Schedule 3 — Data Processing Agreement (Article 28 GDPR)

Version NLS-2.0 · Effective 27 October 2026 · Last updated 27 October 2026

This DPA applies where NLS processes Personal Data on behalf of the Member as controller.

1. Definitions

“Controller”, “Processor”, “Personal Data”, “Personal Data Breach”, “Processing” and “Data Subject” have the meanings in GDPR. “Member Personal Data” means Personal Data processed by NLS on behalf of Member in providing the Services.

2. Roles

For Member Personal Data, Member is controller and NLS is processor except where the parties’ actual processing circumstances require another classification. Each party remains responsible for obligations applicable to its role. NLS may act independently as controller for account administration, billing, security, fraud prevention, legal compliance and its own audit records.

3. Instructions

NLS will process Member Personal Data only on documented instructions from Member, including instructions inherent in Member’s use/configuration of the Services, unless Union or Member State law requires processing. NLS will inform Member of such legal requirement before processing unless prohibited by law.

4. Subject matter and duration

Processing concerns provision of NLS CRM, lead, client, transaction, document, communications, appointment, AI-assisted and related platform functionality for the term of the Services plus permitted retention/deletion periods.

5. Nature and purposes

Hosting, organisation, retrieval, display, search, matching, communication, document generation, transaction workflow, electronic execution support, security, backup, export, deletion, and other processing necessary to provide Member-selected functionality.

6. Data subjects

Buyers, sellers, landlords, tenants, prospects, leads, clients, transaction parties, signatories, beneficial owners, representatives, professional advisers, Member personnel and other persons whose information Member submits or directs NLS to process.

7. Data types

Identification and contact data; client requirements; property and transaction data; communications; appointments/tasks; professional information; documents; signatures and audit data; financial/account information where included in transaction forms; AML/KYC information where included by Member; and other information Member elects to process. Member must not submit Article 9 special-category data unless necessary, lawful and supported by appropriate safeguards and NLS permits the relevant processing.

8. Confidentiality

NLS will ensure persons authorised to process Member Personal Data are bound by confidentiality obligations.

9. Security

NLS will implement appropriate technical and organisational measures taking into account state of the art, costs, nature/scope/context/purpose and risk. Measures may include access controls, protected document storage, secure transport, backup, logging, least-privilege access, vulnerability/patch management and incident procedures as appropriate.

10. Subprocessors

Member grants general written authorisation for NLS to use subprocessors listed in NLS’s maintained subprocessor register. NLS will impose materially equivalent Article 28 obligations on subprocessors. NLS will provide reasonable notice of intended additions/replacements where required, allowing Member to object on reasonable data-protection grounds.

11. International transfers

NLS will not transfer Member Personal Data to a third country except on Member instructions or using a lawful Chapter V GDPR mechanism. Where applicable, NLS will implement Standard Contractual Clauses, an adequacy mechanism or another valid safeguard and supplementary measures where required.

12. Data subject requests

Taking into account the nature of processing, NLS will provide reasonable assistance through appropriate technical and organisational measures to enable Member to respond to requests under GDPR Chapter III. If NLS receives a request relating solely to Member-controlled data, NLS may direct the requester to Member unless law requires otherwise.

13. Compliance assistance

Taking into account the nature of processing and information available, NLS will reasonably assist Member with Articles 32–36 obligations, including security, breach assessment, DPIAs and prior consultation where applicable.

14. Breach notification

NLS will notify Member without undue delay after becoming aware of a Personal Data Breach affecting Member Personal Data and provide information reasonably available to support Member’s assessment and notification obligations. Notification does not constitute an admission of fault.

15. Return and deletion

At termination and on Member’s choice, NLS will return or delete Member Personal Data, unless law requires retention. Data in backups may remain until normal expiry, provided it remains protected and is not restored to active use except for legitimate disaster recovery. Current backup lifecycle: up to 30 days, subject to final production verification.

16. Audit

NLS will make available information reasonably necessary to demonstrate Article 28 compliance and allow audits by Member or an independent auditor, subject to reasonable notice, confidentiality, security and non-disruption conditions. NLS may satisfy routine requests using current third-party reports/certifications where available.

17. Unlawful instructions

NLS will inform Member if, in its opinion, an instruction infringes GDPR or other applicable Union/Member State data-protection law and may suspend the affected processing while the parties resolve the issue.

18. Member obligations

Member warrants that its instructions are lawful; it has an appropriate lawful basis; it has provided required notices; it will not instruct NLS to process data unlawfully; and it will use Platform permissions and retention controls appropriately.

DPA Annex — current processing infrastructure

Data-protection contact

For any question about your personal data or to exercise your rights, contact our privacy contact, Conor O’Connor, at [email protected].