Privacy Policy

Last modified January 18th, 2025

This Privacy Policy includes important information about your personal data and we encourage you to read it carefully.

Welcome

We provide software and services for lenders in their pursuit of providing a relationship banking experience to consumers. Lenders use our technology and services to request documentation from borrowers in the context of consumer loan originations; to evaluate evidence supplied by borrowers; and to share documentation internally in their organizations for the purposes of loan decisioning.

This Privacy Policy ("Policy") describes the Personal Data that we collect, how we use and share it, and details on how you can reach us with privacy-related inquiries. The policy also outlines your rights and choices as a data subject, including the right to object to certain uses of your Personal Data.

Defined Terms

In this Policy, “The Loan Document Processing Corporation, "LDPC",”, “we”, “our,” or “us” refers to The Loan Document Processing Corporation, a Delaware corporation. LDPC is the entity responsible for the collection, use, and handling of Personal Data as described in this document.

“Personal Data” refers to any information associated with an identified or identifiable individual, which can include data that you provide to us, and that we collect about you during your interaction with our Services (such as device information, IP address, etc.).

“Services” refers to the products, services, devices, and applications, that we provide under the LDPC Services Agreement (“Business Services”) or the LDPC Consumer Terms of Service (“End User Services”); websites (“Sites”) like ldp-corp.com; and other LDPC applications and online services. We provide Business Services to entities (“Business Users”). We provide End User Services directly to individuals for their personal use.

Depending on the context, “you” might be an End User, Representative, or Visitor:

End Users

When you use an End User Service, such as uploading personal documentation on the Consumer Upload Portal, for personal use, we refer to you as an “End User.”

Representatives

When you are acting on behalf of an existing or potential Business User — perhaps as a account administrator or credit or compliance executive — we refer to you as a “Representative.”

Visitors

When you interact with LDPC by visiting a Site without being logged into a LDPC account, or when your interaction with LDPC does not involve you being an End User or Representative, we refer to you as a “Visitor.” For example, you are a Visitor when you send a message to LDPC asking for more information about our Services.

Personal Data we collect and how we use and share it

Our collection and use of Personal Data differs based on whether you are an End User, Representative, or Visitor, and the specific Service that you are using. For example, if you're a lender who wants to use our Business Services, we may collect your Personal Data to onboard your business; at the same time, you might also be an End User if you used our End User Service, such as the Consumer Upload Portal, for your personal use.

1.1 End Users

We provide End User Services when we provide the Services directly to you for your personal use (e.g., the Consumer Upload Portal).

a. Personal Data we collect about End Users

Using the Consumer Upload Portal.

LDPC offers a service called the Consumer Upload Portal, which allows you to create an account and store information for future interactions with LDPC’s Services and Business Users. You may save a number of different kinds of Personal Data using the Consumer Upload Portal. For instance, you may save your name, or use the Consumer Upload Portal to store personal documents like your driver's license, paystubs, student loan payoff statements, etc. You can ask us to cease the collection of such data at any time.

Paying LDPC.

When you purchase goods or services directly from LDPC, we receive your Transaction Data. When you make a payment to LDPC, we collect information about the transaction, as well as your contact and payment method details.

More.

For further information about other types of Personal Data that we may collect about End Users, including about your online activity and your engagement with our End User Services, please see the More ways we collect, use, and share Personal Data section below.

b. How we use and share Personal Data of End Users

Services.

We use and share your Personal Data to provide the End User Services to you, which includes support, personalization (such as language preferences and setting choices), and communication about our End User Services (such as communicating Policy updates and information about our Services). For example, LDPC may use cookies and similar technologies or the data you provide to our Business Users (such as when you input your email address on a Business User’s website) to recognize you and help you use the Consumer Upload Portal when visiting our Business User’s website.

Our Business Users.

When you use the Consumer Upload Portal to furnish documents to our Business Users, we share your Personal Data, including name and contact information with those Business Users. You can also direct LDPC to share your saved information and documents with Business Users you do business with. Once we share your Personal Data with Business Users, we may process that Personal Data as a Data Processor for those Business Users, as detailed in Section 1.2 of this Policy. You should consult the privacy policies of the Business Users’ you do business with for information on how they use the information shared with them.

Fraud Detection.

