Data Processing Agreement

Effective date. October 12, 2026

Parties and scope

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer ("Customer") and the administrator of the lossrunreports.com service ("Processor"). It applies whenever the Processor processes personal data contained in Customer Content on the Customer's behalf. It is designed to meet the processor requirements of the GDPR and UK GDPR, the service provider requirements of the CCPA as amended by the CPRA, and the service provider oversight expected under the GLBA Safeguards Rule and state insurance data security laws. No signature is required. Customers that need a countersigned copy can request one at [email protected].

Details of processing

• Subject matter. Provision of the LossRunReports service: requesting, tracking, receiving, reading, analyzing and exporting insurance loss runs and related submission documents.
• Duration. The term of the Customer's subscription, plus the period until deletion under this DPA.
• Nature. Collection, storage, organization, extraction, analysis, transmission on the Customer's instructions, export and deletion.
• Purpose. Solely to provide the service to the Customer and to keep it secure.
• Categories of data subjects. The Customer's users, insured businesses' owners, officers and contacts, claimants and injured workers named in loss runs, drivers and employees listed in schedules, and carrier staff who send or receive requests.
• Categories of personal data. Names, business contact details, titles, signatures, FEINs and other business identifiers, policy numbers, claim numbers, dates of loss, descriptions of incidents and injuries, claim payments and reserves, payroll and driver information contained in documents, and usage and audit log data.
• Special categories. Loss runs, especially for workers compensation, can contain information about injuries. The Customer decides whether to upload such data and is responsible for having a lawful basis for it.

Processor obligations

• Process personal data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use of the service, unless law requires otherwise, in which case the Processor informs the Customer first where permitted.
• Not sell or share personal data, not retain, use or disclose it outside the direct business relationship with the Customer, and not combine it with data from other sources except as needed to provide the service.
• Not use Customer Content to train AI models.
• Ensure that personnel with access are bound by confidentiality and access data only as needed to provide support the Customer requests or to keep the service secure.

Sub-processors

The Customer authorizes the Processor to engage sub-processors in the following categories:

• hosting provider for servers, encrypted storage and backups in the United States,
• payment operator for billing data of account holders,
• email delivery provider for outbound requests and inbound carrier replies,
• AI model provider for document reading and summary drafting, without training on or retaining the data beyond processing,
• analytics without cookies, receiving no Customer Content.

Each sub-processor is bound by written terms that impose data protection obligations no less protective than this DPA. The Processor remains responsible for its sub-processors. The Processor gives at least 30 days' notice by email or in the service before adding or replacing a sub-processor category or provider, and the Customer may object on reasonable data protection grounds. If the parties cannot resolve the objection, the Customer may cancel the affected subscription and receive a refund of prepaid fees for the remaining period.

Security measures

• Encryption in transit with TLS 1.2 or higher and encryption at rest for documents, databases and backups.
• Additional field-level encryption for FEINs and claimant names.
• Tenant isolation that scopes every record to one customer.
• Role-based access control, single sign-on on Enterprise plans and least-privilege internal access.
• An audit log of document views, downloads, exports and requests.
• Retention controls set by the Customer from 30 days to 7 years, automatic deletion and legal hold.
• Daily encrypted backups, monitoring, and patch management for systems that process Customer Content.

These measures are built to support the Customer's GLBA Safeguards program. The Processor may update them as long as the overall level of protection does not decrease.

Personal data breaches

The Processor notifies the Customer without undue delay, and in any case within 72 hours after becoming aware of a personal data breach affecting Customer Content. The notice describes the nature of the breach, the categories and approximate number of records and data subjects concerned, likely consequences and the measures taken or proposed, and is updated as more information becomes available. The Processor takes reasonable steps to contain the breach and supports the Customer's notifications to regulators, insureds and individuals.

Assistance

Taking into account the nature of processing, the Processor assists the Customer by appropriate technical and organizational measures with responding to data subject requests, with data protection impact assessments and prior consultations, and with security obligations. Most requests can be handled by the Customer directly in the service through search, export and deletion. Requests the Processor receives directly from data subjects are forwarded to the Customer.

Deletion and return

During the subscription the Customer can export and delete Customer Content at any time. After the subscription ends, the Customer can export its data until the end of the paid period. Customer Content is then deleted within 30 days, and removed from backups within the following backup cycle, unless law requires longer retention, in which case it stays protected under this DPA until deleted.

Audits

The Processor makes available the information reasonably necessary to demonstrate compliance with this DPA, including a written security overview and a completed security questionnaire. Audits are carried out by review of that documentation and written answers to reasonable follow-up questions, no more than once a year unless a breach or a regulator requires otherwise. Where documentation is not sufficient for a regulator's requirement, the parties agree in good faith on additional verification, at the Customer's cost, with reasonable notice and confidentiality.

International transfers

Customer Content is stored in the United States. Where personal data subject to the GDPR or UK GDPR is transferred to the United States, the standard contractual clauses adopted by the European Commission, with the UK addendum where applicable, are incorporated by reference, with the Customer as data exporter and the Processor as data importer.

Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where the law does not allow it. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails.

Contact

Administrator of the lossrunreports.com service, [email protected].