Data Processing Addendum

Contents

This Data Processing Addendum (the "DPA") forms part of the Deal Studio Terms of Service, or any other written agreement for the Services (together, the "Agreement"), between Business Brokerage Press, Inc., d/b/a Deal Studio ("Deal Studio") and the Brokerage that accepts the Agreement (the "Brokerage"). It applies when Deal Studio processes Customer Personal Data on the Brokerage's behalf.

1. Definitions

Capitalized words not defined here have the meaning given in the Agreement.

• "Data Protection Laws" means all privacy and data protection laws that apply to the processing of Customer Personal Data under the Agreement, which may include the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (the "CCPA"), other US state consumer privacy laws, and Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") and similar provincial laws.
• "Customer Personal Data" means personal information within Customer Data that Deal Studio processes on the Brokerage's behalf.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data in systems controlled by Deal Studio or its Subprocessors.
• "Subprocessor" means a third party Deal Studio engages to process Customer Personal Data.
• "Process" and "processing" mean any operation on personal information, including collecting, storing, using, disclosing, and deleting it.
• The terms "business," "service provider," "controller," "processor," "consumer," "sell," and "share" have the meanings given in the Data Protection Laws that apply.

2. Roles

2.1 For Customer Personal Data, the Brokerage is the business or controller, and Deal Studio is its service provider or processor.

2.2 Deal Studio is a business or controller only for the information described in its Privacy Policy as information it controls, such as User account details, billing records, and Site visitors.

2.3 The Brokerage's Users decide much of what is processed, for example by connecting mailboxes, recording meetings, and texting contacts. Their instructions given through the Platform are the Brokerage's instructions.

3. Instructions

3.1 Deal Studio will process Customer Personal Data only on the Brokerage's documented instructions. The Agreement, this DPA, and the Brokerage's and its Users' use and configuration of the Services are the Brokerage's complete instructions. Other instructions require written agreement.

3.2 Deal Studio will tell the Brokerage if it believes an instruction breaks Data Protection Laws, and may decline to follow it.

3.3 Deal Studio may process Customer Personal Data where the law requires, and will tell the Brokerage first unless the law forbids it.

4. Service provider commitments

Deal Studio will not:

(a) sell or share Customer Personal Data;

(b) retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified in the Agreement, including retaining, using, or disclosing it for a commercial purpose other than those business purposes, or as otherwise permitted by Data Protection Laws;

(c) retain, use, or disclose Customer Personal Data outside the direct business relationship between Deal Studio and the Brokerage;

(d) combine Customer Personal Data with personal information it receives from or on behalf of another person, or collects from its own interactions with consumers, except as Data Protection Laws allow for a business purpose;

(e) use Customer Personal Data to train AI models.

Deal Studio will comply with the obligations that apply to it as a service provider or processor under Data Protection Laws, give the same level of privacy protection they require, and tell the Brokerage if it can no longer meet them. The Brokerage may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data, including by ending the Agreement under its terms.

The business purposes are: providing, hosting, securing, supporting, and maintaining the Services; communications the Brokerage's Users send through the Services; and the other purposes set out in Annex 1.

5. Confidentiality

Deal Studio will make sure that everyone it authorizes to process Customer Personal Data is bound by a duty of confidentiality, and that access is limited to those who need it.

6. Security

6.1 Deal Studio will maintain the technical and organizational measures in Annex 2, appropriate to the risk. It may update them if the update does not materially reduce overall protection.

6.2 The Brokerage is responsible for the security choices within its control, including who it gives access to, the strength of its Users' credentials, and the settings it chooses.

7. Subprocessors

7.1 The Brokerage gives general authorization for Deal Studio to use Subprocessors. The current list is at site.deal-studio.com/subprocessors and is Annex 3.

7.2 Deal Studio will bind each Subprocessor by a written contract with data protection obligations at least as protective as those in this DPA, as they apply to that Subprocessor's service, and remains responsible for each Subprocessor's performance.

7.3 Deal Studio will notify Brokerage Admins at least 30 days before adding or replacing a Subprocessor, by email or a notice in the Platform and by updating the list.

7.4 The Brokerage may object on reasonable data protection grounds within that period. The parties will discuss in good faith. If they cannot resolve it, the Brokerage may end the affected Services and receive a pro-rated refund of prepaid fees for them.

7.5 Where a Subprocessor is needed urgently to keep the Services secure or available, Deal Studio may appoint it first and notify as soon as possible.

8. Help with requests from individuals

8.1 Deal Studio will pass to the Brokerage, without undue delay, any request it receives from an individual about Customer Personal Data, and will not answer it directly except to say it has been passed on, unless the Brokerage asks it to.

8.2 Taking into account the nature of the processing, Deal Studio will help the Brokerage respond to requests to access, correct, delete, or port Customer Personal Data, and to opt out of or limit processing, mostly through features of the Services and otherwise on request.

9. Security Incidents

9.1 Deal Studio will notify the Brokerage's administrators of a Security Incident immediately after discovering it, and in any event within 48 hours.