We use your Personal Data collected across our Services to detect fraud for you, us, and our Business Users. We may provide Business Users with Personal Data about you (including your documents) so that they can assess the fraud or loss risk associated with the loan application.

Advertising.

Where permitted by applicable law, we may use your Personal Data, including Transaction Data, to assess your eligibility for, and offer you, other End User Services or promote existing End User Services. Subject to applicable law, including any consent requirements, we use and share End User Personal Data with third party partners to allow us to advertise our End User Services to you, including through interest-based advertising, and to track the efficacy of such ads. We do not transfer your Personal Data to third parties in exchange for payment, but we may provide your data to third-party partners, such as advertising partners, analytics providers, and social networks, who assist us in advertising our Services to you.

More.

For further information about ways we may use and share End Users' Personal Data, please see the More ways we collect, use, and share Personal Data section below.

1.2 Representatives

We collect, use, and share Personal Data from Representatives of Business Users (for example, account administrators or credit or compliance executives) to provide our Business Services.

a. Personal Data we collect about Representatives

Registration and contact information.

When you register for an LDPC account for a Business User, we collect your name and login credentials. If you register for or attend an event organized by LDPC or sign up to receive LDPC communications, we collect your registration and profile data. As a Representative, we may collect your Personal Data from third parties, including data providers, to advertise, market, and communicate with you as detailed further in the More ways we collect, use, and share Personal Data section below. We may also link a location with you to tailor the Services or information effectively to your needs.

Identification Information.

As a current or potential Business User, or a shareholder, officer, or director of a Business User, we need your contact details, such as name, postal address, telephone number, and email address, to verify your identity and prevent fraudulent activities and harm to the LDPC platform. We collect your Personal Data, such as professional role withinin the Business User, date of birth, government-issued identity documents, and associated identifiers, as well as any history of fraud or misuse, directly from you and/or from publicly available sources, third parties such as credit bureaus and via the Services we provide.

More.

For further information about other types of Personal Data that we may collect about Representatives, including your online activity, please see the More ways we collect, use, and share Personal Data section below.

b. How we use and share Personal Data of Representatives

We typically use the Personal Data of Representatives to provide the Business Services to the corresponding Business Users. The ways we use and share this data are further described below.

Business Services.

We use and share Representatives’ Personal Data with Business Users to provide the Services requested by you or the Business User you represent.

Fraud detection and loss prevention.

We use Representatives’ Personal Data to identify and manage risks that our Business Services might be used for fraudulent activities causing losses to LDPC, End Users, Business Users, and others. We also use information about you obtained from publicly available sources, third parties like credit bureaus and from our Services to address such risks, including to identify patterns of misuse and monitor for terms of service violations. LDPC may share Representatives' Personal Data with Business Users and third party service providers, including phone verification providers, to verify the information provided by you and identify risk indicators. We also use and share Representatives' Personal Data to conduct due diligence, including conducting anti-money laundering and sanctions screening in accordance with applicable law.

Advertising.

Where permitted by applicable law, and where required with your consent, we use and share Representatives’ Personal Data with third parties, including Partners, so we can advertise and market our Services. Subject to applicable law, including any consent requirements, we may advertise through interest-based advertising and track the efficacy of such ads. We do not transfer your Personal Data to third parties in exchange for payment. However, we may provide your data to third party partners, like advertising partners, analytics providers, and social networks, who assist us in advertising our Services. We may also use your Personal Data, including your LDPC account activity, to evaluate your eligibility for and offer you Business Services or promote existing Business Services.

More.

For further information about additional ways by which we may use and share Representatives’ Personal Data, please see the More ways we collect, use, and share Personal Data section below.

1.3 Visitors

We collect, use, and share the Personal Data of Visitors.

a. Personal Data we collect about Visitors

When you browse our Sites, we receive your Personal Data, either provided directly by you or collected through our use of cookies and similar technologies. If you opt to complete a form on the Site or third party websites where our advertisements are displayed (like LinkedIn or Facebook), we collect the information you included in the form. This may include your contact information and other information pertaining to your questions about our Services. We may also associate a location with your visit.

More.

For further information about other types of Personal Data that we may collect from Visitors, including your online activity, please see the More ways we collect, use, and share Personal Data section below.

b. How we use and share Personal Data of Visitors

Personalization.

