Data Processing Addendum

This Data Processing Addendum (the "DPA") is entered into between:

1. HomeHub Portal, trading as HomeHub, a business licensed by the Department of Economy and Tourism in Dubai under trade licence number 1629357, with its registered address at P.O. Box 70834, Dubai, United Arab Emirates ("HomeHub"); and

2. The customer identified in the Order Form or account registration that references this DPA (the "Customer").

This DPA forms part of, and is incorporated into, the HomeHub Terms of Service or other written agreement between HomeHub and the Customer for the provision of the Services (the "Agreement"). It applies wherever HomeHub Processes Personal Data on behalf of the Customer in the course of providing the Services, including in respect of the free first Kit provided without charge.

1Definitions and interpretation

1.1In this DPA the following terms have the following meanings. Terms defined in the Agreement have the same meaning when used in this DPA.

(a)"PDPL" means Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data of the United Arab Emirates, together with any executive regulations, decisions and guidance issued under it from time to time.

(b)"Personal Data" means any data relating to an identified natural person, or to a natural person who can be identified directly or indirectly by way of linking data, within the meaning of the PDPL. For the purposes of this DPA the parties agree to treat an image of an identifiable natural person, and a readable vehicle number plate, as Personal Data.

(c)"Sensitive Personal Data" has the meaning given in the PDPL, and includes data revealing racial or ethnic origin, political or philosophical opinion, religious belief, criminal record, biometric data and health data.

(d)"Processing" and "Process" mean any operation performed on Personal Data within the meaning of the PDPL, including collection, storage, organisation, adaptation, use, disclosure, transmission and erasure.

(e)"Controller" means the person who determines the purpose and means of Processing, within the meaning of the PDPL.

(f)"Processor" means the person who Processes Personal Data on behalf of a Controller, within the meaning of the PDPL.

(g)"Data Subject" means the natural person to whom Personal Data relates.

(h)"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

(i)"Sub-processor" means any third party engaged by HomeHub to Process Customer Personal Data on the Customer's behalf.

(j)"UAE Data Office" means the UAE Data Office established by Federal Decree-Law No. 44 of 2021, or any successor federal data protection authority.

(k)"Services" means the human-reviewed, AI-assisted production and delivery of bilingual property marketing kits (each a "Kit") as described in the Agreement.

(l)"Listing Data" means the content the Customer submits to HomeHub for the production of a Kit, comprising the unstructured property description text, the property photographs and any other files or particulars submitted with them, together with any Personal Data contained in that content.

(m)"Account Data" means Personal Data relating to the Customer and its personnel that HomeHub Processes for its own purposes as Controller, as described in clause 3.2.

(n)"Customer Personal Data" means Personal Data contained in Listing Data that HomeHub Processes on behalf of the Customer as Processor.

1.2Headings are for convenience only. References to a clause or Annex are to a clause of, or Annex to, this DPA unless stated otherwise. The Annexes form part of this DPA.

2Relationship to the Agreement

2.1This DPA supplements the Agreement. In the event of a conflict between this DPA and the Agreement in relation to the Processing of Personal Data, this DPA prevails to the extent of the conflict.

2.2Nothing in this DPA relieves either party of its own obligations under the PDPL or any other applicable law of the United Arab Emirates.

3Roles of the parties

3.1The parties acknowledge that HomeHub acts in two distinct capacities, and agree that their respective roles are as set out in the following table:

3.2This DPA governs HomeHub's Processing of Customer Personal Data as Processor. HomeHub's Processing of Account Data as Controller is governed by the HomeHub Privacy Policy and does not form part of the Processor relationship under this DPA.

3.3The parties acknowledge that the same data item, for example the Customer's broker name and registered telephone number, may fall within both categories depending on the purpose of the Processing, and agree that the applicable role is determined by the purpose for which the item is Processed in each instance.

3.4The Customer is solely responsible, as Controller, for the lawfulness of the Listing Data it submits, for establishing a lawful basis for its collection and Processing, for the accuracy of that data, and for its decisions to publish or distribute any Kit deliverable.

4Subject matter, duration, nature and purpose of the Processing

4.1The subject matter, duration, nature and purpose of the Processing, the categories of Data Subjects and the categories of Personal Data are set out in Annex 1.

