Skip to content
LandGrantIQ

Legal

Data Processing Addendum

Last updated: August 13, 2026

This Data Processing Addendum (this “DPA”) forms part of the agreement between LandGrantIQ (“LandGrantIQ,” “we,” or “us”) and the customer organization (“Customer”) governing Customer’s use of the LandGrantIQ platform (the “Service”), including our Terms of Service or any master agreement between the parties (together, the “Agreement”). It reflects the parties’ agreement on the processing of Personal Data within Customer Data. In the event of a conflict between this DPA and the Agreement with respect to the processing of Personal Data, this DPA controls.

1. Definitions

  • “Data Protection Laws” means all laws applicable to the processing of Personal Data under this DPA, including, as applicable, the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR, the California Consumer Privacy Act as amended (“CCPA”), and other U.S. state comprehensive privacy laws.
  • “Personal Data” means information within Customer Data that identifies or relates to an identified or identifiable natural person.
  • “Subprocessor” means a third party engaged by LandGrantIQ to process Personal Data on Customer’s behalf.
  • The terms “controller,” “processor,” “business,” “service provider,” “data subject,” “processing,” and “personal data breach” have the meanings given in applicable Data Protection Laws.

2. Roles and Scope of Processing

As between the parties, Customer is the controller (or business) of Personal Data within Customer Data, and LandGrantIQ is the processor (or service provider). Where Customer itself acts as a processor for its own clients, LandGrantIQ acts as Customer’s subprocessor. The details of processing are:

  • Subject matter and duration — the provision of the Service for the term of the Agreement, plus any post-termination period required for return and deletion.
  • Nature and purpose — hosting, storage, organization, transmission, analysis, retrieval, and display of Customer Data to provide matter management, parcel intelligence, document automation, analytics, and related features of the Service.
  • Categories of data subjects — Customer’s personnel and authorized users; Customer’s clients, including landowners; opposing and condemning parties and their representatives; appraisers, experts, and other third parties named in matter records.
  • Categories of Personal Data — identification and contact details; property ownership and parcel records; matter, valuation, offer, and negotiation information; communications; and, where submitted by Customer, financial information and government identifiers. Customer is responsible for determining whether special or sensitive categories of data are submitted and for any additional required safeguards.

3. Customer Instructions

LandGrantIQ will process Personal Data only on Customer’s documented instructions — including as set out in the Agreement, this DPA, and Customer’s configuration and use of the Service — unless required to do otherwise by law, in which case we will inform Customer of the legal requirement before processing unless the law prohibits such notice. We will promptly inform Customer if, in our opinion, an instruction infringes applicable Data Protection Laws.

Service-provider commitments (U.S. state laws). LandGrantIQ will not: (a) sell or share Personal Data; (b) retain, use, or disclose Personal Data for any purpose other than providing the Service under the Agreement, including any commercial purpose outside the direct business relationship with Customer; or (c) combine Personal Data with personal information received from other sources except as permitted for service providers. LandGrantIQ certifies that it understands and will comply with these restrictions, and will notify Customer if it determines it can no longer meet its obligations under applicable Data Protection Laws.

4. Confidentiality of Processing

LandGrantIQ ensures that persons authorized to process Personal Data are bound by written confidentiality obligations or an appropriate statutory duty of confidentiality, and access Personal Data only on a need-to-know basis consistent with role-based access controls. We recognize that Customer Data may be subject to attorney–client privilege and work-product protection and will treat it accordingly, including by notifying Customer — where legally permitted — before disclosing Customer Data in response to legal process so that Customer may seek protective measures.

5. Security

Taking into account the state of the art and the nature of the Personal Data processed, LandGrantIQ implements and maintains appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, including:

  • encryption of Personal Data in transit and at rest;
  • role-based access controls, tenant isolation, unique credentials, and support for multi-factor authentication;
  • logging, monitoring, and tamper-evident audit trails of access and material events;
  • vulnerability management, secure development practices, and change control;
  • backup, redundancy, and disaster-recovery procedures; and
  • personnel security training and least-privilege administration.

Further detail is available on our Security page and in security documentation available to Customer on request.

6. Subprocessors

Customer provides general written authorization for LandGrantIQ to engage Subprocessors to provide the Service, including cloud infrastructure providers. As of the date above, LandGrantIQ uses the following Subprocessor:

  • Google Cloud Platform (Google LLC, United States) — cloud infrastructure, hosting, and storage for the Service.

We will: (a) maintain a current list of Subprocessors, available on request to privacy@landgrantiq.com; (b) provide Customer advance notice of any new or replacement Subprocessor, and a reasonable opportunity to object on legitimate data-protection grounds — if the parties cannot resolve the objection, Customer may terminate the affected Service; (c) impose on each Subprocessor data-protection obligations no less protective than those in this DPA; and (d) remain fully liable for the performance of each Subprocessor’s obligations.

7. Assistance with Data Subject Requests

Taking into account the nature of the processing, LandGrantIQ will assist Customer through appropriate technical and organizational measures, insofar as possible, in fulfilling Customer’s obligation to respond to data subject requests (access, rectification, erasure, restriction, portability, objection, and opt-out rights). If a data subject submits a request directly to LandGrantIQ that identifies Customer, we will promptly forward it to Customer and will not respond substantively except as instructed by Customer or required by law.

8. Personal Data Breach

LandGrantIQ will notify Customer without undue delay after becoming aware of a personal data breach affecting Personal Data, and in any event within the period required by applicable Data Protection Laws. The notice will describe, to the extent known, the nature of the breach, the categories and approximate volume of affected data and data subjects, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects, with updates as information develops. We will reasonably cooperate with Customer’s incident response and any legally required notifications.

9. Impact Assessments and Consultation

LandGrantIQ will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities, to the extent required of Customer under Data Protection Laws and taking into account the information available to LandGrantIQ.

10. Audits and Information

LandGrantIQ will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, including security documentation and summaries of third-party assessments where available, and will allow for and contribute to audits conducted by Customer or its mandated auditor, subject to reasonable notice, frequency, confidentiality, and scope requirements, and without granting access to other customers’ data.

11. International Transfers

The Service is hosted in the United States. To the extent Personal Data subject to the GDPR, UK GDPR, or Swiss data protection law is transferred to a country not recognized as providing an adequate level of protection, the parties will rely on an appropriate transfer mechanism, including the European Commission’s Standard Contractual Clauses (Module 2 or Module 3, as applicable), the UK International Data Transfer Addendum, and the Swiss recognized adaptations, which are incorporated by reference into this DPA where required.

12. Return and Deletion

Upon termination or expiration of the Agreement, LandGrantIQ will, at Customer’s election, return Customer Data in a commonly used, machine-readable format or delete it, and will delete remaining copies within a commercially reasonable period thereafter, except to the extent retention is required by applicable law — in which case we will continue to protect the retained data under this DPA and process it only as required by that law. Deletion from backups occurs in the ordinary course of backup rotation.

13. Liability; Order of Precedence

Each party’s liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set forth in the Agreement. This DPA supersedes any prior data-processing terms between the parties with respect to its subject matter.

14. Contact

Questions about this DPA, requests for the current Subprocessor list, or execution of transfer mechanisms: privacy@landgrantiq.com.