; diagnose errors Device, connection, session, consent and diagnostic data Our legitimate interests in providing a functional and reliable Site; and, where applicable, technologies strictly necessary to provide a service requested by you Protect the Site, users and our systems; prevent abuse, fraud and security incidents Device, connection, session, form and security data Our legitimate interests in securing our services and organisation; compliance with legal obligations where applicable Respond to an enquiry, assess requirements, arrange a meeting, prepare a proposal and manage a prospective relationship Contact, professional, enquiry and communications data Steps requested by you before entering a contract; performance of a contract; and our legitimate interests in responding to business enquiries and developing business relationships Send the Palmyra newsletter and measure engagement with it Name, email, consent, subscription and engagement data Your consent, which you may withdraw at any time; or the limited existing-customer exception where applicable and legally permitted Measure Site use and advertising performance, attribute enquiries and improve campaigns Device, cookie, browsing, referral and conversion data Your consent where required by law; otherwise our legitimate interests, subject to your rights and choices Maintain records, enforce terms, establish or defend legal claims, and complete corporate transactions Relevant contact, communications, transaction and technical data Compliance with legal obligations and our legitimate interests in administering and protecting our business and legal rights

Where we rely on legitimate interests, we consider whether our interests are proportionate and whether your rights and interests override them. You may ask us for more information about this assessment.

We will seek fresh consent or identify another lawful basis before using personal data for a materially different and incompatible purpose.

5. When information is required

Fields marked as required on a form must be completed so that we can process the relevant request. If you do not provide required information, we may be unable to respond to your enquiry or register your newsletter subscription. Other information is optional unless we explain otherwise.

6. Marketing communications

We send the Palmyra newsletter to individuals who have asked to receive it or where another lawful exception applies. You can unsubscribe at any time by selecting the unsubscribe link in a marketing email or contacting us. Withdrawing consent does not affect processing carried out before withdrawal.

We may keep a minimal suppression record after an unsubscribe request so that we do not contact you again for the same marketing purpose. Service or transactional communications that are necessary for an existing relationship are not marketing and may continue where appropriate.

7. Cookies and similar technologies

The Site uses cookies and similar technologies. These may include:

• Strictly necessary technologies, used for Site delivery, security, form operation and recording privacy choices.

• Analytics technologies, used to understand Site visits and performance.

• Functional technologies, used to provide enhanced features and remember preferences.

• Advertising and conversion technologies, used to understand whether an advertisement led to a visit or enquiry and to measure campaign effectiveness.

The Site currently uses or integrates with:

• Framer, for website publishing, hosting, content delivery and privacy-friendly aggregate Site analytics;

• HubSpot, for CRM-related forms, newsletter registration, email delivery, consent management and analytics;

• Google Tag Manager and Google Ads, for tag management, advertising attribution and conversion measurement;

• Google-hosted fonts and related content-delivery services; and

• social-media services, when you follow a link to Palmyra's pages on services such as LinkedIn, Facebook, Instagram, X, YouTube or TikTok.

The relevant provider may receive technical information such as your IP address, device and browser details, identifiers, the page visited and interaction or conversion information. Depending on the service and context, a provider may act as our processor or as a separate controller under its own privacy terms.

Except for strictly necessary technologies, we will request consent before storing or accessing information on your device where the law requires it. You can accept, reject or adjust non-essential technologies through the Cookie Settings control on the Site. You can withdraw consent at any time through the same control. Withdrawal does not affect prior lawful processing.

Your browser may also allow you to block or delete cookies. Doing so may affect Site features. Where applicable law requires it, we will treat a recognised opt-out preference signal, such as Global Privacy Control, as a request to opt out of relevant sale, sharing or targeted advertising.

The Site should maintain an up-to-date cookie list in its Cookie Settings tool or a separate Cookie Notice showing each cookie or technology's provider, purpose, category and duration. That list forms part of this Policy.

8. How we disclose personal data

We may disclose personal data to:

• website hosting, content-delivery and development providers, including Framer;

• CRM, form, email-marketing and consent-management providers, including HubSpot;

• analytics and advertising providers, including Google;

• cloud hosting, security, IT, communications and collaboration providers;

• professional advisers, auditors and insurers;

• regulators, courts, law-enforcement bodies and other authorities where disclosure is required or permitted by law;

• prospective buyers, investors, lenders or advisers in connection with a merger, financing, reorganisation or sale, subject to appropriate confidentiality safeguards; and

• other parties at your direction or with your consent.

We require service providers processing personal data on our behalf to use it only under our instructions, protect it appropriately and comply with applicable data-protection law.

We do not sell personal data for money. The use of advertising or conversion technologies may, however, be treated as "sharing", "targeted advertising" or a "sale" under certain US state laws. Where those laws apply, you may opt out through Cookie Settings or by contacting us.

9. International transfers

Palmyra is based in Ireland, but some providers, group personnel or business recipients may process personal data outside Ireland or the European Economic Area. Data-protection laws in those locations may differ from those in your country.

Where required, we use a lawful transfer mechanism, such as an adequacy decision, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another legally recognised safeguard. We also assess supplementary safeguards where appropriate. You may contact us for more information or a copy of the relevant safeguards, subject to necessary redactions.

10. How long we keep personal data

We keep personal data only for as long as needed for the purposes described above, including legal, accounting, security and reporting requirements. Unless a longer period is needed in a particular case, our intended periods are:

• Business enquiries and prospect records: up to 24 months after the last substantive interaction. If a commercial relationship begins, the relevant customer or contract retention period applies.