4.2HomeHub will Process Customer Personal Data only for the purpose of producing, human-reviewing, quality-checking, delivering and supporting the Kits ordered by the Customer, and for no other purpose, for the duration of the Agreement and any retention period stated in clause 16.

5Documented instructions

5.1HomeHub will Process Customer Personal Data only on the Customer's documented instructions, unless required to do otherwise by a law of the United Arab Emirates, in which case HomeHub will inform the Customer of that legal requirement before Processing unless the law prohibits such disclosure.

5.2The parties agree that the following together constitute the Customer's complete documented instructions as at the date of this DPA:

(a)the Agreement and this DPA, including the Annexes;

(b)the act of submitting a listing through the Service, which instructs HomeHub to Process the submitted Listing Data to produce the Kit deliverables described in the Agreement; and

(c)any further written instruction given by an authorised representative of the Customer and accepted by HomeHub in writing.

5.3If HomeHub receives a request from a court, regulator, law enforcement body or other public authority for the disclosure of Customer Personal Data, it will, unless prohibited by law from doing so, notify the Customer without undue delay before disclosing, will disclose only what it is legally obliged to disclose, and will keep a record of the request and of what was disclosed.

5.4If HomeHub considers that an instruction breaches the PDPL or other applicable UAE law, it will inform the Customer without undue delay and may suspend performance of the affected instruction until the matter is resolved. Suspension under clause 5.4 is a compliance safeguard and does not constitute a breach of the Agreement by HomeHub.

6Purpose limitation and prohibition on secondary use

6.1HomeHub will not use Listing Data, Customer Personal Data or Kit deliverables to train, fine-tune, evaluate or improve any artificial intelligence model, whether its own or a third party's.

6.2HomeHub will not use Listing Data or Customer Personal Data to build, contribute to or enrich any comparables database, price index, market report, lead list, owner or landlord database, or any property intelligence or analytics product.

6.3Any use of the kind described in clauses 6.1 or 6.2 requires a separate, clearly labelled, written opt-in agreement signed by the Customer. Silence, continued use of the Services or acceptance of updated terms does not constitute such an opt-in.

6.4HomeHub does not scrape property portals, does not acquire listings or owner data from third parties, and Processes only what the Customer submits.

6.5HomeHub will not contact any Data Subject whose Personal Data appears in Listing Data for any purpose other than as instructed by the Customer under this DPA.

6.6HomeHub will not sell, rent, licence or otherwise disclose Customer Personal Data to any third party, except to a Sub-processor engaged in accordance with clause 9, as directed by the Customer, or as required under clause 5.1 or clause 5.3.

7Confidentiality of personnel

7.1HomeHub will ensure that every person it authorises to Process Customer Personal Data, including its founders, employees, and any contractor or freelance reviewer, is bound by a written obligation of confidentiality that survives the end of that person's engagement, or is under an appropriate statutory obligation of confidentiality.

7.2HomeHub will limit access to Customer Personal Data to those persons who need access to perform the Services, and will maintain a record of the individuals so authorised.

7.3The obligations in this clause 7 survive termination or expiry of this DPA and of the Agreement.

8Security of Processing

8.1HomeHub will implement and maintain the technical and organisational security measures described in Annex 2, and such further measures as are appropriate to the nature of the Customer Personal Data and the risks presented by the Processing, taking into account the state of the art and the costs of implementation for a business of HomeHub's size.

8.2HomeHub may update the measures in Annex 2 from time to time, provided that no update materially reduces the overall level of protection during the term of the Agreement.

8.3HomeHub makes no representation that its security measures are certified against any external standard, and the Customer acknowledges that Annex 2 describes the measures actually implemented.

9Sub-processing

9.1The Customer grants HomeHub a general written authorisation to engage the Sub-processors listed in Annex 3 for the Processing activities described in that Annex. Annex 3 reproduces the HomeHub Sub-Processor Register as at the effective date of this DPA. The Sub-Processor Register published on the Legal page of the HomeHub website is the current authoritative list, is incorporated into this DPA by reference, and prevails over Annex 3 to the extent the two differ following a change notified under clause 9.2.

