Data processing addendum

This Data Processing Addendum (the "DPA") is part of the Milestone Updates Terms of Service (together with this DPA, our Privacy Policy, our Acceptable Use Policy, and any Order, the "Agreement"). This DPA applies when we process personal information on your behalf. If this DPA conflicts with any other part of the Agreement, this DPA controls with respect to the processing of Customer Personal Data.

1. Definitions

Capitalized terms not defined here have the meanings given in the Terms.

• "Customer" or "you" means the person or entity that accepted the Terms. If you use the Service as an employee, sponsored originator, or other representative of a mortgage lender or broker (a "Lender"), you accept this DPA on the Lender's behalf and represent that you are authorized to do so. On request, we will enter into this DPA directly with the Lender.
• "Customer Personal Data" means any personal information within Customer Data that we process on your behalf in providing the Service. This includes the information we retrieve from your loan origination system and the information about recipients' interactions with Milestone Pages.
• "Data Protection Laws" means all U.S. federal and state laws that apply to the processing of Customer Personal Data under the Agreement. These include, as applicable:
  • Title V of the Gramm-Leach-Bliley Act and its implementing regulations, including the Privacy of Consumer Financial Information rule (Regulation P, 12 CFR Part 1016) and the FTC Standards for Safeguarding Customer Information (16 CFR Part 314) (together, "GLBA");
  • the California Consumer Privacy Act as amended by the California Privacy Rights Act, and its regulations ("CCPA");
  • other U.S. state consumer privacy, data security, and breach-notification laws.
• "Security Incident" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data in our or our Subprocessors' systems. It does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans, blocked log-in attempts, or denial-of-service attacks.
• "Subprocessor" means a third party we engage that processes Customer Personal Data on our behalf in providing the Service.
• "Business," "service provider," "sell," "share," "business purpose," "consumer," and "deidentified" have the meanings given in the CCPA. "Controller" and "processor" have the meanings given in applicable state privacy laws. "Nonpublic personal information," "customer information," and "financial institution" have the meanings given under GLBA.

2. Roles of the parties

1. You are in control. As between the parties, you (or the Lender on whose behalf you act) are the controller, the business, and, where GLBA applies, the financial institution for Customer Personal Data.
2. We are your service provider. We are your processor, your service provider under the CCPA, and your service provider under GLBA. We process Customer Personal Data only on your behalf and only to provide the Service.
3. Your other vendors are yours. Your loan origination system provider and your Microsoft 365 tenant are services you obtain directly. We act on your instructions when we connect to them, but they are not our Subprocessors. Their processing is governed by your agreements with them.

3. Your instructions and responsibilities

1. Documented instructions. The Agreement, your configuration of the Service, and your use of its features are your complete documented instructions. Your configuration includes which milestones trigger updates, which recipients receive them, whether agents are copied, and your opt-out list. Additional instructions require our written agreement.
2. Your responsibilities. You are responsible for the following:
   • having a lawful basis, and any notices, authorizations, or consents required by Data Protection Laws and your Lender's policies, to give us Customer Personal Data and to have updates sent to each recipient. This includes any borrower authorization needed to share loan status with real estate agents and other third parties;
   • the accuracy of the data in your loan origination system;
   • maintaining your opt-out list and honoring opt-out requests you receive;
   • keeping any records you are required to keep;
   • using the Service in line with the Acceptable Use Policy.
3. Data minimization. The Service is designed to work without sensitive data. You will not configure the Service to send us, and will not include in Customer Data:
   • Social Security numbers;
   • dates of birth;
   • government ID numbers;
   • credit information;
   • income or asset information;
   • bank or account numbers;
   • wire or payment instructions;
   • loan terms, rates, or payment figures.

4. Our processing obligations

We will:

1. process Customer Personal Data only on your documented instructions and for the Business Purpose described in Annex 1, unless applicable law requires otherwise. In that case, we will tell you before processing unless the law prohibits it;
2. promptly tell you if, in our opinion, an instruction violates Data Protection Laws. We may suspend that processing until you confirm or change the instruction;
3. ensure that every person we authorize to process Customer Personal Data:
   • is bound by appropriate confidentiality obligations;
   • has access only as needed to provide, secure, and support the Service;
   • has been instructed in these obligations;
4. not use Customer Personal Data to train, fine-tune, or improve any artificial intelligence or machine-learning model, whether ours or a third party's. We will configure our Subprocessors' services to opt out of any such use where an opt-out is available;
5. not use or disclose nonpublic personal information other than to carry out the purposes for which you disclosed it to us, consistent with the limits on reuse and redisclosure in 12 CFR 1016.11;
6. maintain the security measures described in Section 7 and Annex 2.

