1. Scope
This DPA forms part of the agreement between [LEGAL ENTITY NAME], doing business as LO Marketing Tools (“Company”), and the customer (“Customer”). It applies when Company processes Customer Personal Data on Customer's behalf.
2. Roles
“Customer Personal Data” means regulated personal information in Customer Data processed on Customer's behalf. “Data Protection Laws” means applicable privacy/data-protection laws, including where applicable GDPR, UK GDPR, and CCPA. Customer is controller/business and Company is processor/service provider/contractor, except where law provides otherwise. Customer is responsible for lawfulness of instructions, collection, notices, and legal bases.
3. Documented Instructions
Company will process Customer Personal Data only on Customer's documented instructions, including to provide, secure, support, and maintain the Services and as permitted by the agreement, unless law requires otherwise. Customer's configurations, integrations, and automation constitute instructions. Company may suspend an instruction it reasonably believes violates Data Protection Laws while the parties address it.
4. Confidentiality
Company will ensure authorized personnel are subject to confidentiality obligations and receive access only as reasonably necessary.
5. Security
Company will maintain reasonable administrative, technical, and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Customer is responsible for its users, endpoints, account permissions, authentication settings, connected services, credentials, API keys, and configurations.
6. Subprocessors
Customer authorizes Company to use subprocessors. Company will impose appropriate data-protection obligations and remains responsible to the extent required by law. Before production use, maintain a current list at [SUBPROCESSOR URL]. Where required, Company will provide notice of material new subprocessors and a reasonable opportunity to object on legitimate data-protection grounds.
7. Rights Requests
Taking into account the nature of processing, Company will provide reasonable assistance with individual privacy-rights requests. If Company receives a request concerning Customer Personal Data and identifies the relevant Customer, Company may direct the requester to Customer unless law requires otherwise.
8. Security Incidents
Company will notify Customer without undue delay after becoming aware of a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data where notification is required by law. Notification is not an admission of fault. Company will provide reasonably available information and cooperation. Unsuccessful attempts that do not compromise Customer Personal Data are not Security Incidents.
9. DPIAs and Regulatory Assistance
Taking into account the nature of processing and available information, Company will provide reasonable assistance with legally required impact assessments and supervisory-authority consultations relating to Company's processing.
10. Return and Deletion
Upon termination, Company will delete or return Customer Personal Data under the agreement and standard retention processes unless law requires retention. Residual copies may remain temporarily in backups, logs, security records, legal holds, and disaster-recovery systems until deleted in the ordinary course, subject to continued protection.
11. Audits
Company will make available information reasonably necessary to demonstrate compliance. Where legally required and after reasonable notice, Customer may request an audit no more than annually unless a Security Incident or regulator requires otherwise. Audits must avoid unreasonable disruption, protect other customers, and use existing independent reports where reasonably sufficient. Customer bears its audit costs unless law requires otherwise.
12. International Transfers
Where GDPR/UK GDPR applies and Customer Personal Data is transferred to a country without adequate protection, the parties will use an applicable lawful transfer mechanism, which may include the European Commission Standard Contractual Clauses and applicable UK Addendum. Mandatory transfer clauses control over conflicting DPA terms.
13. CCPA Service Provider / Contractor Terms
To the extent CCPA applies and Company acts as service provider/contractor, Company will not sell or share Customer Personal Data; retain, use, or disclose it outside the direct business relationship or specified business purposes except as permitted by CCPA; or combine it with personal information from another source except as permitted by CCPA. Company will provide the level of privacy protection required of service providers/contractors, notify Customer if it determines it can no longer meet applicable obligations, and permit reasonable steps required by law to help ensure compliant use.
14. Liability and Precedence
Liability under this DPA is subject to the governing agreement's limitations to the maximum extent permitted by law. This DPA controls conflicts concerning processing of Customer Personal Data, while mandatory transfer clauses control where applicable.
Annex I — Processing Details
| Item | Description |
|---|---|
| Subject matter | LO Marketing Tools, including data organization, campaign workflows, integrations, communications orchestration, AI-assisted functionality, CRM connectivity, analytics, security, and support as configured by Customer. |
| Duration | Term of Services plus limited retention for backups, security, legal obligations, disputes, and deletion processes. |
| Nature/purpose | Hosting, organizing, retrieving, transmitting, enriching where configured, analyzing, securing, supporting, and otherwise processing data to provide Customer-requested functionality. |
| Data subjects | Customer users, employees, contractors, business contacts, prospects, customers, real estate professionals, message recipients, and other individuals whose data Customer submits. |
| Data categories | Identifiers/contact information; business/professional information; account/CRM information; real estate activity; communications content/metadata; consent/suppression information; technical identifiers; other Customer-submitted information. |
| Sensitive data | Not intended unless expressly supported/agreed. Customer should avoid government identifiers, financial account credentials, health data, biometrics, precise geolocation, or other sensitive data unless necessary, lawful, and supported. |
| Frequency | Continuous or as initiated/configured by Customer during the subscription. |
Annex II — Baseline Security Measures
- Appropriate access controls and least privilege.
- Authentication and administrative-access restrictions.
- Industry-standard transport encryption where supported.
- Reasonable protection of stored credentials and secrets.
- Logging/monitoring appropriate to risk.
- Vulnerability, patch, and dependency-management processes.
- Backup/recovery practices appropriate to the Services.
- Incident-response procedures.
- Risk-appropriate vendor/subprocessor diligence.
- Reasonable personnel policies and training.
Controls may evolve as the platform matures, provided overall security is not materially decreased without legitimate reason.