Last Updated: May, 2026
This Data Processing Addendum (“DPA”) is incorporated into and forms part of the agreement between Lendware, Inc., a Delaware corporation (“Lendware,” “we,” “us,” or “our”) and the customer entity or organization that has entered into an agreement with Lendware (“Customer,” “you,” or “your”) governing Customer’s use of Lendware’s products and services, including any applicable Terms of Service, Master Subscription Agreement, Order, statement of work, or other written agreement between the parties (collectively, the “Agreement”).
This DPA applies when Lendware processes Customer-Controlled Data on behalf of Customer in connection with the Services. Capitalized terms not defined in this DPA have the meanings given to them in the Agreement.
Lendware provides a business-to-business CRM, marketing, communications, reporting, workflow, integration, and scoring platform for U.S.-based mortgage lenders, loan officers, brokers, and related business and professional users.
This DPA governs Lendware’s processing of Customer-Controlled Data on behalf of Customer. Customer-Controlled Data may include borrower, consumer, lead, prospect, referral partner, transaction, campaign, communication, CRM, loan application status, contact, and related data that Customer or its authorized users upload, import, sync, generate, or otherwise process through the Services.
This DPA does not apply to information that Lendware processes for its own business purposes, such as information about Lendware website visitors, demo requesters, prospective customers, customer administrators, platform users, billing contacts, support contacts, sales prospects, event registrants, or people who communicate directly with Lendware. Lendware’s processing of that information is described in Lendware’s Privacy Policy.
As between the parties, Customer is generally the business, controller, or similar responsible party for Customer-Controlled Data. Lendware is generally the service provider, processor, contractor, or similar service provider processing Customer-Controlled Data on behalf of Customer.
Customer determines the purposes and means of processing Customer-Controlled Data, including what data is submitted to the Services, how the Services are configured, which integrations are enabled, which contacts are communicated with, what campaigns are sent, what scoring features are used, and how outputs from the Services are used.
Lendware processes Customer-Controlled Data only to provide, secure, support, maintain, administer, and improve the Services for Customer; to comply with Customer’s instructions; to fulfill Lendware’s contractual obligations; to protect the Services; to comply with law; and as otherwise permitted by the Agreement and this DPA.
Customer instructs Lendware to process Customer-Controlled Data as necessary to provide the Services and as otherwise described in the Agreement, this DPA, applicable Orders, the Privacy Policy, and Customer’s configuration or use of the Services.
Customer is responsible for ensuring that its instructions comply with applicable law. Lendware is not responsible for determining whether Customer’s instructions comply with laws applicable to Customer’s business, customers, borrowers, prospects, marketing, lending activities, communications, or data.
If Lendware believes that an instruction may violate applicable law, third-party requirements, carrier requirements, or platform integrity requirements, Lendware may notify Customer, suspend the affected processing, or decline to follow the instruction.
Customer represents and warrants that Customer has and will maintain all rights, notices, consents, permissions, authorizations, and legal bases required for Customer and Lendware to collect, use, process, disclose, transmit, store, and otherwise handle Customer-Controlled Data as contemplated by the Agreement and this DPA.
Customer is responsible for:
(a) the accuracy, quality, legality, reliability, integrity, and appropriateness of Customer-Controlled Data;
(b) providing all privacy notices required by applicable law;
(c) obtaining and maintaining all required consents, opt-ins, permissions, and authorizations;
(d) responding to privacy, consumer, borrower, prospect, and data subject requests, except where applicable law requires Lendware to respond directly;
(e) complying with all laws applicable to Customer’s use of the Services, including privacy, consumer protection, fair lending, mortgage, advertising, telemarketing, text messaging, email, do-not-call, do-not-text, and financial-services laws;
(f) determining whether and how Customer may lawfully use scoring, prioritization, analytics, communication, call recording, transcription, campaign, or workflow features;
(g) maintaining the confidentiality and security of account credentials, user permissions, admin privileges, integrations, and connected systems; and
(h) ensuring that Customer-Controlled Data submitted to the Services does not include prohibited data unless expressly authorized by Lendware in writing and permitted by applicable law.
