Data Processing Addendum
Last updated November 3, 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between Property Partner LLC ("Property Partner," "we," or "us") and the customer ("Customer," "you"). It governs the processing of Personal Data through the Service. If there is a conflict between this DPA and the Terms with respect to the processing of Personal Data, this DPA controls.
1. Definitions
"Applicable Data Protection Laws" means US state privacy laws applicable to the processing, including the California Consumer Privacy Act as amended by the CPRA ("CCPA"), the Virginia Consumer Data Protection Act, and the Colorado Privacy Act. "Personal Data" means information relating to an identified or identifiable individual that is processed through the Service. "Business," "Controller," "Service Provider," "Processor," "Sell," "Share," and "Data Subject" have the meanings given under Applicable Data Protection Laws. "Subprocessor" means a third party we engage to process Personal Data. "Process" means any operation performed on Personal Data.
2. Roles of the parties
The Service processes Personal Data in two capacities, and the roles differ accordingly:
- Property Partner as Business/Controller. We maintain a shared, aggregated dataset of property and owner information. We collect public-records and licensed data — for example code-enforcement, property-tax, and 311 records and licensed parcel data — on our own initiative; skip-trace contact details (phones, emails, and Do-Not-Call status) are obtained on a customer's skip trace request, which we then retain and reuse as part of that shared dataset on our own initiative. A retained trace result may be reused to serve other customers who later skip trace the same owner within a freshness window; it is not siloed to the customer whose skip trace first prompted it. We determine the purposes and means of that aggregation, retention, and reuse, so for the shared dataset we act as a Business/Controller in our own right, as described in our Privacy Policy. The same is true of the account and billing data we collect to provide and administer the Service.
- Property Partner as Service Provider/Processor. For the Personal Data we process on your instruction and on your behalf — in particular your request to skip trace a lead and the resulting usage metering, and the leads you export — you are the Business/Controller and we act as your Service Provider/Processor. This DPA governs that processing. (The underlying trace-result dataset is controller-side shared aggregation, described in the first bullet above and in our Privacy Policy, not data we hold solely on your behalf.)
3. Details of the processing
These details span both roles described in Section 2: the shared, aggregated dataset we maintain as a Business/Controller and the Personal Data we process on your behalf as a Service Provider/Processor. The Section 5 processor covenants attach only to the on-your-behalf subset, not to the shared dataset.
- Subject matter
- Our provision of the Service to you under the Terms.
- Duration
- The term of your subscription, plus the retention and deletion periods described in Section 9.
- Nature and purpose
- Aggregating, matching, storing, displaying, and exporting property and owner information so you can identify and contact potential sellers, and operating the associated account, billing, entitlement, and security functions.
- Categories of Personal Data
- Property-owner names and mailing details; owner contact information (phone numbers, including Do-Not-Call status, and email addresses); property and parcel information associated with individuals; your authorized users' account and contact details; and records of your authorized users' activity in the Service (searches, saved searches, monitored properties and alerts, and leads skip-traced and exported).
- Categories of Data Subjects
- Property owners and mailing contacts surfaced by the Service, and your authorized users.
- Sensitive data
- The Service is not intended to process sensitive categories of Personal Data, and you agree not to use it to do so.
4. Your responsibilities as the Business/Controller
For the Personal Data you process through the Service, you are responsible for establishing and maintaining a lawful and permissible basis for your processing, for providing any notices and honoring any rights required of a Business/Controller, and for using the Service and its data lawfully. In particular, you are responsible for compliance with the TCPA, the Telemarketing Sales Rule, and Do-Not-Call laws (see the Terms), and you will not use the Service or its data for any purpose covered by the Fair Credit Reporting Act. Your instructions to us must comply with Applicable Data Protection Laws.
5. Our obligations as Service Provider/Processor
When we process Personal Data on your behalf, we will:
- Process it only on your documented instructions — which include the Terms, this DPA, and your configuration and use of the Service — and as needed to provide the Service, except where law requires otherwise (in which case we will inform you unless prohibited);
- Not Sell or Share the Personal Data, and not retain, use, or disclose it for any purpose other than providing the Service (the "business purpose"), or outside the direct business relationship with you, or as otherwise permitted by Applicable Data Protection Laws;
- Not combine the Personal Data with information from other sources except as permitted by Applicable Data Protection Laws to perform the Service;
- Ensure that personnel authorized to process the Personal Data are bound by confidentiality;
- Comply with our obligations as a Service Provider/Processor under Applicable Data Protection Laws and notify you if we determine we can no longer meet them.