5. CCPA and state privacy law terms

To the extent the CCPA or a similar state privacy law applies to Customer Personal Data, we certify that we understand and will comply with the following:

1. No selling or sharing. We will not sell or share Customer Personal Data. We will not use it for targeted, cross-context behavioral advertising.
2. Business purpose only. We will retain, use, and disclose Customer Personal Data only for the specific Business Purpose described in Annex 1 and as otherwise permitted for service providers by the CCPA and its regulations. We will not use it for any other commercial purpose.
3. No use outside our relationship with you. We will not retain, use, or disclose Customer Personal Data outside our direct business relationship with you. We will not combine it with personal information we receive from or on behalf of any other person, or that we collect from our own interactions with consumers, except as the CCPA regulations expressly permit service providers to do.
4. Permitted internal uses. We may use Customer Personal Data to:
   • maintain, repair, secure, and improve the Service we provide to you;
   • detect and prevent security incidents and fraud;
   • comply with law.
   In each case, we will do so only as permitted for service providers under 11 CCR § 7050. We will not use it to build or modify profiles for use with other customers. We may create deidentified or aggregated data that does not identify you or any individual, such as counts of updates sent or average viewing completion. If we do, we will:
   • take reasonable measures to ensure it cannot be associated with an individual;
   • publicly commit not to re-identify it;
   • contractually require any recipients to do the same.
5. Same level of protection. We will comply with the CCPA obligations that apply to service providers and give Customer Personal Data the same level of privacy protection the CCPA requires of businesses.
6. Your oversight rights. You may take reasonable and appropriate steps to ensure we use Customer Personal Data consistently with your CCPA obligations, as described in Section 12. On notice, you may also take reasonable and appropriate steps to stop and remediate any unauthorized use, including requiring us to delete Customer Personal Data and confirm deletion.
7. Notice if we can't comply. We will notify you within ten (10) business days if we determine we can no longer meet our obligations under the CCPA or this Section.
8. Help with consumer requests. We will help you respond to consumer requests as described in Section 10.
9. Other state privacy laws. Where another state privacy law applies, we will act as your processor and comply with that law's processor obligations. Those obligations include duties of confidentiality, deletion or return at the end of the services, making information available to show compliance, and binding Subprocessors to equivalent terms.

6. GLBA Safeguards cooperation

We understand that, as a financial institution or as the representative of one, you must oversee your service providers under 16 CFR 314.4(f) or equivalent rules. We will:

1. maintain a written information security program with administrative, technical, and physical safeguards appropriate to our size and complexity, the nature and scope of the Service, and the sensitivity of Customer Personal Data. We will also designate a qualified individual responsible for it;
2. maintain safeguards that include, at a minimum, the measures in Annex 2, including:
   • access controls;
   • encryption of customer information in transit and of authentication credentials at rest;
   • multi-factor authentication for administrative access;
   • activity logging;
   • secure disposal;
   • change management;
3. review and update the program at least annually, and after any material change to the Service or any Security Incident;
4. provide the information you reasonably need to assess our safeguards (Section 12), and to determine whether a Security Incident is a "notification event" you must report to the Federal Trade Commission or other regulators (Section 9);
5. cooperate reasonably with examinations, inquiries, or audits by your regulators that concern the Service, at your reasonable request.

7. Security

We will implement and maintain the technical and organizational measures described in Annex 2. Their purpose is to protect Customer Personal Data against Security Incidents and to preserve its confidentiality, integrity, and availability. We may update these measures over time as technology and threats change. We will not materially reduce the overall level of protection they provide.

8. Subprocessors

1. Authorization. You authorize us to engage the Subprocessors listed in Annex 3.
2. Our obligations for Subprocessors. For each Subprocessor, we will:
   • evaluate its security and privacy practices before engaging it;
   • bind it by written agreement to data protection obligations no less protective than those in this DPA, to the extent applicable to the services it provides;
   • remain responsible for its performance of those obligations.
3. Changes. We will notify you at least thirty (30) days before we add or replace a Subprocessor. We will update Annex 3 and email the account contact on file. In an emergency, where a change is needed to keep the Service secure or available, we may give shorter notice, and we will explain why.
4. Objections. You may object on reasonable data-protection grounds within thirty (30) days of notice. We will work with you in good faith to resolve the objection. If we cannot, you may terminate the affected part of the Service without penalty and receive a refund of any prepaid fees for the unused period.

