Chanzuckerberg.com Website Privacy Policy

 

1. Acceptance of this Privacy Policy

This Privacy Policy applies to visitors to www.chanzuckerberg.com (the “Website”), the “Other Services” (as defined below), and any other products and projects of CZI that state that this Privacy Policy applies to our collection of personal information (the “Services”). This Privacy Policy does not apply to data collection as a job applicant or an employee of CZI, or to products, programs, or activities of CZI that do not incorporate this Privacy Policy by reference or that expressly refer to a separate privacy policy (for example, virtualcellmodels.cziscience.com).

By accessing and using the Services, you are accepting the terms of this Privacy Policy, which may be updated and amended from time to time. By accepting this Privacy Policy, you agree that CZI is the “controller” of personal information which is provided to, collected by, or processed in connection with the Services. If you do not agree to be bound by the terms of this Privacy Policy, do not access or use this Website, the Services, or the Other Services.

 

2. Personal Information We Collect About You

Website Visitors
When you visit the Website, we collect the following information (collectively, “Website Visitor Information”):

• 2.1. From You
  We collect certain personal information from you when you provide it to us directly. Specifically:
  • Mailing list sign-up. When you sign up to receive our newsletter, you choose to provide us with certain personal identifiers, such as your real name, first and last, and your email address. CZI collects this information so that we can send you updates via email. We may combine this information with your internet or other electronic network activity on the Website.
  • User Support. If you email any @chanzuckerberg.com email address, including those published on our Website, with a support request or comments, you may provide us with personal identifiers such as your real name, email address, contact information, and/or a description of the issue so that we can properly respond to the request or comment.
  • Surveys and Feedback. If you decide to respond to a survey or send us feedback, we may collect personal identifiers and information about your interests or preferences.

• 2.2. From Your browser or Device
  When you use online services, certain information routinely gets created and logged automatically; the same is true when you visit our Website. When you access our Website, we collect:
  • Log data. When you visit our Website (whether on your computer or on a mobile device), we gather certain internet or other electronic network activity information automatically and store it in log files. This information includes your IP addresses, your Internet Service Provider, referring/exit pages, date/time stamps, clickstream data, login/logout times, and duration of time spent on our Website.
  • Device data. In addition to log data, we collect information about the device you’re using to access the Website; this includes the type of device, browser type, operating system, settings, unique device identifiers, and crash data.
  • Cookie Information. We also use cookies (small text files sent by your computer or device each time you visit our Website that are unique to your device or your browser) and similar technologies. These cookies share internet or other electronic network activity information and general geolocation data with certain third parties. For example, we use analytics services (e.g., Google Analytics) that place cookies that collect information that allows us to understand how often you use the Website, where you are accessing the Website from, and events that happen on the Website. We use certain cookies to inform our own marketing and digital content efforts, which help us tell people about the work we do. For example, if a LinkedIn or Facebook user visits the CZI website, LinkedIn and Facebook can then identify them as part of a group of CZI Website visitors in order to serve them with marketing and digital content messages about CZI and our work. See this FAQ for more information about the cookies we use, what companies receive information from these cookies, why we use them, and the choices you have to control them.

• 2.3. Job Applicants
  When you apply for a job with CZI, we collect information as part of our recruiting and hiring process. For more information about the data we collect, how we use and share that data, and your legal rights concerning information collected during the hiring process please see our Privacy Policy for Job Applicants.

• 2.4. Sensitive Personal Information
  Except as described in our Privacy Policy for Job Applicants (linked above), our workforce privacy policy (if you are employed by CZI), or policies of certain products, programs, or activities of CZI that state otherwise, we do not collect sensitive personal information about you, and thus we do not use or disclose your sensitive personal information.

• 2.5. Other Services
  We use certain third-party online services to provide information about CZI’s work (like Facebook and LinkedIn) (those services we refer to as, “Other Services”). When you follow, like, comment, or otherwise engage with us through these Other Services, we see the personal information that the Other Service generally makes available about its users (that information, “Other Service Information”). For example, when you comment on our post on an Other Service, that Other Service will commonly attribute your comment to you in a way that others can see (including us). You can check the privacy policy of any Other Service for more information on how it collects, uses, and shares data, including the Other Service Information that may be provided to us. We will not attempt to re-identify you from aggregated or de-identified information provided by Other Services.

