Privacy

Privacy policy.

How Loren Data collects, uses, and protects personal data — including our certified obligations under the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Framework, and our compliance with the GDPR.

Effective: August 14, 2026 · Previous version: March 23, 2026

Data Privacy Framework Certification

Loren Data Corp. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Loren Data Corp. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Loren Data Corp. has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.

If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Information Collection and Use

This privacy policy applies to personal data collected by Loren Data Corp. through our website at www.ld.com and through our platforms and services, including ECGrid, ECGrid Simplify, myAS2, and Global Product Access (collectively, the "Services"). Where a customer agreement, order form, or data processing agreement governs our processing of personal data on a customer’s behalf, that agreement controls with respect to that data.

Loren Data Corp. does not sell personal data for monetary consideration and does not disclose personal data to others except as described in this policy. Certain state privacy laws define "sell" and "share" broadly to include disclosures to advertising networks for cross-context behavioral advertising. Our use of advertising partners is described under Advertising Partners below.

Types of Personal Data Collected

Under the Data Privacy Framework, we collect and process the following types of personal data from individuals in the European Union, United Kingdom, and Switzerland:

  • Contact information (such as name, email address, postal address, and phone number)
  • Account credentials (such as username and password)
  • Financial information (such as credit card number, expiration date, and billing address)
  • Technical information (such as IP addresses, browser type, and device information)
  • Usage data (such as pages visited, time spent on site, and navigation patterns)
  • Professional information (such as company name and job title)
  • Communications and correspondence with us

Purposes of Data Processing

We collect and use personal data for the following purposes:

  • To provide and deliver our services and products
  • To process transactions and fulfill orders/subscriptions
  • To communicate with users about services, updates, and promotional offers
  • To respond to inquiries and provide customer support
  • To administer user accounts and authenticate users
  • To analyze trends, administer the site, and improve user experience
  • To prevent fraud and enhance security
  • To comply with legal obligations and enforce our terms of service
  • To conduct surveys and contests (with user consent)
  • To send service announcements and important updates
  • To operate, monitor, secure, and improve the Services, including through the artificial intelligence and machine learning capabilities described below
  • To detect, investigate, and prevent security incidents, fraud, and abuse, including through automated monitoring and anomaly detection

Several of these purposes are supported by artificial intelligence and machine learning technologies embedded in the infrastructure, analytics, and security services we use. See Artificial Intelligence and Machine Learning below.

Registration

In order to use some of our Services, a user must first complete the registration form. During registration, a user is required to give their contact information (such as name and email address). This information is used to contact the user about the Services on our site for which they have expressed interest.

Orders/Subscriptions

We request information from the user on our order form. Here a user must provide contact information (like name and shipping address) and financial information (like credit card number, expiration date). This information is used for billing purposes and to provide Services to our customers.

Cookies

A cookie is a piece of data stored on the user’s hard drive containing information about the user. Usage of a cookie is in no way linked to any personally identifiable information while on our site. For instance, by setting a cookie on our site, the user would not have to log in a password more than once, thereby saving time while on our site. If a user rejects the cookie, they may still use our site but may not be able to access certain Services.

Some of our business partners may use cookies on our site. However, we have no access to or control over these cookies.

Log Files

We use IP addresses to analyze trends, administer the site, track user’s movement, and gather broad demographic information for aggregate use. IP addresses are not linked to personally identifiable information except as necessary to provide Services or comply with legal requirements.

Artificial Intelligence and Machine Learning

AI/ML in the Services. Loren Data Corp. builds and operates the Services using enterprise infrastructure, analytics, and security services that incorporate artificial intelligence and machine learning ("AI/ML") technologies as core components of their service delivery. These capabilities support security monitoring, threat and anomaly detection, fraud prevention, performance and availability management, search and content discovery, and operational analytics and service improvement. They are integral to how those platforms operate and are not subject to individual customer opt-out. The categories of data processed, and the current list of our infrastructure and platform providers, are described in our AI and Machine Learning Platform Disclosure.

