Data Processing Addendum

Roles

For customer data submitted to a workspace, the customer is generally the controller or business, and we act as a processor or service provider to provide the service. For account, billing, security, and operational data, we may act as an independent controller or business.

Processing details

Subject matter: operation of the LIT/AMS platform. Duration: the term of the customer relationship and any retention period. Nature and purpose: hosting, storage, workflow automation, reporting, support, security, backups, and service improvement.

Data categories may include account data, contact data, employee data, agent licensing data, prospect and customer information, sales records, service records, statement files, commission data, HR records, attendance records, training records, notes, documents, and technical logs.

Customer instructions

We process customer data according to the customer instructions reflected in the Terms, product configuration, user actions, and applicable order forms. Customers are responsible for the lawfulness of their data and instructions.

Customer-authorized overseas access

Customers may instruct us to make workspace data accessible to their authorized overseas employees or contractors through account permissions. Those users act under the authority of the customer and are not our subprocessors merely because they access the service. The customer must assess and satisfy applicable requirements for that access; our own service providers remain covered by the subprocessor provisions.

Security and confidentiality

We will use reasonable safeguards designed to protect customer data and require personnel with access to customer data to handle it confidentially.

Subprocessors

We may use subprocessors to provide hosting, infrastructure, email, payment, support, security, analytics, and related services. The Subprocessor List identifies hosting and configured service providers and their purposes.

Deletion, return, and assistance

Account closure, recovery and deletion follow the timelines and retention criteria in the current Privacy Policy and the public account-deletion page. These specific limits control over general references to legitimate business needs in this DPA. Closing an individual account does not itself terminate the agency workspace. We assist customers with verified data requests, export or return where available, and provider deletion requests where required. A specific legal retention obligation or legal hold may delay only the affected records; it does not authorize unrelated use or indefinite retention of all customer data.

HIPAA note

The service is not intended to create a HIPAA business associate relationship unless a separate written Business Associate Agreement is signed. Customers should not submit protected health information requiring HIPAA treatment unless an appropriate agreement is in place.