Habiata - Data Processing Agreement and Security Measures

This Data Processing Agreement (hereinafter referred to as the "DPA") forms an integral part of the order form concluded between the "Customer" and Habiata S.A., a public limited liability company, having its registered office at 55, rue de la Vallée, L-2661 Luxembourg, registered with the Luxembourg Trade and Companies Register under number B305375, operating under the trade name Habiata. (hereinafter, the "Subcontractor" or "Habiata" and, jointly with the Customer, referred to as the "Parties")

WHEREAS

1. The Customer acts as Data Controller;
2. The Customer wishes to subcontract certain Services, which involve the processing of personal data, to Habiata, acting as Subcontractor;
3. The Parties seek to implement a data processing agreement that complies with the requirements of the current legal framework for data processing and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC; and
4. The Parties wish to set out their rights and obligations in this DPA.
5. This DPA forms an integral part of the contractual relationship between the Customer and Habiata.
6. Any Annexes attached form an integral part of this DPA.

IT IS AGREED AS FOLLOWS

1. DEFINITIONS AND INTERPRETATION

Unless otherwise defined herein, capitalised terms used in this DPA shall have the following meanings

2. MOORING CLAUSE

2.1. Any entity that is not a party to this DPA may, with the agreement of all the Parties, join it at any time, either as a data controller or as a data processor. This is done by signing an amendment.

2.2. Once the amendment is signed, the Subscribing Entity is considered a party to this DPA and enjoys the rights and is subject to the obligations of a controller or processor, in accordance with its designation.

2.3. These clauses do not create any rights or obligations for the subscribing party for the period prior to joining.

3. DESCRIPTION OF PROCESSING

3.1. The Parties acknowledge that the processing of Customer Data by the Data Processor relates more specifically to the following categories of Personal Data and purposes of processing:

Categories of data subjects whose personal data are processed

• property developers (residential, commercial, infrastructure)
• construction companies
• property funds
• asset managers
• family offices
• real estate agencies (and independent real estate agents)
• architectural and engineering firms
• governments
• banks
• insurance providers
• senior executives and boards of directors
• asset and fund managers
• financial controllers
• project managers
• customer and investor relations managers
• analysts
• risk and compliance managers
• administrative managers and assistants

Categories of personal data processed

• identity data
• economic data
• professional data

Type of processing

• collection
• registration
• organisation
• storage
• adaptation
• use
• communication

Purpose(s) for which personal data are processed on behalf of the controller

• performance of contractual obligations
• provision of artificial intelligence-powered features within the Platform, including but not limited to automated data analysis, recommendations and document processing, strictly for the purpose of delivering the services described in the Order Form

Duration of processing

The retention period depends on the type of data used, in accordance with the GDPR and the specific data retention timelines set out in Article 16 of the General Terms and Conditions. For trial accounts that do not convert to paid subscriptions, Customer Data is retained for a maximum of thirty (30) calendar days from the date of initial registration (or ninety (90) calendar days where the Customer has applied for a government subsidy), after which all Customer Data is permanently and irrecoverably deleted. For paid accounts, Customer Data is retained for the duration of the Contract and for a period of thirty (30) calendar days following termination, after which all Customer Data is permanently deleted unless otherwise required by applicable law.

4. PROCESSING CUSTOMER DATA

4.1. As a Subcontractor in charge of processing Customer Data, Habiata must:

• (i) comply with all applicable data protection laws when processing Customer data; and
• (ii) not process Customer Data other than in accordance with the documented instructions of the relevant Customer unless it is required to do so under the law of the European Union or Luxembourg to which it is subject. In particular, Habiata undertakes to inform the Customer of this legal obligation prior to processing, unless prohibited by law for important reasons of public interest
• (iii) process personal data only for the purposes indicated by the Customer, as defined in this DPA or in a subsequent agreement
• (iv) inform the Customer without delay if, in its opinion, an instruction given by the Customer constitutes a breach of the GDPR or other applicable Data Protection Laws

4.2. The Customer authorises Habiata to process the Customer Data.

4.3. For the avoidance of doubt, Habiata shall not use Customer Data to train, improve or develop general-purpose artificial intelligence models or algorithms. Any processing of Customer Data by AI-powered features of the Platform shall be strictly limited to providing the services described in the Order Form and the General Terms and Conditions. Habiata may use anonymised and aggregated data for the purposes of improving its services and developing new features, provided that such data cannot be used to identify any data subject or the Customer.