We use the data we collect about you using cookies and similar technologies to measure engagement with the content on the Sites, improve relevancy and navigation, customize your experience (such as language preference and region-specific content), and curate content about LDPC and our Services that is tailored to you.

Advertising.

Where permitted by applicable law, and where required with your consent, we use and share Visitors’ Personal Data with third parties, including Partners, so we can advertise and market our Services. Subject to applicable law, including any consent requirements, we may advertise through interest-based advertising and track the efficacy of such ads. We do not transfer your Personal Data to third parties in exchange for payment, but we may provide your data to third party partners, like advertising partners, analytics providers, and social networks, who assist us in advertising our Services.

Engagement.

As you interact with our Sites, we use the information we collect about and through your devices to provide opportunities for further interactions, such as discussions about Services or interactions with chatbots, to address your questions.

More.

For further information about additional ways in which we may use and share Visitors’ Personal Data, please see the More ways we collect, use, and share Personal Data section below.

2. More ways we collect, use, and share Personal Data

In addition to the ways described above, we also process your Personal Data as follows:

a. Collection of Personal Data

Online Activity.

Depending on the Service used and how our Business Services are implemented by the Business Users, we may collect information related to:

• The devices and browsers you use across our Sites and third party websites, apps, and other online services ("Third Party Sites")
• Usage data associated with those devices and browsers and your engagement with our Services, including data elements like IP address, plug-ins, language preference, time spent on Sites and Third Party Sites, pages visited, links clicked, payment methods used, and the pages that led you to our Sites and Third Party Sites
• Activity indicators, such as mouse activity indicators, to help us detect fraud

Communication and Engagement Information.

We also collect information you choose to share with us through various channels, such as support tickets, emails, or social media. If you respond to emails or surveys from LDPC, we collect your email address, name, and any other data you opt to include in your email or responses. If you engage with us over the phone, we collect your phone number and any other information you might provide during the call. Calls with LDPC or LDPC representatives may be recorded. Additionally, we collect your engagement data, like your registration for, attendance at, or viewing of LDPC events and any other interactions with LDPC personnel.

Forums and Discussion Groups.

If our Sites allow posting of content, we collect Personal Data that you provide in connection with the post.

b. Use of Personal Data

Besides the use of Personal Data described above, we use Personal Data in the ways listed below:

Analyzing, Improving, and Developing our Services.

We collect and process Personal Data throughout our various Services, whether you are an End User, Representative, or Visitor, to improve our Services, develop new Services, and support our efforts to make our Services more efficient, relevant, and useful to you. We may use Personal Data to generate aggregate and statistical information to understand and explain how our Services are used. Examples of how we use Personal Data to analyze, improve, and develop our products and services include:

• Using analytics on our Sites to help us understand your use of our Sites and Services and diagnose technical issues
• Training machine learning models to power our Services and protect against fraud and other harm
• Analyzing and drawing inferences from data to reduce costs, fraud, and disputes and increase completed, successful application rates for our Business Users.

Communications.

We use the contact information we have about you to deliver our Services. If you are an End User, Representative, or Visitor, we may communicate with you using the contact information we have about you to provide information about our Services and our affiliates' services, invite you to participate in our events, surveys, or user research, or otherwise communicate with you for marketing purposes, in compliance with applicable law, including any consent or opt-out requirements. Where permitted under applicable law, we may record our calls with you to provide our Services, comply with our legal obligations, perform research and quality assurance, and for training purposes.

Social Media and Promotions.

If you opt to submit Personal Data to engage in an offer, program, or promotion, we use the Personal Data you provide to manage the offer, program, or promotion. We also use the Personal Data you provide, along with the Personal Data you make available on social media platforms, for marketing purposes, unless we are not permitted to do so.

Fraud Prevention and Security.

We collect and use Personal Data to help us identify and manage activities that could be fraudulent or harmful across our Services and secure our Services and transactions against unauthorized access, use, alteration or misappropriation of Personal Data, information, and funds. As part of the fraud prevention, detection, security monitoring, and compliance efforts for LDPC and its Business Users, we collect information from publicly available sources, third parties (such as credit bureaus), and via the Services we offer. Furthermore, to protect our Services, we may receive details such as IP addresses and other identifying data about potential security threats from third parties. Such information helps us verify identities and prevent fraud.

