Data Processing Agreement

1. Parties & Roles

"Agent" means the RealBio account holder (the realtor, team or brokerage) acting as Data Controller."RealBio" means Doxa Media, acting asData Processor.

This Agreement governs only the personal information RealBio processes on the Agent's behalf, defined in section 2. It does not cover the Agent's own account data, for which RealBio is the Controller in its own right. See section 3b of the Terms.

2. Scope of Processing

Categories of data subject: members of the public who interact with the Agent's RealBio page, namely leads, enquirers, event registrants and visitors.

Categories of personal information: name; email address; phone number; message and enquiry content; stated buying or selling intent, area and budget; AI assistant conversation transcripts; consent evidence (the wording shown, timestamp, IP address, user agent and page URL); and page analytics events tied to a random visitor identifier.

Nature and purpose: collecting lead submissions on the Agent's public pages, storing them, notifying the Agent, generating AI assistant replies, forwarding leads to any CRM the Agent connects, recording consent and withdrawals, and providing page analytics.

Duration: for as long as the Agent's account is active, then as set out in section 9.

Special categories: RealBio does not knowingly collect health, financial account, biometric or government identifier data, and the Agent must not use free-text fields to submit it.

3. RealBio's Obligations

RealBio will:

• process the personal information only on the Agent's documented instructions (the Agent's configuration of the Platform, the features they enable, and this Agreement constituting those instructions), except where law requires otherwise, in which case RealBio will tell the Agent unless legally prohibited;
• never sell, rent, trade or disclose lead data to third parties, and never use it to market to those leads on RealBio's own behalf;
• not use lead data to train artificial intelligence models, whether its own or a third party's;
• ensure personnel with access are bound by confidentiality;
• implement the security measures in section 5;
• assist the Agent, taking into account the nature of the processing, in responding to data subject requests (section 7) and in meeting the Agent's own breach notification and impact assessment duties.

4. Agent's Obligations

The Agent warrants that it has a lawful basis to collect and to contact every individual whose personal information it processes through the Platform, and that its instructions to RealBio will not put RealBio in breach of applicable law. Where the Agent adds contacts manually, imports them, or connects a CRM, the Agent is solely responsible for the provenance and consent status of that data; RealBio has no means of verifying it and captures the Agent's own declaration of the basis for its records.

5. Security Measures

RealBio maintains, at minimum:

• encryption of personal information in transit (TLS) and at rest;
• row-level access controls so that no Agent can read another Agent's leads;
• privileged database credentials held server-side only and never exposed to browsers;
• authentication on every endpoint that reads or writes personal information;
• automated deletion of data past its retention window (section 9);
• a register of security incidents and a documented response procedure.

6. Sub-processors

The Agent gives general authorization for RealBio to engage Sub-processors, subject to the notice and objection rights in section 3c of the Terms. The current list, and what each receives, is published in thePrivacy Policy. RealBio imposes data protection obligations no less protective than these on each Sub-processor and remains liable to the Agent for their performance.

7. Data Subject Requests

Where an individual contacts RealBio directly to withdraw consent, RealBio will action it immediately (marking the record as withdrawn, suppressing further notifications and stopping CRM forwarding), and the Agent must not contact that person again through any channel, no later than 10 business days after the request, as Canada's Anti-Spam Legislation requires.

For requests to access, correct or delete personal information, RealBio will forward the request to the Agent, since the Agent is the Controller, and will provide the technical assistance needed to answer it. The Agent can export the personal information it holds at any time from the dashboard.

8. Breach Notification

RealBio will notify the Agent without undue delay, and in any event within 72 hours, after becoming aware of a breach of security safeguards affecting personal information processed on the Agent's behalf, with the information the Agent reasonably needs to meet its own obligations to individuals and to regulators. RealBio maintains a register of every such breach for at least 24 months, as PIPEDA requires.

9. Retention, Return & Deletion

Lead records are retained while the Agent's account is active. Page analytics are deleted after 14 months and AI assistant conversations 12 months after the last message. On termination, the Agent may export their data from the dashboard; deleting the account deletes the leads, conversations and analytics associated with it, except where law requires a copy to be kept. Records of consent and of its withdrawal are retained with the record they evidence, since deleting the evidence would defeat its purpose.

10. International Transfers

Personal information is processed by Sub-processors located in the United States. RealBio has assessed those transfers, including the residual risk of access by foreign authorities that no contract can eliminate, and the mitigations relied on. That assessment is available to the Agent on request toprivacy@realbio.io.

11. Audit & Information

On reasonable written request, and no more than once a year unless a breach or regulator requires otherwise, RealBio will provide the information reasonably necessary to demonstrate compliance with this Agreement. RealBio may satisfy such a request with documentation, written responses or third-party certifications rather than on-site access, given that on-site inspection would risk exposing other Agents' data.

12. Precedence & Governing Law

If this Agreement conflicts with the Terms of Service on a matter of data protection, this Agreement prevails. It is governed by the laws of the Province of Ontario and the federal laws of Canada applicable there, and is subject to the same limitations of liability as the Terms.

13. Contact

Questions about this Agreement go to Camilo Ramirez,CEO, atprivacy@realbio.io.