Cotality

GDPR overview

Cotality never claims GDPR compliance in so many words, but it publishes a dedicated Data Privacy Framework policy, effective 29 April 2024. CoreLogic, Inc. and its US entities Symbility Solutions Corp., Next Gear Solutions, LLC and CoreLogic Solutions, LLC are certified under the EU-U.S. Data Privacy Framework, its UK extension and the Swiss-U.S. framework, and commit to the DPF principles for personal data received from the European Economic Area, the United Kingdom, Gibraltar and Switzerland. Data Protection Officers are named for Symbility Solutions Ltd, Symbility Solutions GmbH and CoreLogic Solutions Ltd / CoreLogic UK Limited. Unresolved complaints go free of charge to BBB National Programs and then to binding arbitration, under Federal Trade Commission oversight. No Article 27 representative is designated, and no SOC 2 or ISO 27001 certification is published.

Who owns the data?

Two policies govern data at Cotality, both effective 31 July 2026: a Website Privacy Policy for site visitors and a Product Privacy Policy for the products themselves. Where Cotality acts as a service provider or processor for a business customer, that customer's contract governs the data, and individuals are told to contact the customer directly. Cotality itself buys personal data from third-party licensors and combines datasets from several sources. Records drawn from public registries, or covered by the Gramm-Leach-Bliley Act or the Fair Credit Reporting Act, fall outside the definition of personal data. Aggregated, de-identified or anonymised data may be reused and disclosed to third parties.

Reuse rights

End users get no general right to reuse what they obtain. The terms of use grant a revocable, non-exclusive licence for informational purposes limited to the reader's own transactions, and forbid systematic retrieval, compilation into a collection, database or directory, resale, redistribution to anyone not acting for the reader, modification and derivative works. Anything beyond that requires written permission from the Legal Department in Irvine. On Cotality's own side, personal data is used to deliver, troubleshoot and improve the products, for internal research and testing, and to build, train, test and validate predictive models and analytical tools. Both privacy policies go further and state that personal data may be collected, used or sold for the purpose of training large language models, and website cookie data is sold to advertisers and analytics companies. Individuals may opt out of the sale or sharing of their data and of targeted advertising through an online privacy portal or by telephone; no opt-out from model training is documented.

Data retention & training

Hosting summary

Cotality is headquartered in the United States and says it may use service providers operating in other countries. Both privacy policies warn that personal data may be transferred to the United States, or to other locations where privacy laws are less protective than those of the reader's state, province or country. The Data Privacy Framework policy adds that personal data from the European Economic Area, the United Kingdom, Gibraltar and Switzerland is received by the company in the United States. Beyond that, nothing is disclosed: no hosting region is named, no data centre is identified, no cloud provider is presented as the technical host and no subprocessor list is published. The website itself is served behind Cloudflare on an anycast address, which says nothing about where customer data actually sits. In practice a European or British customer should assume United States processing under the Data Privacy Framework and pin the specifics down in the contract.