GDPR & CCPA Compliance Statement
Effective Date: January 1, 2025
Introduction
Luna Signing Solutions, LLC ("Luna," "we," "us," or "our") is committed to protecting the privacy rights of individuals under the European Union's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). This statement outlines our compliance practices and the rights available to individuals under these comprehensive privacy laws.
GDPR Compliance
Scope and Applicability
The GDPR applies to the processing of personal data of individuals located in the European Economic Area (EEA). Luna Signing Solutions complies with GDPR requirements for all EEA data subjects who use our Services, regardless of where the processing occurs.
Legal Basis for Processing
We process personal data only when we have a valid legal basis:
- Contract Performance: Processing necessary to provide our Services under our Terms of Use
- Consent: Explicit consent for specific processing activities, such as marketing communications
- Legal Obligation: Compliance with applicable laws, including notary recordkeeping requirements
- Legitimate Interests: Processing for legitimate business purposes, such as fraud prevention and system security
Data Subject Rights Under GDPR
If you are located in the EEA, you have the following rights regarding your personal data:
Right of Access (Article 15)
You have the right to obtain confirmation of whether we process your personal data and to access that data. Upon request, we will provide you with a copy of your personal data in a commonly used electronic format.
Right to Rectification (Article 16)
You may request correction of inaccurate personal data and completion of incomplete data. We will respond to rectification requests within one month.
Right to Erasure / "Right to be Forgotten" (Article 17)
You may request deletion of your personal data in certain circumstances. However, this right is subject to limitations, including legal obligations to retain notary journal records for specified periods. We will clearly communicate any limitations on erasure requests.
Right to Restriction of Processing (Article 18)
You may request that we limit the processing of your personal data in certain situations, such as when you contest the accuracy of the data or object to processing based on legitimate interests.
Right to Data Portability (Article 20)
You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller. We provide export functionality for journal entries and account information.
Right to Object (Article 21)
You may object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
Right Not to be Subject to Automated Decision-Making (Article 22)
You have the right not to be subject to decisions based solely on automated processing that produce legal effects. Our Services do not employ automated decision-making that would significantly affect users.
International Data Transfers
When we transfer personal data from the EEA to countries outside the EEA, we ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Transfers only to countries with adequacy decisions where applicable
- Additional security measures to protect data in transit and at rest
- Regular assessments of data transfer risks and safeguards
Data Protection Officer
We have appointed a Data Protection Officer (DPO) to oversee our GDPR compliance. You may contact our DPO with questions or concerns regarding the processing of your personal data at: dpo@lunasigningsolutionsllc.com
Right to Lodge a Complaint
If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or where an alleged infringement occurred. Contact information for EU data protection authorities can be found at: https://edpb.europa.eu/about-edpb/board/members_en
CCPA Compliance
Scope and Applicability
The California Consumer Privacy Act (CCPA) provides California residents with specific rights regarding their personal information. This section applies to California residents and describes how we collect, use, and share personal information and the rights available under CCPA.
Categories of Personal Information
In the preceding 12 months, we have collected the following categories of personal information from consumers:
- Identifiers: Name, email address, phone number, mailing address, IP address, account name
- Commercial Information: Records of notary services purchased or considered, payment history
- Internet Activity: Browsing history on our Services, interaction with our website
- Professional Information: Notary commission number, jurisdiction, expiration date, professional credentials
- Geolocation Data: General location derived from IP address
- Inferences: Preferences and characteristics derived from usage patterns
Sources of Personal Information
We collect personal information from the following sources:
- Directly from you when you create an account or use our Services
- Automatically through your use of our Services (e.g., cookies, log data)
- From identity verification service providers
- From payment processors
- From publicly available databases (e.g., notary commission registries)
Business or Commercial Purposes for Collecting
We use personal information for the following business purposes:
- Providing and maintaining the Services
- Processing notarizations and maintaining electronic journal records
- Authenticating users and preventing fraud
- Processing payments and managing accounts
- Communicating with users about the Services
- Complying with legal obligations
- Improving and developing our Services
- Ensuring security and integrity of our systems
Sharing of Personal Information
We may share personal information with the following categories of third parties:
- Service Providers: Cloud hosting providers, payment processors, customer support tools
- Identity Verification Services: Providers that verify user identity for compliance purposes
- Professional Advisors: Lawyers, accountants, and consultants
- Government Authorities: When required by law or legal process
We do not sell personal information. We have not sold personal information in the preceding 12 months and do not have actual knowledge of selling personal information of minors under 16 years of age.
