Privacy Policy

Introduction and Scope

This Privacy Policy ("Policy") describes how Marcus Naulin, an individually licensed mortgage planner and real estate professional operating through the website https://marcusnaulin.com (collectively, "we," "us," or "our"), collects, uses, discloses, retains, secures, and otherwise processes Personal Information about consumers, prospective clients, clients, business associates, website visitors, telephone callers, and SMS/MMS recipients (collectively, "you" or "User"). This Policy applies to all interactions with the Site and any related communications, lead-capture forms, telephone calls, voicemails, electronic mail, short message service (SMS) and multimedia message service (MMS) text messages, mobile applications, and offline interactions arising from your engagement with us.

We are committed to processing Personal Information lawfully, fairly, and transparently. This Policy is designed to satisfy the substantive disclosure requirements of, among other authorities: the Federal Trade Commission Act, 15 U.S.C. § 45; the Gramm–Leach–Bliley Act ("GLBA"), 15 U.S.C. §§ 6801–6809 and Regulation P, 12 C.F.R. Part 1016; the Telephone Consumer Protection Act ("TCPA"), 47 U.S.C. § 227 and 47 C.F.R. § 64.1200; the CAN-SPAM Act of 2003, 15 U.S.C. §§ 7701–7713; the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA"), Cal. Civ. Code §§ 1798.100 et seq.; the Virginia Consumer Data Protection Act ("VCDPA"); the Colorado Privacy Act ("CPA"); the Connecticut Data Privacy Act ("CTDPA"); the Utah Consumer Privacy Act ("UCPA"); the Texas Data Privacy and Security Act ("TDPSA"); the Oregon Consumer Privacy Act; the Montana Consumer Data Privacy Act; the Tennessee Information Protection Act; the Iowa Consumer Data Protection Act; the Indiana Consumer Data Protection Act; the Delaware Personal Data Privacy Act; the New Hampshire Privacy Act; the New Jersey Data Privacy Act; the Minnesota Consumer Data Privacy Act; the Maryland Online Data Privacy Act; the Rhode Island Data Transparency and Privacy Protection Act; the Illinois Biometric Information Privacy Act ("BIPA"), 740 ILCS 14/1 et seq.; the Texas Capture or Use of Biometric Identifier Act ("CUBI"), Tex. Bus. & Com. Code § 503.001; the Washington Biometric Identifiers Act, Wash. Rev. Code § 19.375; the Children's Online Privacy Protection Act ("COPPA"), 15 U.S.C. §§ 6501–6506; the Fair Credit Reporting Act ("FCRA"), 15 U.S.C. §§ 1681 et seq.; the Equal Credit Opportunity Act ("ECOA"), 15 U.S.C. § 1691; the Fair Housing Act ("FHA"), 42 U.S.C. §§ 3601 et seq.; the Real Estate Settlement Procedures Act ("RESPA"), 12 U.S.C. § 2601; the Truth in Lending Act ("TILA"), 15 U.S.C. § 1601; the Electronic Signatures in Global and National Commerce Act ("ESIGN"), 15 U.S.C. §§ 7001–7031; and the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") where applicable to data subjects in the European Economic Area, United Kingdom, or Switzerland.

By accessing the Site, providing your contact information through any lead-capture mechanism, calling us, or otherwise transmitting Personal Information to us, you acknowledge that you have read, understood, and consented to the practices described in this Policy. If you do not agree, do not use the Site or transmit Personal Information to us.

Definitions and Interpretation

Capitalized terms have the meanings set forth below. Where a term is defined by a federal or state privacy statute that applies to a particular User, the statutory definition controls for that User and that processing activity.

Categories of Personal Information We Collect

We collect the categories of Personal Information identified below from the sources described in the next section. The list is comprehensive but not exhaustive; we collect only what is reasonably necessary, relevant, and proportionate to the disclosed purposes.

A. Identifiers

• Full legal name, prior names, aliases, signature, postal address (including prior addresses for mortgage application history), telephone number(s), mobile number(s), email address, and account username.
• Government-issued identifiers including Social Security number, individual taxpayer identification number (ITIN), driver's license number, state identification number, passport number, and date of birth, where collected for purposes of mortgage origination, identity verification, anti-money-laundering compliance, or RESPA-mandated disclosures.
• Internet Protocol (IP) address, device identifier, mobile advertising identifier, persistent cookie identifier, and other unique online identifiers.

