Data Sharing Agreement

1. Definitions

In this Data Sharing Agreement, the following definitions apply in addition to those set out in the applicable Agent Agreement or Developer Agreement:

• "Lead Data" means the personal data of a Buyer transmitted by DealsGrid LLC to the Recipient in connection with a specific property inquiry, including name, email address, telephone number, messenger handles, and the content of any inquiry message submitted by the Buyer.

• "Recipient" means the Agent or Developer who receives Lead Data from DealsGrid LLC pursuant to this Agreement.

• "Transferring Controller" means DealsGrid LLC in its capacity as the entity that collects Lead Data from Buyers and transmits it to the Recipient.

• "Receiving Controller" means the Recipient in its capacity as an independent data controller that receives and independently processes Lead Data.

• "Data Protection Laws" means all applicable laws and regulations relating to the processing of personal data, including but not limited to the EU General Data Protection Regulation (GDPR) 2016/679, the Thai Personal Data Protection Act B.E. 2562 (PDPA), and any other applicable national or regional data protection legislation.

• "Buyer" means a natural person who has submitted a Lead inquiry on the Platform in connection with a specific property Listing.

• "Platform" means the DealsGrid marketplace at https://dealsgrid.ai and all associated subdomains and services.

2. Data Controller Roles

2.1 Independent Controllers

The parties acknowledge and agree that, with respect to Lead Data:

• DealsGrid LLC acts as an independent data controller in respect of its collection of Lead Data from Buyers on the Platform, its storage of Lead Data on Platform infrastructure, and its transmission of Lead Data to the Recipient;

• The Recipient acts as an independent data controller in respect of its receipt, storage, and further processing of Lead Data following transmission by DealsGrid LLC.

The Recipient does not act as a data processor on behalf of DealsGrid LLC. DealsGrid LLC does not act as a data processor on behalf of the Recipient. Each party independently determines the purposes and means of its own processing of Lead Data and is independently responsible for compliance with applicable Data Protection Laws in respect of that processing.

2.2 No Joint Controllership

Nothing in this Agreement creates a joint controllership relationship between DealsGrid LLC and the Recipient. The parties do not jointly determine the purposes or means of processing Lead Data. Each party bears sole and independent responsibility for its own processing activities.

3. Legal Basis for Transfer

DealsGrid LLC transfers Lead Data to the Recipient on the following legal bases:

• Consent: The Buyer has explicitly consented to the transfer of their Lead Data to the Agent or Developer responsible for the Listing they enquired about, as described in the DealsGrid Terms of Use and Privacy Policy. This consent is obtained at the time the Buyer submits a Lead inquiry on the Platform;

• Contractual necessity: The transfer of Lead Data is necessary for the performance of the service requested by the Buyer, namely to connect the Buyer with the Agent or Developer who can respond to their property inquiry;

• Legitimate interests: The transfer serves the legitimate interests of the Buyer in receiving a timely response to their property inquiry, and the legitimate interests of the Recipient in receiving qualified leads relevant to their Listings.

4. Categories of Lead Data Transferred

The following categories of personal data may be included in Lead Data transmitted to the Recipient:

No special categories of sensitive personal data (as defined under GDPR Article 9 or equivalent provisions under applicable Data Protection Laws) are intentionally collected or transmitted as part of Lead Data. If a Buyer voluntarily includes sensitive information in a free-text inquiry message, the Recipient must not use such information for any purpose other than responding to the inquiry.

5. Obligations of DealsGrid LLC as Transferring Controller

DealsGrid LLC undertakes to:

• Collect Lead Data from Buyers on a lawful basis, with appropriate notice and consent as described in the DealsGrid Privacy Policy (https://dealsgrid.ai/privacy);

• Transmit Lead Data to the Recipient in a secure manner using appropriate technical and organisational security measures;

• Maintain records of Lead Data transmissions as required by applicable Data Protection Laws;

• Notify the Recipient promptly if it becomes aware of a personal data breach affecting Lead Data prior to transmission, or if a Buyer withdraws consent in a manner that affects the lawfulness of further processing by the Recipient;

• Process Lead Data in accordance with its Privacy Policy and applicable Data Protection Laws in respect of its own processing activities.

