Privacy Policy.

1. Who this applies to

This policy covers personal information handled by MEJ Personal Business Services, Inc., a New York corporation with offices at 245 East 116th Street, New York, NY 10029, in connection with our translation, interpreting, certification, apostille, notary and related services, and through our website at www.mejpbs.com.

It applies to:

• Clients who request or purchase services from us
• Document subjects — people named in documents we translate, who are often not the person who hired us
• Website visitors
• Applicants for interpreter and translator positions

Where we act as a service provider to an organization — a hospital, law firm, or government agency — that organization’s own privacy notice governs its relationship with the individual, and our contract with them governs our handling. This policy describes our practices in either case.

2. What we collect

2.1 Information you give us directly

• Contact and billing details — name, organization, email, phone, postal address
• Project details — language pair, document type, deadline, delivery instructions
• The documents themselves, and any accompanying notes or glossaries
• Correspondence with us, by phone, online form, or in person

2.2 Information inside the documents you send

This is the category that matters most. Documents submitted for translation routinely contain:

• Full names, dates and places of birth, and family relationships
• Government identifiers — passport, national ID, A-number, Social Security number
• Immigration and citizenship status, and filing history
• Health and medical information, including diagnoses, treatment records and vaccination histories
• Criminal record information, including police clearance certificates
• Financial records — bank statements, tax filings, affidavits of support
• Educational records, and marital and divorce records
• Information about third parties named in the document, including children

We collect this information because we cannot translate a document without processing its contents. We do not extract, index, aggregate or analyze it for any purpose beyond completing your assignment.

2.3 Payment information

Card and PayPal payments made through our invoice payment portal are processed by PayPal. We do not receive or store complete payment card numbers. We retain transaction records — amount, date, and payment method — for accounting and tax purposes.

2.4 Website and online form information

IP address, browser and device type, pages viewed, referring page, and approximate location derived from IP, collected via Google Analytics. Quote requests, document uploads, and interpreter/translator registrations submitted through our website are processed using Zoho forms. See § 12.

2.5 What we do not collect

We do not buy personal information from data brokers, do not use tracking that follows you across unrelated websites for advertising, and do not build marketing profiles from the contents of client documents.

3. How we use it

We do not use client documents to train machine translation systems, artificial intelligence models, or any other automated system, and we do not permit our linguists or subcontractors to do so.

We send marketing communications only to business contacts who have asked for them or with whom we have an existing commercial relationship, and every such message includes an unsubscribe link. We do not send marketing to individual document subjects.

4. How we handle your documents

4.1 How documents reach us

Documents must be submitted through our secure online upload form, provided to you when you request a quote or place an order. Our online forms are the only channel we provide for sending files, precisely because a dedicated upload form gives us more control over who can access a document in transit than an ordinary email attachment does. If you prefer, you may also bring documents to our office in person.

We do not accept sensitive documents as email attachments. If a document is emailed to us despite this policy, we will ask you to resubmit it through the secure form before we begin work.

4.2 Who sees your document

Access is limited to the people who need it to complete the work: the project coordinator handling your request, the assigned translator or interpreter, and where the project calls for it, a reviewing linguist. Every linguist we engage — employee or independent contractor — is bound by a written confidentiality agreement, and, where the assignment involves protected health information, a signed HIPAA subcontractor Business Associate Agreement (see § 7) in addition to the professional ethics codes of the bodies we belong to, including the American Translators Association and, for medical assignments, the National Council on Interpreting in Health Care.

4.3 Interpreting assignments

Interpreters transmit what is said and hold it in confidence. We do not record interpreting sessions — telephone, video or in person — unless you instruct us to in writing, or a court or agency directs it. Interpreters do not retain notes beyond the assignment; working notes taken during consecutive interpreting are destroyed afterwards, which is standard professional practice.

4.4 Physical documents

Hard-copy documents left with us are stored securely at our office and returned to you or securely destroyed on completion, as you direct.

5. Who we share it with

We do not sell personal information, and we do not share it for anyone else’s marketing.