9.2HomeHub will give the Customer at least 30 days' prior written notice, by email to the Customer's registered notice address, of the addition or replacement of any Sub-processor. The notice will identify the Sub-processor, its location and the Processing it will perform. Where a Sub-processor must be replaced urgently for reasons outside HomeHub's reasonable control, such as the sudden failure or insolvency of a provider, HomeHub may make the replacement immediately and will notify the Customer as soon as reasonably practicable, and the objection right in clause 9.3 then runs from the date of that notice.

9.3If the Customer has reasonable grounds relating to data protection to object to a new Sub-processor, it may notify HomeHub in writing within 30 days of the notice. The parties will discuss the objection in good faith and HomeHub will work with the Customer to find an alternative. If no alternative is reasonably available and the objection is maintained, the Customer may terminate the affected subscription on written notice and HomeHub will refund the fees paid for the unused remainder of the current subscription period, calculated pro rata in AED. That refund is the Customer's primary remedy in respect of an objection under this clause, and this clause does not exclude any right the Customer has under UAE law that cannot be excluded. This clause prevails over the HomeHub Refund and Cancellation Policy to the extent of any inconsistency.

9.4HomeHub will impose on each Sub-processor, by written contract, data protection obligations that provide substantially the same level of protection for Customer Personal Data as this DPA, to the extent applicable to the service the Sub-processor provides.

9.5HomeHub remains fully liable to the Customer for the performance of each Sub-processor's obligations.

9.6Human reviewers, Arabic editors and designers engaged by HomeHub as contractors who access Customer Personal Data are treated as Sub-processors for the purposes of this clause 9 and will be engaged only under written contracts meeting the requirements of clauses 7.1 and 9.4.

10Cross-border transfers

10.1The drafting of each Kit is performed by a hosted artificial intelligence model operated by the Sub-processor named for that purpose in Annex 3. The Listing Data a Customer submits, being the pasted listing text and the uploaded photographs, is transmitted in full to that Sub-processor in the United States for that step, and is transmitted again for any section a human reviewer sends back to be redrafted. Everything else in the production of a Kit is performed on HomeHub-controlled hardware located in the United Arab Emirates: the correction and resizing of photographs, the design and layout of the deliverables, the human review of every Kit, and the decision to deliver it. HomeHub will not route any production step to any further hosted third-party artificial intelligence model service unless that service has first been added to the Sub-Processor Register and notified under clause 9.2.

10.2The Customer acknowledges and agrees that the Sub-processors identified in Annex 3 as located outside the United Arab Emirates will Process the categories of Customer Personal Data described in Annex 3 outside the United Arab Emirates, and the Customer, as Controller, expressly consents to those transfers for the purposes described in Annex 3.

10.3For each transfer described in clause 10.2, HomeHub relies on the grounds available under the PDPL for transfers to jurisdictions in respect of which no adequacy determination has been published, namely contractual safeguards imposing appropriate protection, supported by the Customer's express consent recorded in this DPA. The contractual safeguards consist of the written data protection terms in place between HomeHub and each Sub-processor as described in clause 9.4.

10.4If the UAE Data Office publishes an adequacy list, official standard contractual clauses or any other prescribed transfer mechanism, the parties will cooperate to adopt the prescribed mechanism, and will execute any officially issued standard clauses, within 60 days of a written request by either party.

10.5HomeHub will not transfer Customer Personal Data outside the United Arab Emirates other than as described in this clause 10 and Annex 3.

11Assistance with Data Subject rights

11.1Taking into account the nature of the Processing, HomeHub will assist the Customer, by appropriate technical and organisational measures and at no additional charge for reasonable volumes, in fulfilling the Customer's obligation to respond to Data Subject requests under the PDPL, including requests for access, copies, portability, correction, erasure, restriction, objection to Processing and rights relating to automated Processing.

11.2If HomeHub receives a request or complaint directly from a Data Subject relating to Customer Personal Data, HomeHub will not respond substantively to the Data Subject, except to acknowledge receipt and to direct the Data Subject to the Customer, and will forward the request to the Customer within 5 business days of receipt.

11.3The parties record that no Kit involves any decision based solely on automated Processing that produces legal effects concerning a Data Subject. Every Kit is reviewed by a natural person before delivery.