B. Customer Records and Financial Information (GLBA Nonpublic Personal Information)

• Income, employment status, employer, length of employment, occupation, salary, bonuses, self-employment income, and other compensation.
• Bank account, brokerage, retirement, and other financial-account numbers and balances.
• Credit report data, FICO and other credit scores, credit-history detail, public-record items, debts, liens, judgments, bankruptcies, and tradeline data.
• Real estate ownership records, property addresses, valuations, appraisal results, insurance policy details, escrow records, payment history, and loan-servicing records.
• Tax returns, W-2 forms, 1099 forms, paystubs, profit-and-loss statements, and balance sheets.

C. Protected-Class Characteristics (Limited)

For mortgage and credit transactions, applicable federal regulations under the Home Mortgage Disclosure Act ("HMDA"), 12 U.S.C. § 2801, and Regulation B, 12 C.F.R. Part 1002, require collection of certain demographic information including ethnicity, race, sex, age, and marital status. This information is collected solely for monitoring compliance with anti-discrimination laws and is not used as a basis for any underwriting decision.

D. Commercial Information

Records of products or services purchased or considered, transaction history, lead source, referral source, and consumer preferences.

E. Internet and Network Activity Information

Browsing history on the Site, search history within the Site, page views, click paths, time spent on pages, search queries used to reach the Site, referring URL, browser type, operating system, language preference, screen resolution, time zone, interactions with email and SMS communications including opens, clicks, replies, and unsubscribe events, and information about interactions with our advertisements.

F. Geolocation Data

Coarse geolocation derived from IP address (typically city or ZIP code level). We do not knowingly collect precise geolocation (within 1,850 feet) without your express, separate, and revocable consent.

G. Audio, Electronic, Visual, and Similar Information

Voice recordings of inbound and outbound telephone calls (where lawful and disclosed), voicemail messages, video conference recordings (where you consent on the record), photographs and identification document images submitted for identity verification, and electronic signatures.

H. Professional or Employment-Related Information

Current and former employer details, job title, length of employment, supervisor contact, business references, and self-employment business records.

I. Inferences

Inferences drawn from any of the above to create a profile reflecting your preferences, characteristics, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes — used solely to recommend appropriate loan products, real-estate options, and communication frequency.

J. Sensitive Personal Information

Government identifiers, full financial account numbers, precise geolocation (only with separate consent), racial or ethnic origin (HMDA-required only), and biometric identifiers (only as separately disclosed in our Biometric Information Privacy Policy and only with separate written informed consent).

K. Categories Not Collected

We do not knowingly collect: genetic data, mail content not addressed to us, content of communications between you and a third party, sexual orientation or gender identity unless you affirmatively volunteer it, religious or philosophical beliefs, union membership, or data of children under sixteen (16).

Sources of Personal Information

We collect Personal Information from the following categories of sources:

• Directly from you, when you complete a contact form, lead-capture form, loan application, real-estate inquiry, telephone call, SMS exchange, email, or other voluntary submission.
• From your device, automatically through cookies, pixels, web beacons, server logs, software-development kits, and similar technologies as described in our Cookie Policy.
• From third-party data sources, including consumer reporting agencies (Experian, Equifax, TransUnion), public records, multiple-listing services (MLS), county recorder offices, secretary-of-state databases, employer-verification services (e.g., The Work Number), bank-statement aggregators (e.g., AccountChek, Plaid), tax-transcript services, fraud-prevention vendors, identity-verification vendors, real-estate data providers (e.g., CoreLogic, Black Knight), and lead-generation partners.
• From referral partners, including real-estate agents, attorneys, financial advisors, insurance agents, accountants, builders, prior clients, and friends or family members who refer you to us.
• From public sources, including government licensing databases, court records, social-media profiles you make public, news archives, and corporate registries.
• From co-borrowers, guarantors, and authorized third parties whom you have designated to share information with us.

