Privacy Policy
1. Who we are
BrokerVA ([TODO: legal entity name], “BrokerVA”, “we”, “us”) provides mortgage operations support to lenders and brokers. Our mailing address is 4742 N 24th St, Phoenix, AZ 85016, United States. Our NMLS number is 1977844.
This policy explains what personal information we collect through brokerva.com, why we collect it, who we share it with, and the choices and rights you have. It covers this website, our contact form and our careers application. It does not cover the services we provide to our clients under contract, or other websites we link to.
For the purposes of data protection law, BrokerVA is the controller (in the Philippines, the “personal information controller”) of the information described here. [TODO: name of any Philippine affiliate that handles recruiting or employment, if it is a joint or separate controller]
2. What we collect
When you fill in the contact form
On our Get Startedpage we ask for your first and last name, phone number, email address, company, position, NMLS number, and a description of the services you’re looking for. All fields are required.
The form is protected by Cloudflare Turnstile, which checks that a person, not a bot, is submitting it. To do that, Turnstile looks at information about your browser and device, and we send Cloudflare your IP address along with the check.
When you apply for a job
Our careers applicationis a form hosted by Jotform and embedded on our site. It asks for your name, email address, phone number, whether you have mortgage experience, whether you currently live in the Philippines, the role you’re applying for, your previous or current mortgage role, your years of experience, how you heard about us (and who referred you, if anyone), a description of your relevant experience, your LinkedIn profile (optional), and your résumé. Jotform may also record technical details such as your IP address with the submission.
Please don’t include sensitive information we haven’t asked for in your résumé or answers, such as government ID numbers, health information, religion or marital status.
If you’re new to us, we email you to ask a few follow-up questions (for example, where you’re located and your experience with US mortgage processing). Anything you send back by email is kept with your application.
When you email us
If you email us, we receive your email address, your message and anything you attach.
Analytics, only if you agree
If you accept analytics cookies, we use PostHog to understand how visitors use the site. PostHog then records the pages you view, clicks and other interactions, how long you stay, your browser, device and operating system, the page that referred you, your approximate location (derived from your IP address), and errors the site runs into. It also records sessions (see Cookies and analytics). We don’t link this to your name or email. Visitors are anonymous in PostHog. If you don’t accept, none of this is collected.
Information every website receives
Like any website, our hosting provider receives technical information when your browser requests a page, such as your IP address, browser type and the page requested, and may keep it in server logs for security and troubleshooting.
3. How we use it
- Contact form: to respond to your enquiry, talk to you about our services, and keep a record of our conversations with you in our customer database. We rely on our legitimate interest in answering enquiries and, where you ask about becoming a client, on taking steps at your request before entering into a contract.
- Careers applications: to review your application, contact you about it, schedule interviews and make hiring decisions. We rely on taking steps at your request before a possible employment or engagement contract and, for applicants in the Philippines and elsewhere where consent is required, on your consent.
- Analytics: to see which pages are useful, find and fix problems, and improve the site. We rely on your consent, which you can withdraw at any time.
- Security: to protect our forms and systems from spam, bots and abuse. We rely on our legitimate interest in keeping the site secure.
- Legal obligations: to comply with the law and respond to lawful requests.
We don’t use your information for automated decisions that have legal or similarly significant effects on you, and we don’t sell it.
6. How long we keep it
We keep personal information only as long as we need it for the purposes above or as the law requires, and then delete or anonymize it.
- Contact form enquiries and the related records in our customer database: 3 years after our last contact with you.
- Careers applications, including résumés (in Knack, Jotform, our recruiting mailbox and the sending mailbox’s sent items), the name, email and phone posted to Slack, and our recruiter’s copy of the reply we email you, for applicants we don’t hire: 1 year after the hiring decision.
- Analytics events in PostHog: 1 year. Session recordings: 30 days.
- Hosting logs: 14 days.
If you’re hired, your application becomes part of your personnel records, which are covered by separate notices.