Compliance with Legal Obligations.

We use Personal Data to meet our contractual and legal obligations related to anti-money laundering, Know-Your-Customer ("KYC") laws, anti-terrorism activities, safeguarding vulnerable customers, export control, and prohibition of doing business with restricted persons or in certain business fields, among other legal obligations. Safety, security, and compliance for our Services are key priorities for us, and collecting and using Personal Data is crucial to this effort.

Minors.

Our Services are not directed to children under the age of 13, and we request that they do not provide Personal Data to seek Services directly from LDPC. In certain jurisdictions, we may impose higher age limits as required by applicable law.

c. Sharing of Personal Data

Besides the sharing of Personal Data described above, we share Personal Data in the ways listed below:

Service Providers or Processors.

In order to provide, communicate, market, analyze, and advertise our Services, we depend on service providers. These providers offer critical services such as providing cloud infrastructure, conducting analytics for the assessment of the speed, accuracy, and/or security of our Services, verifying identities, identifying potentially harmful activity, and providing customer service and audit functions. We authorize these service providers to use or disclose the Personal Data we make available to them to perform services on our behalf and to comply with relevant legal obligations. We require these service providers to contractually commit to security and confidentiality obligations for the Personal Data they process on our behalf.

Others with Consent.

In some situations, we may not offer a service, but instead refer you to others (like professional service firms that we partner with). In these instances, we will disclose the identity of the third party and the information to be shared with them, and seek your consent to share the information.

Corporate Transactions.

If we enter or intend to enter a transaction that modifies the structure of our business, such as a reorganization, merger, sale, joint venture, assignment, transfer, change of control, or other disposition of all or part of our business, assets, or stock, we may share Personal Data with third parties in connection with such transaction. Any other entity that buys us or part of our business will have the right to continue to use your Personal Data, subject to the terms of this Policy.

Compliance and Harm Prevention.

We share Personal Data when we believe it is necessary to comply with applicable law; to abide by rules imposed by Financial Partners in connection with the use of their services; to enforce our contractual rights; to secure and protect the Services, rights, privacy, safety, and property of LDPC, you, and others, including against malicious or fraudulent activity; and to respond to valid legal requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities, which may include authorities outside your country of residence.

3. Legal bases for processing Personal Data

For purposes of the General Data Protection Regulation (GDPR) and other applicable data protection laws, we rely on a number of legal bases to process your Personal Data. For some jurisdictions, there may be additional legal bases, which are outlined in the Jurisdiction-Specific Provisions section below.

a. Contractual and Pre-Contractual Business Relationships.

We process Personal Data to enter into business relationships with prospective Business Users and End Users and fulfill our respective contractual obligations with them. These processing activities include:

• Creation and management of LDPC accounts and LDPC account credentials, including the assessment of applications to initiate or expand the use of our Services; and
• Accounting, auditing, and billing activities.

b. Legal Compliance.

We process Personal Data to verify the identities of individuals and entities to comply with obligations related to fraud monitoring, prevention, and detection, and laws associated with identifying and reporting illicit and illegal activities, such as those under the Anti-Money Laundering ("AML") and Know-Your-Customer (“KYC") regulations. For example, we may be required to record and verify a Business User’s identity to comply with regulations designed to prevent money laundering, fraud, and financial crimes. These legal obligations may require us to report our compliance to third parties and subject ourselves to third party verification audits.

c. Legitimate Interests.

Where permitted under applicable law, we rely on our legitimate business interests to process your Personal Data. The following list provides an example of the business purposes for which we have a legitimate interest in processing your data:

• Detection, monitoring, and prevention of fraud;
• Mitigation of financial loss, claims, liabilities or other harm to End Users, Business Users, and LDPC;
• Determination of eligibility for and offering new LDPC Services;
• Response to inquiries, delivery of Service notices, and provision of customer support;
• Promotion, analysis, modification, and improvement of our Services, systems, and tools, as well as the development of new products and services, including enhancing the reliability of the Services;
• Management, operation, and improvement of the performance of our Sites and Services, through understanding their effectiveness and optimizing our digital assets;
• Analysis and advertisement of our Services, and related improvements;
• Aggregate analysis and development of business intelligence that enable us to operate, protect, make informed decisions about, and report on the performance of our business;
• Sharing of Personal Data with third party service providers that offer services on our behalf and business partners that help us in operating and improving our business;
• Enabling network and information security throughout LDPC and our Services;
• Sharing of Personal Data among our affiliates.

d. Consent.

