Privacy Policy
Authenticating a document means trusting us with sensitive records. This policy explains, in plain language, what information we collect, how we use and protect it, who we share it with and the rights you hold under United States and European Union law.
Last updated: May 21, 20261.Who we are
Boston Apostille Service is a licensed, bonded and insured document authentication agency based in Massachusetts. We apostille and authenticate vital records, corporate documents and federal records, including FBI background reports, so they can be used legally in other countries. Our office is at 1215 Main Street, Suite 115, Tewksbury, Massachusetts 01876.
For the purposes of data protection law, including the European Union General Data Protection Regulation (GDPR) and United Kingdom GDPR, Boston Apostille Service is the controller of the personal information described in this policy. This means we decide why and how your personal information is processed.
We are committed to protecting the privacy of every client. Document authentication involves some of the most sensitive records a person or a company owns, and we treat that responsibility seriously. This policy tells you exactly how we handle your information.
2.Scope of this policy
This policy applies to personal information we collect when you do any of the following:
- Visit bostonapostilleservice.com or any related page we operate.
- Submit an apostille application, request a quote or contact us by phone, email, our contact form or in person.
- Send us documents to be authenticated, notarized or translated.
- Use our services as an individual, a business, a law firm or a representative acting for someone else.
This policy covers both visitors to our website and clients who use our services, wherever you live. It applies to residents of the United States, including California, and to residents of the European Economic Area, the United Kingdom and other regions with similar privacy laws.
This policy does not cover the privacy practices of any third party, including government offices, shipping carriers or other websites that we link to. Those organizations operate under their own privacy policies.
3.Information we collect
We collect only the information we need to authenticate your documents, communicate with you and run our business. The categories below describe what we collect.
Information you provide to us
- Contact and identity details: your name, mailing address, email address and phone number.
- Order details: the document type, the destination country, your deadline, the service level you choose and any instructions you give us.
- Correspondence: the content of emails, contact form submissions, phone calls and messages you send us.
- Payment information: the billing details needed to process your payment. Card payments are handled by a third-party payment processor. We do not store full card numbers on our own systems.
Information contained in your documents
To authenticate a document we must handle the document itself. Depending on what you send us, this can include vital records such as birth, marriage and death certificates, single status affidavits, divorce decrees, diplomas and transcripts, corporate documents such as articles of incorporation, powers of attorney and certificates of good standing, and federal records such as FBI background reports. These documents often contain personal information about you and, in some cases, about other people named in the document. Section 4 explains how we treat this sensitive information.
Information we collect automatically
When you visit our website, we and our analytics provider collect certain technical information automatically, including your IP address, browser type, device type, the pages you view, the links you click and the date and time of your visit. We collect this information through cookies and similar technologies, described in Section 8.
4.Sensitive and special category data
Apostille work involves records that privacy law treats as especially sensitive. A birth certificate reveals family and date-of-birth information. An FBI background report reveals criminal history information. A medical or adoption document can reveal health or family data.
Under the GDPR these are special categories of personal data. Under United States law they include sensitive personal information. We handle them with extra care.
We collect sensitive information only because it is contained in the documents you ask us to authenticate, and we use it only to provide that service. We do not use sensitive information for marketing, profiling or any purpose unrelated to your order.
Where the GDPR or similar law requires a specific condition to process special category data, we rely on your explicit request for our service and, where relevant, the establishment or defense of legal claims and reasons of substantial public interest connected to official document authentication. By sending us a document to authenticate, you are asking us to process the information it contains for that purpose.
If a document names a person other than you, we rely on you to have the authority to share that document with us. We process the information of third parties named in a document only to complete the authentication you requested.
5.How we use your information
We use your information for the following purposes.
- To provide our services: to review your documents, confirm the correct authentication path, prepare and submit your documents to the proper authority, arrange notarization or translation and return the finished documents to you.
- To communicate with you: to answer questions, give you a quote, confirm your order, update you on progress and provide customer support through a single point of contact.
- To process payments: to charge the agreed fee and keep a record of the transaction.
- To meet legal and regulatory obligations: to comply with applicable law, respond to lawful requests and keep records we are required to keep.
- To operate and improve our website: to keep the site secure, understand how visitors use it and improve its content and performance.
- To protect our business: to prevent fraud, enforce our agreements and establish or defend legal claims.
Our legal bases for processing (EU and UK clients)
If you are in the European Economic Area or the United Kingdom, data protection law requires us to have a legal basis for using your personal information. We rely on the following bases:
- Performance of a contract: processing your information to deliver the authentication service you requested.
- Legal obligation: processing needed to comply with the law.
- Legitimate interests: running, securing and improving our business and website, where those interests are not overridden by your rights.
- Consent: for non-essential cookies and analytics, and for any optional marketing communications. You can withdraw consent at any time.
- Explicit request and legal claims: for the special category data contained in your documents, as described in Section 4.
6.Government submissions and required disclosures
Authentication only works because a government office reviews and certifies your document. This means a core part of our service is submitting your document, and the personal information in it, to an official authority.
