Required Verification Documents

This Data Services Agreement ("Agreement") is entered into as of the date signed electronically by Applicant ("Effective Date") by and between The Leads Network LLC, including its brands, websites, and trade names, including but not limited to Mortgage Help Center, Mortgage Help Services, Mortgage Leads Network, MortgageLeads.net, and related properties, referred to as "Company," "we," "us," or "our," and the applicant identified in the signature block below, referred to as "Applicant," "Customer," "you," or "your." Applicant's signature confirms Applicant's agreement to this Agreement. Company is not required to approve Applicant, provide Lead Data, or begin any business relationship unless and until Company separately approves Applicant. Company may accept this Agreement by approving Applicant, delivering Lead Data, issuing an invoice, accepting payment, or confirming approval in writing. Submission, signing, or completion of this Agreement does not guarantee approval or access to Lead Data.

1.Services and Lead Data

Company may provide Customer with consumer lead data, live transfers, aged leads, real-time leads, bulk files, form submissions, contact records, call information, or related data products, collectively referred to as "Lead Data." Lead Data may include personal information, contact information, mortgage-related information, lender information, payment-status information, hardship information, state, email, phone number, form responses, timestamps, source information, and other consumer-submitted or derived information. Customer acknowledges that Lead Data may include sensitive consumer information and must be handled accordingly.

2.Lead Types

Real-Time Lead means Lead Data delivered shortly after consumer submission. Aged Lead means Lead Data delivered after the original submission date or after prior delivery to one or more buyers. Live Transfer means a consumer call transferred directly to Customer. Bulk File means Lead Data delivered as a batch, spreadsheet, API export, CSV, or other grouped delivery. Company may impose additional restrictions based on lead type, delivery method, sensitivity, source, age, or compliance risk.

3.Independent Third-Party Recipient

Customer receives Lead Data as an independent third-party recipient and not as Company's service provider, contractor, processor, agent, employee, partner, or joint venturer. Customer is solely responsible for its own use of Lead Data, communications with consumers, compliance obligations, licenses, employees, contractors, vendors, scripts, disclosures, payment practices, and business operations.

4.No Ownership Transfer

Company does not sell, assign, or transfer ownership of its databases, systems, forms, websites, lead-generation methods, tracking records, compliance materials, or consumer-source records. Customer receives only a limited, revocable right to use Lead Data for the approved business purpose authorized by Company.

5.Permitted Use

Customer may use Lead Data only to contact the specific consumer identified in the lead for the approved business purpose authorized by Company. Customer may not use Lead Data for any purpose not expressly approved by Company in writing. Customer's use is limited to Customer's internal business operations and authorized personnel with a legitimate need to access the data.

6.Strictly Prohibited Uses

Customer shall not, directly or indirectly:

1.Sell, resell, broker, license, rent, transfer, assign, sublicense, distribute, or disclose Lead Data to any person or

entity.

2.Upload Lead Data to any data broker, enrichment platform, append service, skip-tracing vendor, advertising

platform, AI training system, or third-party marketing system without Company's prior written approval.

3.Use Lead Data for any scam, fraud, deceptive practice, impersonation, fake lender communication, fake foreclosure

notice, fake approval letter, fake government notice, fake legal notice, or misleading payment demand.

1. Represent or imply that Customer is the consumer's lender, servicer, foreclosure department, court, government

agency, attorney, law enforcement agency, or Company unless truthful and legally permitted.

5.Request payment by Zelle, Cash App, Venmo, wire, gift card, cryptocurrency, or payment to an individual or

unrelated entity in a deceptive or misleading way.

6.Use Lead Data for credit eligibility, employment eligibility, insurance eligibility, tenant screening, background

checks, or any FCRA-regulated purpose unless separately authorized in writing and legally permitted.

1. Contact consumers after opt-out, revocation, DNC request, unsubscribe request, or legal prohibition.
2. Use Lead Data for unrelated marketing, resale, profiling, targeting, identity resolution, or consumer scoring.

9.Permit offshore access, contractor access, affiliate access, or call-center access unless approved by Company in

writing.

10.Store Lead Data in personal email accounts, personal devices, messaging apps, unsecured spreadsheets, or

shared folders.

11.Remove, alter, or obscure Company tracking fields, source fields, batch IDs, lead IDs, seed records, or compliance

metadata.