• Newsletter subscriber records: until you unsubscribe or after 24 months of inactivity, subject to periodic review.

• Marketing suppression and consent records: only the data needed to respect an opt-out or demonstrate compliance, normally for up to six years after the relevant event.

• Routine technical and security logs: normally up to 12 months, unless needed longer to investigate an incident.

• Cookie and advertising identifiers: for the period shown in the Site's Cookie Settings tool and the applicable provider configuration.

• Privacy-request and dispute records: for the period reasonably needed to demonstrate compliance and establish or defend legal claims, normally up to six years after closure.

We may retain information longer where required by law, necessary for litigation or an investigation, or agreed in a customer contract. We may retain anonymised information that can no longer identify an individual.

11. Your data-protection rights

Depending on where you live and the law that applies, you may have the right to:

• obtain information about how we use your personal data;

• request access to and a copy of your personal data;

• correct inaccurate or incomplete personal data;

• request deletion of personal data;

• restrict processing;

• receive certain personal data in a portable format and transmit it to another organisation;

• object to processing based on legitimate interests and object at any time to direct marketing;

• withdraw consent at any time;

• request review of a decision based solely on automated processing where it produces legal or similarly significant effects; and

• lodge a complaint with a data-protection authority.

These rights are not absolute and exemptions may apply. We may need to verify your identity before fulfilling a request. We will not discriminate against you for exercising a privacy right.

To exercise a right, email business@zengate.global with the subject line "Privacy Request". You may also authorise another person to submit a request where permitted by law; we may ask for proof of authority and identity.

Because Palmyra is established in Ireland, you may lodge a complaint with the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland, at https://www.dataprotection.ie/. If you live elsewhere, you may also be entitled to contact your local supervisory authority. We encourage you to contact us first so that we can try to resolve the issue.

12. Automated decision-making

We do not use personal data collected through this public Site to make decisions based solely on automated processing that produce legal or similarly significant effects concerning you.

13. Children

The Site is intended for business and institutional audiences and is not directed to children. We do not knowingly collect personal data from children through the Site. If you believe a child has provided personal data to us, contact us so that we can investigate and delete it where appropriate.

14. Security

We use reasonable technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures may include access controls, encryption in transit, service-provider reviews, backups and monitoring. No website or transmission method can be guaranteed to be completely secure.

15. Third-party websites and services

The Site contains links to third-party websites and services. When you follow a link, the third party may collect personal data under its own privacy notice. We do not control and are not responsible for third-party privacy practices. Review the relevant third party's privacy information before providing personal data.

16. Changes to this Policy

We may update this Policy to reflect changes to our practices, services or legal obligations. We will post the updated version on this page and change the "Last updated" date. If a change materially affects how we use personal data, we will provide additional notice where required by law and seek consent where required.

17. Contact us

For questions, concerns or requests concerning this Policy or our use of personal data, contact:

zenGate Global Limited / Palmyra
Ground Floor, 71 Lower Baggot Street
Dublin, D02 P593
Ireland
business@zengate.global
Subject: Privacy Request

Recommended point-of-collection notices

These short notices should appear next to the relevant submit button and link to the published Privacy Policy.

Contact form

We use the information you provide to respond to your enquiry and discuss your traceability, compliance or market-access requirements. Required fields are needed to process your request. Please do not include sensitive personal data. Learn more in our Privacy Policy.

If Palmyra wants to add contact-form users to marketing, add a separate, optional and unticked checkbox:

[ ] I would also like to receive Palmyra news and marketing by email. I can unsubscribe at any time.

Do not make marketing consent a condition of submitting a business enquiry.

Newsletter form

Change the button label from "Submit" to "Subscribe" and add:

By selecting Subscribe, you ask Palmyra to email you news and insights about traceability, compliance and global supply chains. You can unsubscribe at any time. Learn more in our Privacy Policy.

Cookie banner

The first layer should offer equally clear Accept all, Reject non-essential, and Settings options. Suggested text:

We use necessary technologies to operate this Site. With your permission, we also use HubSpot and Google technologies to measure visits, forms and advertising performance. Select Accept all, Reject non-essential, or Settings. See our Privacy Policy and Cookie Notice.

Pre-publication checks

1. Confirm the legal entity, company number, registered address and monitored privacy email.

2. Confirm that the stated retention periods match actual CRM, email, server and deletion practices.

3. Inventory every live cookie and tag, including those deployed through Google Tag Manager, and publish provider, purpose, category and duration details.

4. Block HubSpot analytics/collected-forms tracking and Google advertising/conversion tags until valid consent is obtained where required. Necessary form processing may be configured separately from analytics and marketing tracking.

5. Ensure withdrawal is as easy as consent and keep a persistent Cookie Settings link in the Site footer.

6. Configure Google Consent Mode and HubSpot consent settings to reflect actual visitor choices; do not treat default-denied signals as consent.

7. Verify that the Google Ads conversion event fires only after a genuine successful lead submission, not on every page view.

8. Add a Privacy Policy link to the global footer, contact form and HubSpot newsletter form.

9. Put data-processing agreements and lawful international-transfer safeguards in place with Framer, HubSpot, Google and any other relevant providers.

10. If the Site is subject to a US state privacy law, assess whether a Do Not Sell or Share My Personal Information link and Global Privacy Control handling are required.

11. Create separate privacy documentation for Palmyra Pro, customer accounts, supply-chain participant data, KYC/KYB, payments or blockchain records; this website notice does not adequately cover those higher-risk activities.

12. Have Irish/EU privacy counsel review the final text and implementation before publication.