Data Processing Agreement

2.1 Customer is the Controller (or a Processor acting on behalf of another Controller) of Customer Personal Data; BLOK is the Processor. For limited data BLOK processes for its own purposes — user account administration, billing, security telemetry, and Service improvement as described in the Privacy Policy — BLOK acts as an independent Controller; that processing is outside this DPA except where Applicable Data Protection Law provides otherwise.

2.2 The subject matter, duration, nature and purpose of Processing, the types of Personal Data, and the categories of Data Subjects are set out in Annex I.

3. Processor Obligations

BLOK shall:

1. Process Customer Personal Data only on Customer's documented instructions, unless required by law (in which case BLOK will inform Customer unless legally prohibited). The Agreement, this DPA, and Customer's configuration and use of the Service constitute Customer's instructions.

2. Ensure persons authorized to Process Customer Personal Data are bound by confidentiality obligations.

3. Implement and maintain the technical and organizational measures described in Annex II.

4. Engage Subprocessors only under Section 5.

5. Taking into account the nature of the Processing, assist Customer by appropriate technical and organizational measures in fulfilling Customer's obligation to respond to Data Subject requests (access, rectification, erasure, restriction, portability, objection). The Service provides self-service tools for export, correction, archival, and user anonymization; where a request cannot be fulfilled through the Service, BLOK will provide reasonable assistance at Customer's request. If a Data Subject contacts BLOK directly regarding Customer Personal Data, BLOK will redirect them to Customer.

6. Assist Customer with data protection impact assessments, Personal Data Breach obligations, taking into account the nature of the Processing and the information available to BLOK.

7. At Customer's choice, delete or return all Customer Personal Data after the end of the provision of the Service, and delete existing copies, unless retention is required by law. Deletion is performed through archival followed by deletion or anonymization consistent with Annex II; encrypted backups are purged on their rolling 30-day cycle.

8. Make available to Customer information necessary to demonstrate compliance with this DPA and allow for and contribute to audits under Section 6.

4. Personal Data Breach

BLOK will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will describe, to the extent known, the nature of the breach, categories and approximate numbers of Data Subjects and records affected, likely consequences, and measures taken or proposed. BLOK will cooperate with Customer and take reasonable steps to mitigate and remediate. BLOK's notification is not an acknowledgement of fault or liability.

5. Subprocessors

5.1 Customer provides general authorization for BLOK to engage the Subprocessors listed in Annex III. BLOK will impose data protection obligations on each Subprocessor no less protective than this DPA and remains liable for Subprocessors' performance.

5.2 BLOK will provide notice of intended additions or replacements of Subprocessors at least 30 days in advance. Customer may object on reasonable data protection grounds within 15 days; if the objection cannot be resolved, Customer may terminate the affected portion of the Service with a pro-rata refund of prepaid fees for the terminated portion.

5.3 Certain optional integrations (for example, Lofty and Dotloop CRM connections, Google Workspace connections, social sign-in providers, and optional AI providers disabled by default) are activated only at Customer's or its users' direction. Providers so connected act at Customer's instruction and are not BLOK Subprocessors.

6. Audits

No more than once per 12-month period (except following a Personal Data Breach or an applicable legal requirement), Customer may audit BLOK's compliance with this DPA by (a) reviewing documentation, security summaries, and third-party audit reports or certifications BLOK makes available, and, where these are insufficient, (b) a remote or on-site audit on at least 30 days' notice, during business hours, under confidentiality obligations, at Customer's expense, and without access to other customers' data.

7. CCPA/CPRA Service Provider Terms

To the extent Customer Personal Data includes personal information subject to the CCPA/CPRA, BLOK acts as a "service provider": BLOK will not sell or share the personal information; will not retain, use, or disclose it other than to perform the Service or as permitted by the CCPA; will not combine it with personal information from other sources except as permitted; certifies it understands these restrictions; and will notify Customer if it can no longer meet its obligations. Customer may take reasonable steps to stop and remediate unauthorized use.

8. Liability and Order of Precedence

Each party's liability under this DPA is subject to the limitations of liability in the Agreement, except where prohibited by Applicable Data Protection Law. In case of conflict: this DPA prevails over the Agreement, for the subject matter of the conflict.

