1. Scope and Roles
This Data Processing Addendum (DPA) is part of the LeasingStack Terms of Service between LeasingStack and the brokerage or dealership that uses our Services (you). It applies when we process personal information in Customer Data on your behalf.
For that personal information, you are the business or controller and we are your service provider or processor. This includes credit applications, uploaded documents, leads, customer records, and deal records that your team or your customers submit through the Services.
If this DPA conflicts with the Terms on how we handle personal information, this DPA controls.
2. Processing on Your Instructions
We process personal information only to provide, secure, support, and improve the Services for you, and only on your documented instructions. The Terms, this DPA, and your configuration and use of the Services are your instructions.
We do not sell or share the personal information we process for you. We do not use it for our own advertising, combine it with personal information we get from other sources except as permitted by law to provide the Services, or keep, use, or disclose it outside our direct business relationship with you.
We will tell you if we believe an instruction violates applicable law, or if we can no longer meet our obligations under applicable privacy law.
3. Confidentiality
Everyone at LeasingStack who can access personal information we process for you is bound by confidentiality obligations and receives access only as needed for their role.
4. Security Measures
We maintain administrative, technical, and physical safeguards designed to protect personal information, as described on our Security page and in our written information security program. These include encryption in transit and at rest, field-level encryption of sensitive applicant fields, private document storage with short-lived access links, role-based access, organization-level data isolation, and logging of sensitive data views and exports.
You are responsible for the security of your own accounts, including managing which staff have access, assigning roles, and protecting login credentials.
Security
5. Subprocessors
We use vetted subprocessors for hosting, email, payments, and support, and we will give a list to customers on request under NDA. Lender program, vehicle, and tax-rate data comes from licensed automotive data providers.
Each subprocessor is bound by written terms to protect the data it handles, and we remain responsible for their performance of those obligations.
6. Security Incident Notice
If we confirm a security incident that leads to unauthorized access to or acquisition of personal information we process for you, we will notify you without undue delay, and within 72 hours of confirming it.
Our notice will describe what happened, the types of data involved, the steps we are taking, and a contact for more information, as far as that information is available. We will provide updates as we learn more and will reasonably help you meet any notice obligations you have to consumers or regulators.
7. Consumer Requests
Consumers may ask to access, correct, or delete their personal information. If we receive a request about data we process for you, we will direct the consumer to you and will not respond on your behalf unless you ask us to.
We will reasonably help you respond to consumer requests, including with tools in the Services that let you find, correct, and delete records, and by exporting data for you on request.
8. Assessments and Information
On reasonable written request, we will provide information needed to show our compliance with this DPA and to help you complete any privacy or risk assessment that applicable law requires. We may provide this through summaries of our security program and controls instead of on-site audits.
9. Deletion or Return at the End of the Services
When your subscription ends, you may export your data for 30 days. After that period, we will delete the personal information we process for you, except where we must keep it to comply with law. Backups that contain deleted data are overwritten on our normal backup cycle of up to 30 days.
Any personal information we must keep remains subject to this DPA for as long as we keep it.
10. Financial Information
Some information in credit applications is nonpublic personal information under the Gramm-Leach-Bliley Act. We protect it under our written information security program and use and disclose it only to provide the Services to you, consistent with the limits that apply to service providers under that law.
11. Term
This DPA stays in effect for as long as we process personal information on your behalf. We may update it to reflect changes in law or the Services, and we will post the updated version on this page with a new effective date.
