Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the SaaS Terms of Service and of each Order Form between Fengming Media Solutions LLC ("Fengming" or "Processor") and the customer ("Customer" or "Controller"). It applies whenever Fengming processes personal data on behalf of the Customer in providing the Service, and it is intended to meet the requirements of Article 28 of the EU and UK General Data Protection Regulation ("GDPR") and of US state privacy laws applicable to service providers and processors.

1. Roles of the parties

1.1. The Customer is the controller of the personal data included in Customer Data, and Fengming processes it as processor (or "service provider" under US state laws) on the Customer's behalf.

1.2. Fengming will process personal data only on the documented instructions of the Customer. The SaaS Terms, the Order Form, this DPA and the Customer's use and configuration of the Service constitute the Customer's instructions. Fengming will inform the Customer if, in its opinion, an instruction infringes data protection law.

2. Details of the processing

• Subject matter and duration: provision of the Service for the term of the Order Form and until the deletion of Customer Data in accordance with the SaaS Terms.
• Nature and purpose: hosting, storage, organization, consultation, transmission, backup and deletion of data, and technical support, in order to provide the Service.
• Categories of data subjects: the Customer's Authorized Users (employees, agents and collaborators); and the Customer's clients, prospects and other contacts (for example property owners, buyers, tenants, leads and other persons involved in transactions).
• Types of personal data: identification and contact data; professional data; data about properties and transactions; communications and notes; appointments and visits; documents and contracts; electronic signature records; images; and technical data such as access logs.
• Special categories: the Service is not designed to process special categories of personal data or data relating to criminal convictions. The Customer will not upload such data unless permitted by law and agreed in writing.

3. Obligations of Fengming

Fengming will:

• ensure that persons authorized to process personal data are bound by confidentiality obligations;
• implement the technical and organizational measures described in Annex I;
• assist the Customer, through appropriate measures and taking into account the nature of the processing, in responding to requests from data subjects exercising their rights;
• assist the Customer in ensuring compliance with its security, breach notification, data protection impact assessment and prior consultation obligations, taking into account the information available to Fengming;
• not sell or share personal data, not retain, use or disclose it for any purpose other than providing the Service, and not combine it with personal data received from other sources, except as permitted by applicable law;
• make available to the Customer the information necessary to demonstrate compliance with this DPA.

4. Sub-processors

4.1. The Customer gives Fengming general authorization to engage sub-processors. The current sub-processors are listed in Annex II.

4.2. Fengming will inform the Customer at least thirty (30) days in advance of any intended addition or replacement of sub-processors. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a refund of prepaid fees for the remaining period.

4.3. Fengming will impose on each sub-processor data protection obligations substantially equivalent to those of this DPA and will remain liable for its sub-processors' performance.

5. Personal data breaches

Fengming will notify the Customer without undue delay, and where feasible within forty-eight (48) hours, after becoming aware of a personal data breach affecting Customer Data. The notification will include the information available to Fengming that the Customer reasonably needs to meet its own notification obligations, and Fengming will take reasonable measures to contain the breach and mitigate its effects.

6. International transfers

6.1. Fengming is established in the United States and some sub-processors may process data outside the European Economic Area (EEA), the United Kingdom or Switzerland.

6.2. For transfers of personal data from the EEA to Fengming in a country without an adequacy decision, the parties agree to the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated by reference, with the following options: clause 7 (docking clause) applies; clause 9, option 2 (general authorization) with the notice period of section 4.2; clause 11, the optional language does not apply; clause 13, the supervisory authority competent for the Customer; clauses 17 and 18, the law and courts of Ireland. Annexes I and II of this DPA serve as the annexes of the clauses. For transfers from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner applies, and for transfers from Switzerland, the clauses apply with the necessary adaptations.

6.3. In case of conflict between this DPA and the Standard Contractual Clauses, the clauses prevail.

7. Audits

Fengming will respond to reasonable written requests for information about its compliance with this DPA. If that information is not sufficient, the Customer may carry out an audit, no more than once a year, with at least thirty (30) days' notice, during business hours, at its own cost and subject to confidentiality obligations, or have it carried out by an independent auditor bound by confidentiality.

8. Return and deletion of data

At the end of the provision of the Service, Fengming will allow the Customer to export Customer Data and will then delete it in accordance with the SaaS Terms, unless retention is required by applicable law.

9. Liability and order of precedence

The liability of each party under this DPA is subject to the limitations of the SaaS Terms, except where applicable law does not allow it. In the event of a conflict regarding the processing of personal data, this DPA prevails over the SaaS Terms and the Order Form.

10. Contact

Data protection questions about this DPA can be sent to privacy@fengming.media.

Annex I — Technical and organizational measures

• Isolation: each Customer uses a separate Instance, with its own data and users, not shared with other customers.
• Access control: role-based permissions (for example administrator, manager and agent), individual credentials and access limited to what each role needs.
• Encryption in transit: all connections to the Service use HTTPS/TLS.
• Protected file storage: documents and images are stored in private storage and accessed through temporary signed links.
• Backups: periodic backups of the hosting environment.
• Change management: changes to the Service are deployed through a version-controlled repository.
• Personnel: access to Customer Data by Fengming personnel is limited to what is necessary for support, maintenance and security, under confidentiality obligations.
• Incident management: procedures to detect, investigate and notify security incidents.

Annex II — Sub-processors

Sub-processor	Service	Location of processing
Hostinger	Hosting of the Service and databases; email	As indicated in the Order Form or Instance configuration
Cloudflare (R2)	Storage of documents and images	European Union jurisdiction, where configured
Brevo	Sending of transactional emails from the Service, when managed by Fengming	European Union
Google (Google Workspace)	Fengming's support communications and internal documentation	United States and other locations

Integrations activated by the Customer with its own accounts at third-party services (for example electronic signature, calendar or email providers) are not sub-processors of Fengming; their use is governed by the agreement between the Customer and those providers.