California Consumer Rights
California residents have the following rights under CCPA:
Right to Know
You have the right to request that we disclose:
- Categories of personal information collected
- Categories of sources from which personal information is collected
- Business or commercial purpose for collecting personal information
- Categories of third parties with whom we share personal information
- Specific pieces of personal information collected about you
Right to Delete
You have the right to request deletion of personal information we have collected from you, subject to certain exceptions (e.g., legal retention requirements for notary journals, completing transactions, detecting security incidents).
Right to Opt-Out of Sale
While we do not sell personal information, you have the right to opt-out of the sale of your personal information. We provide a "Do Not Sell My Personal Information" link on our website for California residents.
Right to Non-Discrimination
You have the right not to receive discriminatory treatment for exercising your CCPA rights. We will not deny services, charge different prices, provide different quality of service, or suggest you will receive different pricing or service quality for exercising your rights.
Authorized Agents
California residents may use an authorized agent to submit requests on their behalf. To designate an authorized agent, you must provide the agent with written permission to submit requests and verify your identity directly with us. We may require proof of the agent's authorization.
California "Shine the Light" Law
Under California Civil Code Section 1798.83, California residents have the right to request information about the disclosure of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.
Exercising Your Rights
How to Submit a Request
To exercise your rights under GDPR or CCPA, you may submit a request through the following methods:
- Email: privacy@lunasigningsolutionsllc.com
- Online Form: Available in your account settings or on our website
- Mail: Luna Signing Solutions, LLC, Privacy Request Department (address on file)
Verification Process
To protect your privacy and security, we will verify your identity before processing requests:
- For requests to know, we will match at least two data points you provide with information we have on file
- For requests to delete, we may require additional verification through your account credentials or additional identifying information
- We will only use personal information provided in a request to verify the requestor's identity or authority
Response Timing
We will acknowledge receipt of your request within 10 business days and respond substantively within the timeframes required by law:
- GDPR Requests: Generally within one month, extendable to two additional months for complex requests
- CCPA Requests: Within 45 days, extendable by an additional 45 days with notice
Fees
We do not charge a fee to process or respond to your verifiable request unless it is excessive, repetitive, or manifestly unfounded. If we determine a fee is warranted, we will inform you of the fee and the reasons for the charge before completing your request.
Data Retention
We retain personal information for as long as necessary to fulfill the purposes outlined in our Privacy Policy, unless a longer retention period is required or permitted by law. Electronic notary journal entries are retained in accordance with state-specific legal requirements, typically 5-10 years. After the required retention period, we securely delete or anonymize personal information.
Children's Privacy
Our Services are not directed to individuals under the age of 18, and we do not knowingly collect personal information from children. If we learn that we have collected personal information from a child without parental consent, we will take steps to delete that information.
Updates to This Statement
We may update this GDPR/CCPA Compliance Statement from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated statement on our website and updating the "Effective Date" at the top.
Contact Information
For questions about this GDPR/CCPA Compliance Statement or to exercise your rights:
Luna Signing Solutions, LLC
Privacy Requests: privacy@lunasigningsolutionsllc.com
Data Protection Officer: dpo@lunasigningsolutionsllc.com
General Support: support@lunasigningsolutionsllc.com
We are committed to protecting your privacy rights and will respond to all requests in accordance with applicable law.
Last Updated: January 1, 2025
This GDPR/CCPA Compliance Statement supplements our Privacy Policy and Terms of Use. In the event of any conflict between this statement and our Privacy Policy, this statement shall control with respect to GDPR and CCPA compliance.