Data Processing Terms

1. Roles

You are the controller of the personal information your website visitors submit: their name, contact details and enquiry content. You decide why it is collected and what happens to it. We process it only on your behalf and only to provide the Service: storing it, letting you manage it in your dashboard, and sending it to you and, if you set them up, to your CRM or newsletter provider.

We do not use that information for our own purposes and we do not share one customer's visitors' information with another customer.

2. What we process, on your instructions

• Contact, valuation, showing, listing-alert and similar form submissions from your website.
• Behavioural data your site captures (pages viewed, listings viewed, saved searches) when a submission connects it to an identified person.
• Lead stage, notes and follow-up actions you record in your dashboard.
• Newsletter sign-ups, if you connect your own Mailchimp or Klaviyo account. The record is created in your account under your credentials.

3. Subprocessors

We use these subprocessors. All currently process personal information in the United States:

We give you at least 15 days' notice by email before adding a subprocessor that would handle visitors' personal information. If you object, you can cancel and receive a refund of any unused prepaid annual fee.

4. Transfers outside Canada

Visitors' information from Canada is transferred to and stored in the United States. You are the controller, so you should tell your website visitors this; the Privacy Policy, section 5, is written so you can point them to it. We require our subprocessors, by their published terms and our agreements with them, to protect the information they handle and to use it only to provide their service to us.

5. Security measures

These measures are in place at the date these terms take effect:

• Passwords are stored hashed (bcrypt), never in plain text.
• Every database table with customer data carries a tenant identifier that is checked on every query, with row-level security enabled in the database as a second check.
• Session tokens are signed and tied to one tenant; a session for one customer cannot be used on another's dashboard.
• Customer sites and the dashboard are served over HTTPS with HSTS, and with a strict Content-Security-Policy and standard anti-sniffing and referrer headers.
• Automated tests in our release process check tenant isolation, lead delivery and operator/customer separation before each release.
• Customer email is sent only from a verified ListingHQ sending domain, never from another customer's or from ListingHQ's own personal address.

6. Requests from visitors

If a visitor contacts us directly to access, correct or delete their information, we refer them to you and help you respond. On your written instruction we will export or delete specific visitors' records.

7. Security incidents

We tell you without undue delay, and within 72 hours of becoming aware, of a security incident affecting your visitors' personal information, so you can meet your own duties under PIPEDA and provincial law. Our notice describes what we know then: what happened, the kinds of information and roughly how many people are involved, and what we are doing about it.

8. When the subscription ends

We make visitors' information available for export for 60 days, then delete it from active systems, subject to backup ageing and legal retention (Terms of Service, section 7).

9. Records, audit and liability

Once a year, on reasonable written request, we give you a written summary of how we comply with these terms. We do not offer third-party audits. Our liability under these terms is subject to the limits in section 11 of the Terms of Service.