9.2 The notice will describe, as far as then known, the nature of the incident, the categories and approximate number of individuals and records affected, the likely consequences, and the steps taken or proposed. Deal Studio will update the Brokerage as it learns more.

9.3 Deal Studio will take reasonable steps to contain and investigate the incident and to reduce its effects, and will give the Brokerage reasonable help with any notices it must give to individuals or regulators.

9.4 Notice is not an admission of fault.

10. Deletion and return

10.1 During the subscription, Brokerage Admins can export Customer Data with the Platform's export tools or by request.

10.2 After the subscription ends, Deal Studio will keep Customer Personal Data available for export for 30 days, then delete it from active systems, and from backups as they expire on their normal cycle of up to 7 days, unless the law requires Deal Studio to keep it. Once the account is closed, Deal Studio staff prepare an export only on a written request from the account owner: firm data goes only to the Brokerage, and a User's Personal Items go only to that User. Deal Studio deletes its copy of the export after handing it over. Deal Studio will confirm deletion in writing on request.

10.3 Information that Deal Studio must keep by law stays protected by this DPA for as long as it is kept.

10.4 Information in the Brokerage's own CRM and marketing automation account is held under the Brokerage's own account with that provider. The Brokerage controls it, and Deal Studio does not delete it when the Agreement ends.

11. Audits and information

11.1 Deal Studio will make available the information reasonably needed to show compliance with this DPA, including written answers to a reasonable security questionnaire not more than once in any 12 months, and summaries of its Subprocessors' security certifications or reports where those Subprocessors make them available.

11.2 If that information is not enough to meet a requirement of Data Protection Laws or a regulator's request, the Brokerage may arrange a review of Deal Studio's relevant controls, at the Brokerage's cost, with at least 30 days' notice, during business hours, by an assessor bound by confidentiality, not more than once in any 12 months.

12. Data location and transfers

12.1 Deal Studio and its Subprocessors process Customer Personal Data in the locations shown in Annex 3, mainly the United States and Canada.

12.2 Where Customer Personal Data about individuals in Canada is processed outside Canada, Deal Studio will protect it to a standard comparable to that required in Canada, by contract with its Subprocessors, and the Brokerage remains responsible for giving any notice of that processing that its own obligations require.

13. The Brokerage's responsibilities

The Brokerage will:

(a) have a lawful basis, and give the notices and obtain the consents Data Protection Laws require, for the Customer Personal Data it puts into the Services or asks Deal Studio to process, including consent for texting, calling, emailing, and recording;

(b) give its own privacy notice to the individuals whose information it holds;

(c) not instruct Deal Studio to process Customer Personal Data in breach of Data Protection Laws;

(d) not put into the Services information it is not allowed to share, such as government identification numbers, full financial account numbers with access codes, or health information, except where a feature is designed to hold it.

14. Liability

Each party's liability under this DPA is subject to the limits in the Agreement, including any separate limit for data protection claims. See Section 22.3 of the Terms of Service.

15. Term and order of precedence

This DPA lasts as long as Deal Studio processes Customer Personal Data for the Brokerage. If it conflicts with the Agreement on the processing of Customer Personal Data, this DPA controls.

16. Acceptance

A Brokerage Admin accepts this DPA for the Brokerage in the Platform. Acceptance is needed once for each Brokerage and each version of this DPA. Deal Studio keeps a record of which version was accepted, by whom, and when, with a keyed hash of the IP address, never the address itself.

---

Annex 1: Details of processing

Annex 2: Security measures

Only measures that are in place today are listed.

1. Encryption. HTTPS for all traffic. Encryption at rest by the database and storage hosting provider. Additional AES-256-GCM application encryption, with keys held in the hosting environment and not in the database, for mailbox and meeting connection tokens, integration keys, and similar secrets.
2. Separation of customers. Row-level security enforced on every Platform table, scoping data to the Brokerage, with personal items limited to their owner.
3. Least access for staff. Deal Studio staff use time-limited operator sessions, shown on screen and logged in an append-only audit trail. Operator sessions cannot open personal mailboxes, texts, call records, recordings, or personal notes.
4. Audit logging. Append-only logs of sign-ins, operator sessions, exports, and sensitive changes.
5. Signed requests. Webhooks from connected providers are verified with signatures or shared secrets.
6. AI controls. Per-brokerage and per-person AI usage limits. AI usage logs record metadata, not content. Human approval before AI-drafted content is sent.
7. Messaging safeguards. Opt-out handling, campaign quiet hours, consent records for personal-contact text campaigns, and required unsubscribe links and postal addresses in marketing email. Live sending is switched on per Brokerage only after setup checks.
8. Backups. Daily database backups by the hosting provider, kept for up to 7 days.
9. Vendor management. Subprocessors bound by written data protection terms (Annex 3).
10. People. Staff confidentiality obligations.

Annex 3: Subprocessors

See site.deal-studio.com/subprocessors, as of the effective date of this DPA.