We may rely on consent or explicit consent to collect and process Personal Data regarding our interactions with you and the provision of our Services such as LDPC Documents® and the Consumer Upload Portal. When we process your Personal Data based on your consent, you have the right to withdraw your consent at any time, and such a withdrawal will not impact the legality of processing performed based on the consent prior to its withdrawal.

e. Substantial Public Interest.

We may process special categories of Personal Data, as defined by the GDPR, when such processing is necessary for reasons of substantial public interest and consistent with applicable law, such as when we conduct politically-exposed person checks. We may also process Personal Data related to criminal convictions and offenses when such processing is authorized by applicable law, such as when we conduct sanctions screening to comply with AML and KYC obligations.

f. Other valid legal bases.

We may process Personal Data further to other valid legal bases as recognized under applicable law in specific jurisdictions. See the Jurisdiction-specific provisions section below for more information.

4. Your rights and choices

Depending on your location and subject to applicable law, you may have choices regarding our collection, use, and disclosure of your Personal Data:

a. Opting out of receiving electronic communications from us

If you wish to stop receiving marketing-related emails from us, you can opt-out by clicking the unsubscribe link included in such emails or as described here. We'll try to process your request(s) as quickly as reasonably practicable. However, it's important to note that even if you opt out of receiving marketing-related emails from us, we retain the right to communicate with you about the Services you receive (like support and important legal notices) and our Business Users might still send you messages or instruct us to send you messages on their behalf.

b. Your data protection rights

Depending on your location and subject to applicable law, you may have the following rights regarding the Personal Data we process about you as a data controller:

• The right to request confirmation of whether LDPC is processing Personal Data associated with you, the categories of personal data it has processed, and the third parties or categories of third parties with which your Personal Data is shared;
• The right to request access to the Personal Data LDPC processes about you;
• The right to request that LDPC rectify or update your Personal Data if it's inaccurate, incomplete, or outdated;
• The right to request that LDPC erase your Personal Data in certain circumstances as provided by law;
• The right to request that LDPC restrict the use of your Personal Data in certain circumstances, such as while LDPC is considering another request you've submitted (for instance, a request that LDPC update your Personal Data);
• The right to request that LDPC export the Personal Data LDPC holds about you to another company, provided it's technically feasible;
• The right to withdraw your consent if your Personal Data is being processed based on your previous consent;
• The right to object to the processing of your Personal Data if LDPC is processing your data based on our legitimate interests; unless there are compelling legitimate grounds or the processing is necessary for legal reasons, we will cease processing your Personal Data upon receiving your objection;
• The right not to be discriminated against for exercising these rights; and
• The right to appeal any decision by LDPC relating to your rights by contacting LDPC’s Data Protection Officer (“DPO”) at support@ldp-corp.com, and/or relevant regulatory agencies.

You may have additional rights, depending on applicable law, over your Personal Data. For example, see the Jurisdiction-specific provisions section under United States below.

c. Process for exercising your data protection rights

To exercise your data protection rights related to Personal Data we process as a data controller, visit our Privacy Center or contact us as outlined below. For Personal Data we process as a data processor, please reach out to the relevant data controller (Business User) to exercise your rights. If you contact us regarding your Personal Data we process as a data processor, we will refer you to the relevant data controller to the extent we are able to identify them.

5. Security and Retention

We make reasonable efforts to provide a level of security appropriate to the risk associated with the processing of your Personal Data. We maintain organizational, technical, and administrative measures designed to protect the Personal Data covered by this Policy from unauthorized access, destruction, loss, alteration, or misuse. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure.

We encourage you to assist us in protecting your Personal Data. If you hold an LDPC account, you can do so by using a strong password, safeguarding your password against unauthorized use, and avoiding using identical login credentials you use for other services or accounts for your LDPC account. If you suspect that your interaction with us is no longer secure (for instance, you believe that your LDPC account's security has been compromised), please contact us immediately.

