Data Processing Agreement

This Data Processing Agreement (“DPA”) is entered into as of the Effective Date by and between:

This DPA is incorporated into and forms part of the Terms of Service (“Agreement” or “ToS”). In the event of any conflict between this DPA and the Agreement, this DPA shall prevail with respect to the processing of Personal Data.

1. Definitions

1.1. “Applicable Data Protection Law” means all laws applicable to the processing of Personal Data, including the GLBA, FTC Safeguards Rule, CCPA/CPRA, VCDPA, GDPR (to the extent applicable), and all other applicable privacy statutes.

1.2. “Authorized User” means any individual granted access to the Platform by the Controller.

1.3. “Controller” means the entity that determines the purposes and means of processing Personal Data.

1.4. “Customer Data” means all data, including Personal Data, provided to the Platform by or on behalf of the Controller.

1.5. “Data Subject” means an identified or identifiable natural person, including mortgage loan applicants, borrowers, co-borrowers, referral partners, and any other individuals whose Personal Data is processed through the Platform.

1.6. “Data Subject Request” means a request to exercise rights under Applicable Data Protection Law (access, correction, deletion, restriction, portability, objection).

1.7. “Nonpublic Personal Information” or “NPI” has the meaning ascribed under the Gramm-Leach-Bliley Act (15 U.S.C. § 6809(4)).

1.8. “Personal Data” means any information relating to an identified or identifiable natural person processed by the Processor on behalf of the Controller, including NPI.

1.9. “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

1.10. “Processing” means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, encryption, decryption, masking, export, and analytics.

1.11. “Processor” means NEXUS Systems LLC.

1.12. “Sensitive Personal Data” means SSNs, DOBs, credit scores, financial account information, and any data classified as “Restricted” or “High Sensitivity.”

1.13. “Sub-Processor” means any third party engaged by the Processor to Process Personal Data on behalf of the Controller.

1.14. “Supervisory Authority” means any governmental or regulatory body with jurisdiction, including the FTC, CFPB, and state attorneys general.

2. Scope and Purpose of Processing

2.1. Purpose Limitation

The Processor shall Process Customer Data solely for providing the NEXUS Platform services and solely in accordance with the Controller’s documented instructions. The Processor shall not Process Personal Data for any other purpose unless required by law or authorized in writing by the Controller.

2.2. Categories of Data Subjects

1. Mortgage loan applicants;
2. Borrowers;
3. Co-borrowers;
4. Referral partners; and
5. Other individuals whose Personal Data is entered into the Platform.

2.3. Categories of Personal Data Processed

2.3.1. High-Sensitivity Personal Data (Restricted)

2.3.2. Standard PII (Confidential)

Names, addresses, contact information, demographic data, and professional identifiers (NMLS numbers).

2.3.3. Financial Data (Confidential)

Loan information, income and employment data, assets and liabilities, commission data, and IRRRL flags.

2.3.4. Application Data

MISMO 3.4 loan application fields, application status and workflow data, campaign and marketing data, and follow-up and relationship data.

2.4. Processing Activities

1. Storage — Secure storage in encrypted PostgreSQL databases on SOC 2 compliant US infrastructure;
2. Retrieval — Authenticated, access-controlled retrieval with sensitive data masked by default;
3. Display — Presentation through the Platform UI with RBAC and org-level isolation;
4. Calculation — Commission calculations, pipeline analytics, DTI ratios, and financial projections;
5. Export — Data export in MISMO 3.4 XML, CSV, and JSON formats;
6. Campaign automation — Scheduled and event-triggered email communications;
7. Analytics — Aggregated production reports, trend analysis, and performance metrics;
8. Client management — Follow-up tracking and engagement workflows;
9. AI-assisted features — Targeting recommendations using non-sensitive data only (SSNs, DOBs, financial account numbers are never transmitted to AI providers); and
10. Backup and disaster recovery — Automated encrypted backups with defined retention.

