Data Processing Addendum

Purpose

This DPA describes how we handle personal data submitted by original judgment owners ("Creditor") through our platform.

Because you assign your judgment to us, we are not a third-party processor in the normal sense.

However, before assignment is complete, we temporarily hold information on your behalf to evaluate the judgment.

Thus:

• Before assignment: we are a data processor for the creditor
• After assignment: we become the data controller/owner

1. Definitions

• Controller – You (creditor) before assignment; Us after assignment.
• Processor – Us before assignment, evaluating the judgment.
• Data Subject – Debtors, creditors, and associated individuals.
• Personal Data – Any identifying information provided to or collected by us.

2. Obligations of the Processor (Before Assignment)

We will:

• Process data only for judgment evaluation
• Implement security, redaction, and access controls
• Comply with privacy laws and FRCP 5.2 redaction requirements
• Not sell or reuse data
• Delete, redact, or archive data when legally allowed

3. Obligations of the Controller (Creditor)

You confirm:

• You have legal authority to provide the judgment
• Information submitted is accurate
• You have lawful grounds to share debtor data

4. Transfer to Controller Role

When you complete the Assignment of Judgment:

• We become legal owner of the data
• We act as Controller of all judgment-related information
• We enforce the judgment under our name and responsibility

5. Subprocessors

We may use:

• Remote online notarization platforms (Proof.com)
• Skip-tracing vendors
• Credit-permissible data providers
• Cloud hosting services
• Payment processors
• Court e-filing systems
• Sheriffs, constables, and levying officers

All subprocessors are bound by contractual confidentiality obligations.

6. Data Security

We maintain:

• Encryption in transit and at rest
• Role-based access controls
• Confidentiality agreements with all staff
• Comprehensive audit logs
• Segregated storage of sensitive data

7. Data Retention

We retain all information for:

• The legal life of the judgment
• Statutory audit requirements
• Court recordkeeping obligations

We do not delete judgment data still under enforcement.

8. Your Rights

For data protection inquiries, you may:

• Request access to your data
• Request corrections
• Request deletion (where legally permitted)

Requests must be submitted in writing to the contact information below.

9. Contact

For questions about data processing, please contact: