Customer Data Processing Addendum

Recitals

I. Mainstay provides Customer with a self-service property-records platform, including document filing, data extraction, property pages, question answering, and Insights (the “Service”), pursuant to the Terms.

II. In connection with the Service, Mainstay will Process Personal Data of Third-Party Individuals contained in documents and other content that Customer uploads, forwards, or otherwise submits to the Service (“Owner Content”).

III. The parties wish to set forth the terms governing Mainstay’s Processing of such Personal Data on Customer’s behalf, to the extent required by Applicable Privacy Laws.

IV. This DPA forms an integral part of, and is incorporated by reference into the Terms.

1. Definitions

The following terms shall have the following meanings in this DPA:

Capitalized terms used but not defined in this DPA have the meanings given to them in the Terms or in Applicable Privacy Laws. For purposes of this DPA:

1.1 “Applicable Privacy Laws” means the U.S. state comprehensive privacy laws applicable to the Processing of Customer Personal Data under this DPA, including (among others) the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020, and its implementing regulations (collectively, as may be amended from time to time, the “CCPA”), to the extent applicable to such Processing, and any successor law to the foregoing. The Service is intended for use in connection with properties located in the United States.

1.2 “Controller” means the natural or legal person which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data. For purposes of this DPA, Customer is the Controller (and, where applicable, the “business” under the CCPA), or is acting on behalf of the owner of the applicable property that is the Controller, in which case Customer represents that such owner has authorized Customer to enter into this DPA and to give the instructions in it on the owner’s behalf.

1.3 “Data Subject” means an identified or identifiable natural person to whom Customer Personal Data relates (each, a “Third-Party Individual”), including tenants, occupants (including minors), guarantors, co-owners, sellers and prior owners, HOA representatives, lender and servicer contacts, property managers, vendors, contractors, inspectors, insurance agents, and individuals appearing in images or forwarded emails.

1.4 “Customer Personal Data” means Personal Data of Third-Party Individuals contained in Owner Content that Mainstay Processes on Customer’s behalf in providing the Service. Customer Personal Data excludes (a) Personal Data relating to Customer or its authorized users, including account, contact, and billing information, for which Mainstay is a controller as described in its Privacy Policy; (b) Service Data (meaning usage, telemetry, diagnostic, and technical data relating to the operation of the Service), provided that data extracted from Owner Content that identifies, or is reasonably capable of being associated with, an individual is Customer Personal Data and not Service Data; and (c) de-identified or Aggregated Data (meaning data that has been de-identified and/or aggregated such that it does not reasonably identify, relate to, or be capable of being associated with a particular individual or household).

1.5 “Personal Data” means any information relating to an identified or identifiable Data Subject, and including “personal information” as defined under the CCPA and other Applicable Privacy Laws.

1.6 “Personal Data Breach” means a breach of security of Mainstay’s systems leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. A Personal Data Breach does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, including pings, port scans, denial-of-service attacks, failed login attempts, and other network attacks on firewalls or networked systems.

1.7 “Process” means any operation or set of operations performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, dissemination, alignment, combination, restriction, erasure, or destruction. “Processing” has the corresponding meaning.

1.8 “Processor” means the natural or legal person which Processes Personal Data on behalf of the Controller. For purposes of this DPA, Mainstay is the Processor (and, where applicable, a “service provider” or “contractor” under the CCPA).

1.9 “Sensitive Personal Data” means (i) categories of personal data, including racial or ethnic origin, religious beliefs, biometric data, genetic data, health data, sexual orientation, and trade-union membership; (ii) personal data of minors; (iii) “sensitive personal information” as defined under the CCPA, including government identifiers (passport, driver’s license, SSN), precise geolocation, financial account credentials, and contents of electronic communications; and (iv) information relating to criminal convictions or offences.

1.10 “Sub-processor” means any third party engaged by Mainstay to Process Customer Personal Data, including cloud hosting and storage providers, OCR and document processing providers, document management systems, AI and large language model providers, email processing providers, analytics and error monitoring providers, customer support tools, and the Brokerage, to the extent a Brokerage receives Customer Personal Data to provide Brokerage Services (as defined in the Terms) to Customer.

2. Scope and roles of the parties

2.1 Roles. The parties acknowledge that, for purposes of this DPA and to the extent Applicable Privacy Laws apply, Customer is the Controller (and “business”) (or is acting on behalf of the property owner that is the Controller, as described in Section 1.2) and Mainstay is the Processor (and “service provider” or “contractor”) of Customer Personal Data.

