Let’s connect
LEGAL · GARLAND & ZHANG

Privacy Policy

What we collect, why, who we share it with, how long we keep it, and the choices you have.

Last updated October 30, 2026

Working draft prepared for review by Garland & Zhang and its counsel. Highlighted items are business decisions still to be confirmed; publication follows approval. This page is not legal advice.

1. Who we are

Garland & Zhang, LLC (“G&Z”, “we”, “us”) operates garlandzhang.com and the Garland & Zhang Global Direct platform. We are the controller of the personal information described here. Privacy contact: robertgarland9@gmail.com, or Garland & Zhang, LLC · 86 Highway 294 · Murphy, NC 28906 · United States. a dedicated privacy@ address is recommended before launch

Which phase this policy covers. Our services are being introduced in phases. This policy describes the phase in force today — commercial transactions with business buyers and the representative, contact, and bank-related information those transactions involve. Retail and consumer sales are not offered yet; before they begin we will publish a separate consumer privacy notice covering consumer data and consumer payment methods. Section 13 sets out how the phases relate.

2. Information we collect

Account and identity

  • Name, business email, telephone number, company name, role, and the participant type you register as.
  • Business details needed to verify you: address, registration or tax identifiers, licenses, certifications, and references.
  • Authentication data: a password stored in hashed form by our authentication provider, and session identifiers. We never store your password in readable form.

Verification materials

  • Documents and images you upload for verification, including business-card images. Card images are processed by optical character recognition so the details can be entered into your record.
  • Where required for a specific program, identity documents you choose to provide.

Transaction and commission records

  • Requests for quotation, quotes, orders, invoices, payment references, shipping and customs documents, and correspondence about a transaction.
  • Referral and commission records: participants involved, introductions logged, agreed terms, amounts earned and paid, and attached signed agreements.

Technical data

  • IP address, device and browser type, pages viewed, and timestamps, generated by our hosting and security logs.
  • Essential cookies used to keep you signed in (see section 7).

Payment, banking, and verification records

  • Details of the banking arrangements behind a commercial transaction: the buyer’s issuing bank, the credit reference and its terms, advising or confirming banks, and payment and remittance confirmations. This can include the names and signature details of the individuals who sign or authorize on behalf of a party.
  • Bank account details of a party, where they are needed to remit or refund a payment.
  • Independent third-party inspection or verification reports and the underlying delivery documents.
  • We do not receive or store consumer card numbers. Card payments are not offered in the current phase, and no card data is processed by us.

3. How we use it

  • Provide, operate, and secure the Site and Platform.
  • Verify participants and screen for legal, sanctions, and counterparty risk.
  • Prepare quotes, orders, invoices, and delivery documentation, and coordinate logistics with partners.
  • Record and administer referrals and commissions, including producing ledger summaries.
  • Prepare and present the document sets required under a letter of credit, confirm the release of payment against those documents, and reconcile receipts against orders.
  • Coordinate independent third-party verification on delivery and record its result.
  • Comply with legal obligations (customs, tax, sanctions, anti-money-laundering, record-keeping) and enforce our agreements.
  • Support you, respond to enquiries, and improve the service.

4. Legal bases where the GDPR applies

Where European data protection law applies, we rely on: performance of a contract (providing the services), legitimate interests (securing the Platform, preventing fraud, verifying participants), legal obligation (customs, tax, sanctions and record-keeping), and consent where we ask for it. You can withdraw consent at any time without affecting processing already carried out.

5. Who we share it with

  • Service providers that host and run the Platform: cloud hosting and content delivery, database and authentication, document/OCR processing, email and notification delivery, and electronic signature services. They act on our instructions.
  • Transaction counterparties — manufacturers, logistics partners, and customs brokers — strictly as needed to fulfil a transaction you are part of.
  • Parties you direct us to share with, including participants in a referral arrangement you are recorded in.
  • Banks and financial institutions — the buyer’s issuing bank, advising or confirming banks, and our own bank, HSBC — to issue, advise, or confirm a documentary credit, to receive payment, and to make or trace a refund. to confirm the company’s banking relationships and whether any are to be named
  • Independent inspection and verification bodies engaged for a transaction, and insurers where cover applies.
  • Professional advisers (legal, accounting, audit) under confidentiality obligations.
  • Authorities where required by law, such as customs, tax, or sanctions authorities.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. current subprocessor list to be published here before launch (hosting, database/auth, OCR, email, e-signature)

6. Retention

We keep account and verification records while your account is active and for a reasonable period afterwards. Transaction, customs, tax, and commission records — including documentary-credit, payment, and remittance records — are kept for the period required for banking, financial, and legal record-keeping — to confirm, commonly seven years. Business-card images are kept to confirm — recommended: for as long as the extracted record is retained, or deleted after the record is verified if you ask. Where a legal hold or open dispute applies, we keep what is needed for that purpose.

7. Cookies and tracking

We use the cookies required to run the Platform — keeping you signed in and protecting forms against cross-site request forgery. These are essential, not advertising, cookies. We do not run advertising or cross-site tracking cookies on the Site or Platform. to confirm whether analytics will be added; if so, this section and a consent mechanism are updated first

8. Security

We use encryption in transit (TLS), access controls, and role-based permissions. Commission and referral records are visible only to roles the client designates, and referrers see only their own records. Ledger entries carry timestamps and an audit history. No system is perfectly secure; if you believe your account has been compromised, contact us immediately.

9. Your choices and rights

Depending on where you live, you may have the right to request access to your personal information, correction of inaccuracies, deletion, a portable copy, restriction of or objection to certain processing, and withdrawal of consent. California residents have rights to know, delete, and correct personal information, and to opt out of sale or sharing — we do not sell or share personal information as those terms are defined, and you will not be discriminated against for exercising a right. Where the GDPR applies you may also lodge a complaint with your supervisory authority.

To make a request, email us with enough detail to identify your account. We will verify your identity before acting, and we may use an authorized agent where the law permits. We aim to respond within the period required by applicable law (typically 30 to 45 days).

10. Children

The Site and Platform are for business use and are not directed to anyone under 18. We do not knowingly collect personal information from children.

11. Artificial intelligence

We do not use your information — including documents, business-card images, or correspondence you upload — to train artificial intelligence models. Automated processing we do use, such as optical character recognition or translation, is applied only to deliver the service to you.

12. International transfers

Information may be processed in the United States and in other countries where our service providers operate. Where personal information subject to the GDPR is transferred out of the EEA or UK, we rely on appropriate safeguards such as standard contractual clauses.

13. Phases: commercial data now, consumer data later

The information we hold today relates to businesses and their representatives, and to the banking and inspection records of commercial transactions. When the retail phase is introduced, it will bring consumer personal information and consumer payment methods (card payments through a payment processor). Before any retail sale is made, we will publish a separate consumer privacy notice describing that processing, name the payment processor, and update this policy where the two overlap. We will not start processing consumer data for a retail phase that has not been announced.

14. Changes to this policy

We may update this policy; the “last updated” date always reflects the current version, and material changes will be notified to registered participants.