Privacy Policy

1. Introduction & Scope

Medallion Signature Locator ("we," "our," or "the Directory") operates https://medallionlocator.com as an educational directory and branch locator for statutory Medallion Signature Guarantees under SEC Rule 17Ad-15 and UCC § 8-306.

This Privacy Policy explains how we collect, use, protect, and disclose information when you visit our website, use our branch eligibility checker, review bank rules, or contact our research team. We maintain strict compliance with global and domestic privacy frameworks, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the California Online Privacy Protection Act (CalOPPA), the European Union General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, and applicable U.S. state privacy laws (including Virginia VCDPA, Colorado CPA, Connecticut CTDPA, and Texas TDPSA).

2. Information We Collect

We practice rigorous data minimization. Because our directory is open to the public without requiring user accounts or subscriptions, we collect minimal personal data:

• Information You Provide Directly: When you send a message through our Contact page, submit a branch data correction, or email our editorial desk, we receive your name, email address, subject matter, and message content.
• Information Collected Automatically: When you browse the website, our server logs record technical diagnostics, including your internet protocol (IP) address, browser type and version, operating system, referring URL, pages viewed, time spent per page, and access timestamps. These logs are used solely for server security, DDoS protection, and technical performance monitoring.
• No Sensitive Personal Information (SPI): We do NOT collect Social Security numbers, bank account numbers, investment balances, driver's license numbers, or financial account credentials. You should never submit confidential banking records or securities certificates through our website.

3. How We Use Your Information & Lawful Bases

We use collected information strictly for operational and educational purposes:

• To respond to user questions, branch correction notices, and feedback.
• To maintain website availability, network security, and prevent automated abuse.
• To evaluate aggregated, non-personally identifiable directory usage trends.

Under GDPR Article 6, our lawful bases for processing include: (a) your explicit consent when submitting an inquiry form; and (b) our legitimate interests in providing a secure, accurate, and functional public research utility.

4. Zero Sale or Sharing of Personal Information

We do not sell, rent, lease, or monetize your personal information. We do not share personal data with third-party data brokers or behavioral advertising networks.

Over the preceding 12 months, Medallion Signature Locator has sold zero (0) categories and shared zero (0) categories of personal information for cross-context behavioral advertising under the CCPA/CPRA.

5. Cookies & Global Privacy Control (GPC)

Our website uses only essential functional cookies required for core navigation, server load balancing, and security. We do not use third-party tracking pixels or persistent advertising trackers.

We respect universal browser opt-out signals, including the Global Privacy Control (GPC). If your browser broadcasts a GPC signal, our systems treat that signal as an automatic opt-out of any non-essential tracking.

6. Your Privacy Rights (California, Virginia, Colorado & EU/UK)

Depending on your jurisdiction, you hold statutory legal rights regarding your personal information:

To exercise your rights, email our compliance desk at privacy@medallionlocator.com or use our Contact Form. We verify and respond to verifiable consumer requests within 45 days.

7. Data Retention & Security Architecture

We retain email communications and contact form submissions only as long as necessary to address your inquiry or update directory records, with a maximum retention period of 12 months. Server diagnostic logs are automatically rotated and deleted every 30 days.

All site traffic is secured using Transport Layer Security (TLS 1.3 / HTTPS encryption). We enforce strict administrative, technical, and physical safeguards to prevent unauthorized access, loss, or disclosure.

8. Children's Privacy Notice (COPPA)

Our services and regulatory materials are directed to adults and registered shareholders over the age of 18. We do not knowingly collect personal information from children under 13 (or under 16 in applicable jurisdictions). If we discover that a minor has provided personal details, we purge that data immediately.

9. Third-Party Links & Financial Institution Disclaimers

Our directory links to official third-party resources, including bank appointment booking portals, transfer agents (Computershare, EQ), and the U.S. Securities and Exchange Commission (SEC). We do not control and are not responsible for the privacy practices, cookie policies, or content of external sites. We encourage you to review their privacy disclosures upon visiting.

10. Changes to This Policy & Contact Information

We review and update this Privacy Policy at least annually to reflect statutory updates and directory changes. Material revisions are reflected with an updated date at the top of this document.