2.1(a) Customer Obligations. Customer is solely responsible for (a) establishing any lawful basis for, and providing any notices to and obtaining any consents from Data Subjects required for, the Processing of Customer Personal Data contemplated by the Terms and this DPA, including with respect to any Sensitive Personal Data; (b) the accuracy, quality, and lawfulness of Owner Content and the means by which Customer acquired it; and (c) not intentionally submitting Sensitive Personal Data except as needed for the Service and permitted by law, or other data prohibited by the Terms. Customer’s obligations under this Section are in addition to Customer’s representations and indemnification obligations under the Terms.

2.2 Mainstay Independent Processing. Notwithstanding Section 2.1, Mainstay acts as an independent controller with respect to (a) account, contact, and billing information of Customer and its authorized users; (b) Processing for security, fraud prevention, and abuse detection; (c) Processing to comply with Mainstay’s legal obligations; (d) Service Data; and (e) the creation and use of de-identified and Aggregated Data, in each case as described in Mainstay’s Privacy Policy and the Terms. Each party shall comply with Applicable Privacy Laws in its own capacity for such independent Processing.

2.3 Instructions. The subject matter, nature, purpose, duration, types of Personal Data, and categories of Data Subjects are described in Annex I (Description of Processing). The Terms, this DPA, and Customer’s use and configuration of the Service constitute Customer’s complete and final documented instructions to Mainstay. Any additional instructions must be consistent with the Terms and this DPA, and Mainstay may decline them or make them subject to additional fees. Mainstay will inform Customer if it believes an instruction violates Applicable Privacy Laws and may suspend the affected Processing until the instruction is modified or confirmed lawful. Mainstay may Process Customer Personal Data as required by applicable law. Customer instructs Mainstay to make Customer Personal Data available to the applicable Brokerage as described in Section 3.6.

2.4 Compliance. Each party shall comply with its respective obligations under Applicable Privacy Laws. To the extent required by Applicable Privacy Laws, and taking into account the nature of the Processing and the information available to Mainstay, Mainstay shall provide Customer with reasonable cooperation in fulfilling Customer’s obligations, at Customer’s expense to the extent such cooperation goes beyond the self-service functionality of the Service.

3. Processing obligations of Mainstay

3.1 Limitation of Purpose. Mainstay shall Process Customer Personal Data only (a) to provide, maintain, secure, support, and improve the Service; (b) for business purposes permitted under the CCPA regulations, including 11 C.C.R. § 7050, such as building or improving the quality of Mainstay’s services, detecting security incidents, and debugging; (c) to create de-identified and Aggregated Data in accordance with Section 3.5; (d) as described in Section 3.4; and (e) to comply with applicable law.

3.2 No Sale or Sharing. Mainstay shall not (a) sell or share Customer Personal Data within the meaning of the CCPA or any analogous concept under Applicable Privacy Laws; (b) except as permitted by Applicable Privacy Laws, including 11 C.C.R. § 7050, retain, use, or disclose Customer Personal Data outside the direct business relationship between the parties; (c) except as permitted by Applicable Privacy Laws, including 11 C.C.R. § 7050, combine Customer Personal Data with personal information received from another source; or (d) subject to Sections 2.2, 3.1, 3.4, and 3.5, use Customer Personal Data for Mainstay’s own commercial purposes.

3.3 Confidentiality of Personnel. Mainstay shall ensure that personnel and contractors with access to Customer Personal Data are bound by written confidentiality obligations.

3.4 Model Training. Customer authorizes Mainstay to use de-identified Customer Personal Data in training, fine-tuning, testing, and improving Mainstay’s own models and algorithms used to provide and improve Mainstay’s services. Notwithstanding the foregoing, Mainstay will not use Customer Personal Data to build or modify profiles for use in providing services to another business, will take commercially reasonable measures designed to prevent its models from outputting identifiable Customer Personal Data to other customers, and will not permit third-party AI model providers to train their models on Customer Personal Data except as disclosed in Mainstay’s Privacy Policy.

3.5 De-identified and Aggregated Data. Mainstay may de-identify and aggregate Customer Personal Data. Once de-identified or aggregated, such data is not Customer Personal Data and is owned by Mainstay as described in the Terms. Mainstay will (a) take commercially reasonable measures to ensure such data cannot be associated with an individual or household; (b) publicly commit to maintain and use such data in de-identified form and not attempt to re-identify it, except to test the effectiveness of its de-identification as permitted by law; and (c) contractually require any recipients of such data not to re-identify it.

