Data Processing Agreement

Draft for legal review. Version 2026-10-25-draft.

This agreement is part of the Terms of Service. It covers the personal data of your clients and contacts that you put into BrokerBase.

Roles

You (the brokerage) are the data fiduciary. We are your data processor: we process this data only to provide BrokerBase to you and on your instructions, which are the Terms, this agreement and what you do in the app.

What we process

Names, phone numbers, email addresses, property requirements, notes, site visits, deals and documents (including ID documents you upload), and WhatsApp messages sent through your connected number.

Our commitments

• Process the data only for you and never for our own purposes.
• Keep it confidential; only our staff who need it for support or legal reasons can access it.
• Keep it secure: encryption in transit and at rest, role-based access, separation between brokerages, logging of sensitive actions and backups.
• Store it in India, except the emails we send for your account (through Resend, United States) and services you choose to connect (WhatsApp and Facebook Lead Ads, provided by Meta).
• Use only the sub-processors on our sub-processors page, and tell you before adding one.
• Help you answer your clients' requests to access, correct or erase their data; the app lets you download or delete a person's data.
• Tell you without undue delay if we become aware of a personal data breach affecting your data, with the information you need for your report to the Data Protection Board.
• Delete your data 90 days after your account closes or expires; backups are overwritten within 30 days after that.

Your commitments

You have a lawful basis and give the required notices for the data you put into BrokerBase, and your instructions to us comply with the law.

[Audit rights, liability and other clauses to be completed after legal review.]