We disclose information only to:

• Assigned linguists — translators, interpreters and reviewers working on your project, each under a written confidentiality agreement and, for PHI assignments, a signed subcontractor Business Associate Agreement.
• Government bodies you have asked us to file with — for apostille work, the New York State Department of State or the U.S. Department of State, which is the purpose of the service.
• Service providers who support our operations under contract: our business email and cloud storage provider, PayPal (payments), Zoho (website quote, upload, and registration forms), and our accountants. Each is bound to confidentiality and permitted to use the information only to provide their service to us.
• Couriers, where you have asked for physical delivery.
• Professional advisers — our lawyers, auditors and insurers, where necessary.
• A successor, if our business is sold or merged. We would notify you and this policy would continue to apply until you were told otherwise.
• Where legally required — see § 6.

6. Government and legal requests

Many of our clients are immigrants, and we understand that how we respond here matters to them. We want to be precise rather than reassuring.

What we do

• We do not voluntarily disclose client information to immigration enforcement or any other law enforcement body. We do not proactively report clients, and we do not grant access to our records absent a valid legal obligation.
• We require valid legal process. We ask for a subpoena, court order, or warrant, and we review it — including whether it is properly issued, correctly directed to us, and within its stated scope.
• We disclose no more than the process compels. Where a demand is overbroad, we object or seek to narrow it.
• We tell you. Where we are legally permitted to notify you that your information has been demanded, we will, so that you have the opportunity to respond or challenge it.
• We do not consent to warrantless access to our premises or records.

What we cannot promise

We are not a law firm, and there is no legal privilege covering translation records comparable to attorney-client privilege. If a court orders disclosure, we must comply. Some legal processes carry non-disclosure obligations that prevent us from telling you about them. We will not claim otherwise.

If you are concerned about the confidentiality of a particular document, the strongest protection generally comes from engaging us through your attorney, so the work may fall within that attorney’s privilege. Ask your lawyer whether that applies to your situation.

7. Protected health information

When we provide translation or interpreting to a covered entity — a hospital, clinic, health plan or provider — and handle protected health information (PHI) on its behalf, MEJPBS acts as a business associate under the Health Insurance Portability and Accountability Act (HIPAA), 45 C.F.R. Parts 160 and 164.

In that role:

• We enter into a Business Associate Agreement (BAA) with the covered entity before handling PHI.
• We use and disclose PHI only as the BAA and HIPAA permit — in practice, only to perform the translation or interpreting requested.
• We apply administrative, physical and technical safeguards to PHI as required by the HIPAA Security Rule.
• We obtain a signed subcontractor Business Associate Agreement from every linguist who handles PHI, so the same obligations flow down to assigned translators and interpreters, consistent with 45 C.F.R. § 164.502(e)(2).
• We report any use or disclosure not permitted by the BAA, and any breach of unsecured PHI, to the covered entity without unreasonable delay and within the timeframe the BAA specifies.
• On termination, we return or destroy PHI as the BAA directs.

Where a covered entity’s BAA imposes stricter terms than this policy, the BAA governs. Individuals seeking to exercise HIPAA rights — access, amendment, an accounting of disclosures — should direct their request to the covered entity, which holds the designated record set. We will support the covered entity in responding.

If you are an individual client sending medical documents on your own behalf, rather than through a healthcare provider, HIPAA generally does not apply to that engagement — but we handle those documents with the same confidentiality described throughout this policy.

8. How we protect it

We maintain a data security program with administrative, technical and physical safeguards appropriate to the sensitivity of what we hold, consistent with the New York SHIELD Act (N.Y. General Business Law § 899-bb).

• Access control — information is available only to personnel and linguists who need it for a specific assignment
• Confidentiality agreements with every employee, contractor and linguist, and signed subcontractor BAAs for PHI assignments
• Encryption of stored document data at rest, and of our website and online forms in transit (HTTPS)
• Physical security at our office for hard-copy documents
• Secure disposal — shredding of paper, secure deletion of electronic files
• Vendor diligence — contractual confidentiality and security terms with our service providers
• A written incident response plan, so that a suspected breach is identified, contained, and reported on a defined timeline rather than handled ad hoc
• Training for personnel on confidentiality and data handling

No system is perfectly secure, and we do not claim otherwise. Submitting documents through our secure upload form rather than email, as described in § 4.1, is part of how we minimize that risk.

9. How long we keep it

You may ask us to delete your documents sooner — see § 10. We will do so unless we are required to keep them for legal, tax or certification reasons, and we will tell you if that is the case.

