Data Processing Addendum

01Definitions and scope

The partner is the controller of personal information processed within its tenant. Aurum Estate is the processor. This addendum applies to all personal information processed by Aurum Estate on the partner's behalf in the course of providing the platform.

Personal information includes consumer account data, lead records, offer and transaction data, uploaded documents, and signature records belonging to the partner's marketplace.

02Processing on documented instructions

• We process personal information only to provide, secure, and support the platform, or as the partner instructs in writing.
• We notify the partner if an instruction appears to conflict with applicable law, and we do not proceed until it is resolved.
• We do not process partner personal information for our own purposes beyond aggregate operational metrics that identify no individual or partner.
• We do not use partner data to train models or build audiences.

03Confidentiality and personnel

• Access is limited to personnel who need it to provide the service.
• Personnel are bound by written confidentiality obligations that survive termination.
• Access reviews run on a defined cycle and after any role change.
• Administrative access to partner data is logged, and support impersonation is audited and time-bound.

04Security measures

• Encryption in transit and at rest, with managed key rotation.
• Tenant isolation enforced at the data layer, scoped from the authenticated session.
• Least-privilege access with periodic review and prompt revocation.
• Centralised secret storage for credentials, with self-service rotation.
• Immutable audit logging of approvals, document access, and money movement.
• Monitoring and alerting for authentication anomalies, unusual export volume, and privilege escalation.
• Documented incident response with defined notification windows.

05Subprocessors

The partner authorizes the use of subprocessors for hosting, storage, document signing, messaging, payments, and monitoring. A current list with locations and purposes is provided during onboarding and on request.

We impose written data protection terms on each subprocessor that are no less protective than these, and we remain liable for their performance. Where the agreement requires it, we notify the partner before adding a new subprocessor and give a reasonable opportunity to object.

06International transfers

Where personal information is transferred across borders, transfers rely on an appropriate lawful mechanism, which is identified in the executed addendum along with the destinations involved. Any transfer mechanism is documented rather than implied.

07Assistance to the partner

• Assisting with data-subject requests, including access, correction, deletion, and portability.
• Providing information reasonably needed for a data protection impact assessment.
• Notifying the partner without undue delay after becoming aware of a personal data breach affecting its data, with the information needed to meet its own notification obligations.
• Supporting the partner's audit rights through documentation and, where required, a review under confidentiality.

08Return and deletion

On termination or on instruction, we return or delete personal information in our possession within the agreed window, subject to legal retention requirements. Where retention is mandatory — for example signature certificates and records subject to a state retention rule — we retain only that data and only for as long as required, then delete it.

09Liability and precedence

Liability under this addendum follows the executed Master Services Agreement. Where this addendum conflicts with the main agreement on a data protection matter, this addendum prevails. Specific liability positions are deliberately left for counsel and the signed agreement rather than stated as a website template.