These covenants apply to the Personal Data we process on your behalf as a Service Provider/Processor (Section 2). They do not apply to the shared, aggregated dataset we maintain as a Business/Controller — including public-records, licensed, and retained skip-trace observations that may be reused to serve other customers within a freshness window — which is governed by Section 2 and our Privacy Policy, not by these processor covenants. We hereby certify that we understand and will comply with these restrictions.
6. Security
We maintain technical and organizational measures appropriate to the risk, including encryption of Personal Data in transit, passwordless authentication with opaque server-side sessions, a strict content-security policy, least-privilege access controls to production systems, logging and monitoring, and use of Stripe for payment processing so that card and bank-account numbers are not stored on our systems.
7. Subprocessors
You authorize us to engage Subprocessors to process Personal Data to provide the Service. We impose data-protection obligations on each Subprocessor that are consistent with this DPA, and we remain responsible for their performance. This list spans both roles in Section 2 — some Subprocessors process data on your behalf (for example Stripe), while others support the shared dataset we maintain as a controller (for example the skip-trace and address-verification providers, Regrid, and the map-imagery provider); the role for each follows Section 2. Our current and anticipated Subprocessors include:
- Stripe
- Payment processing (cards and ACH debit mandates).
- Skip-trace and address-verification providers
- Owner contact enrichment (phones, emails, Do-Not-Call status) and property classification, for skip traces you request.
- Regrid
- Licensed parcel data.
- Map-imagery provider (Esri)
- Satellite base-map tiles served to signed-in map views; interim, slated for replacement.
- Cloud hosting and database infrastructure
- Hosting, storage, and operation of the Service.
- Transactional email provider
- Delivery of sign-in codes and Service notifications, when a live email provider is enabled.
- Matomo Cloud (InnoCraft)
- Cookieless usage analytics; EU-hosted; when analytics is enabled.
We will give you a way to be informed of new Subprocessors (for example by updating this DPA) so you have the opportunity to object on reasonable data-protection grounds before the new Subprocessor begins processing your Personal Data.
8. Data Subject requests
Taking into account the nature of the processing, we will provide reasonable assistance to help you respond to Data Subject requests (such as access, correction, and deletion) within the timelines Applicable Data Protection Laws require. If we receive a request directly from a Data Subject relating to Personal Data we process on your behalf, we will, where lawful, direct the individual to you or forward the request to you, unless you have instructed us to respond, or we will handle it within the window described in our Privacy Policy.
9. Deletion and return
On expiry or termination of the Service, or on your written request, we will delete or return the Personal Data we process on your behalf within a reasonable period, and delete existing copies except to the extent retention is required by law. Because the Service is built on an append-only, event-sourced store, deletion is carried out by removing or redacting Personal Data from active systems and revoking access; any residual copies in backups are purged as those backups expire in the ordinary course.
10. Personal Data breach
We will notify you without undue delay after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Data we process on your behalf, and we will provide information reasonably available to us to help you meet your notification obligations.
11. International transfers
We process Personal Data in the United States, except that usage-analytics data, when analytics is enabled, is processed by our analytics subprocessor (Matomo Cloud, operated by InnoCraft) in the European Union. Separately, the Service is intended for United States businesses and is not directed at individuals in the European Economic Area, the United Kingdom, or Switzerland; that not-directed-at stance concerns the audience to which we offer the Service and is independent of where our subprocessors operate. Cross-border transfer mechanisms such as the EU Standard Contractual Clauses do not apply to our offering unless we agree otherwise in writing.
12. Audits and demonstrating compliance
We will make available to you information reasonably necessary to demonstrate our compliance with this DPA. Where Applicable Data Protection Laws give you an audit right, you may exercise it on reasonable prior written notice, no more than once per year (unless a supervisory authority or law requires otherwise), during business hours, subject to confidentiality, and in a manner that does not disrupt the Service — or we may satisfy the request by providing a relevant third-party report or attestation where available.
13. Relationship to the Terms
Except as amended by this DPA, the Terms remain in full force. The liability provisions of the Terms apply to this DPA. This DPA is governed by the same law as the Terms.
14. Contact
Data-protection questions and requests under this DPA may be sent to:
Property Partner LLC
3723 Greenville Ave STE 73256, Dallas, TX 75206
team@propertypartner.io