5. SUBCONTRACTOR PERSONNEL

5.1. Habiata shall take reasonable steps to:

• (i) ensure the reliability of any employee, representative or sub-contractor who may have access to Customer Data, ensuring in each case that access is strictly limited to those individuals who need to know/access the relevant Customer Data, as strictly necessary for the purposes of the Purchase Order; and
• (ii) comply with Data Protection Laws in the context of that person's duties, ensuring that all such persons are subject to confidentiality undertakings or professional or legal obligations of confidentiality

6. SECURITY

6.1. Taking into account the current state of technology, the costs of implementation and the nature, scope, context and purposes of the Processing as well as the risk of varying likelihood and severity to the rights and freedoms of natural persons, Habiata implements, with respect to Customer Data, the appropriate technical and organisational measures to ensure a level of security appropriate to that risk, including, where appropriate, the measures referred to in Article 32(1) of the Regulation.

6.2. The safety measures put in place are set out in Annex I to this DPA.

6.3. In assessing the appropriate level of security, Habiata takes particular account of the risks presented by the Processing, including a breach of personal data.

6.4. The Parties thus define in Annex I the appropriate technical and organisational measures on the basis of which Habiata is required to provide assistance to the Customer in the application of its assistance obligation described in Article 9 of the DPA, as well as the scope and extent of the assistance required.

7. SENSITIVE DATA

7.1. If the processing concerns Sensitive Data, Habiata applies specific limitations and/or additional guarantees.

8. SUBCONTRACTING

8.1. Habiata will not appoint (or disclose Customer Data to) a Subcontractor, except as required or authorized by Customer.

8.2. In the event that a Sub-Contractor is used, the Parties undertake to formalise the commitment of the accepted Sub-Contractor(s) by means of an amendment to this DPA.

8.3. The Customer grants a general authorization to Habiata with respect to the recruitment of Sub-Subcontractors listed in Appendix II to this Agreement. Habiata undertakes to inform the Customer in writing of any addition or replacement of Sub-Subcontractors within a reasonable time and prior to any formal commitment by Habiata, in order to allow the Customer to validly object to such changes. Habiata undertakes to provide the Customer with all necessary information to enable it to exercise its right to object, where appropriate, in an informed manner.

8.4. Habiata and the Sub-Contractor undertake to formalise their commitment in the form of a separate contract. Habiata will ensure that the Sub-Contractor complies with the same obligations in terms of data protection as the Sub-Contractor and more particularly with regard to the presentation of sufficient guarantees concerning the existence of appropriate technical and organisational measures. At Customer's request, Habiata shall provide Customer with a copy of this agreement with Subcontractor and any subsequent amendments thereto. To the extent necessary to protect business secrets or other confidential information, including personal data, Habiata may redact the text of the contract before distributing a copy.

8.5. Habiata remains fully responsible to the Customer for the performance of the obligations of the Sub-Subcontractor in accordance with the contract entered into with the Sub-Subcontractor. Habiata shall inform the Customer of any breach by the Sub-Subcontractor of its contractual obligations.

8.6. By signing this DPA, the Customer is aware and accepts that the proper performance of the Services by Habiata may involve the transfer of the Customer's data to third parties, including data controllers, such as:

• Amazon Web Services (AWS)
• Google Suite
• Stripe
• Kodehyve
• LetzAI
• LuxTrust
• DocuSign
• Hotjar
• Sentry
• Slack

It is specified that Habiata assumes no responsibility for the Processing of Personal Data carried out by other data controllers.

9. DATA SUBJECT'S RIGHTS / CUSTOMER ASSISTANCE

9.1. Given the nature of the Processing, Habiata will assist Customer in fulfilling Customer's obligations, as reasonably understood by Customer, to respond to requests to exercise data subjects' rights under Data Protection Laws.

9.2. In this context, Habiata agrees to implement the appropriate technical and organisational measures, insofar as this is possible.

9.3. In particular, Habiata shall:

• (i) promptly inform the Customer if it receives a request from a data subject under any Data Protection Law in respect of Customer Data; and
• (ii) ensure that it does not respond to such request except on the documented instructions of the Customer or as required by any Data Protection Law, in which case Habiata shall, to the extent permitted by the relevant Data Protection Law, inform the Customer of this legal requirement before responding to the request

9.4. Habiata also helps the Customer to ensure compliance with the following obligations, given the nature of the Processing and the information available to Habiata:

• (a) the obligation to carry out an assessment of the impact of proposed processing operations on the protection of personal data ("data protection impact assessment") when a type of processing is likely to present a high risk to the rights and freedoms of natural persons
• (b) the obligation to consult the competent supervisory authority(ies) prior to processing where a data protection impact assessment indicates that the processing would present a high risk if the Customer did not take steps to mitigate the risk
• (c) the obligation to ensure that Personal Data are accurate and up to date, informing the Customer without delay if Habiata learns that the Personal Data it processes are inaccurate or have become obsolete

10. PERSONAL DATA BREACH

10.1. Habiata will notify Customer without undue delay as soon as Habiata becomes aware of a personal data breach affecting Customer's data, promptly providing Customer with sufficient information to enable Habiata to fulfil all of its obligations to report or inform the persons affected by the personal data breach under the Data Protection Laws.