12Personal Data Breach

12.1HomeHub will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data and, as a contractual service commitment, will use all reasonable endeavours to provide the initial notification within 48 hours of becoming aware. The parties record that this 48-hour figure is a contractual commitment agreed between them and is separate from, and without prejudice to, the notification standard and procedure prescribed under the PDPL from time to time. The HomeHub Privacy Policy states the statutory standard, being notification on becoming aware, and nothing in this clause varies that standard or represents it as a legal deadline.

12.2The notification will include, to the extent then known: the nature of the breach; the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a contact point at HomeHub. Information may be provided in phases as it becomes available, and HomeHub will keep the Customer updated.

12.3HomeHub will provide reasonable assistance to the Customer in meeting the Customer's own obligations to notify the UAE Data Office and affected Data Subjects.

12.4HomeHub will document all Personal Data Breaches affecting Customer Personal Data, including the facts, effects and remedial action taken, and will make that documentation available to the Customer on written request.

12.5Neither party will make any public statement, or any notification to a Data Subject, that names the other party in connection with a Personal Data Breach without first consulting the other party, except where required by law or a competent authority.

13Impact assessments and consultation

13.1Taking into account the nature of the Processing and the information available to it, HomeHub will provide reasonable assistance to the Customer with any data protection impact assessment, and any prior consultation with the UAE Data Office, that the Customer is required to carry out under the PDPL in connection with the Services.

14Customer obligations and warranties

14.1The Customer warrants and undertakes that:

(a)it holds all rights, consents, licences, permits and authority necessary to submit the Listing Data to HomeHub and to instruct the Processing described in this DPA, including a valid instruction or marketing authority from the property owner or landlord where required;

(b)submitted photographs do not depict identifiable natural persons without the consent of each such person, and the Customer will not publish any Kit deliverable containing an identifiable third party without that person's consent. For this purpose a readable vehicle number plate is treated in the same way as an identifiable person;

(c)it will not submit Personal Data beyond what is necessary for the marketing of the listing, and specifically will not submit seller, landlord or owner contact details except where necessary, and will under no circumstances submit Emirates ID numbers, passport numbers, bank or card details, or any Sensitive Personal Data;

(d)it has established a lawful basis under the PDPL for the collection of all Personal Data contained in the Listing Data and for the Processing instructed under this DPA;

(e)it will review, verify and approve every Kit deliverable before publication or distribution, and it alone decides whether and where a deliverable is published; and

(f)it will not use any WhatsApp broadcast text or other outreach deliverable except in compliance with applicable law and regulatory circulars governing contact with property owners and investors, and it will send such messages only to recipients it may lawfully contact.

14.2The Customer expressly authorises HomeHub to strip, mask, blur or delete any data described in clause 14.1(c) that HomeHub encounters in submitted material, without prior notice. Acting under this clause is a compliance safeguard and is not a breach of the Agreement or a service defect.

14.3The Customer will compensate HomeHub, its officers and its personnel for losses, damages, fines, penalties and reasonable legal costs finally determined or reasonably incurred as a result of third-party claims, regulatory action or criminal complaints arising from the Customer's breach of the warranties in clause 14.1 or from content the Customer submitted or published. This obligation sits outside, and is not reduced by, any limitation of liability in the Agreement.

15HomeHub's right to redact, refuse and suspend

15.1As a compliance safeguard, HomeHub may, acting reasonably and proportionately:

(a)blur or mask identifiable faces and readable vehicle number plates in submitted photographs, or flag them back to the Customer;

(b)remove Personal Data from submitted text that appears unnecessary for the marketing of the listing;

(c)decline to produce or deliver a Kit, or part of a Kit, where it reasonably believes that production or delivery would breach the PDPL, Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes, or other applicable UAE law; and

(d)suspend the Customer's account where it reasonably believes the Customer is in material breach of clause 14.

Action properly taken under this clause 15.1 is not a breach of the Agreement by HomeHub and is not a service defect. This clause does not exclude liability for a harmful act or any other liability that cannot be excluded under UAE law.

15.2HomeHub's human review of each Kit includes a reasonable-endeavours visual check for obviously identifiable individuals and readable vehicle number plates. HomeHub does not warrant that this check will detect every identifiable person or plate, including partial reflections or images within images, and the Customer's pre-publication review under clause 14.1(e) remains the final control.