- Massachusetts documents are submitted to the Secretary of the Commonwealth.
- Federal documents, such as FBI background reports, are submitted to the U.S. Department of State.
- Notarized documents may pass through a notary public as part of the process.
These government offices handle your document under their own rules and procedures. We submit only what each office requires to authenticate your document. By asking us to authenticate a document, you are authorizing this submission, which is the entire purpose of the service.
We may also disclose information when the law requires it, for example in response to a valid subpoena, court order or other lawful request, or where disclosure is needed to protect the rights, safety or property of our clients, the public or our business.
9.How long we keep your information
We keep personal information only as long as we need it for the purposes described in this policy.
- Your original documents are returned to you once authentication is complete. We do not keep your original certified records.
- Order records that identify your transaction, such as your contact details and a summary of the service provided, are generally kept for about one year after your order is completed, after which they are securely destroyed or deleted.
- Limited records may be kept longer where the law requires it, for example for tax or accounting purposes, or where they are needed to establish or defend a legal claim.
When information is no longer needed, we securely destroy paper records and delete electronic records.
10.How we protect your information
We take the security of your documents and your personal information seriously, and we use a combination of physical, administrative and technical safeguards.
- Documents are logged when they arrive and handled under controlled in-office procedures.
- Access to client documents and personal information is limited to staff who need it to complete your order.
- Original documents are stored securely while they are in our care and tracked until they ship back to you.
- Electronic information is protected by reasonable technical measures, and payment card processing is handled by a third-party processor.
- We use tracked, secure shipping methods to return your authenticated documents.
No method of storage or transmission is completely secure. While we work hard to protect your information, we cannot guarantee absolute security. If we become aware of a data breach that affects your personal information, we will notify you and the relevant authorities where the law requires it.
11.International data transfers
Boston Apostille Service operates in the United States, and our systems and offices are located there. If you are in the European Economic Area, the United Kingdom or another region outside the United States, the information you give us will be transferred to and processed in the United States.
Privacy laws in the United States may differ from those in your home country. Where we transfer personal information from the European Economic Area or the United Kingdom, we take steps to make sure it is protected, which may include relying on appropriate safeguards such as standard contractual clauses, or on the fact that the transfer is necessary to perform the service you requested.
By using our services or sending us your documents, you understand that your information will be processed in the United States to complete the authentication you asked us to perform.
12.Your privacy rights
You have rights over your personal information. The rights that apply depend on where you live.
Rights for EU, EEA and UK residents (GDPR)
If you are in the European Economic Area or the United Kingdom, you have the right to:
- Access the personal information we hold about you.
- Request correction of information that is inaccurate or incomplete.
- Request erasure of your information in certain circumstances.
- Restrict or object to our processing of your information in certain circumstances.
- Request a copy of your information in a portable format.
- Withdraw your consent at any time, where we rely on consent.
- Lodge a complaint with your local data protection supervisory authority.
Rights for United States residents, including California
Depending on your state, you may have the right to:
- Know what categories of personal information we collect and how we use them.
- Access the specific personal information we hold about you.
- Request that we correct inaccurate personal information.
- Request that we delete your personal information, subject to legal exceptions.
- Opt out of the sale or sharing of personal information. We do not sell or share your personal information, so there is nothing for you to opt out of.
- Not receive discriminatory treatment for exercising your privacy rights.
How to exercise your rights
To make any privacy request, contact us through our Contact Us page, by phone at (978) 424-4629 or by mail at the address in Section 16. We will verify your identity before acting on a request, which protects your information from unauthorized access. We will respond within the time required by the law that applies to you. You may use an authorized agent to make a request on your behalf where the law allows it.
Some information may be exempt from these rights, for example where we are legally required to keep it or where it is needed to establish or defend a legal claim.
13.Children’s privacy
Our website and services are intended for adults. We do not knowingly collect personal information directly from children under the age of 16 through our website.
We do, however, authenticate documents that belong to or name minors, such as a child’s birth certificate or adoption paperwork, when an adult submits them on the child’s behalf. In that case the adult who requests the service is responsible for having the authority to share the document, and we process the child’s information only to complete the requested authentication.
14.Third-party links
Our website may contain links to other websites, such as government offices, that we provide for your convenience. We do not control those websites and are not responsible for their content or their privacy practices. We encourage you to read the privacy policy of any website you visit.
15.Changes to this policy
We may update this privacy policy from time to time to reflect changes in our practices, our services or the law. When we make a change, we will update the date at the top of this page. If the change is significant, we will take reasonable steps to make it more visible. We encourage you to review this page when you use our services.
16.How to contact us
If you have a question about this policy, about how we handle your information, or if you want to exercise a privacy right, please contact us.
1215 Main Street, Suite 115
Tewksbury, Massachusetts 01876
Phone: (978) 424-4629
Online: Contact Us page
Ready to authenticate your documents?
Work with a licensed Massachusetts agency that treats your records as the sensitive documents they are.