10.2. Habiata also undertakes to assist the Customer, insofar as possible, in fulfilling its legal obligations in relation to personal data breaches.

10.3. In this same context, Habiata shall inform the Customer without delay in the event of the discovery of a personal data breach in relation to Customer Data processed by Habiata.

10.4. In both of the above cases, this information contains at least, and as far as possible, the following information:

• (a) a description of the nature of the breach observed (including, if possible, the categories and approximate number of persons affected by the breach and the records of Personal Data concerned)
• (b) details of a contact point from which further information can be obtained about the Personal Data Breach
• (c) its likely consequences and the steps taken or proposed to be taken to remedy the breach, including mitigating any adverse consequences

10.5. Where, and to the extent that, it is not possible to provide all the information at the same time, the initial notification shall contain the information available at that time and, to the extent that it becomes available, additional information shall subsequently be provided as soon as possible.

10.6. Habiata will cooperate with Customer and take commercially reasonable steps as directed by Customer to assist in the investigation, mitigation and remediation of each such Personal Data Breach.

11. DELETION OR RETURN OF CUSTOMER DATA

11.1. Habiata shall promptly and, in any event, within thirty (30) days of the date of termination of any Service involving the Processing of Customer Data, delete all copies of Customer Data.

11.2. In principle, Habiata shall retain Customer Data for the duration of the performance of the Services, without prejudice to Habiata's right to retain Customer Data for a longer period if legal, administrative, regulatory, etc. obligations applicable to Habiata, respectively limitation periods applicable to the contractual relationship with the Customer require such retention and/or in order to protect its rights and interests in the context of legal proceedings.

11.3. Subject expressly to clause 11.2 of this DPA, Customer may, within one (1) month of the termination of this DPA request Habiata by registered letter with acknowledgement of receipt addressed to legal@habiata.lu (a) to delete all Customer Data or (b) to return to Customer the Customer Data and destroy all existing copies of the Customer Data. Subject expressly to clause 11.2 of this DPA, Habiata will comply with any such written request from Customer within 1 month of the termination of this DPA.

11.4. Notwithstanding the foregoing, the Customer acknowledges and agrees that Habiata may be a data controller in relation to the processing of certain Customer Data, and may retain such data in accordance with Data Protection Laws.

12. AUDIT RIGHTS

12.1. Habiata will make available to Customer, upon request, all information necessary to demonstrate compliance with this DPA, and will permit and assist in audits, including inspections, by Customer or an auditor retained by Customer in connection with Habiata's Processing of Customer Data.

12.2. The Customer shall notify Habiata at least one (1) month in advance of any audit or inspection. The Customer shall take all necessary and reasonable steps (and shall ensure that the auditor, if any, does the same) to prevent any damage to Habiata's premises, facilities and personnel and/or any interruption of Habiata's business during the audit.

12.3. The Customer's information and audit rights exist under Section 12 only to the extent that the DPA does not otherwise provide information and audit rights that meet the relevant requirements of the Data Protection Laws.

12.4. The Parties shall make available to the competent supervisory authority, upon request, the information set out in this clause, including the results of any audit.

13. DATA TRANSFER

13.1. Habiata may not transfer or allow the transfer of Personal Data to countries outside the EU and/or the European Economic Area (EEA) without the prior written consent of the Customer or in the absence of a specific provision of European Union law or Data Protection Laws. If Personal Data processed under this DPA is transferred from a country within the European Economic Area to a country outside the European Economic Area, the Parties shall ensure that the Personal Data is adequately protected. For this purpose, the Parties will rely, unless otherwise agreed, on the standard contractual clauses approved by the European Union for the transfer of Personal Data.

14. CONFIDENTIALITY & NOTIFICATION

14.1. Confidentiality - Each Party shall maintain the confidentiality of this DPA and information it receives about the other Party and its activities in connection with this DPA and shall not use or disclose such confidential information without the prior written consent of the other Party, except to the extent that:

• (i) disclosure is required by law or a public authority (e.g. a regulator); or
• (ii) the relevant information is already in the public domain

14.2. Notices - All notices and communications given under this DPA shall be in writing and shall be delivered by hand, sent by post by registered post or sent by e-mail to the address or e-mail address set out in the Purchase Order or such other address as may be notified by the Parties from time to time.