16Retention, return and deletion

16.1HomeHub will retain and delete Customer Personal Data as follows, subject to clause 16.4:

(a)submitted Listing Data, including photographs and text, is deleted from HomeHub's active production systems within 60 days after delivery of the relevant Kit, matching the period published in the HomeHub Privacy Policy;

(b)delivered Kits are retained on HomeHub's systems for the duration of the Customer's subscription and are deleted within 90 days after termination or expiry of the Agreement;

(c)the private results page link for each Kit expires no later than 30 days after delivery, after which the deliverables remain available only through the Customer's account or by re-delivery on request during the subscription; and

(d)routine backups are retained on a rolling cycle and are overwritten or deleted within 35 days, and Customer Personal Data in backups is not restored to active systems except for disaster recovery.

16.2On termination or expiry of the Agreement, or earlier on the Customer's written request, HomeHub will, at the Customer's election, return the Customer's delivered Kits and any Listing Data still held in a commonly used electronic format, or delete them, and will in either case delete remaining copies in accordance with clause 16.1.

16.3On the Customer's written request, HomeHub will confirm completion of deletion in writing.

16.4HomeHub may retain Personal Data to the extent, and for as long as, required by UAE law, including tax record-keeping obligations, and may retain acceptance records, invoices and Processing records as evidence of compliance, in each case for no longer than the periods published in the HomeHub Privacy Policy, protecting the retained data in accordance with this DPA and isolating it from any other use.

16.5The Customer must not forward a results page link beyond its own personnel and is responsible for access to deliverables once downloaded to the Customer's own systems.

17Records, information and audit

17.1HomeHub will maintain a written record of the categories of Processing carried out on the Customer's behalf, as required of a Processor under the PDPL, and will make that record available to the Customer and to the UAE Data Office on request.

17.2HomeHub will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA. The Customer may submit a written information request no more than once in any period of 12 months, and HomeHub will respond in writing within 30 days, including, where relevant, copies of applicable Sub-processor data protection terms with commercial terms redacted, a description of current security measures, and confirmation of personnel confidentiality undertakings.

17.3An audit beyond clause 17.2, including any on-site inspection, may be requested only where a written response has demonstrably failed to resolve a material, evidenced compliance concern, or where an audit is required by the UAE Data Office or by data protection law applicable to the Customer. Any such audit: requires at least 30 days' written notice; is limited to matters relevant to this DPA; takes place during business hours, no more than once in any period of 12 months, and in a manner that does not disrupt HomeHub's operations or compromise other customers' confidentiality; may be conducted by an independent auditor bound by confidentiality obligations reasonably acceptable to HomeHub; and is at the Customer's cost.

17.4Nothing in this clause requires HomeHub to give access to another customer's data, to its model instruction sets, templates, model configurations or other trade secrets, or to information whose disclosure is restricted by law.

18Change in law

18.1The parties acknowledge that, as at the date of this DPA, executive regulations under the PDPL are awaited and that the PDPL framework, including any adequacy determinations, standard contractual clauses, breach notification procedures and administrative penalties, may be completed or amended after signature.

18.2HomeHub may amend this DPA on at least 30 days' written notice to the extent reasonably necessary to conform it to the PDPL, its executive regulations, or decisions and guidance of the UAE Data Office. An amendment under this clause that materially reduces the protections or increases the obligations applying to the Customer entitles the Customer to terminate the Agreement on written notice before the amendment takes effect, with a refund of prepaid fees for Services not yet delivered.

18.3Each party will execute any transfer clauses or other instruments officially prescribed under the PDPL within 60 days of the other party's written request, in accordance with clause 10.4.

19Liability

19.1Each party's liability arising under or in connection with this DPA is subject to the exclusions and limitation of liability set out in the Agreement, except that the following are subject neither to the aggregate cap nor to the excluded heads of loss set out in the Agreement: the Customer's compensation obligation in clause 14.3; liability arising from a party's breach of clause 7; liability arising from HomeHub's breach of clause 6; and any liability that cannot lawfully be limited or excluded under UAE law.

19.2Nothing in this DPA excludes or limits any liability for a harmful act to the extent such exclusion or limitation is void under the UAE Civil Transactions Law.

20Term and termination

20.1This DPA takes effect on the later of the effective date stated above and the date the Customer first submits Listing Data, and continues for as long as HomeHub Processes Customer Personal Data.