3.6 Affiliated Brokerages. Where the Terms provides for Brokerage Services, Mainstay may make Customer Personal Data available to the applicable Brokerage solely to the extent necessary for the Brokerage to provide Brokerage Services to Customer, verify Customer’s eligibility, and comply with law and multiple listing service rules. Each Brokerage Processes such Customer Personal Data as a Sub-processor in accordance with Section 8. Neither Mainstay nor any Brokerage will use Customer Personal Data to contact Data Subjects, or for marketing, unless Customer separately engages Mainstay or the Brokerage in writing for that purpose.

4. Sensitive personal data

4.1 Sensitive Personal Data. The Service is not designed for the Processing of Sensitive Personal Data, and Customer shall not intentionally submit Sensitive Personal Data except as needed for the Service and permitted by law and the Terms. Mainstay may, but is not obligated to, detect, redact, or delete Sensitive Personal Data. Any Sensitive Personal Data submitted to the Service will be protected by the measures described in Annex II.

4.2 Government and Regulator Disclosures. Mainstay may disclose Customer Personal Data as required by law, regulation, or legal process. Where legally permitted and reasonably practicable, Mainstay will notify Customer of any such required disclosure.

5. Security of processing

5.1 Security Measures. Mainstay shall implement and maintain reasonable technical and organizational measures designed to protect Customer Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, damage, alteration, or disclosure, as described in Annex II (Technical and Organizational Measures).

5.2 Updates. Mainstay may update its security measures from time to time, provided that such updates do not materially reduce the overall protection of Customer Personal Data.

5.3 Employee Training. Mainstay shall provide privacy and information-security training to personnel with access to Customer Personal Data.

6. Personal data breach notification

6.1 Notification. Mainstay shall notify Customer without undue delay after confirming a Personal Data Breach affecting Customer Personal Data, and in any event within the time required by Applicable Privacy Laws. Mainstay will provide notice by email to the email address associated with Customer’s account and/or by message within the Service.

6.2 Content of Notice. To the extent known and reasonably available to Mainstay, which information may be provided in phases, each notice under Section 6.1 shall (a) describe the nature of the Personal Data Breach; (b) identify the likely consequences of the Personal Data Breach; (c) describe the measures taken or proposed to address the Personal Data Breach; and (d) provide a point of contact at Mainstay for further information.

6.3 Cooperation. Mainstay shall provide reasonable cooperation to Customer in connection with a Personal Data Breach. Customer is responsible for any notifications to regulators or Data Subjects required of Customer under Applicable Privacy Laws; provided that Mainstay may, at its option and where permitted by law, provide such notifications on Customer’s behalf.

6.4 No Admissions. Notification of a Personal Data Breach shall not be construed as an acknowledgement by either party of fault or liability.

7. International data transfers

7.1 Locations. Customer authorizes Mainstay and its Sub-processors to Process Customer Personal Data in the United States and in any other country in which Mainstay or its Sub-processors operate. Mainstay will implement transfer safeguards to the extent required by Applicable Privacy Laws.

7.2 Transfer Mechanisms. If a transfer mechanism is required under Applicable Privacy Laws for any transfer of Customer Personal Data, Mainstay may rely on any lawful transfer mechanism, and the parties will cooperate in good faith to document it.

7.3 Other Jurisdictions. For transfers from any other jurisdiction requiring a lawful transfer mechanism, the parties shall cooperate in good faith to the extent reasonably necessary to comply with Applicable Privacy Laws.

8. Sub-processors

8.1 Authorization. Customer grants Mainstay general authorization to engage Sub-processors, including AI model providers, to Process Customer Personal Data, subject to this Section 8. Mainstay maintains a list of its Sub-processors at Annex III.

8.2 Notice of Changes. Mainstay will provide notice of any new Sub-processor by updating the list and/or by other affirmative communication to Customers at least five 5 days before the new Sub-processor begins Processing Customer Personal Data, except where an urgent replacement is reasonably necessary.

8.3 Right to Object. Customer may object to a new Sub-processor on reasonable grounds related to data protection by notifying Mainstay before the Sub-processor begins Processing. The parties will discuss the objection in good faith. If the objection is not resolved, Customer’s sole and exclusive remedy is to stop using the Service and terminate the Terms.

