Portola Technologies, Inc. (“Portola,” “we,” “us,” or “our”) is a B2B financial technologycompany that provides middleware infrastructure enabling financial institutions and fintechcompanies (our “Business Customers”) to originate, service, and manage consumerlending products for their end-user borrowers (“Borrowers”).
Portola Technologies, Inc. (“Portola,” “we,” “us,” or “our”) is a B2B financial technology company that provides middleware infrastructure enabling financial institutions and fintech companies (our “Business Customers”) to originate, service, and manage consumer lending products for their end-user borrowers (“Borrowers”).
We understand that you are aware of and care about your own personal privacy interests, and we take that seriously. This Privacy Statement describes Portola’s policies and practices regarding its collection and use of your personal data, and sets forth your privacy rights. We recognize that information privacy is an ongoing responsibility, and so we will from time to time update this Privacy Statement as we undertake new personal data practices or adopt new privacy policies.
Portola’s services are offered in the United States and are intended for use by United States–based financial institutions, fintech companies, and their U.S. customers. Personal information that we collect or process is stored and processed in the United States.
For Borrower personal information that Portola processes on behalf of a Business Customer, Portola acts as a service provider to that Business Customer. The Business Customer is the entity primarily responsible for that information under applicable financial-privacy laws (including the Gramm-Leach-Bliley Act), and Borrowers should also consult the Business Customer’s own privacy notice for additional information about how their data is collected and used.
This Privacy Statement is the primary description of Portola’s collection and use of personal information. The following companion notices provide additional information:
Portola is headquartered at 92 South Park, San Francisco, CA 94107.
If you have any questions or concerns about Portola’s personal data policies or practices, or if you would like to exercise your privacy rights, please contact us:
Portola Technologies, Inc.
Attn: Privacy
92 South Park
San Francisco, CA 94107
Portola collects personal information about three categories of individuals:
Business Customer personnel (employees, contractors, and authorized users of our Business Customers). For these individuals, the information we collect is generally limited to:
We use this information to provide and administer our services to the Business Customer, authenticate users, communicate about the services, and meet our legal and contractual obligations.
Borrowers (consumers who apply for or hold financial products offered by our Business Customers and whose data we process on the Business Customer’s behalf). For Borrowers, the categories of personal information we may process include:
We process Borrower personal information solely to provide our services to the Business Customer, including to facilitate account opening and verification, originate and service loans, execute payments, prevent and detect fraud, and comply with applicable financial-services laws.
Website visitors. When you visit tryportola.com, we collect information described under “Use of the tryportola.com website” below.
We do not sell personal information to anyone and only share it with third parties who are facilitating the delivery of our services or as otherwise described in this Privacy Statement.
From time to time, Portola receives personal information about individuals from third parties. Typical sources include our Business Customers, our service providers (such as Plaid, Persona, Twilio, Bridge, and the other providers listed at tryportola.com/subprocessors), credit bureaus and other consumer reporting agencies, fraud-prevention and identity-verification providers, government and public records, and, in the case of business contacts, third-party business-information websites (e.g., LinkedIn).
As is true of most other websites, tryportola.com collects certain information automatically and stores itin log files.
The information may include internet protocol (IP) addresses, the region or general location where yourcomputer or device is accessing the internet, browser type, operating system, and other usageinformation about the use of Portola’s website, including a history of the pages you view. We use thisinformation to help us design our site to better suit our users’ needs. We may also use your IP addressto help diagnose problems with our server and to administer our website, analyze trends, track visitormovements, and gather broad demographic information that assists us in identifying visitor preferences.
Portola has a legitimate interest in understanding how customers, prospects, and other visitors use itswebsite. This assists Portola with providing more relevant products and services, communicating valueto our Business Customers, and providing appropriate staffing to meet customer needs.Use of the tryportola.com Website
As is true of most other websites, tryportola.com collects certain information automatically and stores it in log files.
The information may include internet protocol (IP) addresses, the region or general location where your computer or device is accessing the internet, browser type, operating
Portola makes available a comprehensive Cookie Notice at tryportola.com/cookies that describes the cookies and tracking technologies used on the Portola website and provides information on how users can accept or reject them.
When a Business Customer integrates Portola’s services to offer financial products to its Borrowers, Portola processes the Borrower personal information described above strictly in accordance with the Business Customer’s instructions and our contract with the Business Customer. Portola does not use Borrower personal information for its own independent marketing purposes and does not sell Borrower personal information.
Borrowers who wish to exercise rights with respect to their personal information should generally direct those requests to the Business Customer that holds their account. Portola will support the Business Customer in responding to such requests as required by applicable law and our agreement with the Business Customer.
The personal information Portola collects is stored in databases hosted by third-party cloud-infrastructure providers located in the United States. These providers do not use or have access to personal information for any purpose other than hosting, storage, and retrieval on Portola’s behalf.
A current list of our third-party subprocessors can be found at tryportola.com/subprocessors.