Purposes for Which We Process Personal Information

We process Personal Information for the purposes identified below. Each processing activity is supported by at least one of the following lawful bases: (i) your consent; (ii) performance of a contract or pre-contractual steps at your request; (iii) compliance with a legal obligation; (iv) protection of vital interests; (v) performance of a task in the public interest; or (vi) our legitimate interests, where those interests are not overridden by your fundamental rights and freedoms.

1. Originate and process mortgage loan applications, including pre-qualification, pre-approval, full underwriting, document collection, credit analysis, appraisal coordination, title and escrow coordination, lender placement, rate-lock administration, conditions clearance, and closing.
2. Provide real-estate brokerage services, including buyer representation, seller representation, listing services, comparative market analysis, showings, negotiations, transaction coordination, and post-closing follow-up.
3. Communicate with you by telephone, voicemail, SMS, MMS, email, and postal mail regarding inquiries, applications, transactions, conditions, status updates, document requests, scheduling, market updates, and customer service.
4. Send marketing communications — only to the extent permitted by your preferences and applicable law — including newsletters, market reports, rate alerts, product announcements, educational materials, and promotional offers.
5. Verify identity and prevent fraud, identity theft, money laundering, or other unauthorized activity, including through the Federal Financial Institutions Examination Council Customer Identification Program ("CIP") requirements and Office of Foreign Assets Control ("OFAC") screening.
6. Comply with legal obligations, including HMDA reporting, suspicious-activity reporting under the Bank Secrecy Act, IRS reporting, state and federal licensing reporting, recordkeeping, audits, regulatory examinations, subpoenas, court orders, and law-enforcement requests.
7. Operate, maintain, secure, and improve the Site and related services, including troubleshooting, analytics, A/B testing, accessibility improvements, and content personalization.
8. Protect rights and safety, including investigating suspected violations of our Terms, defending against legal claims, and protecting the rights, property, or safety of any person.
9. Pursue corporate transactions, including mergers, acquisitions, divestitures, financings, due diligence, restructurings, and bankruptcy proceedings (subject to confidentiality undertakings and applicable law).
10. Aggregate, anonymize, and de-identify Personal Information for statistical analysis and business intelligence; once de-identified consistent with applicable law, the information is no longer Personal Information.

How We Use SMS, MMS, and Telephone Communications — TCPA Disclosure

Channels and Frequency

Message frequency varies and is typically up to fifteen (15) messages per month per active inquiry or transaction, and up to four (4) messages per month for ongoing newsletter or rate-alert subscribers. Message and data rates may apply — check with your wireless carrier.

Supported Carriers

We support all major U.S. wireless carriers including AT&T, T-Mobile, Verizon Wireless, U.S. Cellular, Boost Mobile, Cricket Wireless, Metro by T-Mobile, Mint Mobile, Visible, Spectrum Mobile, and Xfinity Mobile. Carriers are not liable for delayed or undelivered messages.

Opt-Out (Revoke Consent)

You may opt out of all SMS communications at any time by replying STOP, END, QUIT, CANCEL, UNSUBSCRIBE, or OPTOUT to any message you receive from us. We will deliver one final confirmation message acknowledging your opt-out, after which no further marketing or autodialed messages will be sent. Transactional messages reasonably necessary to complete an active loan or real-estate transaction may continue with your separate written authorization or as required to perform our contract with you. To revoke consent for telephone calls, simply tell the caller you withdraw consent or send written revocation to contact@marcusnaulin.com.

Help

For help, reply HELP to any message, email contact@marcusnaulin.com, or call (805) 377-5626.

No Sale or Sharing of Mobile Information

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. All categories above exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Federal Do-Not-Call

If you are listed on the National Do Not Call Registry, we will not place telemarketing calls to you absent your express written consent or an established business relationship as defined at 47 C.F.R. § 64.1200(f)(5).

State Mini-TCPA Statutes

We comply with state consumer-call statutes including the Florida Telephone Solicitation Act (Fla. Stat. § 501.059), the Oklahoma Telephone Solicitation Act, the Washington Commercial Electronic Mail Act, and similar laws in other states. Where state law imposes more stringent consent or opt-out requirements, the more stringent requirement controls.

