Data Processing Agreement

Processor: {{LEGAL_NAME}}, registered in India, CIN/LLPIN {{CIN}}, registered office {{REGISTERED_ADDRESS}}. Trading as EstateEngine. Contact: sam@getestateengine.com.

This Data Processing Agreement (“DPA”) is entered into between the Customer, acting as data controller, and EstateEngine, acting as data processor, and forms part of the Terms of Service or master services agreement between them.

Capitalised terms not defined here have the meaning given in the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“PDPL”) and, where applicable, the EU General Data Protection Regulation (“GDPR”). “Personal Data”, “Data Subject”, “Processing”, “Controller”, and “Processor” carry their statutory meanings.

EstateEngine processes Personal Data on behalf of the Customer solely for the purpose of providing the EstateEngine Voice service, which enables the Customer to run compliant AI outbound calling campaigns to property owners and to receive qualification, scoring, and handoff outputs.

Categories of Data Subjects: property owners and other individuals contacted through the Service; the Customer's employees and specialists.

Categories of Personal Data: name; phone number; community and unit metadata; call recordings; call transcripts; structured qualification fields; sentiment and outcome data; scores; suppression status; consent source; audit-log entries; workspace login and role metadata.

EstateEngine will process Personal Data for the term of the underlying agreement, plus any period during which return or deletion is being performed in accordance with Section 11.

EstateEngine will:

• Process Personal Data only on documented instructions from the Customer, including as configured through the Service, and only as required to provide the Service.
• Ensure that personnel authorised to process Personal Data are subject to appropriate obligations of confidentiality.
• Implement the technical and organisational security measures described in Section 8.
• Assist the Customer, insofar as reasonably possible, in responding to Data Subject requests and in complying with the Customer's obligations under PDPL and GDPR.
• Not use Call Subject data to train third-party machine learning models.

The Customer authorises EstateEngine to engage the sub-processors listed below. EstateEngine will notify the Customer in advance of adding or replacing a sub-processor and will impose data protection terms substantially equivalent to those in this DPA on each sub-processor.

EstateEngine implements security measures appropriate to the risk of processing, including encryption in transit (TLS 1.2 or higher) and at rest (AES-256 via managed database), row-level security scoped by workspace, least-privilege access controls, mandatory multi-factor authentication for privileged access, signed webhook verification, isolated service-role credentials, and continuous security logging. See the Security overview for details.

EstateEngine will assist the Customer in fulfilling Data Subject requests by providing appropriate tools within the Service (search, export, deletion, suppression) and, where necessary, by responding to reasonable written requests from the Customer within a commercially reasonable time.

EstateEngine will notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting the Customer's Personal Data. The notice will include, to the extent known: the nature of the breach, categories and approximate number of Data Subjects affected, likely consequences, and measures taken or proposed to address the breach.

On termination of the underlying agreement, and at the Customer's written option, EstateEngine will return or delete Personal Data within thirty (30) days, subject to any legal obligation to retain a copy. Backups are overwritten in the ordinary course of business. Suppression records are retained indefinitely to uphold do-not-call obligations.

EstateEngine will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA. Where an audit is required by law or by a regulator, the Customer may conduct an audit at reasonable intervals, on reasonable notice, at its own cost, and subject to reasonable confidentiality and security requirements.

Each party's liability under this DPA is subject to the limitations and exclusions set out in the underlying agreement between the parties.

Requests and notices under this DPA should be sent to sam@getestateengine.com.