Policy & Procedure Manual
HAGGERTY MUNZ, PLLC		Document: Customer Privacy
ONE HUNTINGTON QUADRANGLE		Effective Date: October 23, 2026
SUITE 1N13
MELVILLE, NEW YORK 11747		Pages:

1. Purpose

This Haggerty Munz, PLLC (the “Firm”) respects the privacy and confidentiality of personal information obtained in connection with its legal services and business operations. This statement describes the categories and sources of information the Firm may handle, the purposes for which it is used, circumstances in which it may be disclosed, and how requests or concerns may be directed to the Firm.

2. Scope

This statement applies to personal information relating to clients, borrowers, consumers, employees and other individuals that the Firm receives, collects, maintains, uses, transmits or discloses in paper or electronic form in connection with its services. It complements, and does not supersede, the Firm’s Information Security Policy, Logical Access Management Policy, Encryption & Cryptography Policy, Confidentiality Policy, and incident response policies.

3. Collection and Sources of Personal Information

Depending on the matter, the Firm may receive names, addresses, contact details, identification, financial and account information, transaction and property records, loan and title documentation, correspondence, and other information reasonably necessary to provide services. Sources may include the individual, the Firm’s clients and their authorized representatives, lenders, title companies, real estate professionals and other transaction participants, public records, and other sources permitted by law. The Firm may also receive limited technical information associated with electronic communications or use of its systems.

4. Purpose and Limitation of Use

The Firm uses personal information for identified, legitimate business and legal purposes, including providing requested legal and transaction services, communicating with clients and transaction participants, verifying information, maintaining required records, protecting the Firm and its clients, responding to lawful requests, and meeting legal, regulatory, ethical and contractual obligations. Personnel should use and request only information reasonably necessary for their assigned duties and the matter at hand. Personal information should not be used for unrelated purposes without appropriate authorization or another lawful basis.

5. Accuracy and Correction

The Firm seeks to maintain information reasonably accurate for the purposes for which it is used. Where the Firm learns that material information is incorrect, it will evaluate and, where appropriate, correct or supplement its records, taking into account the source of the information, the integrity of legal and transaction records, and any applicable retention obligations. Requests to correct information will be reviewed in accordance with Section 9.

6. Sharing and Disclosure

The Firm may disclose information as reasonably necessary to carry out authorized legal services and transactions, including to clients, lenders, title insurers and agents, escrow and settlement participants, other counsel, service providers supporting Firm operations, and persons authorized to receive the information. The Firm may also disclose information when required or permitted by law, court order, regulatory request, professional obligations, or to investigate suspected misconduct or security incidents. Access and disclosures are subject to applicable confidentiality duties, contractual requirements and the Firm’s security policies. This statement does not authorize the sale of personal information or sharing for unrelated marketing.

7. Confidentiality and Safeguards

The Firm maintains administrative, technical and physical safeguards intended to protect personal information against unauthorized access, use, disclosure, alteration and destruction. Access is based on job responsibilities, need-to-know and leastprivilege principles, consistent with the Logical Access Management Policy. The Firm’s other policies govern authentication, encryption, monitoring, incident response and security awareness training. This statement does not establish different technical standards from those policies

8. Retention and Secure Disposal

The Firm retains information as necessary for legal services, recordkeeping, litigation holds, professional responsibilities and applicable law or contractual requirements. Retention periods depend on the category of record and the applicable obligation; this statement does not establish a universal retention period. When information is eligible for disposal, it is handled in accordance with the Information Security Policy’s information disposal requirements and any applicable legal hold or client instruction.

9. Requests Concerning Personal Information

Individuals may submit written requests concerning access to, correction of, or deletion of their personal information, or raise concerns regarding its use. The Firm will review the request, verify the requester’s identity and authority by reasonable means appropriate to the sensitivity of the information, and determine what action is required or permitted under applicable law, contractual obligations, professional confidentiality duties, and record-retention requirements. Not every request can be fulfilled, particularly where the information forms part of a client file, transaction record, or legally required record. Requests should be directed to the Firm’s Information Security Officer at the address below. Where the Firm processes information on behalf of a client, it will coordinate with that client as appropriate.

10. Service Providers and Third Parties

The Firm may use service providers to support its operations and delivery of legal services. The Firm expects persons and providers receiving confidential information to handle it consistently with applicable contractual and confidentiality requirements. Any provider access to Firm systems is governed by applicable access-management and information-security policies.

11. Security Incidents and Notifications

Personnel must promptly report actual or suspected unauthorized access, disclosure, loss or misuse of personal information in accordance with the Firm’s

Cybersecurity Incident Response and Breach Management Plan and Security Breach Incident Management Policy. The Firm evaluates incidents, coordinates investigations and determines required notifications under those existing policies, applicable law and contractual obligations. This statement does not create an independent notification deadline.

12. Website and Electronic Communications

Haggerty Munz, PLLC utilizes Zix Secure Email to help protect confidential and nonpublic personal information transmitted electronically. The Firm employs secure email encryption and related safeguards, as appropriate, to reduce the risk of unauthorized access to sensitive information during transmission. Information transmitted by ordinary email may not always be secure, and sensitive personal or financial information should be transmitted using Firm-approved secure methods, consistent with the Firm's Information Security Policy and related security procedures. Any website-related collection or tracking practices shall be addressed in applicable website notices.

13. International Data and Special Requirements

Where a matter involves personal information subject to special jurisdictional, client or contractual requirements, the Firm will evaluate the applicable obligations before adopting any special handling process. This statement does not represent that the Firm conducts international transfers, maintains a GDPR processing register, or operates a formal data privacy impact assessment program unless separately established and documented.

14. Oversight and Review

The Information Security Officer, with Firm management, is responsible for coordinating review of this statement and related privacy concerns. The statement shall be reviewed at least annually and updated as necessary to reflect material changes in the Firm’s practices, applicable obligations and related policies. Revisions require appropriate Firm approval.

15. Contact

Information Security Officer

Haggerty Munz, PLLC

One Huntington Quadrangle, Suite 1N13

Melville, New York 11747

16. Revision History Information:

This policy shall be reviewed and updated at least annually.