Data Processing Agreement

“Personal Data” / “NPI” as Processed by Yozona for the Agency (categories in Annex A). “Process/Processing,” “Sub-processor” (Annex C), “Personal Data Breach,” and “Applicable Data Protection Law” (GLBA Safeguards Rule, NAIC Model Law as adopted in Governing-Law State, state breach-notification law) bear their standard meanings.

The Agency is the Controller; Yozona is the Processor. Yozona Processes Personal Data only to provide the Services and on the Agency's documented instructions.

Purpose limitation: no use beyond the Services; no sale or own-commercial use.

Data minimization: only the active commercial policies and certificate-request details the Agency designates and loads — Yozona does not require the full book of business, personal-lines data, or AMS credentials. Any optional scoped, read-only AMS integration is enabled only with the Agency's express, revocable authorization.

Yozona treats all Personal Data as confidential and binds its personnel/contractors to confidentiality. Yozona does not bind, quote, or advise on coverage; every client-facing output is routed to the Agency's designated licensed producer for sign-off — that sign-off is the Agency's accuracy and E&O control.

Yozona maintains appropriate technical and organizational measures (Annex B), consistent with the GLBA Safeguards Rule and the NAIC Model Law, reviewed periodically and not materially degraded during the term.

Yozona uses Anthropic, PBC as its model provider to draft and process certificate content. Under Anthropic's commercial API terms, Agency data is not used to train Anthropic's models and is retained for up to 30 days for operational and trust-and-safety purposes, then deleted. Anthropic is listed as a Sub-processor in Annex C. Yozona inputs only the scoped data needed to perform the Services and does not input Agency Personal Data into consumer AI accounts.

The Agency authorizes the Sub-processors listed in Annex C. Yozona imposes data-protection obligations on each that are no less protective than this DPA, gives at least 30 days' prior written notice of any addition/replacement (Agency may object on reasonable grounds), and remains liable for each Sub-processor's performance.

Yozona provides reasonable assistance with data-subject rights requests and the Agency's security, breach-notification, and regulatory obligations, and makes available the information (including the Annex B audit trail) needed to demonstrate compliance.

Yozona notifies the Agency without undue delay and within 72 hours of becoming aware of a Breach, describing (to the extent known) nature, categories/volume affected, likely consequences, and measures taken. Yozona contains the breach, cooperates, and documents root cause and remediation. The Agency notifies its end clients and regulators; Yozona supports that timeline.

On termination/expiry or the Agency's earlier written request, Yozona returns and/or deletes the Personal Data (scoped policy store + derived artifacts) at the Agency's choice, confirming deletion in writing within 30 days of offboarding.

In-life retention: scoped policy store kept for the life of the engagement; per-request operational artifacts (audit trail, extracted fields, draft/issued certificates) purged 90 days after the request resolves; read-only record-view links expire 30 days after issuance.

Yozona is not the Agency's system of record — the durable statutory/E&O copy lives in the Agency's own management system.

On reasonable notice, no more than once per year (or after a Breach, or where a regulator requires), Yozona makes the audit trail and reasonable documentation available and responds to the Agency's security questionnaire, during business hours and subject to confidentiality.

Effective on the Effective Date, continuing for the duration of the Services; confidentiality, deletion confirmation, and liability survive. Liability is subject to the limitations in the underlying services agreement.

Governed by the laws of Governing-Law State, without regard to conflict-of-laws principles. On data-protection matters this DPA controls over the services agreement.