This Data Processing Agreement ("DPA") forms part of the LoanBit Terms of Service ("Agreement") between PlainQode Software Limited ("Processor") and the lending organization or other legal entity that has accepted the Agreement ("Controller"). It sets out how the Processor processes personal data on behalf of the Controller in connection with the LoanBit platform.

This DPA is incorporated into the Agreement and takes effect on the same date that the Agreement takes effect.

---

1. Definitions

"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council, as applicable in the relevant jurisdiction, including the UK GDPR where applicable.

"Controller" has the meaning given to it in the GDPR — in this DPA, the Customer (lending organization) who determines the purposes and means of processing.

"Processor" has the meaning given to it in the GDPR — in this DPA, PlainQode Software Limited, which processes personal data on behalf of the Controller.

"Personal Data" means any information relating to an identified or identifiable natural person that is processed by the Processor on behalf of the Controller under the Agreement.

"Processing" has the meaning given to it in the GDPR.

"Data Subject" means the natural person to whom Personal Data relates — primarily borrowers, loan applicants, guarantors, and co-applicants managed by the Controller within the platform.

"Sub-processor" means any third party engaged by the Processor to carry out processing activities on Personal Data on behalf of the Controller.

"Supervisory Authority" means the competent data protection authority with jurisdiction over the Controller.

"SCCs" means the Standard Contractual Clauses adopted by the European Commission for international transfers of personal data.

---

2. Subject Matter, Nature, and Purpose of Processing

The Processor provides the Controller with a cloud-based loan portfolio management platform ("Platform"). To operate the Platform, the Processor processes Personal Data on behalf of the Controller solely for the following purposes:

Storing, displaying, and managing loan applications, active loans, repayments, and related financial records entered by the Controller into the Platform
Sending transactional notifications (statements, reminders, confirmations) to Data Subjects on the Controller's instructions
Running automated background tasks (loan calculations, scheduled reminders, status updates) on behalf of the Controller
Providing optional AI-assisted analytics on anonymized, aggregated data — no individually identifiable Personal Data is sent to AI sub-processors
Maintaining error logs and operational monitoring (with PII scrubbed or masked)
Generating reports and data exports requested by the Controller

The Processor does not use Personal Data processed under this DPA for any purpose other than providing the Platform to the Controller.

---

3. Duration

Processing begins when the Controller first submits Personal Data to the Platform and continues until the later of: (a) termination or expiry of the Agreement; or (b) the end of any post-termination data retention period set out in Section 10.

---

4. Types of Personal Data and Categories of Data Subjects

Categories of Data Subjects: Borrowers, loan applicants, guarantors, co-applicants, and other individuals whose information the Controller enters into the Platform.

Types of Personal Data that may be processed include (but are not limited to):

Identity data: Full name, date of birth, national identification number or passport number
Contact data: Home address, telephone number, email address
Financial data: Employment status, employer details, monthly income and expenses, bank account details, loan history, outstanding obligations
Application data: Loan purpose, requested amount, repayment schedule, collateral details
Documents: Scanned or uploaded identity documents, payslips, bank statements, and supporting documentation
System-generated data: Loan account numbers, payment history, audit trail entries

The exact categories of Personal Data processed depend entirely on what the Controller submits to the Platform — the Processor has no control over or independent knowledge of the Controller's data collection practices.

---

5. Controller's Obligations

The Controller:

(a) confirms it has a lawful basis under applicable data protection law for each category of Personal Data submitted to the Platform;

(b) is responsible for obtaining any necessary consents and providing required privacy notices to Data Subjects;

(c) ensures that its instructions to the Processor comply with applicable law;

(d) will notify the Processor promptly if it becomes aware of any inaccuracy in Personal Data held on the Platform or if it needs to restrict processing of specific records.

---

6. Processor's Obligations

The Processor shall:

(a) Process only on instructions — Process Personal Data only on the documented instructions of the Controller (including as set out in the Agreement and this DPA), unless required to do otherwise by applicable law, in which case the Processor will inform the Controller before processing unless prohibited by law.

(b) Maintain confidentiality — Ensure that personnel authorized to process Personal Data are bound by applicable confidentiality obligations.

(c) Implement appropriate security measures — Implement and maintain the technical and organizational measures described in Section 8.

(d) Sub-processor obligations — Comply with Section 9 regarding the engagement of Sub-processors.

(e) Assist with Data Subject rights — Provide reasonable assistance to the Controller to fulfill Data Subject rights requests (access, rectification, erasure, restriction, portability, objection) as described in Section 11.

(f) Assist with compliance obligations — Provide reasonable assistance to the Controller regarding data protection impact assessments, prior consultation with supervisory authorities, and security obligations under applicable law.

(g) Data deletion or return — Delete or return Personal Data on termination as described in Section 10.

(h) Audit rights — Make available necessary information to demonstrate compliance with this DPA and permit audits as described in Section 12.

(i) Notify of unlawful instructions — Inform the Controller promptly if, in the Processor's opinion, an instruction violates applicable data protection law.

---

7. Data Breach Notification

The Processor will notify the Controller without undue delay, and in any event within 72 hours of becoming aware of a Personal Data breach. The notification will include, to the extent known at the time:

A description of the nature of the breach, including categories and approximate number of Data Subjects and Personal Data records affected
The name and contact details of the Processor's data protection contact
A description of the likely consequences of the breach
A description of the measures taken or proposed to address the breach and, where appropriate, to mitigate its possible adverse effects

The Processor will cooperate with the Controller and take reasonable steps to mitigate the effects of the breach. Notification does not constitute an acknowledgement of fault or liability.

