How borrower data is processed.

01Definitions

• Controller - the licensed mortgage brokerage or agent that determines the purposes and means of processing personal data.
• Processor - Automata Intelligence Inc. (operating as Autowrite), which processes personal data on the Controller's behalf.
• Personal Data - information about an identifiable individual that the Controller uploads to or processes through the Services.
• Sub-Processor - a third party engaged by the Processor to assist in processing Personal Data.
• Applicable Privacy Law - PIPEDA, Quebec Law 25, and other Canadian federal and provincial privacy laws applicable to the processing.

02Roles and Responsibilities

The Controller determines the purposes and means of processing, obtains all required borrower consents, and ensures a lawful basis for processing. The Processor processes Personal Data solely on the Controller's documented instructions, implements appropriate protections, and does not process Personal Data for its own purposes or disclose it except on instruction or as required by law. The Processor will inform the Controller if, in its opinion, an instruction infringes Applicable Privacy Law.

03Scope and Purpose of Processing

The Processor will process Personal Data only as necessary to provide the Services - namely mortgage application preparation, document intake and extraction, compliance automation, and related financial technology services - and as further instructed by the Controller. Details of the processing are set out in Schedule A.

04Categories of Data and Data Subjects

The categories of Personal Data and data subjects are described in Schedule A. They include borrower identity, financial, property, and contact data uploaded by the Controller.

05Processor Obligations

The Processor will:

• process Personal Data only on documented instructions;
• ensure personnel authorized to process Personal Data are bound by confidentiality;
• implement and maintain the security measures described in Schedule B;
• assist the Controller, taking into account the nature of processing, with data subject requests, security, breach notification, and - where required - privacy impact assessments and consultations with regulators;
• delete or return Personal Data in accordance with Section 12; and
• make available information reasonably necessary to demonstrate compliance with this DPA.

06Controller Obligations

The Controller is responsible for the lawfulness of its instructions, for obtaining and maintaining valid borrower consent, for the accuracy of Personal Data, and for compliance with its obligations as a regulated mortgage professional under Applicable Privacy Law and provincial licensing laws.

07Confidentiality

The Processor will treat all Personal Data as confidential and will not disclose it except as permitted by this DPA, on the Controller's instruction, or as required by law. Confidentiality obligations survive termination.

08Security Measures

The Processor maintains the technical and organizational measures set out in Schedule B, appropriate to the risk and the sensitivity of the Personal Data. The Processor regularly tests and reviews these measures and may update them provided the level of protection is not reduced.

09Sub-Processing

The Controller provides general authorization for the Processor to engage the Sub-Processors listed in Schedule C, under written contracts imposing data-protection obligations equivalent to those in this DPA. The Processor remains responsible for its Sub-Processors' performance, will provide an updated list on request, and will give at least thirty (30) days' notice of intended changes so the Controller may object on reasonable grounds.

10Data Subject Requests

The Processor will promptly notify and assist the Controller, taking into account the nature of processing, in responding to borrower requests to access, correct, delete, or port Personal Data, and will comply with the Controller's deletion or return instructions.

11Breach Notification

The Processor will notify the Controller without undue delay and, where feasible, within 72 hours of confirming a breach of security safeguards affecting Personal Data, including the nature of the breach, the categories and approximate number of records affected, likely consequences, and mitigation measures. The Controller remains responsible for regulatory filings (including to the OPC and CAI) and borrower notifications.

12Retention, Return, and Deletion

The Processor will not retain Personal Data longer than necessary to provide the Services. On termination of the Principal Agreement or on the Controller's instruction, the Processor will, at the Controller's choice, delete or return all Personal Data - ordinarily within sixty (60) days - and delete existing copies, unless retention is required by law, in which case the Processor will protect and isolate the data until deletion is permitted.

13Data Location and International Transfers

Personal Data is stored and processed in Canada. The Processor will not transfer Personal Data outside Canada without the Controller's written authorization and, where transfer occurs, will conduct a privacy impact assessment where required and implement equivalent safeguards.

14Audits and Compliance

On reasonable prior notice and no more than once annually (or following a material breach), the Controller may request information or conduct an audit to verify compliance with this DPA. Audits must respect confidentiality and security and must not unreasonably disrupt the Processor's operations. The Processor may satisfy audit requests through third-party attestations such as SOC 2 reports.

15Liability

The Processor's liability under this DPA is limited as set out in the Principal Agreement. The Processor is liable for breaches of its Processor obligations; the Controller remains responsible for the lawful collection, accuracy, and use of Personal Data.

16Term and Termination

This DPA remains in effect for as long as the Processor processes Personal Data on the Controller's behalf and terminates upon deletion or return of all Personal Data in accordance with Section 12.

17Governing Law

This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein.

18Order of Precedence

This DPA forms part of the Principal Agreement. In the event of a conflict regarding the processing of Personal Data, this DPA prevails over the rest of the Principal Agreement.

19Schedule A - Details of Processing

• Subject matter: provision of the Autowrite platform and related services.
• Duration: the term of the Principal Agreement and any wind-down period under Section 12.
• Nature and purpose: document intake, classification, data extraction, secure storage, and compliance automation to prepare mortgage applications on the Controller's instructions.
• Categories of data subjects: the Controller's borrowers, co-applicants, guarantors, and related individuals.
• Categories of Personal Data: identity data; financial data (income, tax forms, pay stubs, bank statements); property data; and contact data.
• Sensitive data: detailed financial information, handled with heightened safeguards.
• Frequency: continuous, for the duration of the Principal Agreement.

20Schedule B - Security Measures

The Processor implements and maintains measures including:

• Encryption: AES-256 at rest and TLS 1.2+ in transit; key management via cloud KMS.
• Access control: least-privilege, role-based access; mandatory MFA and SSO for production/admin access; quarterly access reviews; offboarding within 24 hours.
• Logging: centralized, integrity-protected audit logs retained for 12 months, with alerting on anomalies.
• Resilience: multi-AZ deployment in AWS Canada; daily encrypted snapshots; 30-day daily and 12-month monthly backup retention; quarterly restore tests.
• Secure development: code review, dependency scanning, SAST/DAST, and segregated environments with no production data in lower environments.
• Vulnerability management: monthly patching; critical fixes within 7 days; independent penetration testing.
• Organizational: personnel confidentiality agreements, background checks, and mandatory annual security and privacy training.

21Schedule C - Approved Sub-Processors

Borrower documents and financial data remain hosted in Canada (AWS, ca-central-1). Stripe and Google process only billing and operational information - not borrower application documents - and any resulting transfer outside Canada is limited to that information and protected by their respective data processing terms. This list reflects the sub-processors engaged as of the effective date. The current list is available to Brokers on request, and changes are notified in accordance with Section 9.

22Contact Us

Questions about this document or your personal information can be directed to our Privacy Officer:

• Automata Intelligence Inc. (operating as Autowrite)
• Attn: Privacy Officer
• 37 Leadership Drive, Brampton, Ontario L6Y 5T2, Canada
• Email: info@autowrite.ca