Data Protection & Security Policy

11. Purpose and Relationship to Other Policies

This Data Protection & Security Policy establishes the standards that Correia Solutions LLC dba Correia Financial (“Correia Financial,” “Company,” “we,” “us” or “our”) requires for handling and protecting personal, financial and business information in connection with our commercial financing brokerage services.

Its objectives are to protect information from unauthorized access, use, alteration, disclosure, loss and destruction; maintain appropriate availability and integrity; and support applicable legal, contractual and privacy obligations.

This Policy describes required practices and responsibilities. It is not a representation that every system has been independently audited or certified, and it does not guarantee that a security incident can never occur. Detailed configurations, assessment results, access records and incident procedures are maintained internally rather than published as security-sensitive information.

Our Privacy Policy explains the information we collect, the purposes of processing, permitted disclosures, retention criteria and privacy choices. Our Terms and Conditions address the brokerage relationship. This Policy supplements those documents and does not expand consent, authorize unrelated processing, waive privacy rights or replace any legally required notice or security program.

22. Scope

These standards apply to Company-controlled information and systems and to employees, contractors and other authorized personnel handling information for us. Relevant obligations must be addressed in service-provider arrangements as appropriate to the service and risk. Clients' responsibilities are described separately in Section 17.

The scope includes applications, business bank statements, tax records, identification documents, contact details, electronic signatures, lender submissions, customer communications, call recordings and transcripts, referral records and security logs. It also includes relevant email, messaging, document storage, customer relationship management systems, AI tools, websites, devices, integrations, backups and paper records.

Independent financing providers operate their own systems and remain responsible for their own obligations. This does not eliminate our responsibility for selecting appropriate submission methods and safeguarding information while it is under our control.

33. Accountability and Oversight

Company management is responsible for assigning security responsibilities, approving systems and access, reviewing material risks and ensuring that identified deficiencies are addressed. Jonathan Correia is the designated contact for security matters and coordinates escalation to the appropriate technical, legal, insurance or service-provider resources.

Personnel must follow these standards, complete relevant training and promptly report suspected incidents. Access to client information is a business responsibility, not permission to use information for personal purposes or outside assigned duties.

Where applicable law requires a specifically qualified security individual, written risk assessment, management report or other formal governance measure, the Company must satisfy that requirement. Merely identifying a contact in this Policy does not establish a person's statutory qualifications or certify compliance.

44. Information Classification

Information must be handled according to its sensitivity and content, not merely the name of the file or system holding it.

The highest applicable classification governs a combined record. An application, conversation or transcript containing an account number or Social Security number must be treated as restricted. A record does not become public because it is emailed, uploaded or accessible through a link.

55. Collection, Inventory and Data Minimization

The Company must identify the principal categories of information it handles, the systems and providers that receive it, the purpose of collection and the persons or roles allowed access. Material changes to those information flows require review.

Collect and retain only information reasonably necessary for an identified brokerage, security, legal or administrative purpose. Request sensitive identifiers only when relevant. Personnel must not request online banking passwords or one-time authentication codes. Any authorized account-connection service must use its approved authentication process.

Avoid unnecessary duplication of applications and financial documents. Where practical, redact or mask sensitive details when the complete record is not required. Information used for development, demonstrations or training must be synthetic or appropriately deidentified unless a documented, lawful need and adequate safeguards justify using real records.

66. Access Controls and Authentication

Access must be approved according to job responsibilities and limited to the information and functions needed. Individual accounts must be used where supported; personnel must not share personal logins. Administrative privileges must be limited, separated from ordinary access where feasible and reviewed when roles change.

Strong, unique credentials and approved credential-management methods are required. Multifactor authentication is required for administrative access and access to systems holding restricted information where supported. Where a system lacks support, management must evaluate a documented alternative control or replacement; an exception cannot override a legal requirement.

Access must be reviewed periodically, after material role changes and when concerns arise. Unneeded access, integration credentials and sharing permissions must be removed promptly when a person or provider no longer requires them. Suspected compromised credentials must be reset or revoked through an appropriate incident response process.

77. Storage, Encryption and Transmission

Restricted and confidential information must be stored in approved systems with access restrictions appropriate to the data. Restricted information must be encrypted in storage and during electronic transmission, or protected by a documented legally permissible alternative where a particular system cannot support the required encryption. Convenience alone does not justify an exception.

Personnel must use approved protected portals, document-sharing tools or other appropriately secured methods for sensitive submissions. Encryption in transit helps protect transmission but does not prevent misuse by an authorized recipient, compromise of an endpoint or disclosure caused by an incorrect address.

Before sending information, confirm the recipient, authorization, purpose and attachments. Use restricted links and expiration settings where available and appropriate. Public or unrestricted links must not be used for restricted records. Ordinary SMS is not an approved channel for full Social Security numbers, complete account credentials, tax returns or bank statements.

If sensitive information arrives through an unsuitable channel, personnel must handle it securely, guide the sender to an appropriate method and limit unnecessary further copies. Do not redistribute the information merely because the sender used an insecure channel.

88. Devices, Networks and Physical Records

Devices used for Company information must have appropriate authentication, automatic screen locking, supported software and timely security updates. Device encryption and malware protection must be used where appropriate to the device and sensitivity of information. Lost or compromised devices must be reported promptly.

Personal devices may access Company information only when approved and subject to suitable controls. Restricted documents must not be placed in personal email accounts, unapproved cloud storage or publicly accessible folders. Remote work must protect screens, documents and conversations from unauthorized access.

Paper files must be limited to legitimate needs, secured when unattended and accessible only to authorized persons. Visitors must not have unsupervised access to client records or workstations. Records must not be left in public areas or unsecured vehicles. Equipment and storage media require appropriate sanitization before reuse or disposal.

99. System Configuration, Changes and Security Review

Systems and integrations must be configured to limit unnecessary exposure, permissions and services. Security updates and vulnerabilities must be assessed and addressed according to severity, exploitation risk and system importance. Unsupported software holding sensitive information must be replaced or subject to a documented remediation plan and lawful protective measures.

Changes affecting data access, authentication, tracking, storage or integrations require appropriate review before release. Credentials, private keys and API secrets must not be embedded in public source code, browser-visible code, public documents or ordinary logs.

Security logging and monitoring must be appropriate to the system and available capabilities, including relevant access, permission changes, exports and suspicious activity. Logs must be protected from unauthorized access or alteration and must not unnecessarily record sensitive document contents or credentials. This Policy does not represent that every system is monitored continuously by a dedicated security team.

Risk assessments, vulnerability reviews and control testing must occur at intervals appropriate to risk, following material changes and as required by law. Findings require assigned responsibility and remediation tracking.

1010. Providers, Lenders and Authorized Disclosures

Before authorizing a provider to handle sensitive information, the Company must assess safeguards relevant to the proposed service and information involved. Review may include access controls, security documentation, data location, retention, incident reporting, subcontractors and termination practices. Certifications may inform review but do not guarantee security or legal compliance.

Appropriate contractual provisions must address confidentiality, permitted use, safeguards, incident cooperation and return or deletion of information, subject to legal retention requirements. Provider access must be limited to its authorized function and reviewed as risk or services change.

Applications may be submitted to authorized financing providers and placement intermediaries as described in the Privacy Policy and applicable application authorizations. Verify destinations and limit disclosures to the requested process. Independent providers may have their own legal retention and processing responsibilities.

Referral partners are not automatically entitled to bank statements, tax returns, identification documents or complete applications. Any status or commission-related disclosure must be authorized, appropriate and limited to its purpose. SMS consent is not transferred as permission for another party's independent marketing.

1111. Artificial Intelligence and Automated Processing

Maverick and other approved tools may process applications, bank statements and customer conversations to support document organization, summaries, preliminary review, matching and follow-up activities described in the Privacy Policy.

Personnel may use only Company-approved AI services for restricted or confidential information. Approval must consider the provider's security, contractual terms, retention settings, training practices, access permissions and any subprocessors. Unapproved public AI accounts or tools must not receive client records.

Uploading sensitive information must be limited to the relevant task. Provider use of client data for general-purpose model training or other unrelated purposes must not be enabled without a separate documented assessment, a lawful basis and any required notice or consent. A general website acceptance is not blanket authorization for unrelated AI processing.

AI outputs must be treated according to the sensitivity of their source information. Personnel must review material summaries and conclusions before relying on them for consequential brokerage actions or communicating them as verified facts. Automated outputs do not constitute lender approvals. Suspected errors, inappropriate disclosures and unexpected tool behavior must be reported and investigated.

1212. Website Tracking and Advertising Separation

Analytics and advertising tools must be reviewed to prevent unintended collection of application contents or financial documents. Restricted information must not be included in URLs, advertising event payloads, tracking parameters, audience uploads or session-replay recordings.

Advertising pixels and replay tools must be excluded from sensitive forms, upload areas and authenticated document views unless a documented review establishes that their operation cannot expose protected contents and is otherwise lawful. Server-side tracking and tag-manager changes require the same attention as browser tracking.

Applicable cookie preferences, advertising opt-outs and legally required browser preference signals must be reflected in actual configurations and tested after relevant changes. A statement in a policy is not a substitute for implementing the required control.

1313. Communications and Social Engineering

Personnel must verify unusual requests for data exports, recipient changes, bank-detail changes, credential resets or urgent payments using a reliable, independently verified method. Do not rely solely on an incoming email, altered invoice or text message to approve a sensitive change.

Call recordings, transcripts and message histories must have access and retention controls appropriate to their contents. Recording and transcription must comply with applicable notice and consent requirements. Opt-out and suppression information must be protected and used to honor communication preferences.

Personnel must be trained to recognize phishing, impersonation, suspicious attachments, fraudulent statements and other threats relevant to their duties. Required training must be provided before access where appropriate and refreshed periodically and after relevant incidents or changes.