No training on customer content. Loren Data Corp. does not use customer-specific content, confidential business documents, contracts, orders, transaction data, customer lists, or proprietary information for AI/ML model training purposes. Our infrastructure, analytics, and platform providers are contractually prohibited from using customer content to train their generally available AI/ML models. This paragraph does not apply to content that a customer or user has designated as public within Global Product Access.

Automated decision-making. Loren Data Corp. does not use AI/ML to make decisions that produce legal or similarly significant effects concerning individuals and does not engage in automated decision-making within the meaning of Article 22 of the GDPR. Alerts generated by AI/ML security and fraud detection capabilities are reviewed by Loren Data personnel before any action is taken to suspend or restrict access to the Services.

Further detail. Our AI and Machine Learning Platform Disclosure, available at https://www.ld.com/ai-ml-disclosure/, describes our use of AI/ML in greater detail, including the categories of data processed, our infrastructure and platform providers, and the commitments those providers have made. With respect to AI/ML matters specifically, the AI and Machine Learning Platform Disclosure controls over this privacy policy to the extent it imposes a greater restriction on Loren Data Corp. In all other respects, and to the extent this privacy policy is more protective of personal data, this privacy policy controls.

Sharing and Third-Party Transfers

Sharing with Service Providers (Agents)

We partner with the following types of third-party service providers, and share personal data with them only as necessary for the purposes described: (a) payment processors (e.g., credit card processing companies) to process transactions and billing; (b) cloud hosting and infrastructure providers to store and deliver our Services; (c) email and communications service providers to send transactional and, where authorized, marketing communications; (d) analytics providers (such as Google Analytics) to analyze website traffic and usage patterns; (e) advertising networks (such as Google Ads) that may collect technical data such as IP addresses and cookies to serve relevant advertisements on our websites; and (f) customer support tools and platforms to manage and respond to user inquiries. We also engage (g) providers of artificial intelligence and machine learning technologies embedded in the infrastructure, analytics, and security services described above. When the user signs up for these services, we will share names or other contact information that is necessary for the third party to provide these services.

When we transfer personal data to third parties acting as agents or service providers on our behalf, we:

  • Transfer only the personal data necessary for the agent to provide the requested services
  • Permit the agent to process such personal data only for limited and specified purposes
  • Require the agent to provide at least the same level of privacy protection as is required by the Data Privacy Framework Principles
  • Take reasonable and appropriate steps to ensure that the agent effectively processes the personal data transferred in a manner consistent with our obligations under the DPF Principles
  • Require the agent to notify us if it makes a determination that it can no longer meet its obligation to provide the same level of protection as is required by the DPF Principles
  • Upon receiving such notice, take reasonable and appropriate steps to stop and remediate unauthorized processing

These parties are not allowed to use personally identifiable information except for the purpose of providing these services.

Onward Transfer Liability

Loren Data Corp. remains liable under the Data Privacy Framework Principles if third-party agents process personal data received from the EU, UK, or Switzerland in a manner inconsistent with the Principles, unless Loren Data Corp. proves that it is not responsible for the event giving rise to the damage.

Third-Party Controllers

When we transfer personal data to a third party acting as a controller (rather than as our agent), we do so in accordance with the Notice and Choice Principles set forth below and enter into a contract with such third party that:

  • Limits the purposes for which the data may be processed
  • Ensures that the recipient will provide the same level of protection as required by the DPF Principles
  • Requires the recipient to notify us if it makes a determination that it can no longer meet its obligation to provide the same level of protection
  • Requires the recipient to cease processing or take other reasonable steps to remediate upon making such a determination

Advertising Partners

Loren Data Corp. may work with third parties that serve ads to our websites. To find out more about how Google manages the privacy of information in conjunction with serving ads, please go to: http://www.google.com/intl/en/privacy.html

Links

This website contains links to other sites. Please be aware that Loren Data Corp. is not responsible for the privacy practices of such other sites. We encourage our users to be aware when they leave our site and to read the privacy statements of each and every website that collects personally identifiable information. This privacy statement applies solely to personal data collected by Loren Data Corp. through the Services.

