Data Processing Addendum

This Data Processing Addendum (the “DPA”) is entered into between myAbode Inc., a corporation with its offices at 468 King St W, Toronto, ON M5V 1L8, Canada (“myAbode”, referred to in the Agreement as the “Provider”), and the real estate brokerage identified in the Agreement (as defined below) (the “Customer”, referred to in the Agreement as the “Brokerage”), each a “Party” and together the “Parties”.

This DPA forms part of the Master Subscription and Services Agreement between myAbode and the Customer governing the Customer’s use of the myAbode platform, including the myAbode Deals platform (the “Agreement” and the “Platform”, respectively), and is Schedule B to it. By entering into the Agreement or using the Platform, the Customer accepts this DPA, and the individual accepting it on the Customer’s behalf represents that they have authority to bind the Customer. Capitalized terms not defined in this DPA have the meanings given to them in the Agreement.

1. Definitions
In this DPA:

“Anonymized Data” means information that has been de-identified, aggregated or otherwise modified so that there is no serious possibility that it could be used, alone or in combination with other information, to identify an individual, and that therefore is not Personal Information under Applicable Privacy Laws.

“Applicable Privacy Laws” means all Canadian federal and provincial laws relating to the protection of Personal Information under this DPA, including the Personal Information Protection and Electronic Documents Act (Canada) (“PIPEDA”) and, where and to the extent applicable, the Personal Information Protection Act (Alberta), the Personal Information Protection Act (British Columbia) and the Act respecting the protection of personal information in the private sector (Québec) (the “Québec Act”), each as amended from time to time.

“Authorized Purposes” means the purposes set out in Section 4.2.

“Breach of Security Safeguards” means the loss of, unauthorized access to or unauthorized disclosure of Personal Information resulting from a breach of the security safeguards of myAbode or its Sub-processors, or from a failure to establish those safeguards, as that term is used in PIPEDA (and includes a “confidentiality incident” under the Québec Act where that Act applies).

“Brokerage Clients” means the Customer’s clients and any other individual involved in or named in a transaction managed through the Platform, such as buyers, sellers, landlords, tenants, lawyers and other agents.

“Personal Information” means information about an identified or identifiable individual that myAbode Processes on behalf of the Customer under the Agreement, being information about Brokerage Clients and the transaction and commission information of Platform Users, as further described in Annex 1.

“Platform Users” means the Customer’s agents, brokers, administrators, staff and other individuals authorized by the Customer to access the Platform, including those who sign up for, manage or pay for the Customer’s subscription.

“Process” and “Processing” mean any operation performed on Personal Information, including collection, recording, storage, access, use, analysis, transfer, disclosure, retention and deletion.

“Sensitive Personal Information” means government-issued identification numbers, financial and banking information, anti-money-laundering and beneficial-ownership information, health information, and any other Personal Information that is sensitive or subject to heightened requirements under Applicable Privacy Laws.

“Sub-processor” means any third party engaged by myAbode that Processes Personal Information on myAbode’s behalf.

2. Scope and Roles of the Parties
2.1 Scope. This DPA applies only to Personal Information that myAbode Processes as the Customer’s service provider. It does not apply to personal information for which myAbode is itself accountable, as described in the Privacy Policy, or to Anonymized Data.

2.2 Allocation of roles. For the purposes of Applicable Privacy Laws, the Parties agree that: (a) the Customer is the organization that has Personal Information in its custody or under its control, and is accountable for it under Applicable Privacy Laws; and (b) myAbode acts as the Customer’s service provider, to which the Customer transfers Personal Information for Processing, and Processes it on the Customer’s behalf only as set out in this DPA.

3. Customer Obligations
3.1 Compliance. The Customer is solely responsible for its compliance with Applicable Privacy Laws and with all other laws and professional rules that apply to it, including the Trust in Real Estate Services Act, 2002 (Ontario) (or equivalent legislation in the Customer’s province), the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (Canada) and applicable FINTRAC requirements.

3.2 Consent and notice. The Customer represents, warrants and covenants that it has obtained, and will maintain, all consents (including express consent where required for Sensitive Personal Information) and has provided all notices required under Applicable Privacy Laws to permit: (a) the collection of Personal Information and its entry into, and Processing through, the Platform; (b) the transfer of Personal Information to myAbode and its Sub-processors, including outside Canada as described in Section 6; and (c) the Processing of Personal Information by myAbode for the Authorized Purposes. The Customer is responsible for informing individuals, including Brokerage Clients, of its use of the Platform and service providers.

