Data Processing Addendum

Effective date: 2026-07-05
Version: 1.0

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Meridian Labs, LLC d/b/a Regencly ("Regencly," "Processor") and the Customer ("Customer," "Controller"). It governs Regencly's processing of Personal Data on the Customer's behalf. If there is a conflict on data-protection matters, this DPA controls over the Terms.

Scope note. For the Customer's own account data, Regencly is a controller and its Privacy Policy applies. This DPA covers End-User Personal Data (leads, clients, and visitors of the Customer's site) that Regencly processes on the Customer's behalf as a processor. When the Customer connects a third-party CRM or email/SMS provider, that provider is the Customer's own tool (not Regencly's subprocessor); data flows to it at the Customer's direction, and the Customer is responsible for its terms.

1. Definitions

"Data Protection Laws" means all privacy/data-protection laws applicable to the processing, including the CCPA/CPRA and other US state privacy laws, and, where applicable, the EU/UK GDPR and Swiss FADP. "Personal Data," "controller," "processor," "process/processing," "data subject," and "personal information" have the meanings in the applicable Data Protection Laws. "Subprocessor" means a third party engaged by Regencly to process Personal Data. "SCCs" means the EU Standard Contractual Clauses (Commission Decision 2021/914).

2. Roles and scope of processing

2.1 The Customer is the controller and Regencly is the processor of the End-User Personal Data. Regencly processes Personal Data only to provide the Service and on the Customer's documented instructions (including as set out in the Terms and this DPA), unless legally required otherwise (in which case Regencly will inform the Customer unless the law prohibits it).

2.2 The subject matter, duration, nature, and purpose of processing, the types of Personal Data, and the categories of data subjects are described in Annex I.

2.3 CCPA/CPRA service-provider terms. Regencly acts as the Customer's service provider. Regencly will not: (a) sell or share the Personal Data; (b) retain, use, or disclose it for any purpose other than the business purposes specified in the Terms/this DPA, or outside the direct business relationship; or (c) combine it with data from other sources except as permitted by the CCPA/CPRA. Regencly certifies it understands and will comply with these restrictions.

3. Confidentiality

Regencly ensures that personnel authorized to process Personal Data are bound by confidentiality obligations and process the data only as instructed.

4. Security

Regencly implements and maintains appropriate technical and organizational measures to protect Personal Data, as described in Annex II, taking into account the state of the art, the risks, and the nature of the data.

5. Subprocessors

5.1 The Customer provides general authorization for Regencly to engage Subprocessors to process Personal Data. Regencly's current Subprocessors are listed at regencly.com/legal/subprocessors.

5.2 Regencly imposes data-protection obligations on each Subprocessor no less protective than those in this DPA and remains responsible for its Subprocessors' performance.

5.3 Regencly will give the Customer at least 30 days' advance notice of any new or replacement Subprocessor (via the Subprocessors page and/or email). If the Customer reasonably objects on data-protection grounds, the parties will work in good faith to resolve it; if they cannot, the Customer may terminate the affected Service.

6. Assistance to the Customer

6.1 Data-subject requests. Taking into account the nature of the processing, Regencly will assist the Customer (by appropriate technical and organizational measures, insofar as possible) to respond to data-subject requests (access, deletion, correction, portability, opt-out, etc.). If a request comes to Regencly directly, Regencly will, where permitted, route it to the Customer rather than responding itself.

6.2 DPIAs and consultation. Regencly will provide reasonable assistance with data-protection impact assessments and consultations with authorities where required.

7. Personal Data breach

Regencly will notify the Customer without undue delay after becoming aware of a Personal Data breach affecting the Customer's Personal Data, and will provide information reasonably available to help the Customer meet its notification obligations.

8. Return and deletion

On termination of the Service, Regencly will delete or return the Customer's Personal Data in accordance with the offboarding sequence in the Terms (site dark → 30-day self-serve export window → deletion within 30 days; backups purged on standard rotation), except where retention is required by law. On request, Regencly will confirm deletion.

9. Audits

Regencly will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including by providing third-party audit reports/certifications where available, subject to confidentiality and reasonable frequency.

10. International transfers

Where Personal Data protected by the EU/UK GDPR or Swiss FADP is transferred to a country without an adequacy decision, the parties agree the SCCs (with the UK Addendum and Swiss amendments as applicable) are incorporated by reference and apply, with Module Two (controller-to-processor) or Module Three (processor-to-processor) as relevant. Annex I/II populate the SCC annexes.

11. General

This DPA is governed by the same law and dispute terms as the Terms, except where Data Protection Laws require otherwise. If any SCC term conflicts with this DPA, the SCCs prevail for the data they govern.

Annex I: Description of processing

• Controller: the Customer. Processor: Meridian Labs, LLC d/b/a Regencly.
• Subject matter: provision of the managed real-estate website + marketing Service.
• Duration: the Subscription Term plus the wind-down/deletion period in the Terms.
• Nature and purpose: hosting a website; capturing and storing leads/inquiries; passing data to Customer-connected tools at the Customer's direction; analytics for the Customer; support and security.
• Categories of data subjects: the Customer's leads, prospective and actual clients, and website visitors.
• Types of Personal Data: name, email, phone, postal address; property interests and inquiry details; communications content; device/usage/analytics data; any additional data the Customer collects through its site. No special-category data is requested; the Customer should not submit it.

Annex II: Technical and organizational security measures

Regencly maintains security measures appropriate to the risk, which include:

• Encryption of Personal Data in transit (TLS) and at rest.
• Access controls: least-privilege, role-based access; individual credentials; MFA for administrative access.
• Network and application security; secrets stored in a managed secret store; audit logging.
• Regular backups with a defined rotation and restoration testing.
• Vulnerability management and patching; a secure software-development lifecycle.
• Personnel confidentiality obligations and security awareness.
• Incident-response process and breach-notification procedures.
• Vendor/Subprocessor security review.