20.2Clauses 6, 7, 8, 10, 12, 14.3, 16, 17.1, 19 and 21 survive termination or expiry of this DPA, and clauses 8, 10 and 12 continue to apply to any Customer Personal Data HomeHub still holds.

21General

21.1Governing law. This DPA is governed by and construed in accordance with the federal laws of the United Arab Emirates as applied in the Emirate of Dubai.

21.2Jurisdiction. The onshore courts of Dubai have exclusive jurisdiction over any dispute arising out of or in connection with this DPA, and the parties expressly exclude the jurisdiction of the courts of the Dubai International Financial Centre and the Abu Dhabi Global Market.

21.3Language. This DPA is executed in English. An Arabic translation may be provided for convenience. If this DPA is submitted to a UAE court it must be accompanied by a translation prepared by a legal translator approved by the UAE Ministry of Justice.

21.4Electronic execution. The parties agree that this DPA may be concluded electronically and that electronic acceptance and the electronic record of acceptance have full legal effect in accordance with Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services. HomeHub retains, for each acceptance, the identity of the accepting user, the version of this DPA accepted, a stored copy of that version, the timestamp and the originating IP address.

21.5Severance. If any provision of this DPA is held invalid or is varied by a court exercising a statutory power, the remainder of this DPA continues in full force.

21.6Notices. Notices under this DPA are given by email to the parties' registered notice addresses stated in the Agreement and are deemed received on the next business day in Dubai after sending, absent a delivery failure notification.

21.7Free first Kit. This DPA applies to the free first Kit in the same way as to any paid Kit.

21.8Data protection contact. Questions, requests and notices concerning this DPA may be sent to the data protection contact address published on the Legal page of the HomeHub website, which is the contact stated in the HomeHub Privacy Policy. HomeHub will keep that address current and monitored.

21.9Financial free zone customers. Where the Customer is incorporated in the Dubai International Financial Centre or the Abu Dhabi Global Market and is subject to that zone's own data protection legislation in respect of the Listing Data, the parties will in good faith agree any additional annex necessary to satisfy the mandatory processor-contract requirements of that legislation. In the absence of such an annex, this DPA applies as written.

Annex 1: Description of the Processing

Subject matter. The Processing of Customer Personal Data contained in Listing Data for the production and delivery of bilingual property marketing Kits.

Duration. The term of the Agreement, plus the retention periods stated in clause 16.

Nature of the Processing. Receipt and storage of submitted text and photographs; transmission of that text and those photographs to the artificial intelligence model provider named in Annex 3, in the United States, for the drafting step described in clause 10.1; AI-assisted drafting of marketing copy in English and Arabic; layout and design of deliverables; human review of every Kit before delivery, including the visual check described in clause 15.2; redaction where clause 15.1 applies; delivery by email containing a link to a private results page; support and re-delivery on request; deletion in accordance with clause 16.

Purpose. The production, human review, quality control, delivery and support of the Kit ordered by the Customer. No other purpose, in accordance with clause 6.

Categories of Data Subject.

1. The Customer's brokers, agents and other personnel whose details are reproduced onto Kit deliverables on the Customer's instruction.
2. Property sellers, landlords and owners whose Personal Data appears in submitted text.
3. Tenants, occupants, domestic staff, neighbours, passers-by and other individuals who appear incidentally in submitted photographs.
4. Vehicle keepers, to the extent a readable number plate appears in submitted photographs.

Categories of Personal Data.

1. Broker identification data: name, BRN, ORN, brokerage name, registered telephone number, email address.
2. Third-party contact data incidentally contained in submitted text: names, telephone numbers, email addresses.
3. Images of identifiable natural persons and readable vehicle number plates incidentally contained in submitted photographs.
4. Property-related information capable of being linked to an identifiable owner, landlord or tenant.

Sensitive Personal Data. None is required for, or intended to form part of, the Processing. The submission of Sensitive Personal Data is prohibited under clause 14.1(c), and any Sensitive Personal Data encountered is stripped, masked or deleted under clause 14.2. The parties record that photographs are Processed as images for layout and marketing purposes only, and that HomeHub does not perform facial recognition, biometric matching or any other biometric identification on them.