Call Recording

Telephone calls may be monitored or recorded for quality assurance, training, and recordkeeping. Where a one-party consent jurisdiction governs the call, our consent is sufficient. Where a two-party (all-party) consent jurisdiction governs — including California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon (when both parties are in Oregon), Pennsylvania, Vermont, and Washington — we will provide you a clear audible disclosure at the start of the call and obtain your continued participation as your consent.

Cookies, Pixels, and Similar Technologies

The Site uses cookies, pixels, web beacons, local-storage objects, software-development kits (SDKs), and other technologies (collectively, "Cookies"). For full detail, including category-by-category listing, retention periods, and opt-out controls, see our separate Cookie Policy. Where required by law, we obtain your prior consent before deploying non-essential Cookies.

You may control Cookies through your browser settings, our consent banner (where displayed), and the Network Advertising Initiative (optout.networkadvertising.org) and Digital Advertising Alliance (optout.aboutads.info) tools. You may also signal an opt-out through Global Privacy Control ("GPC"); we honor GPC signals as a request to opt out of sale and share for the browser or device sending the signal.

Disclosures of Personal Information

We disclose Personal Information only as described in this Policy and only to the categories of recipients listed below. We do not sell Personal Information for monetary consideration. We may share certain Personal Information for cross-context behavioral advertising purposes only where you have not opted out and where applicable law permits.

Your Rights and Choices

Depending on the jurisdiction in which you reside, you may have the rights set forth below. We honor every right to the maximum extent applicable law requires, regardless of where you reside, where it is operationally feasible.

A. Right to Know / Access

You may request: (i) the categories of Personal Information we collected about you; (ii) the categories of sources; (iii) the business or commercial purposes for collecting, selling, or sharing; (iv) the categories of recipients; and (v) the specific pieces of Personal Information we hold about you, in a portable format where technically feasible.

B. Right to Correct

You may request that we correct inaccurate Personal Information, taking into account the nature of the information and the purposes of the processing.

C. Right to Delete / Erasure

You may request deletion of Personal Information we collected from you, subject to exceptions including: completing a transaction you requested; detecting fraud or security incidents; complying with a legal obligation; and exercising free speech.

D. Right to Opt Out of Sale and Share

You may direct us not to sell or share your Personal Information. We do not sell Personal Information for monetary consideration. To opt out of any cross-context behavioral advertising sharing, use our Do Not Sell or Share link or transmit a Global Privacy Control signal.

E. Right to Limit Use of Sensitive Personal Information

You may direct us to limit our use of Sensitive Personal Information to that which is necessary to perform the requested service.

F. Right to Non-Discrimination

We will not deny goods or services, charge different prices, provide different quality, or retaliate against you for exercising any privacy right.

G. Right to Object / Restrict Processing

Where applicable, including under GDPR Articles 18 and 21, you may object to processing or restrict processing on the grounds set forth in those articles.

H. Right to Data Portability

Where applicable, you may receive Personal Information you provided in a structured, commonly used, and machine-readable format and transmit it to another controller.

I. Right to Withdraw Consent

Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

J. Right to Appeal

If we deny a privacy-rights request, you may appeal the denial by replying to our denial notice or contacting us through any channel listed below. We will respond to appeals within sixty (60) days as required under most state laws.

K. Right to Lodge a Complaint

You have the right to lodge a complaint with your state attorney general or, where applicable, a supervisory authority such as the European Data Protection Board, the Information Commissioner's Office (UK), or the Federal Data Protection and Information Commissioner (Switzerland).

How to Exercise Your Rights

Submit verifiable consumer requests by email to contact@marcusnaulin.com, by mail to the address in "Contact Us," or by telephone at (805) 377-5626. We will verify your request using the minimum information reasonably necessary, typically two or three pieces of information that match what we have on file. Authorized agents may submit requests with proof of authority and your verification of identity.

California-Specific Disclosures (CCPA/CPRA)

The following disclosures supplement the Policy for California consumers and are made under the CCPA/CPRA. The categories of Personal Information collected during the preceding twelve (12) months mirror Sections 3, the sources mirror Section 4, the purposes mirror Section 5, and the recipients mirror Section 8. We have not sold Personal Information for monetary consideration in the preceding twelve (12) months. We have shared the following categories for cross-context behavioral advertising only where consumer has not opted out: identifiers (IP, advertising IDs) and internet/network activity.