1. Attempt to identify seed leads, test leads, or monitoring records.
2. Use Lead Data after suspension, termination, non-payment, or revocation of access.

Any prohibited use is a material breach.

7.Compliance With Laws

Customer is solely responsible for complying with all laws applicable to its use of Lead Data and all communications with consumers, including where applicable:

• TCPA;
• Telemarketing Sales Rule;
• National Do Not Call rules;
• state telemarketing and mini-TCPA laws;
• CAN-SPAM;
• GLBA and Safeguards Rule obligations;
• FCRA;
• CCPA/CPRA and other state privacy laws;
• Mortgage Assistance Relief Services Rule;
• foreclosure-consultant, loan-modification, debt-relief, legal advertising, licensing, bonding, and advance-fee laws;
• state bar, NMLS, professional licensing, and consumer-protection rules;
• unfair, deceptive, or abusive acts or practices laws.

Customer is responsible for determining whether it may lawfully call, text, email, mail, or otherwise contact each consumer.

8.TCPA, DNC, and Outreach Compliance

Before using any robocall, prerecorded message, automated text, ringless voicemail, AI-generated voice, autodialing technology, or similar method, Customer must independently confirm that it has lawful consent or another valid legal basis for that specific contact method and consumer. Customer must maintain records of consent, opt-outs, revocations, suppression requests, DNC requests, complaints, call logs, SMS logs, email logs, and consumer communications. Customer may not rely solely on Company's delivery of Lead Data as proof that Customer has permission to contact the consumer.

9.Mortgage Relief / Foreclosure Assistance Conduct

If Customer uses Lead Data for mortgage relief, loan modification, foreclosure defense, foreclosure assistance, debt relief, or related services, Customer certifies that it will comply with the Mortgage Assistance Relief Services Rule and all applicable state-law equivalents. Customer shall not:

1. collect advance fees unless legally permitted;
2. make false or misleading claims about foreclosure, loan modification, lender approval, litigation, government action,

or consumer eligibility;

1. send fake lender, servicer, court, government, foreclosure, or legal notices;
2. imply that payment is required to stop an imminent foreclosure unless truthful and legally permitted;
3. misrepresent its identity, authority, affiliation, legal status, or relationship with Company.

10.Privacy Classification and Consumer Disclosures

Customer acknowledges that Company may treat transfers of Lead Data to Customer as a sale or disclosure of personal information to an independent third party under applicable privacy laws. Customer shall use Lead Data only for the purpose for which it was provided and shall not combine, resell, disclose, or repurpose Lead Data except as expressly authorized by Company in writing. Customer shall cooperate with Company regarding consumer privacy requests, opt-outs, deletion requests, regulator inquiries, attorney inquiries, and consumer complaints involving Lead Data.

11.No Unauthorized Sharing or Third-Party Access

Customer may not disclose, transmit, upload, or allow access to Lead Data to any affiliate, contractor, call center, vendor, employee, agent, offshore team, CRM vendor, dialer vendor, SMS provider, email vendor, law firm, processor, broker, or other person or entity unless Company gives prior written approval. Customer remains fully responsible for all acts and omissions of any person or entity that accesses Lead Data through Customer. Company may require Customer to provide written agreements, vendor details, security information, or other proof before approving any third-party access.

12.Offshore Access

No offshore access is permitted unless Company approves it in writing before access occurs. "Offshore access" means any access to, processing of, transmission of, or storage of Lead Data by any person physically located outside the United States or by any system or server physically located outside the United States. Unauthorized offshore access is a material breach.

13.Data Security Requirements

Customer must maintain reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of Lead Data. At minimum, Customer must:

1. use unique user accounts;
2. prohibit shared passwords;
3. restrict access to personnel with a legitimate business need;
4. use multi-factor authentication where available;
5. store Lead Data only in secure CRM or approved secure systems;
6. maintain access logs where available;
7. train personnel on privacy, fraud prevention, and data handling;
8. disable access promptly when personnel leave or no longer need access;
9. protect Lead Data from unauthorized access, copying, disclosure, loss, alteration, or misuse;
10. maintain written confidentiality obligations with personnel and approved contractors;
11. maintain opt-out, DNC, complaint, and incident-response procedures;
12. avoid storing Lead Data in personal devices, personal email, messaging apps, or unsecured spreadsheets;
13. securely delete or return Lead Data when required.

For Bulk Files, Customer must use secure transmission and encrypted storage.

