Data Processing Addendum

Roles and obligations for tenant personal information

Effective: 1 June 2026 | RZBB Ventures LLC

This Data Processing Addendum ("DPA") applies to PropPilot customers ("Customer") who enter tenant personal information into the Platform. It clarifies the respective roles of the Customer and RZBB Ventures LLC ("PropPilot") in relation to that information.

1. Roles

For tenant personal information entered into the Platform by the Customer:

• The Customer is the entity responsible for the collection and use of that information and determines the purposes for which it is used

• PropPilot processes that information only on the Customer's behalf and only to provide the Platform

2. Customer Obligations

The Customer is responsible for:

• Ensuring it has a lawful basis to collect and use tenant personal information

• Providing tenants with appropriate notice of how their information will be used

• Obtaining any required consents from tenants before entering their information into PropPilot

• Complying with the Australian Privacy Act 1988 and all applicable privacy laws

• Not entering information it is not legally authorised to process

3. PropPilot Obligations

PropPilot will:

• Process tenant personal information only to provide the Platform to the Customer

• Maintain reasonable technical and organisational security safeguards

• Assist the Customer with access, correction, and deletion requests where practical

• Notify the Customer of any suspected data breach affecting tenant personal information without undue delay

• Use approved subprocessors only (see Subprocessor List)

• Not use tenant personal information for any purpose other than providing the Platform

4. Subprocessors

PropPilot uses subprocessors as listed in our Subprocessor List. We will take reasonable steps to notify Customers of material changes to subprocessors.

5. Data Retention and Deletion

PropPilot will retain tenant personal information for as long as the Customer's account is active, and will delete or anonymise it within a reasonable period after account closure, except where retention is required by law.

6. Security Incidents

PropPilot will notify the Customer without undue delay upon discovering a confirmed or suspected security incident affecting tenant personal information in the Customer's account. Notification will include available information about the nature of the incident and the steps being taken to address it.