We retain Personal Information for the periods set forth in Section 13. We do not knowingly collect or sell Personal Information of consumers under sixteen (16).

To exercise your right to know, correct, delete, opt out of sale or sharing, limit use of Sensitive Personal Information, or designate an authorized agent, follow Section 9.

Shine the Light (Cal. Civ. Code § 1798.83): California residents who maintain an established business relationship may request once per year a list of Personal Information disclosed to third parties for those third parties' direct-marketing purposes during the prior calendar year. Submit such requests to contact@marcusnaulin.com.

Other State-Specific Rights (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Tennessee, Iowa, Indiana, Delaware, New Hampshire, New Jersey, Minnesota, Maryland, Rhode Island)

Residents of states with comprehensive privacy laws have substantially similar rights to those described in Section 9, including the rights to access, correct, delete, port, and opt out of targeted advertising and sale of Personal Information. Some states additionally provide the right to opt out of profiling in furtherance of decisions producing legal or similarly significant effects, the right to appeal a denied request, and the right to designate an authorized agent. We process verified requests within forty-five (45) days, with one extension of forty-five (45) days where reasonably necessary.

Children Under Sixteen (COPPA, CCPA Sensitive Data)

The Site is not directed to children under thirteen (13), and we do not knowingly collect Personal Information from children under thirteen. If you believe we have collected information from a child under thirteen, contact us immediately and we will delete the information. We do not knowingly sell or share Personal Information of consumers under sixteen (16) without affirmative authorization.

Data Retention

We retain Personal Information for the periods reasonably necessary to fulfill the purposes for which it was collected, to comply with our legal obligations, to resolve disputes, to enforce our agreements, and to protect against fraud and abuse. Specific retention schedules include:

Information Security

We maintain administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, alteration, disclosure, or destruction, consistent with the GLBA Safeguards Rule (16 C.F.R. Part 314), the FTC's Standards for Safeguarding Customer Information, and applicable state data-security laws including the New York SHIELD Act, Massachusetts 201 C.M.R. 17.00, and the California Consumer Records Act. Safeguards include:

• Access controls based on the principle of least privilege.
• Encryption of data at rest and in transit using industry-standard protocols (TLS 1.2+).
• Multi-factor authentication for systems handling Sensitive Personal Information.
• Vendor due diligence and written data-protection agreements with all Service Providers.
• Periodic security testing, vulnerability scanning, and incident-response drills.
• Employee training on privacy, security, and red-flag identity-theft detection.
• Secure destruction of records at the end of their retention period.

No security program is impenetrable. In the event of a security incident affecting your Personal Information, we will notify you and applicable authorities consistent with state breach-notification laws and federal requirements.

International Data Transfers

We are based in the United States and process Personal Information primarily in the United States. If you access the Site or transmit Personal Information from outside the United States, your information will be transferred to and processed in the United States, where data-protection laws differ from those of your home jurisdiction. Where the GDPR applies, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or other lawful transfer mechanisms.

Automated Decision-Making and Profiling

We do not engage in solely automated decision-making that produces legal or similarly significant effects without meaningful human review. Automated tools may pre-screen credit applications, but every adverse-action decision is reviewed by a licensed mortgage professional. Where applicable, you have the right to obtain meaningful information about the logic involved and to contest decisions.

Third-Party Links and Services

The Site contains links to third-party websites and integrates third-party services (e.g., loan-application portals, calculators, identity-verification widgets). We are not responsible for the privacy practices of third parties. Review the privacy policies of any third-party site or service before submitting Personal Information.

Changes to This Policy

We may update this Policy at any time. The "Last Updated" date at the top of this Policy reflects the most recent revision. Material changes will be communicated through a prominent notice on the Site, by email, or by other reasonable means. Your continued use of the Site after the effective date of any change constitutes acceptance of the revised Policy.

Governing Law and Dispute Resolution

This Policy is governed by the laws of the State of California, without regard to conflict-of-laws principles, except to the extent another state's or country's mandatory consumer-protection laws apply. Disputes arising under this Policy are subject to the dispute-resolution provisions in our Terms and Conditions, including binding individual arbitration and class-action waiver, except where prohibited by law.

Contact Us