3.3 Lawful instructions and use. The Customer shall ensure that its instructions to myAbode, its configuration of the Platform, and the Personal Information it or its Platform Users upload or submit to the Platform, comply with Applicable Privacy Laws, and that it has the right to provide that Personal Information to myAbode. The Customer shall limit the Personal Information it submits to what is necessary for the purposes for which it uses the Platform, and is responsible for the accuracy and completeness of that information.

3.4 Platform Users, integrations and credentials. The Customer is responsible for the acts and omissions of its Platform Users, for managing Platform User access and permissions, for the security of Platform User credentials, and for any API keys it issues or third-party systems it connects to the Platform. Personal Information disclosed to such third-party systems at the Customer’s direction is disclosed on the Customer’s behalf and is outside myAbode’s responsibility.

3.5 Affiliated brokerages and offices. Where the Customer permits its affiliates, franchisees, branch offices or teams to use the Platform under the Agreement, the Customer enters into this DPA on their behalf, is responsible for their compliance with it, and remains the sole point of contact with myAbode for all communications under this DPA.

3.6 Requests, complaints and regulators. The Customer is responsible for responding to access, correction and other requests and complaints from individuals, and for communications with privacy regulators, relating to Personal Information, with myAbode’s assistance as set out in Sections 7 and 8.

4. myAbode Obligations
4.1 Instructions. myAbode shall Process Personal Information only for the Authorized Purposes and in accordance with this DPA, unless applicable law requires different Processing, in which case myAbode shall, where legally permitted, inform the Customer of that requirement. The Agreement, this DPA and the Customer's configuration and use of the Platform constitute the Customer's complete instructions; any additional or different instructions require the Parties' prior written agreement.

4.2 Authorized Purposes. The Customer authorizes and instructs myAbode to Process Personal Information for the following purposes: (a) providing, operating, maintaining and supporting the Platform and the services under the Agreement, including hosting, storage, backup, email handling, electronic signatures, workflow automation and the AI features of the Platform (such as automated reading and classification of documents and email, and the AI assistant); (b) securing the Platform, and detecting, preventing and investigating fraud, abuse, security incidents and technical issues; (c) keeping records of AI processing and other audit-trail records for service-quality, troubleshooting, audit and dispute-resolution purposes; (d) using a limited set of records of AI processing, reviewers’ corrections and transaction documents to test and evaluate the accuracy and quality of the Platform’s document-reading and related features and to adjust prompts, instructions and settings, but not to train or fine-tune any AI model, limited to what is reasonably necessary for that purpose and protected by safeguards appropriate to its sensitivity; (e) creating Anonymized Data, which myAbode may use for any lawful purpose, including analytics and improving its products and services, provided that myAbode shall not attempt to re-identify any individual from Anonymized Data; (f) transmitting Personal Information to, or receiving it from, third parties at the Customer’s direction or through integrations the Customer enables; and (g) complying with applicable law and binding orders of competent authorities, subject to Section 11.

4.3 AI. The AI features of the Platform are inherent to the services, and their use does not require any further approval by the Customer. Outputs of the AI features are provided to assist Platform Users; the Customer and its Platform Users remain responsible for reviewing them and for all decisions made in connection with a transaction.

4.4 Confidentiality. myAbode shall ensure that its employees and contractors who are authorized to Process Personal Information are bound by confidentiality obligations through their employment or engagement terms, and have access only to the extent necessary for the Authorized Purposes.

4.5 Security safeguards. myAbode shall implement and maintain security safeguards appropriate to the sensitivity of the Personal Information, including the measures described in Annex 2. myAbode may update those measures from time to time, provided that the overall level of protection is not materially reduced. The Customer acknowledges that no security measures can eliminate all risk, and that it has assessed the measures described in Annex 2 as appropriate for its use of the Platform.

4.6 No sale. myAbode shall not sell Personal Information, or disclose it to third parties except as permitted by this DPA.

5. Sub-processors
5.1 Authorization. The Customer grants myAbode general written authorization to engage the Sub-processors listed at Annex 3 at the end (the “Sub-processor List”), which myAbode uses to Process Personal Information as of the effective date of this DPA, and to engage new or replacement Sub-processors in accordance with Section 5.2.