8.4 Flow-Down. Mainstay shall enter into written terms with each Sub-processor providing a level of protection appropriate to the Processing and substantially similar to this DPA. Mainstay shall be responsible for its Sub-processors to the same extent it is responsible for its own performance under this DPA, subject to the limitations of liability in the Terms.

8.5 Initial List. Customer approves the Sub-processors identified in Annex III as of the date Customer accepts the Terms and this DPA.

9. Data subject rights

9.1 Cooperation. Taking into account the nature of the Processing, Mainstay shall reasonably assist Customer in responding to Data Subject requests under Applicable Privacy Laws.

9.2 Requests to Mainstay. If Mainstay receives a request directly from a Data Subject relating to Customer Personal Data, Mainstay may direct the requester to Customer. Mainstay is not responsible for responding to such requests.

9.3 Fees. Mainstay may charge Customer a reasonable fee for assistance under this Section 9 that goes beyond the self-service functionality of the Service.

10. Retention and deletion

10.1 Retention. Mainstay retains Customer Personal Data during the term of the Terms. Customer may export documents through the Service or by request to Mainstay, and may delete documents or request deletion of its account, at any time before termination.

10.2 Deletion After Termination. Following termination of the Terms or deletion of Customer’s account, Mainstay will delete or de-identify Customer Personal Data within 90 days, except for (a) copies retained in backup systems until overwritten in the ordinary course, (b) information we must retain to comply with law or resolve disputes, and (c) Aggregated Data, which is not subject to deletion.

10.3 Certification. Mainstay will provide written certification of deletion only upon Customer’s request where required by Applicable Privacy Laws. Any retained Customer Personal Data remains subject to the confidentiality and security obligations of this DPA.

11. Audits and inspections

11.1 Audit Right. Mainstay shall satisfy any audit obligations under Applicable Privacy Laws by providing to Customer, no more than once per calendar year upon written request, a summary of its security measures and written responses to a reasonable security questionnaire (and third-party audit reports, when available). An on-site or remote inspection is permitted only where required by Applicable Privacy Laws or a competent regulator, upon at least thirty (30) days’ prior written notice, during Mainstay’s normal business hours, subject to appropriate confidentiality obligations, and at Customer’s expense.

11.2 Scope. Any audit shall be limited in scope to verifying Mainstay’s compliance with this DPA. Mainstay may redact or withhold (a) data of other customers; and (b) Mainstay’s proprietary, commercially sensitive, or security-sensitive information. All audit information is Mainstay’s confidential information.

11.3 Cost. Customer shall bear all costs of any audit, including Mainstay’s reasonable costs of supporting it.

12. Data protection impact assessments

12.1 Cooperation. To the extent required by Applicable Privacy Laws and where the information is not otherwise available to Customer, Mainstay shall provide reasonable information to assist Customer in conducting any required data protection or risk assessment, at Customer’s expense.

13. CCPA service provider provisions

13.1 Service Provider Status. The parties acknowledge that, with respect to Customer Personal Data subject to the CCPA, Mainstay is a “service provider” to Customer. Mainstay shall comply with applicable obligations of a service provider under the CCPA, including 11 C.C.R. § 7051, and shall provide the same level of privacy protection as is required of businesses by the CCPA.

13.2 Restrictions. Except as permitted by the CCPA and its regulations, including as described in Sections 3.1, 3.4, and 3.5 herein, Mainstay shall not (a) sell or share Customer Personal Data; (b) retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified in the Terms and this DPA; (c) retain, use, or disclose Customer Personal Data outside the direct business relationship between the parties; or (d) combine Customer Personal Data with personal information that Mainstay receives from another source or collects from its own interactions with Data Subjects.

13.2(a) Additional CCPA Terms. Mainstay will notify Customer if it determines that it can no longer meet its obligations under the CCPA. Upon notice to Mainstay, Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data.

13.3 Certification. Mainstay certifies that it understands and shall comply with the restrictions in this Section 13.

13.4 Other U.S. State Laws. Mainstay shall comply with analogous processor obligations under other Applicable Privacy Laws as they apply to Customer Personal Data, including providing reasonable cooperation in responding to consumer rights requests as described in Section 9.

14. Liability

14.1 Limitations. Each party’s liability arising out of or related to this DPA is subject to the exclusions and limitations of liability set forth in the Terms (Section 19), and the Terms and this DPA are subject to a single aggregate cap on liability. Nothing in this DPA limits any liability that cannot be limited under applicable law.

