Data Protection and Confidentiality

Clients entrust Middlesex Notary Co LLC d/b/a CIVIL CONSTABLE (“CIVIL CONSTABLE,” “we,” “us”) with court papers, case information and personal information about the people they need served. This Data Protection and Confidentiality Policy sets out how we protect that material. It supplements our Privacy Policy.

1. Confidential Information

For purposes of this Policy, “Confidential Information” means:

1. documents you upload or send to us, and the returns, affidavits and completion records we prepare;
2. case information, including courts, docket numbers, parties, deadlines and instructions;
3. information about recipients and other persons named in documents;
4. client account, billing and payment information and messages; and
5. non-public information about your firm or business.

Information that becomes public through the legal process, such as a return of service filed with a court, is subject to the applicable court rules. This Policy does not limit what a law, court rule or order requires to be filed or disclosed.

2. Our Commitments

2.1 Data minimization. Our forms request the information needed to review and perform service, and optional fields are identified. Please do not provide Social Security numbers, financial account numbers or medical information unless they appear in a document that must be served.

2.2 Purpose limitation. We use Confidential Information only to review, perform, document and bill the service you requested and to maintain required records. We do not use it for advertising, do not sell it, and do not use it to train artificial-intelligence models.

2.3 Access control. Only authorized CIVIL CONSTABLE personnel who need a record to perform their work may access it. Staff accounts are individual, protected by strong passwords and two-step verification, and limited by role. Access to request files is logged.

2.4 Client separation. Each portal request is associated with the account and workspace that submitted it. One client cannot access another client’s requests, documents or invoices. Within a firm or business workspace, access follows the roles assigned by the workspace owner.

2.5 No public access. Uploaded documents are stored outside the public website, encrypted at rest, and served only to authorized users through links that expire after fifteen minutes. Payment links use long random tokens and are excluded from search engines.

2.6 Service providers. Technology providers receive only the information their function requires, as identified in the Privacy Policy. Documents are never sent to artificial-intelligence services.

2.7 Email. Request confirmations contain a reference number and a link to the portal, not recipient details or documents. Please use the secure portal, rather than ordinary email, to send documents to us.

2.8 Secure disposal. Records that are no longer needed are destroyed or erased so that personal information cannot practicably be read or reconstructed, as required by G.L. c. 93I, § 2.

3. Security Safeguards

Our administrative, technical and physical safeguards are designed to meet the Massachusetts standards in 201 CMR 17.00. They include:

• secure user authentication, account lockout after repeated failed sign-in attempts, and two-step verification for staff;
• role-based access limited to personnel who need the information;
• encryption of information transmitted over public networks (HTTPS) and of stored documents;
• logging of access to client records;
• keeping the software that runs the Services up to date;
• selection of service providers capable of protecting personal information; and
• documented response to security incidents.

4. Security Incidents

If we learn of a breach of security involving personal information of a Massachusetts resident, we will investigate and contain it, and give notice as soon as practicable and without unreasonable delay to affected residents, the Attorney General and the Office of Consumer Affairs and Business Regulation, as required by G.L. c. 93H, § 3. Where we hold information on behalf of a client, we will also notify that client promptly. Each incident is documented and reviewed, and our safeguards are updated accordingly.

To report a security concern, email info@civilconstable.com with “Security” in the subject line.

5. Client Responsibilities

• Upload only documents you are authorized to share for service.
• Keep your portal password and email account secure, and enable two-step verification in your portal settings.
• In a firm or business workspace, promptly remove persons who leave and grant “all requests” access only to those who need it.
• Notify us immediately if you suspect unauthorized access to your account.

6. Legal Process

If we receive a subpoena, court order or other legal demand for client records, we will disclose only what is legally required and, unless prohibited by law, notify the affected client so that the client may respond.