Unless expressly authorized in writing by Lendware and permitted by applicable law, Customer will not upload to the Services Social Security numbers, credit reports, credit scores, bank account numbers, payment card numbers, income information, employment history, debt balances, home equity information, mortgage balance information, or consumer credit attributes.
Lendware may process Customer-Controlled Data to:
(a) provide, operate, maintain, support, secure, and improve the Services for Customer;
(b) perform implementation, onboarding, configuration, support, training, customer success, account administration, and professional services;
(c) operate customer-authorized integrations, communications features, scoring features, analytics features, reporting features, workflow features, and related service functionality;
(d) send, manage, track, or support customer-directed communications as configured or initiated by Customer or its users;
(e) generate scoring outputs, rankings, segments, prioritization outputs, high-level signals, recommendations, analytics, or insights for Customer where Customer uses Lendware Predict or similar features;
(f) detect, prevent, investigate, and respond to fraud, abuse, security incidents, unlawful activity, technical issues, and violations of the Agreement;
(g) monitor performance, reliability, security, error rates, deliverability, system health, and feature usage;
(h) comply with applicable law, legal process, government requests, regulatory obligations, and contractual obligations;
(i) create and use aggregated, anonymized, or de-identified data as permitted by this DPA and the Agreement; and
(j) otherwise act in accordance with Customer’s instructions or as expressly permitted by Customer.
Lendware will not:
(a) sell Customer-Controlled Data;
(b) share Customer-Controlled Data for cross-context behavioral advertising;
(c) use Customer-Controlled Data for Lendware’s own sales outreach, marketing outreach, advertising, retargeting, custom audiences, lookalike audience creation, resale, or cross-customer lead generation;
(d) use Customer-Controlled Data from one customer to provide services to another customer;
(e) combine customer databases for cross-customer marketing, resale, enrichment, or model training;
(f) use Customer-Controlled Data to train cross-customer models; or
(g) retain, use, or disclose Customer-Controlled Data outside the direct business relationship between Lendware and Customer, except as permitted by the Agreement, this DPA, Customer’s instructions, or applicable law.
Lendware may create and use Usage Data or other aggregated, anonymized, or de-identified information derived from use of the Services, provided that such information does not reasonably identify Customer, any Customer account, any user, any borrower, any consumer, any prospect, any referral partner, or any other individual.
To the extent applicable privacy laws require service provider, processor, contractor, or similar terms, Lendware agrees that it will:
(a) process Customer-Controlled Data only for the business purposes described in the Agreement and this DPA;
(b) not sell or share Customer-Controlled Data;
(c) not retain, use, or disclose Customer-Controlled Data for any purpose other than the business purposes specified in the Agreement and this DPA;
(d) not retain, use, or disclose Customer-Controlled Data outside the direct business relationship between Lendware and Customer, except as permitted by law;
(e) not combine Customer-Controlled Data with personal information received from or on behalf of another person or collected from Lendware’s own interactions with individuals, except as permitted by applicable law and this DPA;
(f) require subprocessors that process Customer-Controlled Data to be subject to written obligations designed to protect Customer-Controlled Data; and
(g) notify Customer if Lendware determines that it can no longer meet its obligations under applicable privacy laws relating to Customer-Controlled Data.
Customer may take reasonable and appropriate steps to help ensure that Lendware uses Customer-Controlled Data in a manner consistent with Customer’s obligations under applicable privacy laws. Customer may also take reasonable and appropriate steps to stop and remediate unauthorized use of Customer-Controlled Data, subject to the Agreement and reasonable confidentiality, security, and operational limitations.
Customer authorizes Lendware to engage subprocessors to process Customer-Controlled Data as necessary to provide the Services. Subprocessors may include hosting providers, infrastructure providers, communications providers, email providers, telephony providers, analytics and monitoring providers, payment processors, support tools, security and compliance tools, integration providers, and scoring providers. Lendware is not required to publish or maintain a public subprocessor list unless expressly agreed in writing.
Lendware may make subprocessor information available to Customer upon reasonable request, subject to confidentiality, security, and commercial sensitivity limitations.
