Data Processing Addendum

Effective October 15, 2026 · Version 1.1

This Data Processing Addendum ("DPA") forms part of the agreement between you (the "Customer") and Real Deal Pro, Inc. ("Real Deal Pro," "we," "us") governing your use of the Real Deal Pro platform (the "Services"). It applies to the extent that Real Deal Pro processes Personal Data on the Customer's behalf and that processing is subject to data protection law, including the EU/UK General Data Protection Regulation ("GDPR") and U.S. state privacy laws such as the California Consumer Privacy Act as amended ("CCPA/CPRA"). Capitalized terms not defined here have the meaning given in our Privacy Policy and Terms of Service.

1. Roles of the parties

For Personal Data that Real Deal Pro processes on the Customer's behalf in providing the Services, the Customer is the "controller" (and the "business" under CCPA/CPRA) and Real Deal Pro, Inc. is the "processor" (and the "service provider"). The Customer determines the purposes and means of the processing; Real Deal Pro processes that Personal Data only as set out in this DPA and on the Customer's documented instructions. Real Deal Pro acts as an independent controller for its own limited purposes (for example, billing, account administration, security, and legal compliance), which are described in our Privacy Policy.

2. Definitions

"Personal Data," "controller," "processor," "data subject," "processing," and "personal data breach" have the meanings given under applicable data protection law. "Sub-processor" means any third party engaged by Real Deal Pro to process Personal Data in connection with the Services. "Applicable Data Protection Law" means all data protection and privacy laws applicable to the processing under this DPA, including the GDPR, the UK GDPR, and the CCPA/CPRA.

3. Scope and instructions for processing

Real Deal Pro processes Personal Data only on the Customer's documented instructions — including with regard to transfers of Personal Data to a third country — unless required to do otherwise by law to which Real Deal Pro is subject, in which case Real Deal Pro will inform the Customer of that legal requirement before processing, unless the law prohibits such notice. The Customer's instructions are set out in this DPA, the Agreement, and the Customer's use and configuration of the Services. Real Deal Pro will inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. (GDPR Art. 28(3)(a).)

4. Nature, purpose, and duration

The subject matter, nature and purpose of the processing, the categories of data subjects, and the types of Personal Data are described in Annex 1. Processing continues for the duration of the Agreement and until deletion or return of Personal Data in accordance with Section 12.

5. Confidentiality

Real Deal Pro ensures that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to personnel who need it to provide the Services. (GDPR Art. 28(3)(b).)

6. Security measures

Real Deal Pro implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. A description of those measures is set out in Annex 2. (GDPR Art. 28(3)(c) and Art. 32.)

7. Sub-processors

The Customer provides general authorization for Real Deal Pro to engage the sub-processors listed in Annex 3 to process Personal Data in connection with the Services. Real Deal Pro will impose on each sub-processor, by written contract, data-protection obligations that are substantially the same as those set out in this DPA, and Real Deal Pro remains fully liable to the Customer for the performance of each sub-processor's obligations. Real Deal Pro will give the Customer reasonable notice of any intended addition or replacement of a sub-processor and an opportunity to object on reasonable data-protection grounds. (GDPR Art. 28(2), (3)(d), and (4).)

8. Assistance with data-subject requests

Taking into account the nature of the processing, Real Deal Pro will assist the Customer by appropriate technical and organizational measures, insofar as this is possible, to respond to requests from data subjects exercising their rights under Applicable Data Protection Law. Where a data subject contacts Real Deal Pro directly, Real Deal Pro will, where appropriate, refer the request to the relevant Customer. (GDPR Art. 28(3)(e).)

9. Personal data breaches and compliance assistance

Real Deal Pro will notify the Customer without undue delay — and, where feasible, no later than 72 hours — after becoming aware of a personal data breach affecting the Customer's Personal Data, and will provide the Customer with information reasonably available to it to assist the Customer in meeting its own breach-notification and reporting obligations. Real Deal Pro will also assist the Customer, taking into account the nature of processing and the information available to it, in ensuring compliance with its obligations regarding security of processing, breach notification, data protection impact assessments, and prior consultation. (GDPR Art. 28(3)(f) and Art. 32–36.) The 72-hour figure is a template default; confirm the operational notification window before this DPA is executed.