5.2 Changes. myAbode may add or replace Sub-processors by updating the Sub-processor List and giving the Customer notice (which may be by email to the Customer’s administrator or through the Platform) at least ten (10) days before the new Sub-processor begins Processing Personal Information, except where an urgent replacement is necessary for security or continuity of the services, in which case notice shall be given as soon as practicable. The Customer may object in writing, on reasonable grounds relating to the protection of Personal Information, within that notice period. The Parties shall discuss the objection in good faith; if they cannot resolve it within thirty (30) days, the Customer may, as its sole and exclusive remedy, terminate the affected services on written notice. Fees accrued up to the date of termination remain payable. If the Customer does not object within the notice period, the new Sub-processor is deemed approved. While an objection is being resolved, myAbode may suspend the Processing of the affected Personal Information by, or the features that depend on, the objected-to Sub-processor. Termination under this Section 5.2 does not entitle the Customer to any refund or other claim against myAbode.

5.3 Sub-processor terms. myAbode shall engage each Sub-processor under a written contract that requires it to protect Personal Information to a standard comparable to that required of myAbode under this DPA, having regard to the nature of the Sub-processor’s services. myAbode is responsible for the performance of its Sub-processors’ obligations to the same extent as for its own, subject to Section 12.

6. Processing Outside Canada
6.1 Authorization. The Customer acknowledges and authorizes that myAbode and its Sub-processors may Process Personal Information outside Canada, including in the United States and the European Union, as described in the Sub-processor List, and in any other jurisdiction notified under Section 5.2. myAbode’s primary data storage for the Platform is located in Canada.

6.2 Comparable protection. myAbode shall use contractual and other means to ensure that Personal Information Processed outside Canada receives a level of protection comparable to that required by this DPA. The Customer acknowledges that Personal Information Processed in another jurisdiction is subject to the laws of that jurisdiction and may be accessible to its courts, law enforcement and national security authorities.

7. Assistance with Individuals’ Requests
7.1 If myAbode receives a request from an individual to access, correct or otherwise exercise rights in respect of Personal Information, myAbode shall refer the request to the Customer within seven (7) business days and shall not respond to it except to acknowledge receipt and direct the individual to the Customer, unless the Customer instructs otherwise or applicable law requires. myAbode may also direct the individual to the Customer’s account administrator or to any self-service features that may be available in the Platform. Taking into account the nature of the Processing, myAbode shall provide reasonable assistance to enable the Customer to respond to such requests within the time limits required by Applicable Privacy Laws, including through the functionality of the Platform where available.

8. Breaches of Security Safeguards
8.1 Notice. myAbode shall notify the Customer without undue delay, and in any event within forty-eight (48) hours, after myAbode becomes aware that a Breach of Security Safeguards affecting Personal Information has occurred. The notice shall include the information then reasonably available to myAbode about the breach, which may be provided in stages. myAbode shall take the steps it considers reasonable to contain the breach and reduce the risk of harm.

8.2 Reporting. The Customer, as the organization in control of the Personal Information, is responsible for determining whether a Breach of Security Safeguards creates a real risk of significant harm to any individual, and for any report to the Office of the Privacy Commissioner of Canada or any other regulator, and any notification to individuals or other organizations, required under Applicable Privacy Laws. myAbode shall provide reasonable cooperation and information to assist the Customer in doing so, and shall not report to regulators or notify individuals on the Customer’s behalf unless the Parties agree in writing or applicable law requires.

8.3 Exclusions. Section 8.1 does not apply to unsuccessful attempts or activities that do not compromise the security of Personal Information (including unsuccessful log-in attempts, pings, port scans and denial-of-service attacks), or to incidents caused by the Customer or its Platform Users, by credentials or systems outside the control of myAbode and its Sub-processors, or by use of the Platform other than in accordance with the Agreement. However, where the Québec Act applies, myAbode shall notify the Customer without delay of any attempted violation of the confidentiality of Personal Information of which it becomes aware.

8.4 No admission; communications. myAbode’s notification of or response to a Breach of Security Safeguards is not an acknowledgment of fault or liability. The Customer shall not issue any public statement that names or identifies myAbode in connection with a Breach of Security Safeguards without myAbode’s prior written approval, except to the extent required by law or by a regulator, in which case the Customer shall, where legally permitted, give myAbode prior notice and a reasonable opportunity to comment.

9. Audits and Information
9.1 On the Customer’s written request, no more than once in any twelve (12) month period (except following a Breach of Security Safeguards affecting Personal Information or where a regulator requires it), myAbode shall make available information reasonably necessary to demonstrate its compliance with this DPA.