 

3. Use of Your Personal Information

CZI collects and uses your personal information for the following business purposes:

• Product and service delivery. To provide and deliver our Services, including troubleshooting, improving, and personalizing those Services.
• Organizational operations. To operate our organization, such as accounting, improving our internal operations, securing our systems, detecting fraudulent or illegal activity, and meeting our legal obligations.
• Product improvement, development, and research. To develop, analyze, and improve our Services, including through research and evaluation of system performance and usage patterns.  
• Personalization. To understand you and your preferences to enhance your experience and enjoyment using our Services.
• Communications. To send you information, including confirmations, technical notices, updates, security alerts, and support and administrative messages.
• Providing the information you’ve requested. To inform you — via the email address you provide us — of other initiatives, news, requests for applications, and job opportunities related to Biohub. We may also collect your phone number to send you text messages, but only with your consent, and we will not share this information with third parties for their own marketing or promotional purposes.
• Marketing/Advertising. To communicate with you about new services, offers, promotions, upcoming events, and other information about our Services. We may also display targeted advertising about our services to you on third-party platforms (e.g., social media platforms).

Our Website does not include advertisements for third-party goods and services. However, we may use advertising, on our Website or on other third party websites, to promote the products, programs, and services that we provide and/or support. Subject to your settings, we may use your email address or cookies to direct ads for our own programs to you on third-party sites. We have used third-party cookies to inform our marketing and digital content efforts and to serve CZI Website visitors with marketing and digital content messages about CZI and our work in the past 12 months.Please review this FAQ and Section 6 below to learn more about how we use third party cookies and to exercise your control and choice over their use, including advertising.

4. Retention and Deletion

We will keep your personal information only for as long as we believe that we need it for the purpose we have collected it (as described above) or to meet legal obligations, resolve disputes, maintain security, prevent fraud and abuse, enforce our agreements with you, or fulfill your request to unsubscribe from further messages from us. When your information is no longer needed, we will destroy, de-identify, or aggregate it.

 

5. Disclosing Your Personal Information

We disclose personal information with your consent or as we determine necessary to complete your transactions or provide the services you have requested or authorized. In addition, we disclose each of the categories of personal information described above, to the types of third parties described below, for the purposes described in this Privacy Policy:

• Service Providers and Vendors. Biohub works with vendors, service providers, and other partners that help us provide the Services on our behalf. These services include, for example, sending emails, performing statistical analysis, database management services, database hosting, providing customer support software, survey providers, and security. In the course of providing these services, our service providers may have access to your personal information.

• Biohub Entities and Affiliates. We enable access to personal information across our affiliates and related entities, for example, where we share common data systems or where access helps us to operate our organization and provide our Services. Our affiliates include entities that are under common control and ownership, but do not include Meta Platforms, Inc. (Meta) or any Meta affiliates.

• Reorganization, Sale, or Merger. We may share your personal information in connection with a merger, reorganization, acquisition, joint venture, divestiture, dissolution, liquidation, or sale of all or a portion of our organization or assets related to Biohub. 

• Legal and law enforcement. We will access, disclose, and preserve personal information when we believe doing so is necessary to comply with applicable law or respond to valid legal process, including from law enforcement, national security, or other government agencies.

• Security, safety, and protecting rights. We will disclose personal information if we believe it is necessary to: protect our users and others, for example to prevent spam or attempts to commit fraud, or to help prevent the loss of life or serious injury of anyone; operate and maintain the security of our Services, including to prevent or stop an attack on our computer systems or networks; or protect the rights or property of ourselves or others, including enforcing our agreements, terms, and policies.

Third party analytics and targeted advertising providers also collect personal information through our Services including identifiers and device information (such as cookie IDs, device IDs, and IP address), geolocation data, usage data, and inferences based on and associated with that data, as described in this Cookie Policy. These third-party vendors may combine this data across multiple websites to improve analytics for their own purpose and others.  