6. Obligations of the Recipient as Receiving Controller

6.1 Lawful Processing

The Recipient undertakes to process Lead Data in compliance with all applicable Data Protection Laws. As an independent data controller, the Recipient is solely responsible for identifying and maintaining a valid legal basis for its own processing of Lead Data following receipt from DealsGrid LLC.

6.2 Purpose Limitation

The Recipient must not process Lead Data for any purpose other than:

• Responding directly to the Buyer's specific inquiry about the property or project to which the Lead Data relates;

• Providing the Buyer with information about the specific property or reasonably related properties within the Recipient's portfolio;

• Managing the sales or agency relationship with the Buyer in connection with the Buyer's expressed property interest.

6.3 Prohibited Processing

The Recipient must not:

• Sell, rent, exchange, or otherwise transfer Lead Data to any third party for commercial or marketing purposes;

• Use Lead Data to send unsolicited marketing communications unrelated to the Buyer's specific property inquiry without first obtaining the Buyer's explicit prior consent in accordance with applicable law;

• Use Lead Data to build advertising audiences, retargeting lists, or lookalike audiences on any advertising platform without the Buyer's explicit prior consent;

• Process Lead Data in a manner that is incompatible with the purpose for which it was originally collected and disclosed to the Buyer;

• Process Lead Data in violation of any applicable Data Protection Law.

6.4 Data Minimisation and Retention

The Recipient must not retain Lead Data in identifiable form for longer than is necessary for the purpose of responding to and managing the Buyer's inquiry. The Recipient should implement a reasonable internal retention policy for Lead Data and delete or anonymise Lead Data when it is no longer required for that purpose, unless a longer retention period is required by applicable law.

6.5 Security

The Recipient must implement appropriate technical and organisational measures to protect Lead Data against unauthorised access, accidental loss, destruction, disclosure, or alteration, having regard to the nature of the data and the risks associated with its processing. At a minimum, the Recipient must ensure that Lead Data stored in any CRM, messaging platform, or other system is accessible only to authorised personnel.

6.6 Sub-processors and Third-Party Systems

The Recipient acknowledges that it may transmit Lead Data to third-party systems, including CRM platforms, email marketing tools, messaging applications, and advertising platforms, as part of its own processing activities. The Recipient is solely responsible for ensuring that any third-party provider to whom Lead Data is transmitted:

• Is bound by data protection obligations at least equivalent to those set out in this Agreement;

• Processes Lead Data only for the purposes authorised by the Recipient and consistent with this Agreement;

• Provides sufficient guarantees regarding its technical and organisational security measures.

DealsGrid LLC accepts no liability for the data processing practices of any third-party system used by the Recipient.

7. Data Subject Rights

7.1 Buyer Rights

Buyers have rights in relation to their personal data under applicable Data Protection Laws, including rights of access, rectification, erasure, restriction of processing, data portability, and objection. Each party is independently responsible for responding to data subject requests relating to its own processing of Lead Data.

7.2 Cooperation

Where a Buyer submits a data subject request to DealsGrid LLC that relates to Lead Data already transmitted to the Recipient — for example, a request for erasure or a request to know who has received their data — DealsGrid LLC will notify the Recipient of the request. The Recipient must cooperate with DealsGrid LLC and respond to such requests within the timeframes required by applicable law. Where a Buyer submits a data subject request directly to the Recipient, the Recipient must handle the request independently in its capacity as an independent data controller.

7.3 Withdrawal of Consent

If a Buyer withdraws their consent to the transfer of Lead Data after the Lead Data has already been transmitted to the Recipient, DealsGrid LLC will notify the Recipient. The Recipient must cease processing the relevant Lead Data for marketing purposes upon receipt of such notification, unless the Recipient has an independent legal basis for continued processing under applicable law.

