--- title: "Data Processing Addendum" url: "https://www.brokerpro.com/legal/data-processing-addendum/" description: "The BrokerPro Data Processing Addendum governing how ISS processes personal data on behalf of customers." --- **Effective Date:** December 13, 2026 · **Last Updated:** November 13, 2026 For accounts created on or after November 13, 2026, this DPA applies immediately. For accounts created before November 13, 2026, it takes effect on December 13, 2026. This Data Processing Addendum (“DPA”) is part of the BrokerPro [Terms of Service](/legal/terms-and-conditions/) or other agreement for the Services (the “Agreement”) between Infinity Software Solutions, Inc. (“ISS”) and Customer. It applies when ISS processes Personal Data on Customer’s behalf in providing the Services. Capitalized terms not defined here have the meanings in the Agreement. ## 1. Definitions - **“CCPA”** means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., and its regulations. - **“Controller”** means the entity that determines the purposes and means of processing Personal Data. - **“Customer Data Incident”** has the meaning in Section 7. - **“Data Protection Laws”** means all laws and regulations that apply to the processing of Personal Data under the Agreement, as amended. These include the laws of the United States and its states, and the laws of Canada and its provinces, including the Personal Information Protection and Electronic Documents Act (PIPEDA), Québec’s Act respecting the protection of personal information in the private sector, and the personal information protection acts of Alberta and British Columbia. - **“Data Subject”** means the identified or identifiable person to whom Personal Data relates. - **“Personal Data”** means information in Customer Data relating to an identified or identifiable natural person, including information derived from it by the Services. - **“Processing”** means any operation performed on Personal Data, such as collection, recording, storage, use, disclosure, combination, erasure or destruction. - **“Processor”** means the entity that processes Personal Data on behalf of the Controller, including a “service provider” under the CCPA. - **“Security Measures”** means the security measures ISS applies to the Services, as updated from time to time. - **“Subprocessor”** means any Processor engaged by ISS or its Affiliates to process Personal Data, including Third-Party AI Platforms. ## 2. Processing of Personal Data **2.1 Roles.** Customer is the Controller and ISS is the Processor. ISS may engage Subprocessors under Section 5. **2.2 Customer’s obligations.** Customer will process Personal Data in compliance with Data Protection Laws, including giving any required notices to Data Subjects about ISS’s role as Processor. Customer’s instructions will comply with Data Protection Laws. Customer is solely responsible for its use of Personal Data and how it was obtained, including any consents needed for calls, text messages, email and call recording. **2.3 ISS’s obligations.** ISS will treat Personal Data as Confidential Information and process it only on Customer’s documented instructions, which are: (i) processing under the Agreement to provide the Services in the applicable Order Form; (ii) processing initiated by Authorized Users through the Services; and (iii) processing to follow other reasonable written instructions from Customer, such as by email, that are consistent with the Agreement. In processing Personal Data, ISS will: 1. process it only within the direct business relationship between the parties; 2. not “sell” or “share” it, as those terms are defined in the CCPA, and not combine it with personal information ISS receives from others or collects on its own, except as permitted by Data Protection Laws; 3. notify Customer promptly if ISS determines it can no longer meet its obligations under Data Protection Laws; and 4. on Customer’s reasonable request, provide information needed to show ISS’s compliance with Data Protection Laws. Customer may, on notice, take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Data by ISS or its Subprocessors. ## 3. Data Subject requests To the extent legally permitted, ISS will promptly notify Customer if it receives a request from a Data Subject to exercise rights such as access, correction, deletion, portability, objection or opting out of automated decision-making (a “Data Subject Request”). ISS will not respond to a Data Subject Request itself, except to redirect the Data Subject to Customer if Customer authorizes it. Taking into account the nature of the processing, ISS will provide commercially reasonable help for Customer to respond to Data Subject Requests that Customer cannot address through the Services. Customer is responsible for ISS’s reasonable costs of that help, to the extent legally permitted. ## 4. ISS personnel **4.1 Confidentiality.