Some of the data disclosures to these third parties may be considered a “sale” or “sharing” of personal information as defined under the laws of California and other U.S. states.  These third parties use the data we provide for analytics or to help us advertise our own Services — not for their own direct marketing or advertising purposes. Please see the “Choices and Rights Over Your Personal Information” and “California Privacy Rights” sections below for more details.

Please note that CZI will not share mobile phone numbers with third parties or affiliates for marketing or promotional purposes. Likewise, we do not share text messaging originator opt-in data and consent with any third parties except with service providers that support the delivery of SMS communications on our behalf and as otherwise required by law.

Some of our Services may also include integrations, references, or links to services provided by third parties whose privacy practices differ from ours. If you provide personal information to any of those third parties, or allow us to share personal information with them, that data is governed by their privacy policies.

Finally, we may disclose de-identified information in accordance with applicable law.

 

6. Choices and Rights over your Personal Information

• • 6.1. Rights

You have the following rights with respect to the personal information we have about you:

• • • Delete data. You can ask us to erase or delete all or some of your personal information subject to our legal obligations and lawful exceptions.
    • Change or correct personal information. You can also ask us to change, update or fix inaccurate data in certain cases, subject to our legal obligations and lawful exceptions.
    • Object to, limit, or restrict use of personal information. You can ask us to stop using all or some of your personal information (e.g., if we have no legal right to keep using it) or to limit our use of it (e.g., if your personal information is inaccurate or unlawfully held). For example, you can opt out of receiving text messages at any time. And you can opt-out of targeted advertising as described below.
    • Right to access and/or take your personal information. You can ask us for a copy of your personal information in machine readable form.
    • The right not to be discriminated against. CZI will not discriminate against you in any manner for exercising any of the above rights with respect to your personal information.
    • Right to notice. You have a right to receive notice of our personal information collection, use, retention, and disclosure practices at or before collection of personal information.

If you would like to exercise your right to any of the above, email us at privacy@chanzuckerberg.com. In the email, please provide us with your name, the country (and state if within the United States) in which you live, which of the above rights you would like to exercise, and sufficient information that allows us to reasonably verify that you are the person about whom we collected personal information. Before processing your request to access, change, or delete personal information, we will take reasonable steps to verify your identity, which may include verifying that the email address from which you submit the request matches the email address we maintain on file for you. In some cases, we may ask that you provide additional information or take additional actions to verify your identity.If you would like an authorized agent to make a request for you, have that agent email privacy@chanzuckerberg.com with the above information along with additional information sufficient for us to verify that the authorized agent is acting on your behalf.

Please also let us know if you have questions or concerns related to exercising any rights you have under applicable law to control your personal information.

If you would like to appeal a CZI decision with respect to a request to exercise any of these rights, please email us at privacy@chanzuckerberg.com and explain the basis for your appeal.

If you wish to raise a concern about our use of your information (and without prejudice to any other rights you may have), you have the right to do so with your local supervisory authority.

• 6.2. Additional ControlsYou have choices available to you through the device you use to access the Website. For example, your browser may let you control cookies and other types of local data storage. Where we receive information about you from Other Services (as described in Section 2.5 above), those Other Services – like social media sites – may offer their own controls around the data you choose to share with us.

  Targeted Advertising. To opt-out from or otherwise control the use of data collected on our Services to display targeted advertising on third-party platforms, you have several options. First, you can opt-out of this practice by clicking the Do Not Sell or Share My Personal Information link or the link provided in the footer of our Services and turn off the toggle switch for Marketing and Social Media Cookies. Or you can use the Global Privacy Control (“GPC”) setting in a web browser or browser extension as described below. You can use the opt-out controls offered by the organizations our advertising partners may participate in, which you can access at:

  • United States: Digital Advertising Alliance (https://optout.aboutads.info/)
  • Canada: Digital Advertising Alliance of Canada: (https://youradchoices.ca/)
  • Europe: European Digital Advertising Alliance (https://www.youronlinechoices.com/)

  Or, you can use the other cookie or mobile ID controls described below.

  These choices are specific to the device or browser you are using. If you access our Services from other devices or browsers, take these actions from those devices or browsers to ensure your choices apply to the data collected when you use them.