Surveys & Contests

From time-to-time, our site may request information from users via surveys or contests. Participation in these surveys or contests is completely voluntary and the user, therefore, has a choice whether or not to disclose this information. Information requested may include contact information (such as name and shipping address), and demographic information (such as zip code, age level). Contact information will be used to notify the winners and award prizes.

Survey information will be used for the purpose of monitoring or improving the use and satisfaction of this site.

Security

This website takes every precaution to protect our users’ information. When users submit sensitive information via the website, your information is protected both online and off-line.

When our registration/order form asks users to enter sensitive information (such as credit card number and/or social security number), that information is encrypted and is protected with the best encryption software in the industry, SSL/TLS. While on a secure page, such as our order form, the lock icon on the bottom of Web browsers such as Netscape Navigator and Microsoft Internet Explorer becomes locked, as opposed to un-locked, or open, when you are just 'surfing'.

While we use SSL/TLS encryption to protect sensitive information online, we also do everything in our power to protect user-information off-line. All of our users’ information, not just the sensitive information mentioned above, is restricted in our offices. Only employees who need the information to perform a specific job (for example, our billing clerk or a customer service representative) are granted access to personally identifiable information. Our employees must use password-protected screen-savers when they leave their desk. When they return, they must re-enter their password to re-gain access to your information. Furthermore, ALL employees are kept up-to-date on our security and privacy practices. Every quarter, as well as any time new policies are added, our employees are notified and/or reminded about the importance we place on privacy, and what they can do to ensure our customers’ information is protected. Finally, the servers that we store personally identifiable information on are kept in a secure environment.

Loren Data Corp. takes reasonable and appropriate measures to protect personal data from loss, misuse, unauthorized access, disclosure, alteration, and destruction, taking into account the risks involved in the processing and the nature of the personal data.

AI tool access controls. AI-assisted development and productivity tools used by Loren Data personnel may operate within environments that include access to production systems and data, including EDI transaction data. Internal policies prohibit personnel from directing AI tools to access, extract, or process customer personal data, and any inadvertent access is handled as a security incident under our incident response procedures.

Data Integrity and Purpose Limitation

Loren Data Corp. collects and processes only personal data that is relevant for the purposes for which it has been collected. We take reasonable steps to ensure that personal data is reliable for its intended use, accurate, complete, and current. We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by law, after which we will delete or anonymize it. Where AI/ML technologies process personal data in connection with the Services, that processing is subject to the same retention limits, and we do not retain personal data solely for AI/ML purposes beyond the retention period applicable to the underlying data.

Choice and Opt-Out

Marketing Communications

We send all new members a welcoming email to verify password and username. Established members may occasionally receive information on products, services, special deals, and a newsletter. Out of respect for the privacy of our users, we present the option to not receive these types of communications.

For individuals in the EU, UK, and Switzerland: You have the right to opt out of having your personal data:

  • Disclosed to third parties (other than agents/service providers acting on our behalf)
  • Used for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized by you

To opt out of marketing communications or to limit the use or disclosure of your personal data, please contact us at or use the unsubscribe link provided in our emails.

Sensitive Personal Data

For sensitive personal data (such as health information, financial account information, or information about children), we will obtain your affirmative express consent (opt-in) before:

  • Disclosing the information to a third party
  • Using the information for a purpose other than those for which it was originally collected or subsequently authorized by you

Loren Data Corp. gives users options for removing their information from our database to not receive future communications or to no longer receive our service.

Users of our site are always notified when their information is being collected by any outside parties. We do this so our users can make an informed choice as to whether they should proceed with services that require an outside party, or not.

Site and Service Updates

We also send the user site and service announcement updates. Members cannot un-subscribe from service announcements, which contain important information about the service. We communicate with the user to provide requested services and in regard to issues relating to their account via email or phone.

Access to and Correction of Personal Information

If a user’s personally identifiable information changes (such as your zip code), or if a user no longer desires our service, we will endeavor to provide a way to correct, update or remove that user’s personal data provided to us. This can usually be done at the member information page or by emailing .