Annex I — Description of Processing

Subject matter and duration. Processing of Customer Personal Data to provide the Service for the term of the Agreement plus the wind-down period in Section 3(g).

Nature and purpose. Hosting, storage, transmission, retrieval, synchronization with Customer-connected systems, AI-assisted analysis and generation (chat assistance, document summarization, search embeddings, comparative market analyses, market reports), communication delivery (email, SMS one-time codes, property/report sharing), access control, audit logging, and security monitoring.

Categories of Data Subjects.

• Customer's users (real estate principals, administrators, and agents);

• Customer's clients, leads, and prospective buyers/sellers (including recipients of shared properties and reports);

• Other individuals appearing in content Customer submits (for example, counterparty agents in documents, listing agents in MLS records).

Categories of Personal Data.

• Identification and contact data: names, email addresses, phone numbers, roles, license numbers;

• Business content: contact/lead records, documents, chat messages with the AI assistant, notes, saved properties, reports;

• Transaction-related real estate data associated with identifiable individuals;

• Technical and security data: IP addresses, device/browser information, approximate location from IP, authentication events, audit trails;

• MLS professional credentials (agent/broker identifiers, brokerage details).

Special categories. The Service is not designed for special-category data (racial/ethnic origin, health, etc.) or for government identifiers. Documents uploaded by Customer may incidentally contain sensitive identifiers; the ingestion pipeline automatically detects and masks common sensitive identifiers (national ID numbers, payment card and bank numbers, contact details, names, locations) before content is embedded for search. Customer instructs its users not to submit special-category data.

Frequency. Continuous, for the duration of the Agreement.

Annex II — Technical and Organizational Measures

• Tenant isolation. Logical multi-tenant isolation enforced at the database layer through PostgreSQL row-level security on every tenant-scoped table, with tenant context set per transaction; tenant identifiers are immutable at the identity layer. Cache keys and file-storage paths are tenant-scoped.

• Encryption in transit. TLS 1.2 minimum with strong cipher suites on all public endpoints; TLS 1.3 supported; internal service-to-service calls and database connections use TLS.

• Encryption at rest. All data stores (relational databases, object storage, caches, logs, backups) encrypted with AWS KMS customer-managed keys with automatic key rotation enabled. High-sensitivity records (MLS credentials) additionally encrypted at the application layer with AES-256-GCM. Archived message content encrypted with AES-256.

• Access control and authentication. Managed identity provider (Amazon Cognito) with separate user pools for customer users and platform administrators; 12-character minimum passwords with complexity requirements; multi-factor authentication (TOTP, email OTP, SMS OTP) with per-tenant enforcement options; risk-based adaptive authentication enabled; refresh-token rotation and token revocation enabled; short-lived administrator sessions; role-based access control with configurable module-level permissions; administrator cross-tenant actions individually audit-logged.

• Network and application security. Web application firewall with OWASP managed rule sets, SQL-injection protection, IP reputation filtering, and per-IP rate limiting; databases not publicly accessible; secrets held in AWS Secrets Manager (no hardcoded credentials); parameterized queries and schema validation on all API endpoints.

• Threat detection and monitoring. Amazon GuardDuty threat detection including malware scanning of uploaded files; anomalous-login detection with device fingerprinting, geo-velocity checks, and risk scoring; security alerting to affected users and the security team; CloudWatch monitoring and alarming.

• Audit logging. Tamper-resistant application audit trail capturing actor, action, affected records, before/after values, IP address, and user agent; retention target of 7 years.

• Availability and resilience. Multi-availability-zone database deployment; automated encrypted backups retained 30 days; deletion protection on production databases; blue-green application deployments; health-checked load balancing.

• AI processing. Rex response generation uses third-party AI providers listed in Annex III (OpenAI for United States accounts; OpenRouter and the model hosts it routes to for South African accounts). Search embeddings and ranking run in BLOK's AWS environment via Amazon Bedrock. Providers are engaged on terms that do not permit training on Customer Personal Data. Document content passes through automated PII detection and masking before it is embedded.

• Data minimization at the billing layer. Payment card data is collected directly by Stripe; the platform stores only tokens, identifiers, and one-way hashes.

Annex III — Authorized Subprocessors

The following Subprocessors are authorized under Section 5:

BLOK Group

231 Public Square, Suite 230

Franklin, TN 37064

support@blok.co