15. Term and termination

15.1 Term. This DPA takes effect when Customer accepts the Terms and this DPA and continues in force for so long as Mainstay Processes Customer Personal Data on Customer’s behalf.

15.2 Survival. The provisions of this DPA that by their nature should survive termination shall survive, including Sections 3.5 (De-identified and Aggregated Data), 5 (Security, as to retained data), 10 (Retention and Deletion), 13 (CCPA), 14 (Liability), and 15 (Term and Termination).

16. General provisions

16.1 Order of Precedence. In the event of any conflict between this DPA and the Terms, this DPA shall prevail with respect to the Processing of Customer Personal Data, and the Terms shall prevail in all other respects.

16.2 Governing Law and Disputes. This DPA is governed by the governing law, dispute resolution, arbitration, and class action waiver provisions of the Terms (Sections 21 and 22).

16.3 Severance. If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect, and the parties shall negotiate in good faith to replace the invalid provision with one that achieves, to the extent permitted by law, its original commercial intent.

16.4 Entire Agreement. This DPA, together with the Terms and the Annexes attached hereto, constitute the entire agreement of the parties with respect to the Processing of Customer Personal Data and supersede any prior agreements, understandings, or representations on the subject matter.

16.5 Amendments. Mainstay may update this DPA in accordance with the terms of the Terms or as required by law. Updates to Annex III (Sub-processors) will be made in accordance with Section 8. However, any update that materially expands Mainstay’s permitted uses of Customer Personal Data already submitted will apply to that data only if Customer affirmatively agrees to it.

16.6 Assignment. Mainstay may assign this DPA together with the Terms. Customer may not assign this DPA without Mainstay’s prior written consent. Any purported assignment in violation of this Section 16.6 shall be void.

16.7 Notices. Mainstay may provide notices to Customer by email to the address associated with Customer’s account or by message within the Service. Notices to Mainstay shall be sent to the contacts in Annex IV (Notices).

16.8 Electronic Signatures. Customer’s electronic acceptance of the Terms constitutes its execution of this DPA, and no separate signature is required.

Annex I. Description of processing

This Annex describes the Processing carried out by Mainstay on behalf of Customer under this DPA.

A. List of Parties

B. Description of Transfer

C. Competent Supervisory Authority

Not applicable, except to the extent required by Applicable Privacy Laws.

Annex II. Technical and organizational measures

Mainstay implements and maintains the following baseline technical and organizational measures to protect Customer Personal Data:

1. Information Security Governance

• Written information security policy reviewed periodically.
• Designated individual responsible for information security.
• Documented incident response plan.

2. Personnel Security

• Confidentiality obligations covering all personnel.
• Privacy and security training for personnel at onboarding and periodically thereafter.
• Offboarding processes including timely revocation of access.

3. Access Controls

• Role-based access control with access granted on a need-to-know, least-privilege basis.
• Multi-factor authentication for administrative and production access.
• Unique user accounts; no shared credentials.
• Periodic review of access rights.
• Automated session timeout for inactive sessions.

4. Data Protection

• Encryption of Customer Personal Data at rest using AES-256 or equivalent, which may be provided by Mainstay’s cloud hosting provider.
• Encryption of Customer Personal Data in transit using TLS 1.2 or higher.
• Secure deletion procedures for digital media.

5. System Security

• Up-to-date anti-malware and endpoint protection on systems handling Customer Personal Data.
• Timely application of security patches.
• Network segmentation and firewalls protecting systems handling Personal Data.
• Logging of production access, with logs retained for 90 days.

6. Physical Security

• Physical security of data centers is provided by Mainstay’s cloud hosting providers.
• Secure storage of physical files (locked cabinets or rooms).
• Clean-desk policy for sensitive materials.

7. Backup and Recovery

• Regular backups of systems containing Customer Personal Data.
• Encrypted backups.
• Documented disaster recovery and business continuity plan tested at least annually.

8. Sub-processor Management

• Sub-processor due diligence.
• Written data-protection terms with Sub-processors as described in Section 8.4.
• Periodic review of Sub-processor security posture.

9. Audit, Certification, and Assurance

Mainstay’s current third-party attestations or certifications:

Annex III. Sub-processors

Mainstay maintains the current list of its Sub-processors below. Mainstay engages the following categories of Sub-processors to Process Customer Personal Data.

To be provided.

Annex IV. Notices

Notices under this DPA, including Personal Data Breach notifications, shall be sent to the contacts below.

Mainstay Contacts

Customer Contacts