LAST UPDATED: AUGUST 10, 2026

Data Privacy &
Security

This document outlines our data protection standards and your rights regarding personal information. Johnson Legacy Group is committed to maintaining the highest level of security and transparency.

Minimalist document stack representing compliance and data privacy

PRIVACY FRAMEWORK

Our Core Policy

This framework defines our rigorous approach to data privacy, outlining the specific mechanisms through which we collect, utilize, and protect your institutional information.

What We Collect

We collect personal identification data, financial profiles, and usage metrics to provide our services. This includes information you provide directly during onboarding and data gathered automatically through your interactions with our secure platforms.

How We Use Your Data

Your data is utilized strictly for service delivery, compliance verification, and platform enhancement. We maintain a firm policy against monetizing your personal information or selling it to third parties under any circumstances.

Legal Basis

Our processing operations rely on your explicit consent, contractual necessity, and our legitimate interest in maintaining secure and efficient financial infrastructure in strict accordance with global compliance standards.

SMS Opt-In:

By providing your phone number and opting in to receive text messages, you agree to receive SMS messages from us related to appointments, updates, reminders, and other relevant communications. Message frequency may vary. Message and data rates may apply. You can opt out at any time by replying STOP. For help, reply HELP. Your consent to receive SMS messages is not a condition of purchasing any products or services.

Sharing

We share information solely with verified third-party vendors essential to our operations, regulatory bodies when required by law, and affiliate institutions under rigorous confidentiality and data protection agreements.

Retention

Data is retained only as long as strictly necessary to fulfill the purposes outlined in this policy or as mandated by financial compliance regulations. Upon expiration of these periods, records are permanently and securely deleted.

Rights

You maintain the fundamental right to access, rectify, or request deletion of your personal data. You may also object to specific processing activities or request data portability in a structured, machine-readable format.

Security

We implement enterprise-grade encryption protocols, strict role-based access controls, and continuous monitoring to safeguard your information against unauthorized access, alteration, disclosure, or destruction.

SMS & Text Message Policy

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

VERIFIED SECURITY

Verified Compliance

Encryption
Access Control
Staff Training
Incident Response

NO SURPRISES

Common Questions

We believe your data is yours. We never sell your personal information, and we ensure our partners treat your privacy with the same strict respect we do.

Do you sell my personal data to third parties?

No. We never sell your personal information to anyone. We only share data with trusted partners when it is strictly necessary to provide our services to you.

Who exactly has access to my information?

Only authorized Johnson Legacy Group personnel and strictly vetted third-party service providers that help us deliver our services. Everyone is bound by strict confidentiality obligations.

Can I ask you to delete my data?

Absolutely. You have the right to request the deletion of your personal data at any time. We will erase it from our active systems, keeping only what is legally required for compliance.

How long do you keep my information?

We retain your information only as long as needed for the purposes described in this policy and as required by applicable laws. When it is no longer needed, we securely delete or de-identify it.