We retain your Personal Data for as long as we continue to provide the Services to you or our Business Users, or for a period in which we reasonably foresee continuing to provide the Services. Even after we stop providing Services directly to you or to a Business User that you're doing business with, and even after you close your LDPC account or complete a transaction with a Business User, we may continue to retain your Personal Data to:

• Comply with our legal and regulatory obligations;
• Enable fraud monitoring, detection, and prevention activities;
• Comply with our tax, accounting, and financial reporting obligations.

In cases where we keep your Personal Data, we do so in accordance with any limitation periods and record retention obligations imposed by applicable law.

6. Updates and notifications

We may change this Policy from time to time to reflect new services, changes in our privacy practices or relevant laws. The “Last updated” legend at the top of this Policy indicates when this Policy was last materially revised. Any changes are effective the latter of when we post the revised Policy on the Services or otherwise provide notice of the update as required by law.

We may provide you with disclosures and alerts regarding the Policy or Personal Data collected by posting them on our website and, if you are an End User or Representative, by contacting you through your LDPC Dashboard, email address and/or the physical address listed in your LDPC account.

7. Jurisdiction-specific provisions

United States.

If you are a consumer located in the United States (“US”), we process your personal information in accordance with US federal and state privacy laws. For additional details, please review the information below and see our additional U.S. Privacy Disclosures here.

Your Rights and Choices.

As a US consumer and subject to certain limitations under US privacy laws, you may have choices regarding our use and disclosure of your Personal Data. In addition to the above rights, you may also have the rights listed in this section. Please see our Privacy Center to learn more about data subject rights metrics and learn more about the laws under which these rights may apply.

• Exercising the right to know: You have a right to request additional information about the categories of personal information collected, sold, disclosed, or shared; purposes for which this personal information was collected, sold, or shared; categories of sources of personal information; and categories of third parties with whom we disclosed or shared this personal information.
• Exercising the right to opt-out from a sale or sharing: We do not transfer your personal data to third parties in exchange for payment. However, as noted above, we may provide the data to third party partners, such as advertising partners, analytics providers, and social networks, who assist us in advertising our products and Services to you. Because these third parties may use the data LDPC provides for their own purposes, LDPC's provision of data to these parties may be considered a data “sale” or “sharing” (for behavioral advertising) as those terms are defined under the CCPA and other applicable US privacy laws. You can opt out of targeted advertising and any related data “sales” or “sharing” (for behavioral advertising) by contacting support@ldp-corp.com.
• Exercising the right to limit the use or sharing of Sensitive Personal Information: We do not sell or share (for behavioral advertising) Sensitive Personal Information as defined by US privacy laws and have not done so in the past 12 months.

Profiling with legal or similarly significant effects.

In the event that we engage in profiling or automated decision making for which applicable law entitles you to an opt out we will provide you with notice of how to exercise that opt-out right.

Appeal.

If you wish to appeal any of our decisions regarding a rights request under US privacy laws, you may do so by contacting LDPC’s Data Protection Officer (“DPO”) at support@ldp-corp.com.

• To submit a request to exercise any of the rights described above, please contact us using the methods described in the Contact Us section below. Please note that rights under some U.S. state laws do not apply to Personal Data we collect, process, and disclose when you act as a consumer to obtain financial products or services from LDPC for personal, family, or household purposes. The federal Gramm-Leach Bliley Act may govern how LDPC shares and protects that data instead. See our US Consumer Privacy Notice below for more information.
• We will verify your request by asking you to send it from the email address associated with your account or requiring you to provide information necessary to verify your identity, including name, address, transaction history, photo identification, and other information associated with your account.
• You may designate, in writing or through a power of attorney, an authorized agent to make requests on your behalf to exercise your rights under the CCPA and other applicable US privacy laws. Your agent may submit a request on your behalf by contacting us using the methods described in the Contact Us section below. We may still require you to directly verify your identity and confirm that you gave the authorized agent permission to submit the request.

9. Contact us

If you have any questions or complaints about this Policy, please contact us at support@ldp-corp.com.

10. US Consumer Privacy Notice

The following Consumer Privacy Notice applies to you if you are an individual who resides in the United States and obtains financial services from LDPC primarily for your own personal, family, or household purposes.

Last updated: January 19th, 2025