For individuals in the EU, UK, and Switzerland: Under the Data Privacy Framework Principles, you have the right to:

  • Access your personal data that we hold
  • Correct inaccurate or incomplete personal data
  • Delete your personal data in certain circumstances

To exercise these rights, please contact us at:

Email:
Postal Address: Loren Data Corp., PO BOX 1438 LAKE FOREST, CA 92609
Phone: 1 310-827-7400

We will respond to your request within a reasonable timeframe. In some cases, we may limit or deny access to personal data where:

  • The burden or expense of providing access would be disproportionate to the risks to your privacy
  • The rights of persons other than you would be violated
  • Access is prohibited by law or would interfere with legal obligations

Disclosure to Public Authorities

Loren Data Corp. may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. We will comply with such lawful requests while taking reasonable steps to notify affected individuals unless prohibited by law.

Enforcement and Dispute Resolution

Regulatory Oversight

Loren Data Corp. is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC) with respect to our compliance with the Data Privacy Framework Principles.

Complaint Resolution Process

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Loren Data Corp. commits to resolve complaints about our handling of personal data received in reliance on the Data Privacy Framework.

Step 1: Contact Us Directly

EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the DPF should first contact Loren Data Corp. at:

Email:
Postal Address: Loren Data Corp., PO BOX 1438 LAKE FOREST, CA 92609
Phone: 1 310-827-7400

We will investigate and attempt to resolve complaints within forty-five (45) days of receipt.

Step 2: Independent Dispute Resolution

If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, Loren Data Corp. has further committed to refer unresolved privacy complaints under the DPF Principles to JAMS, an independent alternative dispute resolution provider based in the United States.

If you do not receive timely acknowledgment of your DPF complaint from us, or if we have not addressed your DPF complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.

Step 3: Binding Arbitration

Under certain conditions, you may invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms. For additional information, please visit https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf?tabset-35584=2.

General Data Protection Regulation (GDPR)

For individuals in the European Union and United Kingdom, Loren Data Corp. complies with the General Data Protection Regulation (GDPR) and related data protection laws. The rights and protections described in this privacy policy are in addition to any rights you may have under the GDPR.

For GDPR-specific inquiries, please contact us at .

Notification of Changes

If we decide to change our privacy policy, we will post those changes on our Homepage so our users are always aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it.

If at any point we decide to use personally identifiable information in a manner different from that stated at the time it was collected, we will notify users by way of an email. Users will have a choice as to whether or not we use their information in this different manner. We will use information in accordance with the privacy policy under which the information was collected.

For personal data received under the Data Privacy Framework, if we make material changes to how we use such data, we will provide individuals with notice and choice (opt-out or opt-in for sensitive data) before implementing such changes.

If we materially change how AI/ML technologies process personal data in connection with the Services, including the categories of data processed, the categories of AI/ML providers we engage, or any restriction on the use of customer content for AI/ML model training, we will update this policy and our AI and Machine Learning Platform Disclosure and provide notice before the change takes effect.

Product release notes and change logs describe new AI/ML functionality that operates within the purposes, data categories, and restrictions already described in this policy and in our AI and Machine Learning Platform Disclosure. Release notes do not modify this policy or that Disclosure.

Data Retention and Withdrawal from DPF

So long as Loren Data Corp. retains personal data received under the Data Privacy Framework, we will continue to apply the DPF Principles to that data. If we decide to withdraw from the DPF program, we will either:

  • Continue to apply the DPF Principles to all personal data received while we were certified, or
  • Return or delete such personal data

We will annually reaffirm our commitment to the DPF Principles to the U.S. Department of Commerce.

Contact Information

If you have any questions or concerns about this privacy policy or our data practices, please contact us at:

Loren Data Corp.
Email:
Postal Address: PO BOX 1438 LAKE FOREST, CA 92609
Phone: 1 310-827-7400

Verification

Loren Data Corp. conducts periodic assessments to verify that our privacy practices are implemented as represented in this policy and that they comply with the Data Privacy Framework Principles. We maintain records demonstrating compliance with the DPF Principles.