Data Processing Policy

Last Updated: October 2024

This Data Protection Policy (“DPP”) sets forth the obligations of The Real Brokerage Inc. and its subsidiaries (collectively “Real Broker”) with respect to the processing and security of Customer Data, and Personal Data in connection with the Products and Services. 

In the event of any conflict or inconsistency between this DPP  and any terms in a Customer’s agreement with Real Broker (“Customer’s Agreement”), the DPP terms shall prevail. The provisions of this DPP supersede any conflicting provisions of Real Broker’s Privacy Policy that otherwise may apply to processing of Customer Data or Personal Data, as defined herein. 

Real Broker makes the commitments in this DPP to all Customers with an existing Customer’s Agreement. These commitments are binding on Real Broker with regard to Customer regardless of (1) the Product Terms that are otherwise applicable to any given Product subscription or license, or (2) any other agreement that references the Product Terms.

‍

1. Your Definitions

1.1 “Company” shall mean the entity that processes Personal Data on behalf of the Customer and is the data processor as defined under applicable Data Protection Laws.  For the purposes of this DPP, “Company” shall also mean Real Broker.

1.2 “Customer” shall mean those real estate agent/brokers engaged in independent contractor agreements with Real Broker as well as potential buyers and sellers working with Real Broker and its agent/brokers. 

1.3 “Data Protection Laws” shall mean all applicable data protection and privacy laws, including but not limited to the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and the Personal Information Protection and Electronic Documents Act (PIPEDA).

1.4 “Data Subject” shall mean the identified or identifiable natural person, also referred to as a Customer herein, to whom the Personal Data relates.

1.5 “Personal Data” shall mean any information relating to an identified or identifiable natural person processed by the Company on behalf of the Customer, including but not limited to names, addresses, email addresses, phone numbers, financial information, and any other data that can be used to identify an individual.

1.6 “Processing” shall mean any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure, or destruction.

1.7 “Products and Services” shall mean the products and services provided by Real Broker to its independent contractor agent/brokers as well as the real estate related-services provided by Real Broker through its agent/brokers to buyers and sellers.

1.8 “Sub-processor” shall mean any third party engaged by the Company to process Personal Data on behalf of the Customer..

2. Scope and Purpose of Processing

2.1 Purpose of Processing

The Company shall process Personal Data only for the purposes of providing the services specified in the Customer’s Agreement. These services include, but are not limited to:

• Data storage
• Data analysis
• Customer relationship management
• Technical support
• Marketing and promotional activities
• Compliance with legal obligations
• Any other related services as agreed upon in writing by both parties

2.2 Compliance with Law

The Company shall process Personal Data in accordance with applicable law. 

2.3 Limitation on Processing

The Company shall not process Personal Data for any purpose other than those set forth in this Policy or as otherwise agreed upon in writing by the Customer. 

2.4 Confidentiality and Training

The Company shall ensure that all personnel engaged in the processing of Personal Data:

• Are informed of the confidential nature of the Personal Data
• Have received appropriate training on their responsibilities regarding the protection of Personal Data
• Are subject to confidentiality obligations or professional or statutory obligations of confidentiality

2.5 Documentation and Record-Keeping

The Company shall maintain accurate records of all processing activities carried out on behalf of the Customer, including:

• The purposes of the processing
• The categories of data subjects and Personal Data processed
• Any transfers of Personal Data to third countries or international organizations, including the identification of those countries or organizations
• A general description of the technical and organizational security measures implemented

3. Data Subject Rights

3.1 The Company shall promptly respond to requests from Customer/Data Subjects, including, but not limited to, requests for access, rectification, erasure, restriction of processing, data portability, and objection to processing. 

4. Security Measures

4.1 The Company shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including but not limited to:

1. Encryption of Personal Data in transit and at rest.
2. Measures to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services.
3. Measures to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident.
4. Regular testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.
5. Implementing access controls to ensure that only authorized personnel have access to Personal Data.
6. Conducting regular security audits and risk assessments to identify and mitigate potential security risks.

4.2 The Company shall maintain a written record of all categories of processing activities carried out on behalf of the Customer, including:

1. The name and contact details of the Company and the Customer.
2. The categories of processing carried out on behalf of the Customer.
3. A description of the technical and organizational security measures implemented.

5. Sub-processors

5.1 The Company engages sub-processors for the processing of Personal Data, provided that the Company imposes data protection obligations on any sub-processors that it engages that are at least as protective as those set out in this Agreement.

5.2 The Company shall maintain an up-to-date list of sub-processors, which shall be made available to the Customer upon request. This list shall include the identities of those sub-processors and their country of location.

5.3 The Company shall notify the Customer of any intended changes concerning the addition or replacement of sub-processors by updating this Policy, which is publicly available, accordingly.  

5.4 The Company shall remain fully liable to the Customer for the performance of the sub-processor’s obligations.

6. Data Breach Notification

6.1 The Company shall notify the Customer without undue delay upon becoming aware of a Personal Data breach. Such notification shall include, at a minimum:

1. The nature of the Personal Data breach, including the categories and approximate number of data subjects concerned and the categories and approximate number of Personal Data records concerned.
2. The likely consequences of the Personal Data breach.
3. Measures taken or proposed to be taken by the Company to address the Personal Data breach, including, where appropriate, measures to mitigate its possible adverse effects.

6.2 The Company shall cooperate with the Customer and take reasonable commercial steps as are directed by the Customer to assist in the investigation, mitigation, and remediation of each such Personal Data breach.

7. Data Transfers

7.1 Personal Data will be stored and processed in the United States. ,

7.2 The Company shall ensure that appropriate safeguards are in place to protect the Personal Data in accordance with Data Protection Laws, including but not limited to:

1. The use of standard contractual clauses approved by the relevant data protection authorities.
2. Any other legally recognized transfer mechanism that ensures an adequate level of protection.

8. Data Retention and Deletion

8.1 The Company shall retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected or as required by applicable law.

8.2 Upon termination of the Customer’s Agreement, the Company shall, at the Customer’s choice, return or delete all Personal Data processed on behalf of the Customer, unless applicable law requires storage of the Personal Data.

8.3 The Company shall certify in writing to the Customer that it has complied with the obligation to delete Personal Data.

8.4 The Company shall ensure that any sub-processor engaged by the Company also complies with the obligations set forth in this section.