Data Use & Lead Purchase Agreement

This Data Use & Lead Purchase Agreement ("DULA") is incorporated into every order for Lead Data.

1. Permitted purpose

Customer may use Lead Data only for the specific lawful business purpose, category, geography, and channels disclosed in its account and order. Approval for one purpose does not approve another. Customer is an independent controller or business with respect to its use and must provide its own notices.

2. No consent transfer

Unless the order expressly states otherwise and includes auditable consent evidence, Vortoc does not sell, assign, or represent consumer consent. Public-record-derived Leads are cold data: not hand-raisers, applications, inbound inquiries, referrals, or requests to be contacted. Customer will not state or imply otherwise.

3. Pre-use controls

Before outreach or other use, Customer will identify the seller or service provider and the lawful purpose; identify the person's state and other relevant jurisdictions using reasonable methods; confirm licensing and professional-rule requirements; select a lawful channel and calling or sending window; screen against Customer's internal suppression list and every applicable federal, state, and local registry using a legally permitted, current process; determine whether the proposed technology requires consent and, if so, possess adequate consent for the specific sender, purpose, and channel; confirm contact information and reassigned-number risk using reasonable controls; apply frequency, content, identification, and opt-out rules; and create an auditable campaign record.

4. Prohibited uses

Customer may not use Lead Data as or to prepare a consumer report under the FCRA or analogous law; for credit, lending, insurance, employment, housing, tenant screening, education admissions, government benefits, or another eligibility decision; to determine creditworthiness, capacity, character, reputation, personal characteristics, or mode of living for an eligibility purpose; for stalking, harassment, threats, coercion, discrimination, fraud, identity theft, doxxing, locating protected persons, or physical harm; to contact minors, protected witnesses, domestic-violence survivors, or persons whose contact is legally restricted; to provide legal advice or solicit legal representation where professional rules prohibit it; to advertise or make decisions based on protected traits or unlawful proxies; to append highly sensitive data, publish personal dossiers, or reidentify deidentified data; to train general-purpose models or create competing datasets without written permission; or in any way prohibited by the Acceptable Use Policy.

5. Contact rules

Customer is solely responsible for calls, texts, voicemail drops, artificial or prerecorded voice, email, direct mail, social messaging, and door-to-door contact. Do-not-call scrubbing does not establish TCPA consent, permission under state mini-TCPA laws, email compliance, or a lawful purpose. Consent for one seller or channel is not automatically consent for another.

6. Downstream providers

Customer may disclose Lead Data only to approved processors acting solely for Customer under a written agreement. Customer remains responsible, limits access, prohibits reuse or sale, requires safeguards and incident notice, passes through suppression and deletion instructions, and ensures secure deletion. Independent resale, co-registration, affiliate distribution, or lead brokering is prohibited without a separate signed reseller agreement.

7. Complaints, requests, and incidents

Customer will record and honor opt-outs immediately; notify Vortoc at [email protected] within one business day of a regulator inquiry, demand letter, systemic complaint, suspected unlawful campaign, or security incident involving Lead Data; preserve relevant evidence; cooperate; and pause affected activity when reasonably requested. Customer may not retaliate against or mislead a complainant.

8. Records and audit

Customer will retain compliance records for the longest period required by applicable law or contract and provide them on reasonable request. Vortoc may conduct a risk-based audit on notice, or immediately for suspected material harm. Evidence may include policies, licenses, registry subscriptions, scrub dates, scripts, consent artifacts, vendor contracts, suppression logs, dispositions, and deletion attestations.

9. Data lifecycle

Customer will use Leads within 90 days of delivery unless the order says otherwise; refresh legal and contact screening immediately before use; restrict downloads; and delete Lead Data at expiration, termination, recall, or completed purpose, retaining only legally required records and minimized suppression data. Customer will certify deletion on request.

10. Remedies

Misuse is a material breach. Vortoc may suspend delivery, revoke access, quarantine or recall data, require remediation or deletion, notify affected partners, and terminate. Contract remedies are cumulative and do not limit legal obligations.