Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms between the Client and Placy that references or otherwise incorporates this DPA.

Placy Ltd acts as Processor, and the Client (as defined in the Terms) acts as Controller or as processor on behalf of a third-party controller.

Processor and the Controller each separately referred to as a “Party”, and jointly as the “Parties”.

BACKGROUND

A. Pursuant to the Terms, Processor grants the Controller access to the Service, and the Controller agrees to comply with the Terms.

B. In providing the Service, Processor will from time to time be provided with or have access to and otherwise process on behalf of the Controller, with Personal Data within the meaning of the Regulation (EU) 2016/679 (‘’GDPR’’) and/or other applicable EU and Cyprus data privacy laws and regulations as these are amended, restated or replaced from time to time (together referred to as the “Data Protection Regulations”).

C. In processing Personal Data on behalf of the Controller according to section B above, Processor may from time-to-time act as a data Processor and the Controller as a data Controller within the meaning of the Data Protection Regulations.

D. The Processor declares that when acting in its capacity as a data processor within the meaning of the Data Protection Regulations, it has the means to provide sufficient guarantees and implement appropriate technical and organisational measures in such a manner that any processing executed in the framework of this DPA shall meet the requirements of the Data Protection Regulations and ensure the protection of the rights of the data subjects.

E. This DPA sets out the terms and conditions for such processing of the Personal Data by Processor on behalf of the Controller with the aim to ensure that the Parties comply with the Data Protection Regulations.

1. SCOPE

1.1. To the extent that in the framework of rendering the Service pursuant to the Terms, the Processor acts as a Data Processor within the meaning of the Data Protection Regulations, this DPA shall apply to all processed Personal Data from the date of receipt thereof and/or access thereto in connection and for the purpose of providing the Service under the Terms.

1.2. The types of Personal Data processed, and the categories of Data Subjects concerned are further specified in Appendix 1.

1.3. In consideration of the undertakings provided by the Processor, the Controller instructs the Processor to process the Personal Data on behalf of the Controller and the Processor agrees to process the Personal Data, subject to the terms and conditions of this DPA and in compliance with the Data Protection Regulations.

1.4. The obligations stipulated herein shall not release the Parties from other applicable obligations under the Data Protection Regulations.

1.5. For the purposes of this DPA, the terms and definitions used by or otherwise referred to in the GDPR shall apply.

1.6. “Terms” means the Terms between the Parties in regards to the Service. Capitalised terms not defined in this DPA have the meaning given in the Terms.

2. CONTROLLER RIGHTS AND OBLIGATIONS

2.1. The Controller shall:

(a) comply at all times with the Data Protection Regulations and shall demonstrate such compliance as required by the Data Protection Regulations, as the responsible data controller for the processing of Personal Data;

(b) without prejudice to the generality of clause 2.1.(a), ensure that the appropriate legal grounds are in place enabling lawful processing of the Personal Data by the Processor for the duration and purposes of the Terms and this DPA;

(c) give instructions and determine the purposes and means of the processing of Personal Data by the Processor. Such instructions shall be binding on Processor but Processor will not meet any Controller instructions which are contrary to this DPA and or the Data Protection Regulations;

(d) at all times retain the control and authority over the Personal Data and shall be primarily responsible for handling and responding to requests made by Data Subjects in respect to the exercise of their rights.; and

(e) be responsible for filling-out and regularly updating Appendix 1, and indicating therein all types of Personal Data, and all categories of Data Subjects involved with the data-processing under the Terms.

2.2. In the event where the Controller is in breach of its aforesaid obligations the Processor shall have the right to immediately terminate this DPA and the Terms.

3. PROCESSOR RIGHTS AND OBLIGATIONS

3.1. Processor shall process Personal Data in the framework of the Terms and in accordance with this DPA and shall thus:

(a) process Personal Data only in accordance with the documented instructions of the Controller (unless required to act otherwise pursuant to Union or Member State law to which the Processor is subject in which case it shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest). However, such instructions must always be in line with the respective rights and obligations of the Parties as set out in the Data Protection Regulations and this DPA;

(b) Immediately inform the Controller if, in its opinion, an instruction infringes the Data Protection Regulations or other Union or Member State data protection provisions;

(c) ensure that persons authorised by Processor to process the Personal Data on behalf of the Controller, in particular Processor’s employees as well as any Sub-processors or their employees, shall have committed themselves to confidentiality or shall be under an appropriate statutory obligation of confidentiality;

(d) not engage another processor without prior specific or general written authorisation of the Controller and in the case of a general written authorisation it shall inform the Controller of any intended changes concerning the addition or replacement of other processors, thereby giving the Controller the opportunity to object to such changes;