Lendware will require subprocessors that process Customer-Controlled Data to be bound by written obligations that are designed to protect Customer-Controlled Data and are no less protective, in material respects, than Lendware’s obligations under this DPA, taking into account the nature of the services provided by the subprocessor.
Lendware remains responsible for its subprocessors’ performance of obligations relating to Customer-Controlled Data to the extent required by applicable law and the Agreement.
Customer acknowledges that certain features of the Services depend on third-party providers, including communications, scoring, email, calendar, hosting, and integration providers. If Customer objects to a subprocessor that is necessary to provide a feature, Customer’s sole remedy may be to stop using the affected feature or terminate the affected Order if expressly permitted by the Agreement.
Where Customer uses Lendware Predict or similar scoring, prioritization, analytics, recommendation, or signal-generation features, Customer authorizes Lendware to engage one or more third-party scoring providers to process Customer-Controlled Data and generate scores, rankings, segments, prioritization outputs, high-level signals, recommendations, analytics, or insights for Customer.
The scoring provider may process Customer-Controlled Data solely to provide scoring-related services to Lendware and Customer, subject to the applicable provider agreement and applicable law. The scoring provider may have limited rights to create aggregated or de-identified data as permitted by the provider agreement and applicable law.
Scoring outputs are designed to help Customer prioritize marketing, outreach, CRM workflows, and business follow-up. They are not credit reports, credit scores, eligibility determinations, underwriting decisions, loan pricing decisions, adverse action notices, or legal/compliance advice.
Customer may not use scoring outputs as the sole basis for any credit, lending, underwriting, pricing, eligibility, discouragement, or adverse action decision.
Lendware will maintain a written information security program that includes administrative, technical, and physical safeguards designed to protect Customer-Controlled Data against unauthorized access, disclosure, loss, modification, or destruction.
Lendware is SOC 2 Type II audited and uses compliance-monitoring tools, including Vanta, to support its security, privacy, and vendor-management program.
Lendware’s safeguards may include, as appropriate, access controls, authentication, logging, monitoring, encryption, vendor management, incident response procedures, backup and disaster recovery practices, and employee or contractor confidentiality obligations.
Customer is responsible for securing its own systems, users, credentials, devices, networks, integrations, configurations, and Customer-controlled administrative settings.
No method of transmission or storage is completely secure, and Lendware does not guarantee absolute security.
If Lendware confirms a Security Incident involving Customer-Controlled Data, Lendware will notify Customer without undue delay and, in any event, within 72 hours after confirmation, unless prohibited by law or instructed by law enforcement or a supervisory authority.
Lendware’s notice will include information reasonably available to Lendware at the time, which may include the nature of the Security Incident, categories of Customer-Controlled Data involved, known or reasonably likely consequences, measures taken or proposed to address the Security Incident, and contact information for follow-up.
Lendware will take reasonable steps to investigate, contain, and mitigate the Security Incident. Customer is responsible for determining whether notice to individuals, regulators, customers, borrowers, prospects, partners, or other third parties is required, unless applicable law requires Lendware to provide such notice directly.
Customer will not make any public statement identifying Lendware in connection with a Security Incident without Lendware’s prior written approval, unless required by law.
Customer is responsible for receiving, verifying, and responding to privacy rights requests relating to Customer-Controlled Data, unless applicable law requires Lendware to respond directly.
If Lendware receives a privacy rights request relating to Customer-Controlled Data, Lendware may refer the request to Customer or notify Customer, unless prohibited by law. Lendware will provide reasonable assistance to Customer in responding to privacy rights requests, taking into account the nature of the Services and Customer-Controlled Data.
Lendware may charge reasonable fees for assistance with privacy rights requests that require substantial manual effort, custom engineering, or work outside the ordinary functionality of the Services, unless prohibited by applicable law or otherwise agreed in writing.
During the term of the Agreement, Customer may access and export Customer-Controlled Data through the Services to the extent supported by the Services and Customer’s account permissions.
Following termination or expiration of a customer account, Customer-Controlled Data will be made available for export for the period specified in the applicable agreement, typically 30 days unless otherwise agreed in writing or unless Customer’s access has been terminated or suspended for security, legal, abuse, or nonpayment reasons.