10. Audits and information

Real Deal Pro will make available to the Customer all information reasonably necessary to demonstrate compliance with the obligations in this DPA, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to reasonable advance notice, confidentiality obligations, and limits designed to protect the security and confidentiality of other customers' data. (GDPR Art. 28(3)(h).)

11. International data transfers

Real Deal Pro operates in the United States, and Personal Data processed under the Services is hosted in the United States. Where Personal Data subject to the GDPR or UK GDPR is transferred to a country that has not received an adequacy decision, the parties will rely on an appropriate transfer mechanism, such as the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller-to-processor), together with the UK International Data Transfer Addendum where applicable, which are incorporated by reference and completed using the details in the Annexes.

12. Return and deletion of data

At the Customer's choice, Real Deal Pro will delete or return all the Personal Data to the Customer after the end of the provision of the Services, and delete existing copies unless retention is required by law. The Customer can export its data from the Services at any time during the term. (GDPR Art. 28(3)(g).)

13. California / U.S. state privacy terms

Where Real Deal Pro acts as a "service provider" to the Customer (the "business") under the CCPA/CPRA, Real Deal Pro:

• processes Personal Data only for the limited and specified business purposes of providing the Services, and not for any other purpose;
• will not "sell" or "share" the Personal Data (as those terms are defined under the CCPA/CPRA), and will not retain, use, or disclose it outside the direct business relationship or for any purpose other than the specified services;
• complies with the applicable obligations of the CCPA/CPRA and provides the same level of privacy protection as the law requires of the business;
• notifies the Customer if it determines it can no longer meet its obligations under the CCPA/CPRA; and
• grants the Customer the right, on notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Data.

(Cal. Civ. Code § 1798.100(d)(1)–(5).) Real Deal Pro certifies that it understands and will comply with these restrictions.

14. General

In the event of a conflict between this DPA and the Agreement regarding the processing of Personal Data, this DPA prevails. Except as modified here, the Agreement remains in full force. This DPA is governed by the laws of the State of Iowa, with venue in Johnson County, Iowa, to the extent permitted by Applicable Data Protection Law. We may update this DPA to reflect changes in our processing or in legal requirements; material changes will be communicated to active Customers.

Annex 1 — Details of processing

• Subject matter: provision of the Real Deal Pro real-estate transaction-management platform.
• Nature and purpose: hosting, storage, processing, and transmission of Customer data to provide deal, client, document, e-signature, calendar, invoicing, and communications features.
• Duration: the term of the Agreement, plus any legally required retention period.
• Categories of data subjects: the Customer's authorized users and team members, and the Customer's clients and transaction counterparties (e.g., buyers, sellers, cooperating agents).
• Types of Personal Data: contact and identity details (name, email, phone, address); account and authentication data; deal, client, and transaction records; documents and e-signature data; billing and payment information; and, where the tax-filing feature is enabled, taxpayer identification information for 1099 recipients.

Annex 2 — Technical and organizational security measures

Real Deal Pro's measures include, without limitation:

• encryption of Personal Data in transit (TLS) and at rest;
• authentication and role-based access control, with tenant/workspace isolation so each Customer's data is segregated;
• access on a least-privilege, need-to-know basis, with personnel under confidentiality obligations;
• audit logging of security-relevant events, with logs retained for a defined period and then purged;
• hosting and content-delivery access logs retained for a defined period (website 180 days, API no more than 12 months) and then deleted; website measurement otherwise limited to daily aggregate counts carrying no identifier;
• error monitoring configured to minimize Personal Data: our API strips IP addresses, user-agent strings and personal fields before transmission; browser-side reports may carry an IP address used only for approximate location; session recording is disabled;
• use of reputable cloud infrastructure and sub-processors with their own security programs and provider-managed backups; and
• ongoing maintenance, dependency updates, and review of measures as the Services evolve.

Annex 3 — Authorized sub-processors

This list mirrors the sub-processors disclosed in our Privacy Policy:

For the most current sub-processor list, see the "Sub-processors" section of our Privacy Policy.

Questions

For questions about this DPA, or to request a countersigned copy, contact:

legal@real-deal-pro.com

This DPA is a standard template provided for transparency and is not a substitute for legal advice. It has not been reviewed by a licensed attorney and must be reviewed by counsel and countersigned before it is relied upon or offered for signature.