Unitlogi Global Terms of Service

Version 1.0 | Last updated: 1 August 2026

1. Agreement and Professional Eligibility

1.1 Agreement.

These Terms of Service (the “Terms”) govern access to and use of Unitlogi, a web-based real estate operations workspace operated by INTECH HERITAGE LLC - FZ, a company incorporated in Meydan Free Zone, Dubai, United Arab Emirates, under commercial licence No. 2528442.01 (“Intech Heritage”, the “Company”, “we”, “us” or “our”).

These Terms form a legally binding agreement between the Company and the Customer.

1.2 Customer.

The “Customer”, “you” or “your” is the independent professional or legal entity identified as the subscriber to Unitlogi.

Where an individual subscribes or accepts these Terms on behalf of a real estate agency or another legal entity, that entity is the Customer. Where an independent broker subscribes in their own professional capacity, that broker is the Customer.

1.3 Professional use only.

Unitlogi is made available exclusively for business and professional purposes to independent real estate brokers, real estate agencies and their authorised professional users. Unitlogi is not intended for personal, family or household use and may not be subscribed to as a consumer service.

1.4 Authority and legal capacity.

Any individual accepting these Terms confirms that:

a. they have reached the age of legal majority and have the legal capacity to enter into a binding agreement;

b. where they act on behalf of an agency or another legal entity, they have authority to bind that entity to these Terms; and

c. the identity, professional and organisational information provided to the Company is accurate, complete and kept up to date.

A person who does not have the required authority may not accept these Terms or use Unitlogi on behalf of another person or entity.

1.5 Professional authorisations.

The Customer is responsible for holding and maintaining any licence, registration, permission or professional authorisation required to conduct its real estate activities in each jurisdiction in which it operates. Access to Unitlogi does not constitute verification or approval of the Customer’s professional status by the Company.

The Customer and its Authorised Users shall comply with all laws and professional rules applicable to their use of Unitlogi and their real estate activities, including applicable real estate, advertising, anti-money-laundering, sanctions, competition, consumer-protection, privacy and electronic-communications requirements.

1.6 Acceptance and effective date.

These Terms take effect when the Customer accepts them electronically or enters into a Subscription that expressly refers to them. A person who does not agree to these Terms must not create an Account, subscribe to or use Unitlogi.

2. Service, Accounts and Permitted Use

2.1 Access to Unitlogi.

Subject to compliance with these Terms and payment of the applicable fees, the Company grants the Customer a limited, non-exclusive and non-transferable right to access and use Unitlogi during the applicable Subscription period for the Customer’s professional real estate activities.

For purposes of these Terms, the Customer’s Unitlogi workspace and associated access credentials constitute its “Account”, and Unitlogi and the functionality made available through it constitute the “Service”.

2.2 Scope of the Service.

The Customer may use the features made available under its selected Subscription, subject to any applicable number of Authorised Users, storage capacity, usage limits or other plan restrictions communicated when subscribing.

Access is provided only through the interfaces and functionalities made available by the Company. No Subscription gives the Customer a right to obtain Unitlogi’s source code, a local installation, an application programming interface, a third-party integration or any functionality that the Company has not expressly made available.

2.3 Authorised Users.

An “Authorised User” is an individual whom the Customer permits to access Unitlogi through an individual user account under the Customer’s control.

Each Authorised User account is personal and may not be shared, transferred or used by another person. The Customer shall ensure that only properly authorised individuals have access to its Unitlogi workspace.

2.4 Account administration.

The Customer is responsible for:

a. designating its account administrators and determining the appropriate access permissions for its Authorised Users;

b. keeping its Account and Authorised User information accurate and up to date;

c. promptly modifying or removing access when an Authorised User changes role or is no longer authorised;

d. maintaining the confidentiality of usernames, passwords and other authentication credentials; and

e. notifying the Company without undue delay of any suspected unauthorised access or misuse of an Account.

The Customer is responsible for activities performed through its Account by its Authorised Users or by any person to whom the Customer has provided access. This does not make the Customer responsible for unauthorised access caused by a breach of the Company’s own obligations.