14.Seed Leads, Test Records, and Monitoring

Company may include seed leads, test records, unique data fields, tracking numbers, batch identifiers, decoy records, or other monitoring methods in any Lead Data. Customer consents to Company's use of seed leads and monitoring for compliance, fraud detection, resale detection, leak detection, and misuse detection. As between the Parties, contact with a seed lead or test record traceable to Customer's delivered Lead Data shall be treated as strong evidence of breach, subject to Customer's right to rebut with credible records. Customer shall not attempt to detect, remove, filter, suppress, alter, or identify seed leads.

15.Records and Audit Rights

Customer must maintain records sufficient to prove compliance with this Agreement, including:

• lead receipt records;
• CRM access records;
• call logs;
• SMS logs;
• email logs;
• opt-out records;
• complaint records;
• disposition records;
• employee, contractor, vendor, and call-center access lists;
• deletion records;
• scripts, templates, and consumer-facing documents.

Company may audit Customer's compliance upon reasonable notice. Company may conduct an immediate audit without advance notice if Company suspects fraud, misuse, resale, unauthorized access, consumer harm, or a security incident. Customer must provide requested records within three business days, or sooner if the matter involves fraud, consumer harm, active security risk, legal demand, regulator inquiry, or law enforcement. Company may suspend Lead Data delivery during any audit or investigation.

16.Security Incident and Misuse Reporting

Customer must notify Company immediately, and in no event later than 24 hours, after discovering or suspecting any:

1. unauthorized access to Lead Data;
2. loss, theft, copying, disclosure, or misuse of Lead Data;
3. access by an unauthorized employee, contractor, vendor, call center, offshore person, or third party;
4. consumer complaint alleging fraud, impersonation, fake lender notice, fake approval, fake foreclosure notice,

suspicious payment request, or misuse of consumer information;

1. seed lead contact or suspicious seed lead activity;
2. ransomware, malware, phishing, CRM compromise, email compromise, account compromise, or device loss

involving Lead Data;

1. request from law enforcement, regulator, attorney, or consumer relating to Lead Data misuse.

Customer must preserve all evidence, including call recordings, call logs, texts, emails, CRM notes, user access logs, IP logs, employee lists, vendor records, and payment records.

17.Incident Cooperation

If a security incident, suspected misuse, consumer complaint, seed-lead event, or regulatory inquiry occurs, Customer must cooperate fully with Company. Customer must, at its own expense:

1. investigate the incident;
2. identify affected records;
3. identify every person or system that accessed the data;
4. provide written findings to Company;
5. stop the misuse;
6. preserve and produce evidence;
7. assist with consumer notices if required;
8. assist with regulator, attorney, law-enforcement, or customer inquiries;
9. reimburse Company for reasonable costs caused by Customer's breach, misuse, or security failure.

18.Data Retention and Deletion

Customer may retain Lead Data only as long as reasonably necessary for the approved purpose unless a shorter period is required by Company in writing. Unless otherwise approved in writing, Customer must delete or securely destroy Lead Data no later than 180 days after receipt, except for limited records legally required to be retained for compliance, billing, dispute, audit, or litigation purposes. Upon termination, suspension, written request, or non-payment, Customer must immediately stop using Lead Data and must delete or return all Lead Data within five business days unless Company provides written permission otherwise. Customer must certify deletion upon request.

19.Consumer Requests and Complaints

If Customer receives any consumer request, complaint, deletion request, opt-out request, privacy request, attorney inquiry, regulator inquiry, or law-enforcement inquiry involving Company Lead Data, Customer must notify Company within 24 hours. Customer must cooperate with Company in responding to consumer privacy rights requests and must not make statements on behalf of Company without Company's written approval.

20.Quality, Returns, and No Guarantee

Company does not guarantee that any Lead Data will result in a sale, retained client, funded loan, signed agreement, completed transfer, payment, or revenue. Unless otherwise stated in writing, Lead Data is provided "as is" as to consumer interest at the time of generation or collection. Lead return, credit, or replacement policies, if any, are controlled by Company's written policy, invoice, order form, or written agreement. Company may deny credits for leads mishandled by Customer, contacted late, contacted unlawfully, transferred to unauthorized parties, or used outside the approved purpose.

