This DPA applies when Broker Matrix, LLC processes personal data and MLS listing data on behalf of Customer in connection with the Qsells platform and related services (the "Service"). It is designed for brokerages, franchise organizations, teams, independent agents operating under a brokerage account, and MLS participants who require documented processor obligations for vendor review, API access, and listing submission integrations.

This DPA supplements the Qsells Terms of Service and Privacy Policy. Where Customer and Processor have executed a separate written data processing agreement, that agreement controls to the extent it expressly supersedes this DPA.

• "Agreement" means the Terms of Service, order form, subscription, or other contract under which Customer accesses the Service, together with this DPA.
• "Applicable Data Protection Law" means privacy and data protection laws applicable to the processing of Personal Data under this DPA, including the GDPR, UK GDPR, CCPA/CPRA, and U.S. state comprehensive privacy laws, as applicable to Customer's use of the Service.
• "Customer Data" means all data Customer or its authorized users submit to, store in, or transmit through the Service, including Personal Data and MLS Data.
• "MLS" means a Multiple Listing Service, real estate board, association, or vendor that licenses listing data and governs listing submission, display, and syndication rules applicable to Customer.
• "MLS Data" means listing content, photographs, virtual tours, remarks, agent and broker attribution fields, status information, IDX display fields, and related metadata licensed from or submitted to an MLS on Customer's behalf.
• "Personal Data" means information relating to an identified or identifiable natural person that Processor processes on behalf of Customer through the Service.
• "Processing" means any operation performed on Personal Data or MLS Data, including collection, storage, use, disclosure, transmission, indexing, synchronization, submission, deletion, or retrieval.
• "Subprocessor" means a third party engaged by Processor to process Customer Data on Processor's behalf.

For Customer Data uploaded, imported, or generated through Customer's use of the Service, Customer is the controller (or "business" under CCPA) and Broker Matrix, LLC is the processor (or "service provider").

Processor will process Customer Data only on documented instructions from Customer, including those set forth in the Agreement, this DPA, Customer's configuration of the Service, and applicable MLS rules that Customer is obligated to follow. Processor may also process Customer Data where required by applicable law, provided Processor notifies Customer unless prohibited by law.

Processor maintains a processor/sub-processor hierarchy: Customer → Processor → Subprocessors listed in Section 8. Subprocessors process Customer Data solely to provide infrastructure and features supporting the Service and are bound by written obligations no less protective than those in this DPA.

Customer instructs Processor to process Customer Data as necessary to provide the Service in accordance with the Agreement, this DPA, and Customer's use of product features. Customer is responsible for configuring permissions, workflows, integrations, and MLS connections in a manner consistent with its policies and legal obligations.

Customer represents and warrants that:

• It has a lawful basis (or valid consent, where required) to collect, upload, and instruct Processor to process Personal Data.
• It maintains valid MLS membership, participant agreements, feed licenses, and broker-of-record authorizations required for listing submission, syndication, and display in each applicable market.
• Listing data submitted through the Service is accurate, complete, and compliant with applicable MLS rules, copyright requirements, and fair housing laws.
• It will not use the Service to repurpose MLS Data beyond authorized CRM, IDX, submission, and related brokerage operations.
• It will promptly notify Processor of any MLS directive, license revocation, or restriction that requires suspension of sync, display, or submission for affected listings.

MLS Data is licensed, not sold. Processor treats MLS Data as confidential and restricted information subject to the MLS rules applicable to Customer.

• Authorized use only — Processor processes MLS Data solely to provide the Service on Customer's instructions, including drafting, editing, submitting, synchronizing, and displaying listings as permitted by Customer's MLS agreements.
• No unauthorized repurposing — Processor will not sell, license, or redistribute MLS Data to unrelated third parties, use MLS Data to build independent listing databases for resale, or combine MLS Data with third-party datasets for purposes outside the Service without Customer's and the MLS's authorization.
• Display and attribution — Where the Service displays MLS Data (including IDX or internal CRM views), Processor supports configuration of required disclaimers, broker and agent attribution, photo credits, and status-dependent display rules as implemented in product features and Customer settings.
• Status changes and removals — Processor will process status updates, withdrawals, expirations, and deletion instructions transmitted through authorized MLS interfaces or Customer-directed actions within commercially reasonable timeframes consistent with product capabilities and MLS technical requirements.
• Sold and off-market restrictions — Processor will honor sold, withdrawn, expired, and off-market restrictions communicated through MLS feeds or Customer configuration, including limiting display or submission where rules require.

The Service enables authorized users designated by Customer to draft, validate, and submit listings to MLS systems through approved interfaces, RETS/RESO Web API connections, vendor bridges, or other integration methods supported by Processor and the applicable MLS.

Processor treats Customer Data, including MLS Data, as confidential information. Processor personnel and Subprocessors with access to Customer Data are bound by confidentiality obligations and may access such data only on a need-to-know basis to perform the Service or comply with law.

Processor will not disclose MLS Data or other Customer Data to third parties except: (a) to Subprocessors performing services under Section 9; (b) as directed by Customer through enabled integrations; (c) as required by law, after notifying Customer where permitted; or (d) with Customer's prior written consent.

Customer authorizes Processor to engage Subprocessors to support the Service. Processor maintains an up-to-date list of material Subprocessor categories below. A detailed subprocessor list is available on request to privacy@qsells.com.

Processor implements technical and organizational measures designed to protect Customer Data against unauthorized access, loss, or alteration. These measures are described in Annex B and in our Information Security Policy.

Processor maintains commercially reasonable safeguards appropriate to the sensitivity of real estate transaction data, consumer PII, and MLS listing content. Processor does not currently hold SOC 2 Type II or HIPAA certification; enterprise customers may request security questionnaires and roadmap information for compliance reviews.

