Data Processing Agreement

1. Definitions

• "Applicable Law" means the U.S. state privacy laws that apply to Controller's processing of Personal Information, including where applicable the California Consumer Privacy Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Delaware Personal Data Privacy Act, the Indiana Consumer Data Protection Act, the Iowa Consumer Data Protection Act, the Montana Consumer Data Privacy Act, the New Hampshire Privacy Act, the New Jersey Data Privacy Act, the Oregon Consumer Privacy Act, the Tennessee Information Protection Act, the Texas Data Privacy and Security Act, the Utah Consumer Privacy Act, and the Virginia Consumer Data Protection Act.
• "Personal Information" has the meaning given in Applicable Law, and includes personal data and personal information as defined in the statutes listed above.
• "Processor," "Controller," and "process" have the meanings given in Applicable Law. Where Applicable Law uses "service provider," "processor," or comparable terms, Mortgage Vault acts in that role for Controller.
• "Subprocessor" means a third party engaged by Mortgage Vault to process Personal Information on Controller's behalf.

2. Scope and roles

Mortgage Vault processes Personal Information as a Processor on behalf of Controller solely to provide the Services described in the Terms of Use and the Order. Controller is the Controller of the Personal Information it submits to the Services and is responsible for the lawfulness of that Personal Information and for any instructions it gives Mortgage Vault.

3. Processor obligations

Mortgage Vault will:

• process Personal Information only on Controller's documented instructions, including as necessary to provide the Services;
• not sell Personal Information and not share Personal Information for cross-context behavioral advertising as those terms are defined under Applicable Law;
• not retain, use, or disclose Personal Information for any purpose other than the specific purpose of performing the Services, or as otherwise permitted by Applicable Law;
• not combine Personal Information received from Controller with personal information received from any other source, except as permitted by Applicable Law;
• comply with the applicable Processor obligations under Applicable Law and provide the same level of privacy protection Applicable Law requires;
• notify Controller if Mortgage Vault determines it can no longer meet its obligations under Applicable Law, and allow Controller to take reasonable steps to stop or remediate the unauthorized use of Personal Information; and
• make available to Controller information reasonably necessary to demonstrate compliance with this DPA.

4. Confidentiality

Mortgage Vault will ensure that personnel authorized to process Personal Information are subject to a written obligation of confidentiality.

5. Security

Mortgage Vault will implement and maintain appropriate administrative, technical, and physical safeguards designed to protect the Personal Information it processes on Controller's behalf. Current safeguards are described in the Security Overview.

6. Subprocessors

Controller authorizes Mortgage Vault to engage the Subprocessors listed on the Subprocessor List. Mortgage Vault will:

• enter into a written agreement with each Subprocessor that imposes data-protection obligations no less protective than those in this DPA;
• remain liable for each Subprocessor's compliance with those obligations; and
• update the Subprocessor List when it adds a new Subprocessor and, where applicable to Controller's plan, provide advance notice as described in the Subprocessor List.

Controller may object in writing to a new Subprocessor within fifteen (15) days of notice. If the parties cannot resolve the objection in good faith, Controller may terminate the affected Services for cause.

7. Assistance with consumer requests

Taking into account the nature of the processing, Mortgage Vault will provide reasonable assistance to Controller in responding to verifiable consumer requests to access, correct, delete, or opt out of the processing of Personal Information, to the extent Controller cannot fulfill the request itself through the Services. Requests should be sent to privacy@mymortgagevault.com.

8. Data protection assessments

Mortgage Vault will make available to Controller, upon reasonable request, information reasonably necessary to conduct data-protection assessments that Applicable Law requires Controller to conduct in connection with its use of the Services.

9. Audits

No more than once every twelve (12) months (and more frequently if required by Applicable Law or by a supervisory authority), Controller may request a summary of Mortgage Vault's most recent security review or attestations relevant to the Services. Audits are conducted by written questionnaire; on-site audits are limited to enterprise customers and require prior written agreement on scope, cost allocation, and confidentiality.

10. Security incidents

Mortgage Vault will notify Controller without undue delay after becoming aware of a Security Incident affecting Personal Information that Mortgage Vault processes on Controller's behalf. The notice will describe, to the extent known at the time, the nature of the incident, the categories of Personal Information involved, and the measures Mortgage Vault has taken or proposes to take. Mortgage Vault will provide reasonable cooperation in Controller's investigation and, where required, in Controller's notifications to regulators or data subjects.

11. Return or deletion of Personal Information

On termination of the Services, Mortgage Vault will delete Personal Information within a reasonable period, as described in the Privacy Policy, except to the extent retention is required by law or necessary to defend legal claims.

12. Data location

Personal Information is stored on servers in the United States. Where a Subprocessor processes Personal Information outside the United States, that arrangement is described in the Subprocessor List.

13. Limitations of liability

Each party's liability under this DPA is subject to the exclusions and limitations of liability in the Terms of Use.

14. Governing law

This DPA is governed by the same law that governs the Terms of Use.

15. Miscellaneous

• This DPA is incorporated into and forms part of the Terms of Use.
• If any provision of this DPA is unenforceable, the remaining provisions remain in effect.
• Mortgage Vault may update this DPA to reflect changes in Applicable Law or its Services; material changes will be posted with an updated Effective Date.

16. Contact us

Mortgage Vault Corp. · Attn: Privacy · 2810 N. Church St., Unit 558336, Wilmington, DE 19802
Email: privacy@mymortgagevault.com