** ISS will ensure that personnel who process Personal Data know it is confidential, are appropriately trained, and have signed written confidentiality agreements that survive the end of their engagement. **4.2 Reliability.** ISS will take commercially reasonable steps to ensure the reliability of those personnel. **4.3 Limited access.** ISS will limit access to Personal Data to personnel who need it to provide the Services. **4.4 Privacy contact.** ISS’s privacy contact can be reached at [privacy@brokerpro.com](mailto:privacy@brokerpro.com). ## 5. Subprocessors **5.1 Authorization.** Customer authorizes ISS to engage its Affiliates and third-party Subprocessors, including Third-Party AI Platforms, telephony, messaging and hosting providers, to provide the Services. ISS will have a written agreement with each Subprocessor containing data protection obligations no less protective than those in the Agreement, to the extent applicable to the services that Subprocessor provides. ISS will provide its current list of Subprocessors on request. **5.2 New Subprocessors.** ISS will notify Customer before authorizing a new Subprocessor that ISS engages directly to process Personal Data. For a new Subprocessor engaged by one of ISS’s service providers, including a new AI model provider, ISS will pass on the provider’s notice within two (2) calendar days after receiving it. Where the provider gives ISS advance notice, Customer will therefore be notified before the new Subprocessor processes Personal Data. Customer may object in writing to [privacy@brokerpro.com](mailto:privacy@brokerpro.com) within seven (7) days after ISS’s notice. ISS will respond to reasonable objections in good faith. If the parties cannot resolve the objection, Customer may stop using the affected part of the Services. **5.3 Liability.** ISS is liable for the acts and omissions of its Subprocessors to the same extent ISS would be liable if performing their services directly under this DPA, except as otherwise set out in the Agreement. ## 6. Security **6.1 Controls.** ISS will maintain appropriate technical and organizational measures to protect the security, confidentiality and integrity of Customer Data, including protection against unauthorized or unlawful processing and accidental loss, destruction, alteration, or unauthorized disclosure or access, as set out in the Security Measures. ISS will not materially decrease the overall security of the Services during a subscription term. **6.2 Impact assessments.** On Customer’s request, ISS will give reasonable cooperation for any data protection impact assessment Customer must perform about its use of the Services, to the extent Customer cannot otherwise get the information and ISS has it. ## 7. Customer Data Incidents ISS will notify Customer promptly, and in any event within seventy-two (72) hours, after becoming aware, including through notice from a Subprocessor, of any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data processed by ISS or its Subprocessors (a “Customer Data Incident”). The notice will include, to the extent known, the Customer Data affected, the categories and approximate number of Personal Data records and Data Subjects affected, and the steps ISS is taking. ISS will provide further information as it becomes available. ISS will make reasonable efforts to identify the cause, take steps it considers necessary and reasonable to remediate it to the extent within ISS’s reasonable control, keep Customer informed, and reasonably cooperate with Customer, including on required notices to third parties. Unless required by law or law enforcement, ISS will not issue a public statement naming Customer about a Customer Data Incident without first giving Customer reasonable prior written notice. ## 8. Return and deletion ISS will return and delete Customer Data, to the extent allowed by law, under Section 17(d) of the [Terms of Service](/legal/terms-and-conditions/). For AI Data, ISS will instruct its AI platform provider to delete it, and deletion follows that provider’s procedures and timeframes. ISS does not promise a fixed deletion deadline for AI Data. ## 9. Limitation of liability Each party’s and its Affiliates’ total liability arising out of or related to this DPA, under any theory, is subject to the Limitation of Liability section of the Agreement. Any reference there to a party’s liability means the total liability of that party and its Affiliates under the Agreement and this DPA together. ## 10. Order of precedence If this DPA conflicts with the Agreement on the processing of Personal Data, this DPA controls. A separately signed agreement between the parties on data protection or confidentiality controls over this DPA to the extent of any conflict.