Contact for breach notifications: privacy@loanbit.io

---

8. Technical and organizational Security Measures

The Processor maintains the following measures, which may be updated from time to time provided that updates do not materially reduce the overall level of security:

Access controls

Role-based access control (RBAC) scoped to tenant — no user can access another organization's data
Multi-factor authentication (MFA) for all platform-admin and infrastructure accounts
Privileged access to production infrastructure is restricted to authorized engineering personnel

Data security

All data in transit is encrypted using TLS 1.2 or higher
All data at rest is encrypted using AES-256 or equivalent
Database-level row security policies enforce tenant isolation
Session cookies are HttpOnly and Secure; CSRF protections are in place

Operational security

Immutable audit logs record all significant actions within the Platform
Sensitive fields (e.g., portions of national ID numbers) are masked in logs and error reports
Automated vulnerability scanning and dependency monitoring
Regular backups with verified restore capability

Organizational measures

Internal data handling policies covering access, breach response, and data minimization
Onboarding security awareness for personnel with access to production data

---

9. Sub-processors

The Controller provides general authorization for the Processor to engage Sub-processors. The Processor will enter into data processing agreements with Sub-processors on terms that impose materially equivalent data protection obligations to those in this DPA.

The Processor will inform the Controller of any intended addition or replacement of a Sub-processor with at least 30 days' notice by updating its Sub-processor list and emailing registered account holders. If the Controller has reasonable grounds to object, it must notify the Processor in writing within 14 days — the parties will then attempt to resolve the objection in good faith.

Current Sub-processors:

Sub-processor	Purpose	Location	Safeguard
Vercel, Inc.	Hosting and edge delivery	European Union	EU data residency configured
Supabase, Inc.	Database, authentication, file storage	European Union	EU data residency configured
Stripe, Inc.	Payment processing (Controller's subscription billing only — no borrower data is shared)	European Union	EU data residency configured
Resend, Inc.	Transactional email delivery	European Union	EU data residency configured
Functional Software, Inc. (Sentry)	Error monitoring (PII scrubbed/masked before transmission)	European Union	EU data residency configured
Inngest, Inc.	Background task execution (tenant/entity IDs and operational metadata only)	United States	SCCs
Google LLC	Address autocomplete — optional feature (address text only; no identity or financial data)	United States	SCCs
OpenAI, LLC	Optional AI-assisted analytics (anonymized, aggregated data only; no personal data is transmitted)	United States	SCCs

---

10. Data Retention and Deletion

Upon expiry or termination of the Agreement, the Processor will:

Retain Personal Data for up to 30 days from termination to allow the Controller to export its data
After the 30-day period (or earlier at the Controller's written request), permanently delete or securely destroy all Personal Data, including copies held by Sub-processors, unless applicable law requires longer retention
Provide written confirmation of deletion upon the Controller's request

The Controller is solely responsible for exporting its data before the end of the 30-day retention period. The Processor is not liable for Personal Data that is not exported within that window.

---

11. Data Subject Rights

Where a Data Subject exercises a right under applicable law (access, rectification, erasure, restriction, portability, objection) directly against the Processor, the Processor will redirect the request to the Controller within 5 business days and will not respond to Data Subjects directly without the Controller's prior written consent, except as required by law.

The Processor will provide the Controller with reasonable technical assistance and access to tools within the Platform (such as data export and account deletion functions) to fulfil Data Subject rights requests. Complex requests that require custom engineering work beyond standard Platform features may be subject to a reasonable fee, agreed with the Controller in advance.

---

12. Audit Rights

The Controller may, no more than once per calendar year and on at least 30 days' written notice, audit the Processor's compliance with this DPA by submitting a written questionnaire, which the Processor will respond to within 20 business days.

Costs of audits, including any third-party auditor engaged by the Controller, are borne by the Controller unless the audit reveals a material breach of this DPA by the Processor.

The Processor may share up-to-date third-party audit reports or security certifications where available.

---

13. International Transfers

The Processor's primary infrastructure sub-processors (Vercel, Supabase, Stripe, Resend, and Sentry) are configured to store and process data within the European Union, meaning no international transfer occurs for those services.

Where the Processor transfers Personal Data outside the EU/EEA — specifically to Inngest, Google, and OpenAI, which operate in the United States — it will ensure that such transfers are made subject to appropriate safeguards in accordance with applicable data protection law, including:

Standard Contractual Clauses (SCCs) as adopted by the European Commission, where GDPR applies
IDTA or UK SCCs, where UK GDPR applies
Any other safeguard mechanism permitted under applicable law

The Sub-processor list in Section 9 identifies the location and applicable safeguard for each sub-processor.

---

14. Liability

Each party's liability to the other party under or in connection with this DPA is subject to the limitations and exclusions set out in the Agreement.

This DPA does not reduce or limit either party's obligations to Data Subjects or Supervisory Authorities under applicable data protection law.

---

15. Order of Precedence

In case of conflict between this DPA and the Agreement, this DPA takes precedence to the extent necessary to resolve the conflict in respect of data protection obligations. In all other respects, the Agreement continues to apply.

---

16. Governing Law

This DPA is governed by and construed in accordance with the laws of Jamaica. Disputes arising under this DPA are subject to the exclusive jurisdiction of the courts of Jamaica.

Notwithstanding the above, this DPA is intended to meet the requirements of GDPR Article 28 and, where applicable, the UK GDPR. Where mandatory provisions of EU or UK data protection law apply, those provisions shall take effect alongside this DPA.

---

17. Contact

For questions about this DPA or to submit a data protection request:

Privacy: privacy@loanbit.io
Legal: legal@loanbit.io

PlainQode Software Limited. Kingston, Jamaica