(e) reasonably assist the Controller by appropriate technical and organisational measures in its response to meet requests from Data Subjects and otherwise comply with its obligations as controller under the Data Protection Regulations including without limitation its obligations pursuant to articles 32 to 36 of the GDPR. In this framework provide the Controller with any necessary and available information that may assist the Controller with its obligation to carry out a data protection impact assessment as may be required by article 35 of the GDPR and prior consultation as may be required by article 36 of the GDPR;

(f) upon request in writing from the Controller, make available to it information in order to demonstrate compliance with the obligations of Data Processors laid down in article 28 of the GDPR;

(g) take all measures and comply with all obligations provided under clauses 4, 5 and 6 of this DPA;

(h) allow for and contribute to audits conducted by the Controller as set forth in clause 9 of this DPA;

(i) not use Personal Data for any purposes other than those specified in this DPA and the Terms;

(j) Maintain records related to the activities of processing of Personal Data carried out on behalf of the Controller in accordance with Article 30(2) of the GDPR.

3.2. This DPA shall not prevent Processor or any Sub-Processor in any way from processing the Personal Data as required by law, regulation or by a competent court or supervisory authority. In case a supervisory authority or a competent court makes a request concerning the Personal Data, including a request for blocking, deleting, amending the Personal Data, delivering them any information or executing any other actions, Processor shall, without undue delay, inform the Controller of all such requests prior to any response or other action concerning the Personal Data.

4. DATA SECURITY

4.1. The Parties shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.

4.2. The Controller shall assess possible risk to the rights and freedoms of natural persons in processing of Personal Data and implement measures to minimise such risk such as and as appropriate:

(a) the anonymization and/or encryption of Personal Data;

(b) the ability to ensure confidentiality, integrity, availability and resilience of processing systems and Service;

(c) the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;

(d) a process for regular testing, inspecting and evaluating the technical and organisational measures for ensuring the security of the processing.

4.3. According to Article 32 of the GDPR, the Processor shall also – independently from the Controller – evaluate the risks to the rights and freedoms of natural persons inherent in the processing activity entrusted to it by the Controller, and implement the measures to mitigate those risks. To this end, the Controller shall provide the Processor with all information necessary for identification and assessment of such risk.

4.4. Furthermore, the Processor shall help the Controller in ensuring compliance with its obligations pursuant to article 32 of the GDPR, inter alia by providing the Controller with information on technical and organisational measures which have already been implemented by the Processor under the said article together with all other information necessary for the Controller to comply with its relevant obligation.

4.5. If, according to the assessment made by the Controller, the mitigation of the identified risks requires further measures to be implemented by the Processor, the Parties shall agree such measures in good faith. Any measures beyond those already implemented by the Processor shall be implemented at the Controller’s cost. The Processor shall make available to the Controller all information necessary to demonstrate compliance with this clause 4.5.

5. PERSONAL DATA BREACH NOTIFICATION

5.1. In the event of a ‘Personal Data Breach’, i.e., a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to the Personal Data, the Processor shall without undue delay ensure that the Controller is duly notified in writing.

5.2. The Personal Data Breach notification shall contain at least the following:

(a) a description of the nature of the Personal Data Breach including, the categories and approximate number of Data Subjects concerned and the categories and approximate number of data records concerned;

(b) a description of likely consequences of the Personal Data Breach;

(c) a description of the measures taken to address the Personal Data Breach and to mitigate its possible adverse effects; and

(d) contact details of Processor’s Data Protection Officer or other contact point where more information can be obtained.

5.3. Where, and in so far as it is not possible to provide all these information at the same time, the information may be provided in phases without undue delay. In such cases when certain information cannot be provided by Processor to the Controller at all, Processor will inform the Controller accordingly.

5.4. Processor shall document all Personal Data Breaches and shall have those records of Personal Data Breaches available to the Controller upon request.

5.5. Processor shall take appropriate steps to protect the Personal Data after having become aware of a Personal Data Breach in order to limit any possible detrimental effect to the Data Subjects. Processor will cooperate with the Controller to respond to the Personal Data Breach.

6. SUB-PROCESSORS (SUBCONTRACTORS)

6.1. ‘Sub-Processor’ shall mean any further processor that is engaged by Processor as a subcontractor for the performance of the Service or parts of the Service provided that such Sub-Processor has access to the Personal Data of the Controller when carrying out its contractual obligations.

6.2. The Controller hereby grants the Processor general written authorisation to engage Sub-Processors for the processing of Personal Data within the scope of the Terms, subject to the conditions of this clause 6.