1414. Retention, Deletion and Legal Holds

Information must be retained only as long as reasonably necessary for the purposes described in the Privacy Policy, applicable agreements and legal obligations. Management must maintain retention criteria or schedules by record category rather than treating all records as permanent.

Factors include application status, financing-related recordkeeping, accounting requirements, fraud prevention, disputes and legal holds. Limited consent and suppression records may be retained to demonstrate permissions and prevent unwanted communications. Deletion requests must be evaluated under applicable law and the Privacy Policy.

When retention is no longer justified, information must be securely deleted, deidentified or destroyed using a method appropriate to the medium. Paper records must be shredded or handled through an appropriate confidential destruction process. Electronic media must be sanitized or securely destroyed before disposal where necessary.

Backups may retain information until their scheduled expiration, subject to restricted access and applicable obligations. Restoring a backup must not silently defeat a previously honored deletion or opt-out request; relevant restrictions must be reapplied where required. A legal hold suspends routine destruction of relevant records until properly released.

1515. Backups and Business Continuity

Critical records and systems must have backup and recovery arrangements appropriate to their importance and risk. Backup access, storage and encryption must reflect the sensitivity of the underlying information. Recovery procedures must be tested periodically and after significant changes where appropriate.

Continuity planning must address system outages, loss of access, compromised accounts and interruption of essential providers. Restoration must prioritize safe operation and data integrity. There is no promise of uninterrupted service, immediate recovery or zero data loss; any specific service-level commitment must be established separately.

1616. Security Incident Response and Notifications

A security incident may include unauthorized access, a lost device, an incorrect recipient, exposed documents, compromised credentials, malware, suspicious data exports or a provider breach. A suspected incident must be reported promptly even when its full impact is unknown.

The response must be proportionate to the event and include, as appropriate:

1. Assess and contain: identify affected systems and take reasonable steps to limit ongoing exposure, including restricting access, revoking credentials or isolating affected resources when appropriate.
2. Preserve evidence: protect relevant logs, communications and records. Avoid unnecessary deletion or alteration that could interfere with investigation or legal obligations.
3. Investigate: determine the information and individuals affected, likely cause, unauthorized activity and relevant provider involvement.
4. Coordinate: engage appropriate management, technical support, counsel, insurers, providers and authorities as necessary. Internal consultations must not improperly delay required notification.
5. Notify: provide notices to affected individuals, business partners, regulators or other recipients when required by applicable law or contract, within the applicable deadlines and with required content.
6. Recover and improve: restore services safely, address identified weaknesses, document the response and reassess controls.

Not every security event is a legally reportable breach. Notification decisions must be based on the facts and applicable requirements, not solely on the Company's preference or whether an investigation is complete. Where required, initial notices must be provided and supplemented as information becomes available.

1717. Client Responsibilities and Assistance

Clients should protect credentials, use the document-submission method we designate, keep contact information current and promptly report suspected impersonation or unauthorized access. Do not disclose authentication codes or passwords in response to an unsolicited request.

Before submitting information about another person, ensure you have appropriate authority and provide required notices. If you receive information that appears intended for someone else, notify us, do not use or redistribute it, and follow reasonable secure-handling instructions.

Clients may contact us for assistance with secure submission. These responsibilities do not transfer the Company's security obligations to clients or waive rights available under law.

1818. Security Reports and Privacy Requests

Report suspected data exposure, account compromise, phishing involving our name or a website vulnerability to jonathan@correiafinancial.biz or (619) 387-5891. Include a description, approximate time, affected service and safe contact information. Do not send passwords, full account numbers or unnecessary copies of exposed records.

A security report is not authorization to access another person's information, bypass controls, disrupt a system or conduct further testing. If you discover an apparent exposure, stop accessing the affected material and report the minimum information reasonably necessary to identify it.

For access, correction, deletion, advertising opt-outs or other privacy requests, contact info@correiafinancial.biz. Requests are handled under our Privacy Policy, including appropriate identity verification and applicable deadlines. Information provided to verify a request must itself be protected and limited to the verification purpose and related lawful recordkeeping.

1919. Review, Exceptions and Enforcement

Management must review this Policy at least annually and after material changes in services, providers, information handling, legal obligations or significant incidents. Personnel and providers must receive relevant updates through appropriate channels.

Exceptions to a required control must be documented, justified by a specific business or technical need, approved by management, time-limited where appropriate and accompanied by suitable alternative safeguards and remediation plans. An exception cannot waive applicable law, required consent or a binding contractual obligation. Identified gaps must be addressed according to their risk and urgency.

Violations may result in restricted access, corrective training, disciplinary action, termination of a relationship or legal action where appropriate and lawful. Personnel must not retaliate against good-faith reporting of security concerns.

The applicability of financial privacy, security, breach-notification and other requirements depends on the Company's activities, information and governing law. This Policy is not a claim of universal regulatory compliance, a security certification or a substitute for any more detailed security program required by law.

2020. Changes and Contact Information

We may update this Policy as our practices, risks or obligations change. We will update the revision date and provide additional notice or obtain consent where required. Posting a revision does not retroactively authorize unrelated processing or eliminate existing legal duties.