2.5. Processing shall continue for the duration of the Agreement plus any post-termination retention period.

3. Processor Obligations

3.1. Processing on Instructions

The Processor shall Process Personal Data only on documented instructions from the Controller. The Processor shall immediately inform the Controller if an instruction infringes Applicable Data Protection Law.

3.2. Confidentiality

All persons authorized to Process Personal Data are under appropriate confidentiality obligations. Access is limited to personnel who require it, with appropriate training.

3.3. Security

The Processor implements comprehensive security measures as described in Annex II, including:

1. AES-256-GCM encryption for Sensitive Personal Data with per-value random IVs;
2. TLS 1.2+ on all connections;
3. TOTP-based two-factor authentication;
4. JWT-based authentication with live database validation;
5. Organization-level data isolation at the database query level;
6. Complete audit logging with seven-year retention;
7. SSN masking by default with audit-logged reveal;
8. Rate limiting on all sensitive endpoints;
9. DOMPurify input sanitization;
10. Helmet.js security headers;
11. Sentry error monitoring (no PII transmitted);
12. Watchdog automated health monitoring (30-second intervals); and
13. CI/CD pipeline security with dependency auditing.

3.4. Assistance with Data Subject Rights

The Processor shall assist the Controller in fulfilling Data Subject Requests through appropriate technical and organizational measures.

3.5. Assistance with Impact Assessments

The Processor shall provide reasonable assistance with data protection impact assessments and consultations with Supervisory Authorities.

3.6–3.8.

The Processor shall assist with breach notification, provide data return/deletion upon termination, and make available information to demonstrate compliance including support for audits.

4. Controller Obligations

4.1. The Controller warrants it has a lawful basis for collection and processing, and is responsible for obtaining consents and providing privacy notices.

4.2. The Controller shall ensure instructions comply with Applicable Data Protection Law.

4.3. The Controller is responsible for managing Authorized User access, including prompt deactivation of departed personnel.

4.4. The Controller is responsible for the accuracy, quality, and legality of all Customer Data.

5. Sub-Processors

5.1. The Controller provides general written authorization for the Processor to engage Sub-Processors. The current list is in Annex III.

5.2. The Processor enters into written agreements with each Sub-Processor imposing obligations no less protective than this DPA, and remains fully liable for Sub-Processor performance.

5.3. The Processor provides at least thirty (30) days’ notice before engaging new Sub-Processors.

5.4. The Controller may object within fifteen (15) days. If the Parties cannot resolve the objection within thirty (30) days, either Party may terminate without penalty to the Controller.

6. Data Security Measures

The Processor implements and maintains comprehensive measures as detailed in Annex II, appropriate to the nature, scope, context, and purposes of Processing and the risk to Data Subjects. Security is regularly reviewed, never materially decreased during the Agreement, and full documentation is available upon request.

7. Data Breach Notification

7.1. The Processor shall notify the Controller within seventy-two (72) hours of becoming aware of a Personal Data Breach.

7.2. Notification includes: nature of the breach, categories and approximate number of affected Data Subjects and records, contact details, likely consequences, and measures taken or proposed.

7.3. The Processor shall cooperate with investigation, mitigation, and remediation, and assist with regulatory notifications.

7.4. Incident Response Capabilities:

1. Detection — Watchdog (30-second health checks) and Sentry (error tracking);
2. Containment — Immediate session revocation, key rotation, endpoint disabling;
3. Assessment — Audit log queries to determine scope;
4. Remediation — Key rotation, re-encryption, vulnerability patching; and
5. Documentation — Incident recording with root cause analysis.

7.5. A breach log is maintained and available to the Controller upon request.

8. Data Subject Rights

The Processor provides mechanisms for:

1. Right of Access — Data export in MISMO 3.4 XML, CSV, and JSON;
2. Right to Rectification/Correction — Data correction through the Platform UI;
3. Right to Erasure/Deletion — Account and data deletion functionality;
4. Right to Data Portability — Structured, machine-readable export formats; and
5. Right to Restriction — Record-level access restriction upon Controller instruction.

Response within thirty (30) days or as required by law. Reasonable assistance at no additional charge.

9. Data Transfers

9.1. All Customer Data is stored and processed within the United States.

9.2. No international transfers without prior written consent. Cloudflare processes HTTP metadata at global edge locations for CDN/DDoS only.

9.3. If international transfer is authorized, appropriate safeguards (SCCs, BCRs, or equivalent) will be implemented.

10. Audits and Inspections

The Controller may conduct audits with thirty (30) days’ notice, during business hours, no more than once per year (unless a breach or regulatory inquiry necessitates additional audits). The Processor may offer third-party audit reports, security questionnaires, or compliance documentation as alternatives. Remediation plans will be developed for any identified non-compliance.

11. Term and Termination

11.1. This DPA is co-terminous with the Agreement.

11.2. Upon termination, the Controller has thirty (30) days to export data in MISMO 3.4 XML, CSV, or JSON format.

11.3. Customer Data is permanently deleted from production within sixty (60) days post-export period. Backups purged within ninety (90) days.

11.4. Data may be retained as required by law. Audit logs retained for seven (7) years.

11.5. Survival: Definitions, Confidentiality, Breach Notification (post-termination discoveries), Audits (one year), Term and Termination, Liability, and Governing Law survive.

12. Liability

12.1. Liability is subject to the limitations in the Agreement, except for fraud, intentional misconduct, gross negligence, breach of confidentiality, breach notification obligations, or any liability that cannot be limited by law.

12.2. Each Party indemnifies the other for breaches of this DPA, subject to the Agreement’s limitations.

13. Governing Law and Regulatory Compliance

13.1. Governed by Michigan law. Disputes in Macomb County, Michigan courts.

13.2. The Processor implements a comprehensive information security program satisfying the GLBA Safeguards Rule, including administrative, technical, and physical safeguards.

13.3. Compliance with the FTC’s Revised Safeguards Rule (effective June 9, 2023): encryption in transit and at rest, access controls, monitoring and logging, and regular security testing.

13.4. Compliance with applicable state privacy laws (CCPA/CPRA, VCDPA, NYDFS 23 NYCRR 500) and GDPR-compatible structure.

14. General Provisions

14.1. Entire Agreement. This DPA, together with the Agreement and annexes, constitutes the entire agreement regarding Processing.

14.2. Amendments. Amendments require written agreement, except Annex III updates per Section 5.

14.3. Severability. Invalid provisions are modified to the minimum extent necessary.

14.4. Order of Precedence. This DPA prevails over the Agreement for Personal Data matters. The body prevails over annexes.

14.5. Notices. Written notices to designated addresses; breach notices may be via email.

14.6. No Third-Party Beneficiaries. Except Data Subjects to the extent provided by law.

14.7. Waiver. Failure to enforce does not constitute waiver.

14.8. Counterparts. Electronic signatures are valid and binding.

15. Acceptance

By creating an Organization account and accepting the Terms of Service, the Controller accepts the terms of this DPA. Electronic acceptance has the same legal effect as a physical signature.

Annex I — Description of Processing

A. List of Parties

B. Description of Processing

C. Competent Supervisory Authority

Federal Trade Commission (FTC) and Consumer Financial Protection Bureau (CFPB).

Annex II — Technical and Organizational Security Measures

1. Encryption

2. Access Controls

3. Data Masking and Minimization

4. Audit Logging

5. Network Security

6. Infrastructure Security

7. Monitoring and Incident Detection

8. Key Management

9. Organizational Measures

Annex III — List of Sub-Processors

The Controller is deemed to have authorized the above Sub-Processors by executing this DPA. Changes are subject to the notification and objection procedure in Section 5.