15. NON-COMPLIANCE WITH CLAUSES AND TERMINATION

15.1. The validity of the DPA is linked to the validity and existence of the contract for the provision of services, evidenced by the signing of the Purchase Order, subject to the obligations that continue to apply thereafter.

15.2. Without prejudice to Data Protection Laws, in the event of a breach by Habiata of its obligations under this DPA, Customer may instruct Habiata to suspend the processing of personal data until Habiata has complied with this DPA or the DPA is terminated. Habiata shall promptly inform the Customer if it is unable to comply with this DPA for any reason.

15.3. The Customer is entitled to terminate the DPA if:

• (a) the processing of personal data by Habiata has been suspended by the Customer in accordance with point 15.2 and compliance with this DPA is not restored within a reasonable time and, in any event, within one month of the suspension
• (b) Habiata is in serious or persistent breach of this DPA or its obligations under Data Protection Laws
• (c) Habiata does not comply with a binding decision of a competent court or competent supervisory authority(ies) regarding its obligations under this DPA or the Data Protection Laws

15.4. Habiata is entitled to terminate the DPA if, after having informed the Customer that its instructions violate the Data Protection Laws, the Customer insists that its instructions be followed.

16. APPLICABLE LAW AND JURISDICTION

16.1. This DPA shall be governed by and construed in accordance with Luxembourg law, to the express exclusion of any provisions of Luxembourg private international law.

16.2. The courts of the Grand Duchy of Luxembourg shall have exclusive jurisdiction to hear all disputes relating to the formation, validity, interpretation, performance, non-performance or termination of the DPA (including any dispute relating to the existence, validity or termination of this DPA as well as non-contractual obligations in relation to this DPA).

ANNEX I

TECHNICAL AND ORGANISATIONAL MEASURES, INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE DATA SECURITY

Description of the technical and organisational security measures implemented by Habiata (including any relevant certification) to ensure a level of security appropriate to the nature, scope, context and purpose of the processing and the risks to the rights and freedoms of natural persons:

Data Classification

Habiata identifies the personal and sensitive data processed on behalf of the Customer and assigns each category a protection level. The controls below represent the minimum measures applied to each level. This classification is reviewed when new features or integrations are introduced.

Control Environment

Habiata's ongoing risk assessment and management process includes a periodic review of its organisational structure to help meet changing commitments and system requirements.

Communication and Information

Habiata logs critical information including, but not limited to, development, financial transactions, payroll and expenses. Habiata has policies and procedures in place for important processes. The responsibilities of the processor and the controller are described in the contract between the controller and the processor in relation to the processing of personal data. Planned or urgent changes to the system are communicated internally to all relevant stakeholders. This is covered by the incident and change management procedures.

Control Activities

Habiata's operating system and products are always built and deployed from source code stored in source code management systems such as Bitbucket. Before being deployed to production, all deployments are tested on non-production environments and tested by engineers and a dedicated QA team. No production data is used for testing. Deployment is fully automated and controlled. "Infrastructure-as-code" practice is used. All changes made to the software are logged.

Monitoring Activities

Processor access to customer-created documents, data and usage logs is controlled by AWS-identity-access-management mechanisms. Accounts with access to the production environment or customer data are subject to two-factor authentication. Subcontractor personnel may only access the controller's data on the controller's written instructions. Access to customer data is restricted on a role and need-to-know basis. Subcontractor staff are authorised to access the above information by completing an access request and will use their own identification details. Shared accounts or passwords are not permitted on production systems. When an employment contract or a collaboration contract (in the case of self-employed workers) ends, access is immediately withdrawn. The Processor has set up an "off-boarding" procedure. Communications between the Processor's services and those of the Controller are always encrypted using TLS 1.2 or better. Deployments are communicated via Slack to all engineers and staff. Configuration changes are tracked via source code management systems.

System Operations & Change Management

All code and configuration changes are reviewed by at least one member of the processor engineering team. CI tests are used to test and verify the application logic before any changes can be merged. The processor uses several environments to develop and test changes. The production environment is completely isolated from all other environments. Telemetry and anonymous usage data (e.g. exceptions, logs) are used to optimise processor services. Monitoring is used on telemetry and usage reports to quickly detect technical problems with a view to resolving them. Priority is given to mitigating and resolving security problems and incidents. The processor ensures the confidentiality, integrity and availability of processing systems and services at all times. Data is always transmitted encrypted (using TLS 1.2 or better). Data is stored encrypted in Processor environments. All backup data is encrypted. Key management systems are used by the Processor.