8. International Data Transfers

DealsGrid LLC is incorporated in the United States. Lead Data is processed on servers located in [ASIA-PACIFIC REGION — e.g. Singapore / Tokyo]. The Recipient acknowledges that Lead Data may be transferred to and processed in jurisdictions outside the Buyer's country of residence.

Where Lead Data originates from Buyers located in the European Union or European Economic Area, any transfer of such data outside the EU/EEA — whether by DealsGrid LLC to its infrastructure providers, or by the Recipient to its own systems — must be made in compliance with the GDPR transfer requirements, including through the use of Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions, or other appropriate transfer mechanisms.

The Recipient is solely responsible for ensuring that its own international transfers of Lead Data comply with applicable Data Protection Laws.

9. Personal Data Breaches

Each party must notify the other without undue delay upon becoming aware of a personal data breach affecting Lead Data that is reasonably likely to result in a risk to the rights and freedoms of affected Buyers. Notification must be sent to privacy@dealsgrid.ai (for notifications to DealsGrid LLC) or to the email address registered by the Recipient on the Portal.

Each party is independently responsible for notifying the relevant data protection supervisory authority and affected Buyers of any breach affecting its own processing of Lead Data, in accordance with applicable Data Protection Laws and within the timeframes required by law (including the 72-hour notification requirement under GDPR where applicable).

10. Liability and Indemnification

Each party is solely and independently liable for its own compliance with applicable Data Protection Laws in respect of its processing of Lead Data. DealsGrid LLC accepts no liability for any breach of Data Protection Laws committed by the Recipient in connection with its processing of Lead Data following receipt from DealsGrid LLC.

The Recipient agrees to indemnify, defend, and hold harmless DealsGrid LLC, its members, managers, employees, contractors, and affiliates from and against any and all claims, penalties, fines, liabilities, damages, costs, and expenses (including reasonable legal fees) arising out of or in connection with:

• Any breach by the Recipient of its obligations under this Agreement or applicable Data Protection Laws in respect of Lead Data;

• Any complaint, investigation, or enforcement action by a data protection supervisory authority arising from the Recipient's processing of Lead Data;

• Any claim by a Buyer arising from the Recipient's processing of Lead Data.

11. Term and Termination

This Agreement enters into force upon the Recipient's acceptance of the applicable Agent Agreement or Developer Agreement and remains in effect for the duration of that Agreement. Termination of the Agent Agreement or Developer Agreement for any reason automatically terminates this Agreement with respect to future Lead Data transfers. Termination does not affect either party's obligations in respect of Lead Data already received prior to termination, which obligations survive termination indefinitely.

12. Sub-Processors Used by DealsGrid LLC

In the course of its own data processing activities, DealsGrid LLC engages the following sub-processors who may process Lead Data on its behalf. Each sub-processor is bound by appropriate data processing agreements or equivalent contractual arrangements:

DealsGrid LLC reserves the right to update its list of sub-processors from time to time. Material changes to the sub-processor list will be reflected in an updated version of this Agreement published on the Platform.

13. General Provisions

• Governing Law: This Agreement is governed by the laws of the State of Wyoming, United States, without regard to conflict of law principles. To the extent that mandatory provisions of EU GDPR, Thai PDPA, or other applicable data protection laws impose additional requirements, those requirements prevail over this Agreement to the extent of any inconsistency.

• Entire Agreement: This Agreement, together with the applicable Agent Agreement or Developer Agreement, constitutes the entire agreement between the parties regarding the processing of Lead Data and supersedes all prior understandings on this subject.

• Severability: If any provision of this Agreement is found invalid or unenforceable, the remaining provisions continue in full force.

• Language: This Agreement is executed in English, which is the authoritative and legally binding version.

• Amendments: DealsGrid LLC reserves the right to amend this Agreement at any time. Continued use of the Platform following publication of an updated Agreement constitutes acceptance of the amended terms.

14. Contact Information

For all privacy and data protection matters relating to this Agreement:

DealsGrid LLC — Privacy & Data

Wyoming, United States

Privacy: privacy@dealsgrid.ai

Legal: legal@dealsgrid.ai

Website: https://dealsgrid.ai