7. Your rights
Wherever you live, you can ask us to give you a copy of the personal information we hold about you, correct it, or delete it, and you can withdraw any consent you’ve given (for analytics, through Cookie settings). Withdrawing consent doesn’t affect anything we did before you withdrew it. To make a request, email us at [TODO: privacy contact email (the site’s general address is team@brokerva.com)]. We’ll need to confirm your identity before acting on it, and we’ll respond within the time the law requires. We won’t treat you differently for exercising your rights.
US state privacy rights
Depending on the state you live in (for example California, Colorado, Connecticut, Virginia and others with comprehensive privacy laws), you may have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to receive it in a portable format; and to opt out of the sale or sharing of personal information, targeted advertising and certain profiling. We don’t sell or share personal information or use it for targeted advertising, and we honor Global Privacy Control. You can use an authorized agent to make a request on your behalf. If we deny your request, you may appeal by replying to our decision; if you remain unhappy, you can contact your state attorney general.
European Economic Area and United Kingdom
If the GDPR or UK GDPR applies to you, you also have the right to restrict or object to our processing (including processing based on our legitimate interests), and to data portability. You can complain to your local data protection authority, or in the UK to the Information Commissioner’s Office, though we’d appreciate the chance to address your concern first.
Philippines (job applicants)
Under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), you have the right to be informed about how your personal information is processed, to access it, to object to its processing, to have it corrected, to have it erased or blocked, to data portability, and to be indemnified for damages caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of your personal information. You can also file a complaint with the National Privacy Commission. Our Data Protection Officer can be reached at [TODO: Data Protection Officer name and contact].
8. International transfers
We are based in the United States, and our website and most of our service providers store and process information in the United States. Our website is hosted by Render in the US, and PostHog stores analytics in its US region. Many of our applicants live in the Philippines, and applying means your information is transferred to and stored in the United States, where data protection laws may differ from those where you live. Our recruiting team is based in the Philippines and reviews applications from there.
Where the law requires it, we protect these transfers with recognized safeguards. Knack, Jotform, Microsoft, Slack, Cloudflare, PostHog and Render are certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. Jotform, Microsoft, Slack, Cloudflare, PostHog, Render and Sanity have also agreed to the European Commission’s Standard Contractual Clauses and their UK equivalent, which we rely on where a certification doesn’t apply, including for Sanity and for job applicant data. [TODO: confirm Knack’s DPA includes Standard Contractual Clauses (Knack App Settings > Info > Agreements); its Data Privacy Framework certification doesn’t cover applicant (HR) data]
9. Security
We protect your information with reasonable technical and organizational measures. The site is served only over encrypted HTTPS connections. The credentials for the systems that hold your information stay on our servers and are never sent to your browser. Our contact form checks that a person, not a bot, is submitting it before storing anything. Enquiries and applications are stored in our customer database, which only staff accounts we create can reach. It has no public sign-up and requires two-factor sign-in. New submissions are announced in internal Slack channels, and applications are emailed to our recruiting team’s group mailbox.
No system is completely secure. If a breach affects your personal information, we’ll notify you and the authorities as the law requires.
10. Children
Our website is for businesses and job seekers. It isn’t directed at children, and we don’t knowingly collect personal information from anyone under 16. Applicants must be at least 18. If you believe a child has given us personal information, contact us and we’ll delete it.
11. Changes to this policy
We may update this policy as our website or the law changes. We’ll post the new version here and change the “Last updated” date at the top. If we make a significant change to how we use personal information, we’ll give more prominent notice, such as a notice on this site, and ask for your consent again where the law requires it.
12. Contact us
For questions about this policy or to exercise your rights, contact us at:
- Email: [TODO: privacy contact email (the site’s general address is team@brokerva.com)]
- Mail: [TODO: legal entity name], Attn: Privacy, 4742 N 24th St, Phoenix, AZ 85016, United States