Data Processing Agreement

How this agreement works

This Data Processing Agreement ("DPA") forms part of the services agreement, including any proposal or statement of work, between Calder and Birch LLC ("Calder & Birch", "we", "us") and the insurance agency receiving our services ("Agency", "you"). It applies whenever we process Agency Personal Data on your behalf. If this DPA and the services agreement conflict on a data protection matter, this DPA controls.

You can accept this DPA online at the bottom of this page, or sign a copy we send you. Either way, the version in effect on the day you accept applies until you accept a newer one.

1. Definitions

• Agency Personal Data means personal information about your prospects, quote requesters, customers, policyholders and website visitors that you give us, or that we collect on your behalf, while performing the services.
• Data Protection Rules means the privacy, data security and marketing statutes and regulations that apply to the processing. These include the Gramm-Leach-Bliley Act and its privacy and safeguards rules; state insurance data security and privacy regulations, including those based on the NAIC Insurance Data Security Model; the California Consumer Privacy Act as amended by the California Privacy Rights Act, and other U.S. state consumer privacy statutes; the Telephone Consumer Protection Act; the CAN-SPAM Act; and CMS marketing rules where Medicare products are involved.
• Nonpublic Personal Information has the meaning given in the Gramm-Leach-Bliley Act.
• Security Incident means unauthorized access to, or acquisition, disclosure, alteration or destruction of, Agency Personal Data in our possession or control.
• Subprocessor means a third party we engage that processes Agency Personal Data for us.

"Business", "service provider", "controller" and "processor" have the meanings given in the Data Protection Rules.

2. Roles and instructions

You are the business and controller of Agency Personal Data. We are your service provider and processor. We process Agency Personal Data only to provide the services and on your documented instructions: the services agreement, this DPA, and written instructions you give us, including by email. If we believe an instruction would break the Data Protection Rules, we'll tell you before acting on it.

3. Our commitments as your service provider

We will not:

• sell Agency Personal Data, or share it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act;
• retain, use or disclose it for any purpose other than providing the services to you, including for our own marketing or for any other client;
• retain, use or disclose it outside our direct business relationship with you;
• combine it with personal information from other sources, except as the Data Protection Rules allow service providers to do.

Because we work with one agency per line of business in each territory, we never use one agency's data to benefit a competing agency. We'll comply with the obligations the Data Protection Rules place on service providers, give Agency Personal Data the level of protection those rules require, and tell you if we can no longer meet our obligations. You may take reasonable and appropriate steps to stop and remediate any unauthorized use.

4. Your responsibilities

• You have the right to give us Agency Personal Data, and you've given the notices and obtained the consents the Data Protection Rules require, including prior express written consent for marketing calls and texts that use automated technology.
• Your instructions comply with the Data Protection Rules, your carriers' requirements and your state's insurance advertising rules.
• You review and approve marketing content before it goes live, and you maintain your own privacy notice for your customers and prospects.
• You won't send us the sensitive data described in Schedule A unless we've agreed in writing.

5. Confidentiality and our people

Everyone at Calder & Birch who can access Agency Personal Data is bound by confidentiality obligations, is trained on these commitments, and has access only to the data they need for your account.

6. Security

We maintain a written information security program with administrative, technical and physical safeguards appropriate to the nature of Agency Personal Data, consistent with the Gramm-Leach-Bliley Act safeguards rule and state insurance data security regulations. Schedule B lists the main measures. We review the program at least once a year.

7. Subprocessors

You authorize us to use the Subprocessors described in Schedule C. We'll bind each one to written data protection terms at least as protective as this DPA, and we remain responsible for their performance. Before adding or replacing a Subprocessor that will receive your data, we'll email you at least 15 days in advance. You may object on reasonable data protection grounds; we'll then work with you on an alternative, or you may end the affected services.

8. Helping you meet your obligations

• Consumer requests: if someone contacts us to access, correct or delete Agency Personal Data, or to opt out, we'll forward the request to you within five business days and help you respond.
• Opt-outs: we'll honor do-not-call, do-not-text and email unsubscribe requests within the time the Data Protection Rules require, and keep the consent and opt-out records you instruct us to keep.
• Assessments and regulators: we'll give you reasonable information and help for risk assessments, carrier reviews and inquiries from regulators about our processing.