Customer is responsible for safeguarding account credentials, configuring role-based access within its organization, and promptly notifying Processor of suspected unauthorized access to Customer accounts.

Processor will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a confirmed security incident that results in unauthorized access to, acquisition of, or disclosure of Customer Data processed under this DPA.

Notification will include, to the extent known, a description of the nature of the incident, categories of data affected, likely consequences, and measures taken or proposed to mitigate harm. Processor will cooperate with Customer's investigation and, where applicable, Customer's obligations to notify MLSs, regulators, or data subjects under Applicable Data Protection Law or MLS vendor requirements.

Customer is the primary point of contact for data subjects (consumers, clients, contacts, and portal users) whose Personal Data Customer controls in the Service. Processor will assist Customer in responding to verifiable requests to access, correct, delete, restrict, or port Personal Data, taking into account the nature of processing and information available to Processor.

Processor may direct individuals who contact Processor directly to Customer where Customer is the controller. Processor will implement technical measures within the Service to support Customer's fulfillment of such requests where commercially reasonable.

Processor is based in the United States. Customer Data may be processed and stored in the United States and other countries where Processor or its Subprocessors operate.

Where Personal Data is subject to GDPR, UK GDPR, or similar cross-border transfer requirements, Processor will make available appropriate safeguards such as Standard Contractual Clauses (SCCs) or equivalent mechanisms upon request. Supplementary technical and organizational measures are described in Annex B.

Upon reasonable written notice and no more than once per twelve (12) month period (unless required by law or following a material security incident), Customer may audit Processor's compliance with this DPA through:

• Completion of Processor's standard security questionnaire or due diligence packet.
• Review of relevant third-party audit reports or certifications Processor makes available (if any).
• A written inquiry process coordinated with Processor's security team.

On-site audits require mutual agreement on scope, timing, and confidentiality, and must not unreasonably interfere with Processor's operations or other customers' data. Customer bears its own audit costs unless a material breach of this DPA is confirmed.

Upon termination or expiration of the Agreement, Customer may export Customer Data using available export features during any applicable wind-down period. Following termination, Processor will delete or return Customer Data per Customer's written instructions within ninety (90) days, except where retention is required by law or encrypted backups persist for a limited period as described in the Privacy Policy.

MLS Data will be removed from active production systems in accordance with MLS rules and Customer instructions, including cessation of display, sync, and submission for affected listings. Processor may retain minimal logs required for security, billing dispute resolution, or legal compliance.

Each party is responsible for its own compliance with Applicable Data Protection Law and MLS agreements applicable to its role. Customer is responsible for the lawfulness of Customer instructions, MLS licenses, and listing content submitted through the Service. Processor is responsible for processing Customer Data in accordance with this DPA and the Agreement.

Liability arising from this DPA is subject to the limitation of liability and indemnity provisions in the Agreement. Nothing in this DPA limits either party's liability for fraud, willful misconduct, or liabilities that cannot be limited under applicable law.

Customer will indemnify Processor against third-party claims arising from Customer's breach of MLS agreements, submission of unlawful or inaccurate listing data, or lack of a lawful basis for Personal Data provided to Processor, except to the extent caused by Processor's breach of this DPA.

In the event of conflict between documents governing the parties:

• A separately executed enterprise DPA or data processing addendum signed by both parties controls over this online DPA.
• This DPA controls over the Privacy Policy with respect to processor obligations.
• The Terms of Service control over this DPA for commercial terms, service levels, and general liability caps.
• MLS rules and vendor agreements between Customer and the MLS control over this DPA with respect to MLS Data use, display, and submission requirements.

This DPA is effective as of the date Customer first accesses the Service or the effective date above, whichever is later, and remains in effect for the duration of the Agreement. Sections that by their nature should survive termination (including confidentiality, return/deletion, liability, and audit records) will survive.

Processor may update this DPA to reflect changes in law, MLS industry requirements, or security practices. Material changes will be posted on this page with an updated effective date and, where appropriate, notice to organization administrators at least fifteen (15) days before taking effect.

For DPA questions, subprocessor lists, MLS vendor onboarding, security questionnaires, or incident reporting:

Processor implements the following measures, reviewed periodically and improved on a commercially reasonable basis:

• Encryption in transit — TLS 1.2+ for browser, API, and integration traffic; encrypted connections to database and storage services.
• Encryption at rest — encrypted storage for databases, object storage, and backups provided by infrastructure Subprocessors.
• Multi-tenant isolation — logical separation of customer organizations using organization-scoped data models and row-level security (RLS) policies in the database layer.
• Access control — role-based permissions within organizations; authentication via industry-standard identity providers; principle of least privilege for personnel access.
• Authentication & session security — secure session management, token handling, and optional multi-factor authentication where supported.
• Logging & monitoring — application and security event logging; monitoring for availability and error conditions; retention of submission audit trails for listing changes where product features support it.
• Vulnerability management — dependency updates, security patching, and remediation of confirmed vulnerabilities on a risk-prioritized basis.
• Incident response — documented procedures for detecting, containing, and notifying customers of security incidents affecting Customer Data.
• Personnel security — confidentiality obligations for team members with production access; access granted on need-to-know basis and revoked upon role change or termination.
• Vendor management — due diligence and contractual safeguards for Subprocessors handling Customer Data.
• Business continuity — infrastructure redundancy and backup practices through cloud providers; recovery procedures for service restoration.
• Secure development — code review practices, environment separation, and protection of production credentials and secrets.

Additional detail is available in the Information Security Policy. Enterprise customers may request completed security questionnaires for MLS vendor review.