This Data Processing Addendum ("DPA") supplements the Terms & Conditions between the Customer (a brokerage, team, or professional subscriber) and The Collective Software Group LLC ("Processor") governing use of PipelineGenie.
1. Roles
The Customer is the Controller of personal information about its clients (buyers and sellers) that it enters into PipelineGenie. The Processor processes that information on the Customer's documented instructions to provide the Service.
2. Nature of Processing
- Subject matter: providing the PipelineGenie service.
- Duration: for the term of the subscription plus the retention period in our Privacy Notice.
- Data subjects: Customer's employees, agents, buyers, sellers, cooperating agents, and vendors.
- Categories of data: contact details, property information, transaction status, messages, notes, and pricing suggestions.
3. Confidentiality & Security
Processor personnel with access to Customer data are subject to confidentiality obligations. Processor maintains administrative, technical, and physical safeguards including TLS encryption in transit, encryption at rest, least-privilege access controls, and audit logging. See Security Overview.
4. Subprocessors
The current subprocessor list is in our Privacy Notice. Processor imposes data protection obligations no less protective than this DPA on each subprocessor. Processor will notify Customer of new subprocessors and provide an opportunity to object.
5. Data Subject Requests
Processor will assist the Customer in responding to data subject requests (access, correction, deletion, portability) with reasonable cooperation and, where possible, self-service tooling.
6. Security Incidents
Processor will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer data and will provide reasonably available information to help Customer meet its notification obligations.
7. International Transfers
Where personal data is transferred out of the EEA, UK, or Switzerland, the parties will rely on the EU Standard Contractual Clauses or the UK International Data Transfer Addendum, incorporated by reference.
8. Return or Deletion
On termination, Processor will delete Customer personal data within the retention window described in the Privacy Notice, except where retention is required by law.
9. Audits
Processor will make available on reasonable request the information necessary to demonstrate compliance with this DPA, including summaries of security assessments.
10. Executing This DPA
Enterprise Customers requiring a countersigned DPA should email legal@getpipelinegenie.com. For all other Customers, subscribing to the Service constitutes acceptance of this DPA to the extent Customer processes personal data of data subjects protected by applicable law.