  Data sales. Some privacy laws define “sale” broadly to include some of the disclosures described in the “Disclosing Your Personal Information” section above, in particular those related to targeted advertising. To opt-out from such data “sales”, you may use the targeted advertising controls described above.

  Browser or platform controls.

  • Cookie controls. Most web browsers are set to accept cookies by default. If you prefer, you can go to your browser settings to learn how to delete or reject cookies. If you choose to delete or reject cookies, this could affect certain features of our Services. If you choose to delete cookies, settings and preferences controlled by those cookies, including advertising preferences, may be deleted and may need to be recreated.
  • Global Privacy Control. Some browsers and browser extensions support the GPC or similar controls that can send a signal to a website you visit indicating your choice to opt-out from certain types of data processing, including data sales and/or targeted advertising, as specified by applicable law. When we detect such a signal, we will make reasonable efforts to respect your choices indicated by a GPC setting or similar control that is recognized by regulation or otherwise widely acknowledged as a valid opt-out preference signal. Please be aware that we may not always be able to link an opt-out preference signal to other user data, such as your email address.
  • Do Not Track. Some browsers include a “Do Not Track” (DNT) setting that can send a signal to the websites you visit indicating you do not wish to be tracked. Unlike the GPC described above, there is not a common understanding of how to interpret the DNT signal; therefore, our Sites do not respond to browser DNT signals. Instead, you can use the range of other tools to control data collection and use, including the GPC, cookie controls, and advertising controls described above.
  • Mobile advertising ID controls. iOS and Android operating systems provide options to limit tracking and/or reset the advertising IDs.

  Email web beacons. Most email clients have settings that allow you to prevent the automatic downloading of images, including web beacons, and the automatic connection to the web servers that host those images.

  Communication Preferences. The personal information you voluntarily provide for our mailing lists allows us to keep you posted on our latest announcements, requests for applications, job opportunities, and upcoming events. If you no longer want to be on our mailing lists, you can opt-out anytime by updating your preferences. You may update your preferences or request to unsubscribe from our mailing lists by using the “Manage Preferences” link at the bottom of any email sent to a CZI mailing list. You may also send an email to privacy@chanzuckerberg.com requesting to unsubscribe.

 

 

7. Data Transfer

CZI is based in the United States; when you engage with the Website, you are sending personal information into the United States which may have different data protection rules than those of your country. We process data both inside and outside of the United States. For those located in the European Economic Area (EEA) or the United Kingdom (UK), if we transfer your personal data outside of the EEA or UK to a place that does not have a similar degree of protection for personal data (as described under GDPR), we will use other measures to protect your data such as Standard Contractual Clauses (SCCs).

 

8. Our Legal Bases

We will collect, use and disclose your personal information only where we have a legal right to do so. This Section explains our legal bases for processing personal information, including under GDPR.

• 8.1. Consent.
  We rely on consent to engage in certain data collection activities, such as when you sign up for our newsletter.
• 8.2. Legitimate Interests.
  We rely on legitimate interests to process the data we collect when you browse our Website. We process this data based on our legitimate interest in understanding how our Website is being used and what you find valuable, and your legitimate interest in accessing our Website.Where we rely on consent, you have the right to revoke your consent and where we rely on legitimate interests, you have the right to object by emailing us at privacy@chanzuckerberg.com. If you have any questions about the lawful bases on which we collect and use your personal information, please contact our Data Protection Officer via email at GDPR-REP@chanzuckerberg.com.

 

9. Additional Information for California Residents

The California Consumer Privacy Act (“CCPA”) requires certain businesses to give California residents a number of rights regarding their personal information. We are offering these rights to you, including the right to have your personal information deleted (subject to certain exceptions), the right to change or correct your personal information, the right to limit the use or disclosure of your sensitive personal information (if applicable), the right to access your personal information, the right to opt-out of the “selling” or “sharing” of personal information (if applicable), and the right not to be discriminated against for exercising these rights.

These rights, and how to exercise them, are described in more detail in Section 6 of this Privacy Policy and below.

Notice at Collection. At or before the time of collection, you have a right to receive notice of our practices, including the categories of personal information and sensitive personal information to be collected, the purposes for which such information is collected or used, whether such information is sold or shared, and how long such information is retained. You can find those details in this Privacy Policy.