9.2 If the information provided under Section 9.1 is not sufficient to address the Customer’s reasonable concerns, the Customer may request an audit, subject to the following conditions: (a) it is conducted by an independent auditor reasonably acceptable to myAbode and bound by confidentiality obligations; (b) the Customer gives at least thirty (30) days’ prior written notice and the Parties agree on its scope; (c) it takes place during normal business hours and does not unreasonably interfere with myAbode’s operations; (d) it does not extend to the data of other customers, to Sub-processors’ facilities, or to information subject to legal privilege or security restrictions; (e) neither the Customer’s auditor nor, where applicable, the Customer is a competitor of myAbode; and (f) the Customer bears all costs of the audit, including myAbode’s reasonable costs.

9.3 All information provided or obtained under this Section 9, including audit results, is myAbode’s confidential information, may be used by the Customer only to assess myAbode’s compliance with this DPA, and shall not be disclosed to any third party (other than a regulator on request) without myAbode’s prior written approval.

10. Retention, Return and Deletion
10.1 During the term. The Customer may request an export of Personal Information in writing during the term of the Agreement. The Customer is solely responsible for retaining any Personal Information it is required to keep under applicable law, including FINTRAC, trust-accounting and brokerage record-keeping requirements; myAbode does not act as the Customer’s record keeper for those purposes.

10.2 On termination. Within thirty (30) days after termination or expiry of the Agreement, the Customer may request in writing that myAbode provide it with an export of Personal Information, including documents, in a commonly used format at myAbode’s then-current rates. After that period ends, myAbode shall delete Personal Information no later than ninety (90) days after termination or expiry (or, if later, after completing any export requested within that period), except: (a) copies held in backup, versioned storage, disaster-recovery and logging systems, which shall be deleted in accordance with myAbode’s normal retention cycles (backups being kept for thirty (30) days before being overwritten) and shall not be actively Processed in the meantime; and (b) Personal Information that myAbode is required by applicable law to retain, or that forms part of the audit-trail records described in Section 9.4 of the Agreement or in Sections 4.2(c) and 4.2(d), which myAbode may retain for those purposes. On written request, myAbode shall confirm deletion in writing.

10.3 Anonymized Data. Sections 10.1 and 10.2 do not apply to Anonymized Data.

11. Legal Demands
11.1 If myAbode receives a subpoena, court order, warrant or other legally binding demand from a public authority for Personal Information, myAbode shall, to the extent legally permitted, notify the Customer so that it may seek a protective order or other remedy, and shall disclose only the Personal Information it determines, acting reasonably, is required to be disclosed.

12. Liability and Indemnity
12.1 Limitation of liability. Each Party’s liability arising out of or in connection with this DPA, is subject to the limitations and exclusions of liability in the Agreement, which apply in the aggregate to all claims under the Agreement and this DPA. Except as set out in Section 12.2, nothing in this DPA creates any separate or additional liability, or overrides those limitations and exclusions.

12.2 Customer indemnity. The Customer shall defend, indemnify and hold harmless myAbode, its affiliates and their respective directors, officers and employees from and against all third-party claims, regulatory proceedings, fines, penalties, damages, costs and reasonable legal fees arising out of or relating to (a) the Customer’s breach of Section 3, including any failure to obtain a required consent or provide a required notice; or (b) any instruction of the Customer, or any Personal Information submitted by the Customer or its Platform Users, that causes myAbode’s Processing in accordance with this DPA to infringe Applicable Privacy Laws.

13. General
13.1 Term. This DPA takes effect on the effective date of the Agreement and remains in effect for as long as myAbode Processes Personal Information on the Customer’s behalf.

13.2 Order of precedence. In the event of any conflict or inconsistency between this DPA and the Agreement regarding the Processing of Personal Information, this DPA prevails.

13.3 Changes. This DPA may be amended only as provided in the Agreement, except as stated under Section 5.2.

13.4 Governing law. This DPA is governed by the laws that govern the Agreement.

13.5 Severability. If any provision of this DPA is held invalid or unenforceable, the remaining provisions remain in full force and effect.

Annex 1 – Details of Processing

Annex 2 – Security Safeguards
myAbode maintains administrative, technical and physical safeguards designed to protect Personal Information, appropriate to its sensitivity, including:

Annex 3 – Sub-processor List
Current as of October 5, 2026. myAbode engages the following Sub-processors to Process Personal Information on the Customer's behalf. Primary storage of Platform data is in Canada. Sub-processors located outside Canada Process Personal Information only as needed for the services described below. Changes to this list are made under Section 5.2.