After the applicable export period, Lendware may delete, disable access to, return, or de-identify Customer-Controlled Data, subject to applicable law, backup retention cycles, legal holds, and limited retention for billing, security, compliance, audit, fraud prevention, dispute-resolution, and legal purposes.
Backup copies may persist for a limited period in accordance with Lendware’s ordinary backup and disaster-recovery practices before being overwritten or deleted.
Lendware is based in the United States, and the Services are intended for U.S.-based business and professional use only. Lendware currently processes and stores Customer-Controlled Data in the United States.
Customer will not use the Services for customers, users, consumers, borrowers, prospects, or other individuals located outside the United States unless expressly authorized by Lendware in writing.
If Lendware’s processing locations materially change, Lendware will update its Privacy Policy or otherwise provide notice as required by applicable law or the Agreement.
Customer is responsible for determining whether the Gramm-Leach-Bliley Act, the FTC Safeguards Rule, or any similar financial privacy or security law applies to Customer, Customer-Controlled Data, or Customer’s use of the Services.
Customer represents and warrants that it has all rights, notices, consents, authorizations, and legal bases required to disclose nonpublic personal information or other regulated financial information to Lendware for processing through the Services.
Lendware will maintain administrative, technical, and physical safeguards designed to protect Customer-Controlled Data as described in this DPA, the Agreement, and Lendware’s security documentation.
Lendware does not act as Customer’s legal, regulatory, compliance, underwriting, credit, or lending advisor. Customer is solely responsible for its own GLBA, Safeguards Rule, privacy, lending, advertising, consumer protection, and regulatory compliance obligations.
Upon Customer’s reasonable written request, and subject to confidentiality obligations, Lendware may provide information reasonably necessary to demonstrate Lendware’s compliance with this DPA. Such information may include security documentation, summaries of relevant controls, SOC 2 Type II reports or bridge letters where available, vendor-management information, or responses to reasonable security questionnaires.
Any audit or information request must be reasonable in scope, frequency, duration, and burden and must not compromise the security, confidentiality, availability, or integrity of Lendware’s systems, other customers’ data, trade secrets, or confidential information.
Lendware may require Customer to rely on third-party audit reports, certifications, attestations, security summaries, or written responses instead of conducting direct audits. Direct audits, if any, are subject to Lendware’s prior written approval, reasonable scheduling, confidentiality obligations, security requirements, and payment of Lendware’s reasonable costs.
Unless expressly authorized in writing by Lendware and permitted by applicable law, Customer will not upload, submit, sync, or otherwise process through the Services Social Security numbers, credit reports, credit scores, bank account numbers, payment card numbers, income information, employment history, debt balances, home equity information, mortgage balance information, consumer credit attributes, government identification numbers, health information, biometric information, precise geolocation data, children’s data, or other sensitive information not necessary for Customer’s authorized use of the Services.
Customer is responsible for configuring the Services and training its users to avoid submitting prohibited or unnecessary sensitive information.
If Customer becomes aware that prohibited or unnecessary sensitive information has been submitted to the Services, Customer will promptly delete it where possible and notify Lendware if assistance is required.
Each party’s liability under this DPA is subject to the limitations, exclusions, disclaimers, and liability caps in the Agreement, except to the extent prohibited by applicable law.
If there is a conflict between this DPA and the Agreement, this DPA will control solely with respect to the processing of Customer-Controlled Data and solely to the extent of the conflict. For all other matters, the Agreement controls.
If there is a conflict between this DPA and an Order or Master Subscription Agreement that expressly references this DPA and expressly states that it overrides a specific provision of this DPA, that Order or Master Subscription Agreement will control solely with respect to that specific provision and solely to the extent of the conflict.
Questions about this DPA or Lendware’s privacy practices may be directed to:
Lendware, Inc.
192 Lexington Avenue, 16th Floor
New York, NY 10016
Attn: Privacy
Email: privacy@lendware.ai
We Make Top Performers.
Lendware, Inc.
192 Lexington Avenue
16th Floor
New York, NY 10016
©2025 Lendware. All rights reserved.