Right to Know. You can request that we disclose to you the personal information we have collected about you. You also have a right to request additional information about our collection, use, disclosure, or sale of such personal information. Note that we have provided much of this information in this Privacy Policy. You may make such a “request to know” using the email address in the “Contact Information” section at the end of this Privacy Policy.

Rights to Request Correction or Deletion. You also can request that we correct inaccurate personal information and that we delete personal information under certain circumstances, subject to a number of exceptions. To make a request to correct or delete, please use the contact details provided in the Contact Information section at the end of this Privacy Policy.

Right to Opt-Out / “Do Not Sell or Share My Personal Information”. You can opt-out from future “sales” or “sharing” of personal information as those terms are defined by the CCPA.

Note that the CCPA defines “sell,” “share” and “personal information” very broadly, and some of our data disclosures described in this Privacy Policy may be considered a “sale” or “sharing” under those definitions, in particular those related to targeted advertising. In the past 12 months, we have sold or “shared” the following categories of personal information: (1) identifiers; (2) internet or other electronic network activity; (3) geolocation data; and (4) inferences drawn from internet or other electronic network activity. To opt-out from “sales” or “sharing” of personal information, you can click the Do Not Sell or Share My Personal Information link or use the GPC described in Section 6.2 of this Privacy Policy.

We do not knowingly sell or share the personal information of minors under 16 years of age.

Right to Limit Use and Disclosure of Sensitive Personal Information. The CCPA provides for a right to limit the use of sensitive personal information for any purposes other than to provide the services or goods you request or as otherwise permitted by law. Note that we do not use sensitive personal information for any such additional purposes and therefore do not offer this right.

Finally, you have a right to not be discriminated against for exercising these rights set out in the CCPA.

Additionally, under California Civil Code section 1798.83, also known as the “Shine the Light” law, California residents who have provided personal information to a business with which the individual has established a business relationship for personal, family, or household purposes (“California Customers”) may request information about whether the business has disclosed personal information to any third parties for the third parties’ direct marketing purposes. Please be aware that we do not disclose personal information to any third parties for their direct marketing purposes as defined by this law.

 

10. Other Important Information

• 10.1. Security of Your Information
  Security of personal information is important to us. We implement security safeguards designed to protect your personal information, including reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, alteration, and destruction. Despite these efforts, we cannot guarantee that your data may not be accessed, disclosed, altered, or destroyed by a breach of any of our physical, technical, or administrative safeguards. Please notify us immediately at security@chanzuckerberg.com if you become aware of any security issues relating to our Services.
• 10.2. Children
  The Services are not designed or intended for children under 16. We do not have actual knowledge that we have sold or shared the personal information of users under 16 years of age. If we become aware that we have the information of such children collected through the Services, we will promptly delete it.
• 10.3. Changes to This Privacy Policy
  We may modify this Privacy Policy from time to time, and you can see when the last update was by looking at the “Last Updated” date at the top of this Privacy Policy. If we make material changes to it, we’ll provide you notice through this Privacy Policy. If you object to any changes, you may stop accessing the Services or exercise other opt-outs or rights that we provide. Your continued use of the Services after we publish a notice about changes to this Privacy Policy means that you accept the updated Privacy Policy following the date it takes effect.
• 10.4. Contact Information
  If you have questions or complaints regarding this Privacy Policy, please contact us at privacy@chanzuckerberg.com.

Chan Zuckerberg Initiative
2682 Middlefield Road, Suite i
Redwood City, CA 94063

To comply with article 27 of the GDPR and the UK-GDPR, we have appointed a representative who can accept communications on behalf of CZI LLC in relation to personal data processing activities falling within the scope of the GDPR or the UK-GDPR. If you wish to contact them, their details are as follows:

European GDPR Representative:
Bird & Bird GDPR Representative Services SRL
Avenue Louise 235
1050 Bruxelles
Belgium
EUrepresentative.ChanZuckerberg@twobirds.com

UK Data Protection Representative:
Bird & Bird GDPR Representative Services UK
12 New Fetter Lane
London EC4A 1JP
United Kingdom
UKrepresentative.ChanZuckerberg@twobirds.com