Annex 2: Security measures

HomeHub implements and maintains the following technical and organisational measures for Customer Personal Data:

1. Processing location and hardware. Kit generation and human review are performed on HomeHub-controlled hardware located in the United Arab Emirates, with full-disk encryption enabled.
2. Segregation. Customer Personal Data is Processed under a dedicated operating system account used only for HomeHub production work, in working directories that are excluded from consumer cloud synchronisation services such as iCloud Drive, Photos synchronisation, Google Drive and Dropbox.
3. Access control. Access to Customer Personal Data is limited to named, authorised individuals bound by written confidentiality undertakings under clause 7. A current list of authorised individuals is maintained.
4. No personal devices or channels. Customer Personal Data is not stored on personal devices or personal cloud accounts of HomeHub personnel and is not transmitted over personal consumer messaging accounts.
5. Delivery security. Kits are delivered through a link to a private results page. The link contains a 128 bit random token generated for that Kit alone, and that token is the whole of the credential: the link is not tied to the delivery email address and no second factor is required, so any person holding the link can open the Kit until it expires. Guessing a link is not a practical attack at that key length, and a link for one Kit reaches no part of another. The link expires in accordance with clause 16.1(c), and clause 16.5 requires the Customer not to forward it beyond its own personnel.
6. Model use and its limits. Listing content is submitted to the artificial intelligence model provider named in Annex 3, in the United States, for the drafting step described in clause 10.1, and to no other third-party artificial intelligence service. That provider is engaged on written terms restricting its Processing to running the model and returning the draft, together with the security and abuse monitoring it performs on its own service. Listing content is not used to train, fine-tune or evaluate any model, whether HomeHub's or the provider's, in accordance with clause 6; HomeHub keeps the provider's model improvement setting switched off on the account used for production work and treats keeping it off as a term of the engagement under clause 9.4.
7. Intake requirement and human catch. Emirates ID numbers, passport numbers, bank and card details and Sensitive Personal Data must not be submitted, under clause 14.1(c), and HomeHub is authorised by clause 14.2 to delete them. HomeHub records that this is a requirement placed on the Customer and a human control at review, not an automatic technical control: nothing at intake scans a submission for that data and nothing removes it automatically. Where a reviewer encounters such data it is deleted from the submission and kept out of the Kit, and the Customer is told. Until it is found it is stored and transmitted with the rest of the submission, including to the provider in Annex 3, and it is deleted with that submission under clause 16.1(a).
8. Logging. Access to production systems is logged. Acceptance of the Agreement and this DPA is logged with user identity, document version, timestamp and IP address.
9. Backups. Backups are encrypted and retained on a rolling cycle not exceeding 35 days.
10. Deletion. Deletion is performed in accordance with clause 16, including deletion from active systems and expiry of backups.
11. Incident response. A documented internal procedure exists for identifying, containing, assessing and notifying Personal Data Breaches in accordance with clause 12.
12. Review. These measures are reviewed at least annually and on any material change to the Processing.

Annex 3: Approved Sub-processors

The Customer authorises the following Sub-processors as at the effective date. This Annex reproduces the HomeHub Sub-Processor Register published on the Legal page of the HomeHub website. Where the two differ following a change notified under clause 9.2, the published Register prevails, as provided in clause 9.1.

Anthropic PBC is the only hosted artificial intelligence service engaged as a Sub-processor. No hosted translation, transcription or image service Processes Listing Data: the Arabic copy is drafted by the same model and edited by a person in the United Arab Emirates, and photograph correction is a fixed calculation performed on HomeHub hardware in the United Arab Emirates that generates, adds and removes nothing. If any production step is routed to a further such service, that provider will be added to the Sub-Processor Register and notified under clause 9.2 before it Processes any Customer Personal Data, and clause 10 will apply to the resulting transfer.

Anthropic PBC was Processing Listing Data before this Annex named it. Version 1.0 of this DPA and of the Sub-Processor Register stated that no hosted artificial intelligence model provider was engaged, which was wrong when it was published. Clause 7 of the Sub-Processor Register records that correction, records that the thirty days' prior notice in clause 9.2 could not be given before the fact and is being given now, and preserves the objection right in clause 9.3 running from the date of that notice.

Contracted human reviewers, Arabic editors and designers, where engaged, are Sub-processors under clause 9.6 and Process Customer Personal Data only within the United Arab Emirates on HomeHub-controlled systems under written contracts meeting clauses 7.1 and 9.4.