← Back to Invictus CRM

Data Processing Agreement

1. Purpose and Scope

This Data Processing Agreement ("DPA") forms part of the agreement between Team Invictus Services Inc., operating as Invictus CRM ("Processor," "we," "us"), and each agency or advisor using the platform ("Controller," "you," "your agency"). It governs how we process personal data on your behalf as you use Invictus CRM to manage your clients, leads, and policy information.

In this relationship, your agency is the data controller — you decide what client information to collect and why. Invictus CRM is the data processor — we process that data only to provide the CRM service to you, and only under your instructions.

2. What Data We Process

On your instructions, we process personal data that you and your team enter into the platform, which may include:

• Client and lead contact details (name, phone, email, address, date of birth)
• Policy and coverage information
• Family member information relevant to insurance applications
• Signed documents and signature audit data (timestamp, IP address)
• Communication records (emails sent through the platform, activity notes)

3. Our Obligations as Processor

We agree to:

• Process personal data only on your documented instructions, as expressed through your normal use of the platform
• Ensure that anyone with access to the underlying infrastructure is bound by confidentiality obligations
• Implement appropriate technical and organizational security measures (see our Data Security & Compliance Statement)
• Assist you in responding to data subject requests (access, correction, deletion) from your clients, to the extent the platform allows
• Notify you without undue delay if we become aware of a data breach affecting your agency's data
• Delete or return personal data at the end of our service relationship with you, except where retention is required by law

4. Sub-Processors

We use a limited number of trusted sub-processors to operate the platform — currently Google Firebase/Google Cloud (hosting, database, storage, authentication), Resend (transactional email), and Stripe (billing). Each is bound by its own data protection obligations. We will notify agencies of any material change to this sub-processor list.

5. International Data Transfers

Data is hosted on Google Cloud infrastructure. Where data is processed or stored outside Canada, this occurs under Google's own data protection commitments, including Standard Contractual Clauses where applicable.

6. Your Responsibilities as Controller

As the controller, your agency remains responsible for:

• Having a valid legal basis to collect and process your clients' personal data
• Providing your clients with appropriate privacy notices
• Obtaining any necessary consents, particularly for marketing communications (see our Anti-Spam Policy)
• Responding substantively to your clients' data subject requests, using the tools the platform provides

7. Data Retention and Deletion

Client and policy data is retained for as long as your account remains active, plus any period required by insurance regulatory record-keeping obligations. Upon account closure, data can be exported before deletion; deletion requests are handled in accordance with applicable law and your own regulatory obligations.

8. Audits

We maintain independent third-party certifications for our underlying infrastructure (see Data Security & Compliance Statement). Reasonable audit requests regarding our processing of your data can be directed to support@invictuscrm.com.

9. Contact

Questions about this DPA can be sent to support@invictuscrm.com.