9. Security incidents

We'll notify you without undue delay, and no later than 48 hours after confirming a Security Incident. Our notice will include what we know about the nature of the incident, the data and people affected, and the steps we're taking, and we'll update you as we learn more. This timing is designed to help you meet your own deadlines, including the 72-hour notice to your state insurance regulator that many states require. We'll cooperate with your investigation and won't notify affected individuals or regulators about Agency Personal Data without your approval, unless the Data Protection Rules require us to.

10. Return and deletion

When the services end, we'll delete or return Agency Personal Data, at your choice, within 30 days, and confirm in writing on request. We may keep copies only where the Data Protection Rules require us to, or where you've instructed us to keep records such as consent records. Anything kept stays protected under this DPA. Copies in routine backups are deleted as those backups expire.

11. Information and audits

We'll give you the information reasonably needed to show we're meeting this DPA, such as completed security questionnaires and summaries of our policies. Once a year, on 30 days' written notice, you or an independent auditor bound by confidentiality may review our compliance during business hours, at your cost. Additional reviews are allowed after a Security Incident, or when a regulator requires one.

12. Insurance-specific terms

• Nonpublic Personal Information: we'll use and disclose Nonpublic Personal Information only to perform the services for you, consistent with the Gramm-Leach-Bliley Act's limits on reuse and redisclosure.
• Third-party service provider oversight: for the purposes of your state's insurance data security regulations, we're a third-party service provider. The security measures, incident notices and audit rights in this DPA are designed to support your oversight duties.
• Health information: we don't accept protected health information under HIPAA unless we've first signed a separate business associate agreement with you.
• Medicare: for Medicare products, we act only at your direction, and campaigns and outreach follow your instructions, your carriers' requirements and CMS marketing rules.

13. Term, liability and changes

This DPA lasts as long as we process Agency Personal Data for you. Each party's liability under this DPA is subject to the limits in the services agreement, except where the Data Protection Rules don't allow such limits. This DPA is governed by the same rules and jurisdiction as the services agreement. We may update this DPA to reflect changes in the Data Protection Rules or our Subprocessors. We'll email you at least 30 days before a new version takes effect and post every version on this page.

Schedule A: Details of the processing

• Purpose: local SEO and Google Business Profile management, Google Ads and Local Services Ads, review generation, quote funnel and speed-to-lead optimization, retention and cross-sell email, agency websites, and reporting.
• Duration: the term of the services agreement, plus the return and deletion period in section 10.
• People whose data we process: your prospects, quote requesters, customers and policyholders; visitors to websites we manage for you; and your staff who use our tools.
• Types of data: contact details (name, email, phone, address); quote request details you choose to collect, such as lines of business and coverage interest; consent and opt-out records; call recordings and message history; marketing engagement data; and the policy outcome data needed for reporting, such as whether a quote was bound and the policy type.
• Sensitive data not accepted without written agreement: Social Security numbers, driver's license numbers, financial account numbers, and health information. Health information also requires a business associate agreement.

Schedule B: Security measures

• Encryption in transit (HTTPS/TLS) everywhere, and encryption at rest where our tools support it.
• Multi-factor authentication on every account that can access Agency Personal Data.
• Unique accounts for each person, a password manager, and no shared passwords.
• Least-privilege access, reviewed regularly and removed promptly when no longer needed.
• Security and privacy review of every Subprocessor before use.
• Secure deletion of data and devices.
• A written incident response plan, tested at least once a year.
• Security and privacy training for everyone with access.

Schedule C: Subprocessors

The Subprocessors used for each engagement depend on the services you choose. They're named in your proposal or statement of work before any Agency Personal Data is shared with them, and typically include:

• Google LLC: Google Ads, Local Services Ads, Google Analytics, Google Tag Manager and Google Business Profile.
• Call tracking, email marketing, form processing and website hosting providers: named in your statement of work.

Version history

• Version 1.0, effective November 10, 2026: first published version.