Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service or Master SaaS Subscription Agreement (the "Agreement") between The Wireless Advisors LLC D/B/A LeasingHQ ("Processor", "we"), 5900 Balcones Drive #32899, Austin, TX 78731, and the customer identified in the Agreement ("Controller", "you"). It applies whenever we process personal information on your behalf.

1. Roles of the Parties

You are the controller (or "business") of applicant, resident, and employee personal information you submit to the Service. We act as your processor (or "service provider") and process that information only on your documented instructions, which include your use of the Service's features and any integrations you enable. We are an independent controller only for account administration, billing, security, and product telemetry described in our Privacy Notice.

2. Details of Processing

• Subject matter: provision of the Leasing Headquarters applicant tracking and leasing workflow service.
• Duration: the term of the Agreement, plus the deletion period in Section 9.
• Nature and purpose: hosting, storage, organization, retrieval, calculation, document generation, transmission to platforms you connect, support, and deletion.
• Categories of data subjects: rental applicants, residents, guarantors and occupants named by you, leasing agents, property staff, and account administrators.
• Categories of personal information: name, email, contact details, unit number and property, lease terms and rent amounts, move-in date and move-in balance, mailbox number, checklist and verification status, concession and gift card records, uploaded documents and notes, leasing agent identity, and audit log entries recording who changed what and when.
• Sensitive data: the Service is not designed for Social Security numbers, government ID images, full financial account numbers, or health information. Do not upload them; if you do, you remain responsible for that decision and for any additional legal requirements it creates.

3. Our Obligations

• Process personal information only on your documented instructions.
• Not sell or share personal information, and not use it for cross-context behavioral advertising or for any purpose other than providing the Service.
• Bind personnel with access to written confidentiality obligations.
• Limit access to personnel who need it, using role-based access and per-property row-level isolation.
• Notify you if we believe an instruction violates applicable data protection law.

4. Your Obligations

You are responsible for the lawfulness of the personal information you submit, for providing required notices to applicants and residents, for the accuracy of the data, for configuring roles and property assignments correctly, and for removing users promptly when their access should end.

5. Security Measures

We implement and maintain the technical and organizational measures described in our Security Overview, including encryption in transit and at rest, role-based access control, database row-level security scoping data to the correct property, authentication with hashed credentials, audit logging of record changes, least privilege for administrative access, and monitoring and logging of the hosting environment.

6. Service Providers

You authorize us to engage the third-party service providers we use to host, operate, and secure the Service. We impose data protection obligations on each provider that are no less protective than this DPA and remain responsible for their performance. We will provide notice before adding a new service provider that processes personal information, and you may object on reasonable data protection grounds; if we cannot accommodate the objection, you may terminate the affected subscription and receive a pro-rated refund of prepaid fees.

7. Integrations You Enable

Property management systems, screening providers, and verification providers you connect (for example RealPage OneSite, Yardi, or Verifast) are independent controllers or your own processors, not our subprocessors. When you enable an integration you instruct us to transmit and receive the associated data. We are not responsible for their processing.

8. Data Subject Requests and Assistance

Taking into account the nature of the processing, we will assist you in responding to requests to access, correct, delete, or port personal information, and with data protection impact assessments and regulator consultations. If we receive a request directly from an applicant or resident, we will refer them to you rather than respond on your behalf, unless legally required otherwise. Access, export, and deletion tools are available in the Service.

9. Retention, Return, and Deletion

We retain personal information for the term of your account. On termination we make Customer Data available for export for thirty (30) days, after which we delete or de-identify it within ninety (90) days, except where retention is required by law. Backups are deleted on a rolling schedule not exceeding thirty-five (35) days.

10. Security Incidents

We will notify you without undue delay and within seventy-two (72) hours after confirming a personal data breach affecting your data, describe the nature and scope of the incident, the categories and approximate number of records affected, the measures taken, and provide reasonable cooperation for your own notification obligations. Notification is not an acknowledgment of fault.

11. Audits

On written request no more than once per year, we will provide information reasonably necessary to demonstrate compliance with this DPA, including a security questionnaire response and available third-party reports. On-site audits may be conducted where required by law, at your expense, on thirty (30) days' notice, during business hours, and subject to confidentiality.

12. International Transfers

Personal information is processed and stored in the United States. Where personal information subject to UK or EU data protection law is transferred, the parties agree the Standard Contractual Clauses (Module Two, controller to processor) are incorporated by reference, with the governing law and forum being Ireland for the EU clauses and the UK Addendum applying for UK transfers.

13. U.S. State Privacy Laws

With respect to the Texas Data Privacy and Security Act, the CCPA/CPRA, and comparable state laws, we act as a service provider or processor. We certify that we understand and will comply with these restrictions: we do not sell or share personal information, we do not retain, use, or disclose it outside the direct business relationship or for any purpose other than the services specified, and we do not combine it with information from other sources except as permitted by law.

14. Order of Precedence

In a conflict between this DPA and the Agreement regarding processing of personal information, this DPA controls. Liability under this DPA is subject to the limitations in the Agreement.

15. Contact

The Wireless Advisors LLC D/B/A LeasingHQ
5900 Balcones Drive #32899
Austin, TX 78731