Data Processing Agreement
This DPA forms part of the Terms of Service and governs LoanPacket's processing of personal data on behalf of customers.
Roles
The customer is the controller (or a processor acting for a lender or borrower) and LoanPacket is the processor of borrower personal data uploaded to the platform.
Processing instructions
LoanPacket processes personal data only to provide the service as documented and on the customer's instructions. Model training on customer or borrower data is expressly prohibited.
Subprocessors
LoanPacket maintains a public list of subprocessors and provides 30 days' notice of changes. Customers may object to a new subprocessor on reasonable grounds.
Security and audits
LoanPacket maintains the measures described in the Security Policy and makes its SOC 2 Type II report available under NDA.
International transfers
Data is stored in the United States by default. India residency is available for customers with offshore processing teams. Transfers rely on standard contractual clauses where required.
Deletion
On termination, customer data is deleted within 60 days, with certification on request.