9. Security Incident notification

1. Notice. We will notify you without undue delay after we become aware of a Security Incident. Our target is to notify you within seventy-two (72) hours of confirming one. If we suspect an incident involving the credentials we use to send email from your mailbox, we will promptly disable those credentials and notify you, even before the investigation is complete.
2. Contents. Our notice will include, to the extent known and as it becomes known:
   • a description of the incident;
   • the date or date range;
   • the types of Customer Personal Data involved;
   • the approximate number of individuals affected;
   • whether the data was encrypted;
   • the steps we have taken and recommend;
   • a contact for more information.
   We will provide updates as our investigation progresses.
3. Cooperation. We will take reasonable steps to contain, investigate, and remediate the incident. We will give you the information and assistance you reasonably need to meet your own notification obligations. These obligations include the FTC Safeguards Rule's requirement to notify the FTC within 30 days of discovering an event involving 500 or more consumers, and state breach-notification laws.
4. Who notifies. Unless the law requires otherwise, you decide whether and how to notify affected individuals, regulators, and others. We will not do so on your behalf without your approval, except where the law requires us to.
5. No admission. Our notice is not an admission of fault or liability.

10. Consumer requests and other assistance

1. Requests sent to us. If we receive a request from a consumer to exercise privacy rights regarding Customer Personal Data (including requests to access, delete, or correct data, or to stop receiving updates), we will:
   • promptly forward it to you;
   • not respond to it ourselves, except to acknowledge receipt and direct the person to you, unless you instruct otherwise or the law requires it.
   If we receive a request to stop receiving updates, we will also apply it to your opt-out list.
2. Help with your responses. Taking into account the nature of the processing, we will provide reasonable assistance so that you can respond to consumer requests, including by deleting or exporting Customer Personal Data about a specific individual.
3. Other assistance. We will also provide reasonable assistance with any data protection assessments, regulatory inquiries, and consultations that concern the Service.

11. Data location, retention, and deletion

1. U.S. only. The Service is offered only in the United States and is intended for U.S. loans and recipients. Our Subprocessors operate global networks, so Customer Personal Data may be processed or cached outside the United States to deliver the Service quickly and securely. It remains protected under this DPA wherever it is processed.
2. Retention during the Agreement.
   • Milestone Pages expire and are removed one hundred eighty (180) days after creation.
   • Event and send logs are kept for about thirteen (13) months.
   • Loan data retrieved from your loan origination system is kept only as long as needed to detect milestone changes, generate updates, and keep the related logs.
   • Microsoft and loan-system credentials are kept until you disconnect them or the Agreement ends.
3. At termination. When the Agreement ends, or at your earlier written request:
   • we will delete stored Microsoft authorization tokens and loan-system credentials within two (2) business days;
   • we will delete or return all other Customer Personal Data within thirty (30) days, unless the law requires us to keep it.
   If you ask before termination, we will provide a copy of the send history and update content we still hold, in a commonly used format.
4. Residual copies. Any copies that remain in system logs or backups will stay protected under this DPA. They will be deleted in the normal course of those systems, and will not be actively processed.
5. Not a system of record. The Service is not a records-retention system. You are responsible for keeping any copies of communications or advertising your Lender or the law requires you to keep. Messages we send through your Microsoft mailbox are saved to that mailbox's Sent Items unless you configure otherwise.

12. Audits and assessments

1. Documentation. Once every twelve (12) months, or more often if required by law or a regulator, or after a Security Incident, we will respond to your reasonable written security and privacy questionnaire. This may be your own form, or an industry-standard form such as the SIG Lite or CSA CAIQ. On request, we will also provide:
   • a summary of our written information security program and incident response plan;
   • our current Subprocessor list;
   • available third-party security reports or certifications for our Subprocessors;
   • other information reasonably necessary to show compliance with this DPA.
2. Further review. If the documentation is not reasonably sufficient to show compliance, or a regulator requires it, you (or an independent auditor bound by confidentiality) may conduct a further assessment. The assessment must:
   • take place with at least thirty (30) days' notice;
   • take place during business hours;
   • follow a mutually agreed scope;
   • be at your expense;
   • be conducted in a way that does not compromise the security of other customers' data.
   Remote reviews are preferred.
3. Confidentiality. Information we provide under this Section is our confidential information.
4. Remediation. If an assessment identifies a material gap, we will agree on a remediation plan with you in good faith.

13. Legal requests

If a government authority or other third party asks us to disclose Customer Personal Data, we will:

• redirect the request to you where reasonably possible;
• promptly notify you, unless the law prohibits notice;
• disclose only what the law requires.

14. Liability

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability in the Terms. This applies whether the claim is in contract, tort, or under any other theory.

15. Term and changes

This DPA lasts as long as we process Customer Personal Data on your behalf. We may update this DPA to reflect changes in law or in the Service. If a change materially reduces your protections, we will give you at least thirty (30) days' notice, unless the change is required by law. Lenders that need negotiated terms may contact us at support@milestoneupdates.com.

Annex 1: Details of processing

Annex 2: Security measures

These are the measures we maintain today. Your Lender may request more detail under Section 12.

Annex 3: Subprocessors

To get email notice of Subprocessor changes, or with questions about this DPA, contact support@milestoneupdates.com.