Data Processing Agreement

Effective: September 1, 2026

1. Scope

This Data Processing Agreement (DPA) governs the processing of personal data by Open Doorway AI on behalf of its customers (the "Controller") in connection with the provision of real estate analytics and property intelligence services. This DPA applies to all personal data processed through the Open Doorway platform, including property owner information, tenant data, investment portfolio details, and contact information provided by the Controller.

2. Processing Details

Subject matter: Processing of personal data to deliver property valuation, market analysis, and portfolio management services. Duration: For the term of the underlying services agreement. Nature and purpose: Collection, storage, analysis, and reporting of real estate market data and portfolio analytics. Types of personal data: Names, email addresses, property addresses, financial transaction records, and usage analytics. Categories of data subjects: Property owners, tenants, investors, and platform users.

3. Sub-processors

We engage the following categories of sub-processors: cloud infrastructure providers (AWS, GCP) for data hosting and compute; payment processors (Stripe) for billing; analytics providers for platform optimization; and specialized real estate data aggregators for market intelligence. All sub-processors are bound by data processing agreements that provide equivalent protections. A current list of sub-processors is available upon request. We notify customers at least 30 days before engaging new sub-processors.

4. Security Measures

Open Doorway AI implements comprehensive technical and organizational measures including: AES-256 encryption at rest and TLS 1.3 in transit; SOC 2 Type II certified infrastructure; role-based access controls with least-privilege enforcement; multi-factor authentication for all administrative access; regular security assessments and penetration testing; incident response procedures with defined escalation paths; employee security training and background checks; and physical security controls at data center facilities.

5. Data Breach Notification

In the event of a personal data breach, Open Doorway AI will notify the Controller without undue delay and no later than 48 hours after becoming aware of the breach. Notification will include: the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address the breach. We cooperate fully with the Controller and relevant supervisory authorities in breach investigation and remediation.

6. Audit Rights

The Controller has the right to audit Open Doorway AI's compliance with this DPA, subject to reasonable prior notice (minimum 30 days) and conducted no more than once annually unless a breach has occurred. Audits may be conducted by the Controller or a qualified third-party auditor. Open Doorway AI will provide reasonable assistance and access to facilities, records, and personnel necessary for the audit. Findings are treated as confidential by both parties.