6.3. Processor shall make available to the Controller information regarding the Sub-Processors, that includes the names and country locations of those Sub-Processors, alongside with the scope of Service they provide for the Processor.

6.4. In case of any additions or change to the information provided to the Controller under clause 6.3 above, Processor shall notify the Controller accordingly. Unless the Controller objects in writing within 15 working days of being informed about Processor’s use of a new Sub-Processor, Processor may apply to the new Sub-Processor for the indicated data processing activities. If the Controller made a reasonable objection within the given timeline, Processor will use reasonable efforts to change the sub-contracted Service to avoid processing of the Personal Data by the “objected-to” new Sub-Processor.

6.5. Processor is obliged to choose such Sub-Processors diligently and regularly monitor their performance for the provision of the Service.

6.6. Processor shall pass on to Sub-Processors the obligations of Processor under this DPA to the extent applicable to the subcontracted Service, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the Data Protection Regulations. Where such other processor fails to fulfil its data protection obligations, the Processor shall remain fully liable to the Controller for the performance of that other processor's obligations.

7. TRANSFER OF PERSONAL DATA

7.1. The Controller authorises the Processor and its Sub-Processors to transfer Personal Data outside the European Economic Area to the extent necessary to provide the Service, provided that each transfer complies with Chapter V of the GDPR, including by relying on an adequacy decision (such as the EU-US Data Privacy Framework, where the recipient is certified) or the Standard Contractual Clauses adopted by the European Commission.

7.2. If Personal Data must be transferred to third countries or international organisations in accordance with European Union or Member State law which must be complied with by the Processor although the Controller has not given instructions to do this to the Processor, the Processor shall notify the Controller of the afore-mentioned legal requirement prior to transfer of data unless such legal act prohibits communication of such information.

8. RETURN / DESTRUCTION OF PERSONAL DATA

8.1. Upon termination or expiry of the Terms, the Processor shall anonymize and delete all Personal Data it holds on behalf of the Controller within thirty (30) calendar days, unless the Controller instructs the Processor in writing, within that period, to return such Personal Data to the Controller or to a third party designated by the Controller, in which case the Processor shall return such Personal Data and then delete any remaining copies. This clause shall not apply to the extent that Union or Member State law requires continued storage of the Personal Data..

8.2.Upon the Controller’s request, Processor shall confirm to the Controller in writing that the return or destruction / deletion of Personal Data has been accomplished.

9. AUDITS

9.1 The Processor shall make available to the Controller all information necessary to demonstrate compliance with Article 28 of the GDPR and this DPA.

9.2 Where such information is reasonably insufficient, the Controller, or an independent auditor bound by confidentiality and not a competitor of the Processor, may audit the Processor at the Controller’s cost, on at least 30 days’ written notice, during normal business hours, and no more than once in any 12-month period, unless required by a supervisory authority or following a Personal Data Breach. Audits shall be limited to the Processor’s compliance with this DPA and shall not extend to data of other customers.

9.3 In respect of Sub-Processors, the Processor’s obligations under this clause 9 are satisfied by making available the audit reports, certifications or other information made available by the relevant Sub-Processor.

10. MISCELLANEOUS

10.1 This DPA takes effect on the effective date of the Terms and remains in force until the Terms end and all Personal Data has been returned or deleted in accordance with clause 8.

10.2 Appendix 1 (Description of the Processing) forms an integral part of this DPA.

10.3 This DPA forms part of the Terms. In the event of any inconsistency between this DPA and the Terms, this DPA shall prevail in relation to the Parties’ data protection obligations. Liability, governing law and dispute resolution are governed exclusively by the Terms.

APPENDIX 1

A. LIST OF PARTIES

B. Subject matter and purpose: Provision of the Service to the Controller, including storing and analysing the Content and generating Output, and supporting and securing the Service, as described in the Terms.

C. Nature of the processing: Collection, storage, organisation, retrieval, analysis, generation of Output using the AI Technology, disclosure to Sub-processors, export, and deletion or anonymisation.

D. Duration and frequency: Continuous, for the duration of the Controllers use of the Service.

E. Categories of data subjects: Prospective and existing buyers, sellers, tenants and landlords; leads, enquirers and other contacts of the Controller; the Controller’ personnel who use the Service; and any other individuals whose personal data is contained in the Content.

F. Categories of personal data:

G. Special categories of personal data: None. The Controller shall not upload special categories of personal data or criminal offence data to the Service.

H. Retention: As set out in clause 8 of this DPA.

I. Sub-Processors: Sub-Processors process personal data for the same subject matter, nature, purposes and duration as above.

Last updated: 20 October 2026