We do not otherwise reveal personal data to non-Portola persons or businesses for their independent use unless:
(1) you request or authorize it;
(2) we are directed to do so by the Business Customer on whose behalf we are processing the data;
(3) the information is provided to comply with the law (for example, compelled by law enforcement to comply with a search warrant, subpoena, or court order), enforce an agreement we have with you, or to protect our rights, property, or safety, or the rights, property, or safety of our employees or others;
(4) the information is provided to our agents, vendors, or service providers who perform functions on our behalf;
(5) to address emergencies or acts of God;
(6) to address disputes or claims, or to persons demonstrating legal authority to act on your behalf; or
(7) in connection with a corporate transaction such as a merger, acquisition, financing, or sale of assets.
We may also gather aggregated, de-identified data about our services and website visitors and disclose the results of such aggregated (and not personally identifiable) information to our partners, service providers, and other third parties.
The Portola website may connect with third-party services such as LinkedIn, X, and others. If you choose to share information from the Portola website through these services, you should review the privacy policy of that service. If you are a member of a third-party service, those connections may allow that service to associate your visit to our site with your personal data.
Privacy rights in the United States depend on the type of personal information involved and the state in which you reside.
Borrower financial information. Most personal information that Portola processes about Borrowers is “nonpublic personal information” subject to the federal Gramm-Leach-Bliley Act (GLBA) and is handled in accordance with the privacy notice provided by the Business Customer (the financial institution or fintech company) that holds your account. If you are a Borrower and wish to exercise rights with respect to your personal information, you should generally contact that Business Customer in the first instance. Portola will assist the Business Customer in responding to your request as required by applicable law and our agreement with the Business Customer.
California residents (CCPA / CPRA). If you are a California resident, you have the right to:
Portola does not sell personal information and does not share personal information for cross-context behavioral advertising as those terms are defined under California law. Most Borrower information that Portola processes is collected in the context of providing financial products and services governed by GLBA, and is therefore exempt from the CCPA.
Other U.S. state privacy laws. Residents of other states with comprehensive consumer privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Indiana, Minnesota, and Maryland) may have similar rights of access, correction, deletion, and opt-out under their respective state laws. As with California, most Borrower financial information that Portola processes is exempt from these laws under the applicable GLBA or financial-institution exemption.
How to submit a request. Submit a privacy request through the form at tryportola.com/privacy-requests, by email to privacy@tryportola.com, or by mail to the address in the “Privacy Contact” section above.
We will respond within the timeframe required by the applicable state law (generally 45 days, subject to extension where permitted). We will need to verify your identity before responding, and we may decline requests where we are unable to verify identity, where the request is not covered by applicable law, or where a legal exception applies. You may use an authorized agent to make a request on your behalf with appropriate written authorization. See the Privacy Requests page for the complete process, including what to include in your request.
We provide reasonable access to your personal data at no cost. If access cannot be provided within a reasonable time frame, Portola will provide you with a date when the information will be provided. If for some reason access is denied, Portola will provide an explanation as to why access has been denied.
Portola maintains an information security program designed to protect the confidentiality, integrity, and availability of personal data in our custody. Our safeguards include administrative, technical, and physical controls — encryption of data in transit and at rest, role-based access controls with multi-factor authentication, network segmentation, logging and monitoring, vulnerability management, secure software development practices, and personnel training. Portola’s controls are independently assessed against the SOC 2 framework.
No method of transmission or storage is perfectly secure. Portola cannot guarantee absolute security, but we take commercially reasonable steps to protect personal data and to notify affected parties as required by law in the event of a security incident.
Data Storage and Retention
Your personal data is stored by Portola on its servers and on the servers of the cloud-infrastructure and database providers Portola engages, all located in the United States.
Portola retains personal data for the duration of the relevant business relationship and for a period of time thereafter, as required to:
(a) comply with applicable legal, regulatory, tax, accounting, and financial-services recordkeeping obligations (including, where applicable, recordkeeping requirements under the Bank Secrecy Act, the Equal Credit Opportunity Act / Regulation B, the Truth in Lending Act / Regulation Z, and other consumer-financial laws);
(b) enforce our agreements;
(c) resolve disputes;
(d) prevent fraud and abuse; and
(e) for historical, analytical, and archiving purposes consistent with the services we provide.
Portola retains prospect data until such time as it no longer has business value and is purged from Portola systems.
All personal data that Portola controls may be deleted upon verified request from data subjects or their authorized agents, subject to the exceptions described above.
For more information on where and how long your personal data is stored, and for more information on your rights of erasure and portability, please contact us at privacy@tryportola.com.
Portola’s services are directed to financial institutions and adult borrowers. We do not knowingly attempt to solicit or receive information from children.
If you have questions, concerns, complaints, or would like to exercise your rights, please contact us at:
Portola Technologies, Inc.
Attn: Privacy
92 South Park
San Francisco, CA 94107