21.Payment and Suspension

Customer must pay all invoices according to the applicable invoice, order, or written payment terms. Invoices not paid within the applicable terms accrue interest at the lesser of 1.5% per month or the maximum rate permitted by law. Company may suspend or terminate Lead Data delivery immediately for non-payment, late payment, suspected fraud, suspected misuse, consumer complaints, security concerns, resale concerns, compliance concerns, or breach of this Agreement. Suspension does not waive amounts owed.

22.Confidentiality

Lead Data, pricing, source information, batch records, seed records, campaign data, delivery methods, consumer records, buyer lists, Company business methods, and compliance materials are confidential. Customer may not disclose Company confidential information except as expressly permitted by this Agreement.

23.Representations and Warranties

Customer represents and warrants that:

1. the signer is authorized to bind Customer;
2. Customer will use Lead Data only for the approved purpose;
3. Customer will not resell or share Lead Data;
4. Customer will comply with all applicable laws;
5. Customer maintains reasonable security controls;
6. Customer will report incidents and complaints promptly;
7. Customer is not using Lead Data for fraud, deception, impersonation, or unlawful consumer solicitation;
8. Customer will not allow unauthorized persons to access Lead Data;
9. Customer will cooperate with audits and investigations.

24.Indemnification

Customer shall defend, indemnify, and hold harmless Company, its owners, officers, employees, contractors, vendors, affiliates, brands, and customers from and against any claims, losses, damages, liabilities, penalties, fines, settlements, judgments, chargebacks, refunds, attorney fees, investigation costs, regulatory costs, consumer notice costs, and expenses arising from or relating to:

1. Customer's use or misuse of Lead Data;
2. Customer's breach of this Agreement;
3. unauthorized resale, disclosure, access, or sharing;
4. Customer's communications with consumers;
5. TCPA, DNC, TSR, CAN-SPAM, privacy, mortgage relief, consumer-protection, or professional-rule violations;
6. fraud, deception, impersonation, fake notices, fake approvals, or misleading payment requests;
7. security incidents involving Customer or its personnel;
8. acts or omissions of Customer's employees, contractors, vendors, call centers, affiliates, or agents.

25.Limitation of Liability

Except for Customer's payment obligations, indemnification obligations, confidentiality obligations, data-security obligations, prohibited-use violations, resale or unauthorized disclosure, fraud, willful misconduct, consumer harm, or legal violations, neither Party shall be liable for indirect, incidental, consequential, special, punitive, or lost-profit damages. Customer's liability for prohibited use, resale, unauthorized disclosure, security incidents, fraud, consumer deception, confidentiality breaches, indemnification, and unpaid invoices is not capped. Company's aggregate liability arising out of this Agreement shall not exceed the greater of the total fees paid by Customer to Company in the twelve months preceding the claim or $50,000, except in cases of Company's gross negligence, willful misconduct, or fraud.

26.Injunctive Relief

Customer acknowledges that unauthorized use, resale, disclosure, or misuse of Lead Data may cause irreparable harm. Company may seek immediate injunctive relief without posting bond, in addition to all other remedies available at law or equity.

27.Termination

Company may terminate this Agreement immediately upon notice if Customer:

1. fails to pay;
2. resells or shares Lead Data;
3. misuses Lead Data;
4. permits unauthorized access;
5. creates consumer harm;
6. fails to report a security incident;
7. fails to cooperate with an audit or investigation;
8. violates applicable law;
9. creates reputational, legal, financial, or compliance risk for Company.

Upon termination, Customer must stop using Lead Data and delete or return all Lead Data as required by this Agreement.

28.Updates to Agreement

Company may update this Agreement or impose additional requirements upon written notice. Continued receipt or use of Lead Data after notice constitutes acceptance of the updated terms.

29.Governing Law and Venue

This Agreement shall be governed by the laws of the State of California, without regard to conflict-of-law principles. Venue for any dispute shall be in the state or federal courts located in California. Customer consents to personal jurisdiction in those courts and waives objections to venue or forum non conveniens. Company may bring an action for injunctive relief in any court of competent jurisdiction where Customer, its principals, or the relevant conduct is located.

30.Entire Agreement

This Agreement, together with any invoice, order form, insertion order, lead order, written approval, pricing schedule, or written policy issued by Company, constitutes the entire agreement between the Parties regarding Lead Data. If there is a conflict, the stricter data-protection, compliance, or consumer-protection term controls.

31.Electronic Signature

Applicant agrees that electronic signatures, including DocuSign signatures, are valid and binding.