Agency data processing addendum

1. Parties and scope

For private CRM, messages, appointments, deal records and document-vault material processed solely to provide an agency's instructed workspace, the agency is controller and PlusHouse Dev L.L.C. is processor. This addendum is incorporated into an agency service agreement when validly accepted or signed. Publication alone is not proof of contract formation. Each party remains an independent controller for its own separate purposes, including applicable platform account, security, billing or statutory processing.

2. Processing schedule

• Subject and nature: collection, organization, storage, access, transmission, retrieval, correction, export and deletion needed to provide the instructed agency tools; optional AI analysis only when validly instructed and lawfully configured.
• Purpose and duration: delivering those tools for the agency during its service relationship and the return/deletion period, subject to specific lawful retention obligations.
• Data subjects: agency staff, owners, co-owners, prospective buyers and tenants, clients, counterparties and their authorized representatives.
• Data: contact and account identifiers, correspondence, property facts, appointments, CRM notes, deal details, contracts, uploaded identification and other necessary documents. Special-category and criminal-record data are not authorized by default; any exceptional use needs an identified legal condition and suitable written safeguards.

3. Documented instructions and confidentiality

PlusHouse processes the covered data only on lawful documented instructions, including authorized workspace actions and agreed written instructions, unless law requires otherwise; where permitted, it informs the agency of that requirement. If an instruction appears unlawful, PlusHouse informs the agency and may suspend the affected processing pending clarification. Personnel with access must be bound by confidentiality and authorized only as necessary. Private client records must not be reused for unrelated advertising or model training on PlusHouse's own initiative.

4. Security and assistance

PlusHouse must apply technical and organizational security appropriate to risk, including authenticated access, agency-scoped permissions, private file access controls, protected transport, secure credential handling and operational incident controls. The agency must manage its users, permissions, inputs, devices and required originals. No party promises absolute security.

Taking account of the processing and information available, PlusHouse assists with data-subject requests, security duties, impact assessments and regulatory consultations. It notifies the agency without undue delay of a personal-data breach affecting covered records and supplies known facts, likely consequences and mitigation, with updates as available. This processor notification does not replace the controller's own assessment of applicable authority or individual notification deadlines.

5. Subprocessors and international transfers

The agency gives general authorization for providers disclosed for the relevant instructed service in the Privacy Policy and the maintained provider register. PlusHouse must impose materially equivalent processing and confidentiality obligations, remain responsible for subprocessor performance as required by law, and provide an up-to-date register of relevant entities, functions, locations and safeguards on request.

Before adding or replacing a subprocessor for covered records, PlusHouse must give written notice at least 30 days in advance unless a shorter period is needed for an urgent protective change and is lawful. The agency may raise a reasoned data-protection objection during that period. The parties must seek a reasonable alternative; if none is available, the affected service can be ended and unused prepaid charges assessed under the agreement and mandatory law.

No clause authorizes an otherwise unlawful transfer. PlusHouse and the agency must identify the applicable Kosovo and any GDPR or local transfer requirements and implement required agreements, assessments, supplementary measures or authority permissions before the affected transfer. Optional AI must remain unused for covered data if these conditions are not met.

6. Information and audit

PlusHouse must provide information reasonably needed to demonstrate compliance with this addendum and allow proportionate audits or inspections by the agency or an independent auditor bound by confidentiality. The parties should first use relevant existing reports where sufficient. Reasonable scope, scheduling and confidentiality controls must protect other customers and systems without preventing an effective audit or a regulator's powers.

7. Return, deletion and limits

At the agency's choice and documented instruction on ending the service, PlusHouse must return or delete covered personal data and delete copies unless law requires identified retention. Agree the export format and completion schedule in writing, taking account of the statutory duties and practical provider lifecycle. Explain any lawful exception and restrict the retained data. Backups must follow an identified restricted lifecycle, and restored data must remain subject to the deletion instruction.

This addendum does not itself constitute an international-transfer clause, a joint-controller arrangement or a security certification. Mandatory statutory liability and third-party rights remain intact. Any conflicting instruction must be resolved in favor of mandatory data-protection law. Operational readiness and execution of this addendum must be verified before claiming complete compliance.