Consumer Financial Privacy & Data Protection Policy

Effective Date: January 1, 2026 | Last Updated: October 2026

Kartikay Escrow Corporation ("we," "us," or "our") is dedicated to safeguarding your non-public personal information (NPI). As an independent California fiduciary licensed by the Department of Business Oversight (DBO), we uphold the highest standard of data confidentiality, cybersecurity encryption, and statutory consumer rights under the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), and the federal Gramm-Leach-Bliley Act (GLBA).

1. Categories of Non-Public Personal Information (NPI) Collected

In order to execute settlement agreements and fulfill real estate escrow mandates, we collect the following categories of information over the preceding 12 months:

• Personal Identifiers: Legal names, physical home/business addresses, telephone numbers, email addresses, Social Security Numbers (SSN), Employer Identification Numbers (EIN), and government-issued photo identification (passports, driver's licenses).
• Financial & Settlement Data: Bank account numbers, wire coordinates, mortgage loan payoff statements, loan approval terms, tax prorations, earnest money deposits, and settlement accounting figures.
• Real Property Records: Property deeds, title reports, purchase contracts, HOA documentation, entity corporate resolutions, trust agreements, and hazard disclosure reports.
• Digital & Network Activity: Internet Protocol (IP) addresses, browser type, operating system, and secure portal interaction logs generated when accessing our digital services for fraud-prevention purposes.

2. Methods of Data Collection

We obtain information directly and indirectly through the following channels:

• Directly from You: Via escrow opening sheets, telephone consultations, secure document upload portals, written instructions, and emails.
• From Authorized Third Parties: From entities directly involved in your transaction, such as real estate brokers, mortgage lenders, title insurance companies, legal counsel, and tax authorities.
• Automated Technologies: Via security monitoring tools on our website and encrypted document delivery platforms designed to log IP addresses and timestamps for digital signature verification.

3. Federal Gramm-Leach-Bliley Act (GLBA) Compliance

As a provider of financial settlement services, Kartikay Escrow Corporation complies strictly with the GLBA. We recognize our continuing obligation to respect the privacy of our clients and to protect the security and confidentiality of clients' non-public personal information. We do not disclose any NPI to non-affiliated third parties, except as permitted or required by law to process your transaction.

4. Strictly Permitted Fiduciary Disclosures

We disclose non-public personal information only to parties directly necessary to consummate your transaction or as explicitly required by state and federal law. These permitted disclosures include:

• Title insurance underwriters to issue preliminary reports and final title policies.
• Mortgage lenders and loan servicers to secure payoffs, clarify demands, and fund new financing.
• County recorder offices for the public recording of grant deeds and deeds of trust.
• The Internal Revenue Service (IRS) and California Franchise Tax Board (FTB) for statutory 1099-S reporting and Form 593 withholding compliance.
• The California Department of Business Oversight (DBO) and Escrow Agents Fidelity Corporation (EAFC) during official regulatory compliance audits.

5. Cybersecurity & Technical Safeguards

We maintain rigorous administrative, technical, and physical safeguards designed to prevent unauthorized access, loss, or disclosure of NPI:

• AES-256 Bit Encryption: All data in transit and at rest is protected with military-grade 256-bit encryption protocols.
• Multi-Factor Authentication (MFA): Internal escrow software systems mandate biometric or token-based MFA for all escrow staff.
• Air-Gapped Trust Accounting: Trust fund disbursements and wire transfers are segregated behind multi-tiered authorization protocols requiring dual-officer callback verification to prevent wire fraud.

6. Data Breach Notification Protocol

In the highly unlikely event of a data security incident that compromises your unencrypted personal information, Kartikay Escrow Corporation is committed to fully complying with the California Data Breach Notification Law (Civ. Code § 1798.82). We will notify affected consumers, the California Attorney General, and appropriate regulatory bodies without unreasonable delay, detailing the nature of the breach, the data involved, and the mitigation steps taken.

7. Your California Consumer Privacy Rights (CCPA / CPRA)

California residents enjoy specific rights regarding their personal information. Subject to legal and fiduciary exceptions, you possess the:

• Right to Know & Access: You may request disclosure of the specific pieces and categories of personal information we have collected about you over the past 12 months.
• Right to Correct: You may request the correction of inaccurate personal information maintained in our active systems.
• Right to Delete: You may request the deletion of your personal data, subject to strict statutory exceptions (see Section 8 regarding statutory retention mandates).
• Right to Limit Use of Sensitive Data: You may direct us to limit the use of your sensitive personal information to exactly what is necessary to perform our escrow services.
• Right to Non-Discrimination: We will never discriminate against you, alter our escrow service fees, or deny services for exercising any of your statutory privacy rights.

8. Statutory 5-Year Record Retention Mandate (CCPA Exemption)

Please note that under California Financial Code § 17404 and DBO regulations, independent escrow companies are legally mandated to retain complete records of all escrow transactions, closed files, written instructions, accounting ledgers, and canceled checks for a minimum of five (5) years following the close of escrow. Consequently, deletion requests under the CCPA/CPRA cannot override statutory record-keeping obligations required by state regulatory bodies or the GLBA.

9. Cookies, Do Not Track (DNT), and Tracking Technologies

Our website utilizes necessary session cookies solely to maintain secure form transmission, verify session integrity, and prevent Cross-Site Request Forgery (CSRF). We do not deploy third-party advertising cookies or cross-context behavioral tracking scripts.

Do Not Track / Global Privacy Control: Because we do not track our users across third-party websites or sell data, our website does not uniquely respond to "Do Not Track" browser signals. We respect Global Privacy Control (GPC) signals by default, as no commercial data sharing occurs on our platform.

10. Children's Online Privacy Protection Act (COPPA)

Our website and escrow services are not directed toward children under the age of 18. We do not knowingly collect, solicit, or maintain personal information from anyone under the age of 18. If we learn that we have inadvertently collected personal information from a minor without verifiable parental consent, we will delete that information as quickly as possible.

11. Third-Party Links

Our website may contain links to third-party entities, such as county tax assessors, title companies, or regulatory bodies. Kartikay Escrow Corporation is not responsible for the privacy practices, data collection protocols, or content of these external websites. We encourage clients to read the privacy policies of any external site they visit.

12. Policy Updates & Modifications

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in California law, federal financial regulations, or our operational practices. When material changes are made, we will post the revised policy on this page with an updated "Effective Date." We encourage you to review this policy periodically.

13. Designated Fiduciary Privacy Officer Contact

To submit a verifiable consumer privacy inquiry, exercise your CCPA/CPRA access rights, or verify our document retention protocols, please contact our designated compliance officer using the details below. We will respond to verifiable consumer requests within 45 days of receipt.