10. Your rights

Wherever you live, you may ask us to:

• Tell you what we hold about you
• Correct information that is inaccurate
• Delete your documents and information, subject to the limits in § 9
• Provide a copy of information you gave us, in a portable format
• Stop marketing communications

To make a request, contact us using the details in § 16. We will verify your identity before acting — necessarily so, given what these documents contain — and respond within 30 days, or tell you if we need longer.

We will not discriminate against you for exercising these rights.

If the document was submitted by an organization rather than by you — your attorney, employer or hospital — we may need to direct your request to that organization, which controls the record. We will tell you if so and help you reach them.

11. International transfers and GDPR

We are based in the United States and information we hold is processed here. Two situations involve international transfer:

• Apostille and consular work. The purpose of an apostille is to authenticate a document for use in another country. Completing that service necessarily means your document is transmitted to, or presented to, foreign authorities — at your direction.
• Linguists located outside the United States. For some language pairs, the qualified professional may be based abroad. They are bound by the same confidentiality terms.

If you are in the European Economic Area or the United Kingdom

We currently serve very few clients based in the EEA or UK. Where the EU or UK General Data Protection Regulation applies to our processing, the following apply.

Legal bases. We rely on:

• Contract (Art. 6(1)(b)) — to provide the service you requested
• Legal obligation (Art. 6(1)(c)) — tax, accounting, lawful demands
• Legitimate interests (Art. 6(1)(f)) — securing our systems, managing our business
• Consent (Art. 6(1)(a)) — where we ask for it, for example marketing

Special category and criminal data. Documents we translate often contain health data, and sometimes data relating to criminal convictions or offences. Where GDPR applies, we process these on the basis of your explicit consent (Art. 9(2)(a)), or because processing is necessary for the establishment, exercise or defence of legal claims (Art. 9(2)(f)) — which covers immigration and court filings. By sending us a document for translation you are asking us to process its contents for that declared purpose. You may withdraw consent at any time, though we cannot un-translate work already delivered.

Additional rights. You also have the right to restrict or object to processing, and the right not to be subject to solely automated decision-making. We do not make automated decisions with legal or similarly significant effects.

Transfers. Transfers from the EEA or UK to the United States are made under appropriate safeguards, including Standard Contractual Clauses where required. We have not currently appointed an Art. 27 EU or UK representative, given the limited volume of EEA/UK clients we serve; we will revisit this if that volume increases.

Complaints. You may lodge a complaint with your local supervisory authority, or in the UK with the Information Commissioner’s Office. We would ask that you raise it with us first so we can try to resolve it.

If you are a California resident

We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act, and we have not done so in the preceding twelve months. The rights in § 10 are available to you.

12. Website, cookies and analytics

Our website uses cookies and similar technologies that are strictly necessary for it to function, and analytics cookies provided by Google Analytics to understand how visitors use the site.

Quote requests, document uploads, and interpreter/translator registrations submitted through forms on our site are processed by Zoho and delivered to us. Information you enter there is handled under this policy once we receive it, and under Zoho’s terms in transit.

Most browsers let you refuse or delete cookies. Our site remains usable with analytics cookies disabled.

Our site links to third-party sites, including government pages. We are not responsible for their privacy practices.

13. Children

Our services are directed to adults and organizations, and we do not knowingly collect information online directly from children under 13.

We do frequently translate documents about children — birth certificates, school records, adoption and custody papers, vaccination histories — submitted by a parent, guardian, attorney or agency. We handle that information with the same protections described throughout this policy, and only for the purpose of completing the translation.

14. If something goes wrong

If we discover a breach affecting private information of a New York resident, we will notify affected individuals and the relevant authorities as required by the New York SHIELD Act (N.Y. General Business Law § 899-aa), in the most expedient time possible and without unreasonable delay, following the written incident response plan described in § 8.

Where the information involved is protected health information, we will notify the covered entity in accordance with our BAA and 45 C.F.R. § 164.410. Where GDPR applies, we will meet the notification obligations it imposes.

Our notice will describe what happened, what information was involved, what we are doing about it, and what you can do.

15. Changes to this policy

We may update this policy as our services, systems or legal obligations change. The “last updated” date at the top always reflects the current version. If we make a material change to how we handle personal information, we will post a notice on this page and, where practicable, notify affected clients directly.

16. How to contact us

Please put “Privacy Request” in your subject line so it reaches the right person quickly. If you need to communicate in a language other than English, tell us which one — we will respond in your language.