2.5 Professional use.

The Customer may use Unitlogi in its ordinary real estate activities, including through the enabled functions for managing contacts, properties, interactions, tasks, opportunities and property requirements, importing information and generating matches or other results.

The Customer remains responsible for its professional activities, communications, decisions and relationships with clients, property owners, counterparties and other third parties.

2.6 Client-facing features.

Where Unitlogi provides a customer-facing sharing function, including a property link or property sheet, the Customer may use that function solely for legitimate professional purposes and send it only to an intended recipient.

Such access does not permit a client or other recipient to enter the Customer’s internal Unitlogi workspace. The Customer is responsible for the information it chooses to share and for ensuring that it is authorised to contact the recipient.

The Company may restrict or disable a shared link where reasonably necessary for security, legal compliance, Account suspension or termination, or prevention of misuse.

2.7 Compliance with plan limits.

The Customer and its Authorised Users shall comply with the limits of the applicable Subscription and with reasonable technical instructions made available for the safe and proper operation of Unitlogi. The Customer may not circumvent or attempt to circumvent any technical or account limitation.

3. Subscriptions and Payments

3.1 Subscription terms.

A “Subscription” means the paid, free or promotional access arrangement selected by or made available to the Customer. The applicable base price, billing interval, currency, included features, number of Authorised Users and any usage limits shall be those displayed or communicated to the Customer when subscribing.

The complete amount payable, including any applicable taxes, shall be presented to the Customer through the applicable checkout or billing process.

3.2 Billing provider and Merchant of Record.

Payments may be handled by the Company or by an authorised third-party payment provider, reseller or Merchant of Record.

Where a third party is identified during checkout as the Merchant of Record or seller of record, that third party is responsible for processing the transaction, collecting and remitting applicable transaction taxes and issuing the relevant invoice or receipt.

Intech Heritage remains the provider and operator of Unitlogi, and these Terms continue to govern access to and use of the Service. Any additional billing terms presented by the Merchant of Record govern only the payment-processing, invoicing, taxation, refund-administration, payment-dispute and related transaction services provided by that entity.

3.3 Free or promotional period.

The Company may offer a free first month or another promotional access period on the conditions presented when the Customer subscribes.

Where a payment method is required, the Customer authorises the Company and the applicable billing provider or Merchant of Record to charge the subscription fee and applicable taxes when the free or promotional period ends, unless the Customer cancels before the stated expiry date.

3.4 Automatic renewal.

Unless cancelled, each Subscription automatically renews for successive periods equal to the selected billing interval. The applicable subscription fee and taxes will be charged at the beginning of each renewal period.

The Customer is responsible for maintaining valid and up-to-date payment and billing information.

3.5 Cancellation.

The Customer may cancel its Subscription at any time through the Account or through another cancellation method made available by the Company or the applicable billing provider.

Cancellation stops the next automatic renewal. The Customer will retain access to Unitlogi until the end of the billing period already paid, after which the Subscription will end.

If the Customer cancels during a free or promotional period before the applicable payment date, the Customer will not be charged for the following paid period.

Cancellation does not itself constitute a request for immediate deletion of Customer Data. The Account closure and data-retention choices described in Section 8 will apply after access ends.

3.6 Fees and taxes.

Unless expressly stated otherwise during checkout, the displayed base subscription price does not include applicable value-added tax, goods and services tax, sales tax or similar transaction taxes.

The applicable tax treatment and amount may be determined by the Company or the Merchant of Record based on the Customer’s billing location, business status, tax-registration information and other information required by law.

The Customer shall provide accurate and complete billing and tax information, including any valid tax-registration number or exemption information it wishes to claim.

The Customer remains responsible for its own income, corporate, professional and other taxes that are not collected as part of the Unitlogi transaction. The Customer is also responsible for currency-conversion fees, foreign-transaction fees or other charges applied independently by its bank or payment provider.

3.7 Failed or overdue payments.

If a payment fails or becomes overdue, the Company or the applicable billing provider may retry the payment method and request updated payment information.

If payment remains outstanding after notice, the Company may restrict or suspend access to Unitlogi until the outstanding amount is paid. Suspension for non-payment does not immediately delete Customer Data.

3.8 Refunds.

Subscription fees and other amounts paid are non-refundable and are not credited for partial billing periods, unused Accounts, unused features or an early decision to stop using Unitlogi.

This rule does not apply where a refund is required by applicable law or where the relevant charge results from a duplicate payment or a billing error attributable to the Company or its billing provider.

3.9 Price changes.

The Company may change its base subscription prices by giving the Customer at least thirty (30) days’ prior notice.

A new base price will apply only from the first renewal occurring after the notice period has expired. If the Customer does not accept the new price, it may cancel before that renewal and continue using Unitlogi until the end of the period already paid.

A change resulting solely from an applicable tax, exchange rate, bank fee or other amount not controlled by the Company is not considered a change to the base subscription price.

4. Customer Data, Privacy and Confidentiality

4.1 Customer Data.

“Customer Data” means all data, documents, files, photographs, communications, records, property information, client information and other content submitted to or stored in Unitlogi by or on behalf of the Customer.

As between the Customer and the Company, the Customer retains all rights it holds in Customer Data. These Terms do not transfer ownership of Customer Data to the Company.

4.2 Permission to process Customer Data.

The Customer grants the Company a limited, non-exclusive right to host, copy, process, transmit and display Customer Data only as reasonably necessary to:

a. provide, maintain, secure and support Unitlogi;

b. perform the Customer’s authorised instructions and provide enabled features;

c. prevent or investigate fraud, misuse and security incidents;

d. comply with the applicable Unitlogi Data Processing Agreement and applicable law; and

e. complete any permitted retention, recovery or deletion process after Account closure.

The Company shall not sell Customer Data or use identifiable Customer Data for third-party advertising.

4.3 Customer responsibilities.

The Customer determines which Customer Data is submitted to Unitlogi and is responsible for ensuring that:

a. it has all rights, permissions, lawful bases and professional authority required to collect, use, upload and otherwise process that data;

b. all legally required privacy notices have been provided and all necessary consents have been obtained;

c. its instructions to the Company comply with applicable law and do not infringe another person’s privacy, confidentiality, intellectual property or other rights;

d. Customer Data is reasonably accurate, relevant and limited to what is necessary for the Customer’s legitimate professional activities; and

e. Customer Data is not unlawful, fraudulent, misleading, discriminatory, harmful or malicious.

4.4 Restricted data.

Unitlogi is not intended to store specially protected or highly sensitive information, including medical information, biometric data, criminal records, payment-card details, financial-account credentials, government identification documents or information concerning children, unless the Company has expressly authorised the relevant category in writing and appropriate safeguards have been agreed.

The Customer shall not use Unitlogi as a general archive for passports, identity cards, banking documents or other sensitive records that are not necessary for an expressly enabled Unitlogi function.

4.5 Data protection roles.

Where the Company processes Personal Data contained in Customer Data on behalf of the Customer, the Customer acts as the Controller and the Company acts as the Processor. That processing is governed by the applicable Unitlogi Data Processing Agreement (the “DPA”), which forms part of these Terms. For purposes of these Terms, “Personal Data”, “Controller” and “Processor” have the meanings given in applicable data protection law and the DPA.

If there is a conflict concerning Personal Data processed by the Company on behalf of the Customer, the DPA shall prevail.

The Customer remains responsible for responding to its clients and other data subjects. The Company shall provide the assistance required from a Processor under the DPA and applicable data protection law.

4.6 Intech Heritage as an independent Controller.

The Company acts as an independent Controller when it determines the purposes and essential means of processing Personal Data for Account administration, authentication, billing coordination, security, fraud prevention, legal compliance, corporate records and direct communications with the Customer or its Authorised Users.

That processing is described in the Unitlogi Privacy Policy and is not governed by the Processor obligations in the DPA.

The Privacy Policy does not replace any privacy notice that the Customer must provide to its own clients, prospects, property owners, contacts or other data subjects.

4.7 Confidentiality.

Each party shall protect the other party’s non-public business, technical and commercial information against unauthorised use or disclosure and shall use it only as necessary to perform or exercise its rights under these Terms.

Confidential Information may be disclosed only to personnel, professional advisers and service providers who need it for that purpose and who are subject to appropriate confidentiality obligations, or where disclosure is required by law or a competent authority.

These obligations do not apply to information that the receiving party can demonstrate:

a. is or becomes public without breach of these Terms;

b. was lawfully known without a duty of confidentiality;

c. was lawfully received from a third party without restriction; or

d. was independently developed without using the other party’s Confidential Information.

The confidentiality obligations continue for as long as the relevant information remains confidential. Customer Data and Personal Data remain subject to the additional protections and retention rules in the DPA.

4.8 Usage and aggregated data.

The Company may process technical, operational, security and usage information generated through access to Unitlogi for service operation, security, billing, performance monitoring, troubleshooting and product analysis.

Where that information identifies an individual, it shall be processed in accordance with the Privacy Policy and applicable data protection law.

The Company may use aggregated or irreversibly de-identified information for statistics, service improvement and business analysis only where it can no longer reasonably identify the Customer or any individual. The Company shall not attempt to re-identify that information, and anonymisation shall not be used as an alternative to a valid deletion request.

5. Matching and AI Features

5.1 Matching function.

Unitlogi may calculate a matching percentage between a contact’s property requirements and available properties.

The matching percentage is generated through programmed criteria, rules and weightings applied to information entered or selected by the Customer. It is not generated by artificial intelligence or a generative AI model.

5.2 Nature of matching results.

A matching percentage is an organisational and decision-support indicator only. Its accuracy and relevance depend on the quality, completeness and currency of the information available in Unitlogi.

A matching result does not guarantee that a property is available, suitable, legally compliant or capable of resulting in a successful transaction. It does not replace the Customer’s professional judgement, verification or direct discussion with the relevant client or property representative.

5.3 AI Features.

Certain separate Unitlogi functions may use artificial intelligence models or services to assist with tasks such as structuring imported information, generating property descriptions, preparing internal profile summaries or assisting with interactions.

Any text, summary, suggestion, description, analysis or other result generated or assisted by an AI Feature is referred to as an “AI Output”.

5.4 Personal Data and AI providers.

Unitlogi shall not transmit Personal Data contained in Customer Data to an external generative AI model or AI provider.

Before information is transmitted for AI inference, the Company shall apply programmed controls designed to remove Personal Data, minimise the information transmitted and replace identifiers with non-identifying references or placeholders where necessary.

Only non-personal information or information that has been irreversibly anonymised may be transmitted to an AI provider. If a function cannot be performed without transmitting Personal Data, that function shall not be enabled for the affected information.

5.5 No model training.

Neither the Company nor an AI provider may use Customer Data, prompts or AI Outputs to train, fine-tune or independently improve a general-purpose or third-party artificial intelligence model.

The Company shall use appropriate provider settings and contractual protections designed to prevent retention, training, fine-tuning or other independent use of information transmitted for AI inference.

The Company may use aggregated or irreversibly de-identified usage metrics to analyse and improve Unitlogi, in accordance with Clause 4.8, provided that those metrics do not identify the Customer, an Authorised User or any other individual.

5.6 Human review and responsibility.

AI Outputs may contain errors, omissions, outdated information, unsuitable wording, bias or incorrect inferences. The Customer shall review and verify an AI Output before relying on it in its professional activities.

AI Outputs do not constitute legal, financial, tax, investment, property-valuation or other professional advice. Unitlogi shall not be used as the sole basis for a decision that produces legal or similarly significant effects concerning an individual.

The Customer remains responsible for every professional decision, communication, recommendation and transaction made using a matching result or AI Output.

5.7 Client-facing property links.

Where Unitlogi identifies one or more matching properties, the Customer may prepare an interaction containing a link to the relevant client-facing property sheets. The intended recipient may use that link to view the property information selected for external display.

A client-facing property link does not provide access to the Customer’s Account, internal workspace, matching percentage, internal profile, notes, prompts, summaries or other internal information.

Unitlogi does not provide for other internal matching results or AI Outputs to be transmitted directly to clients unless the Company expressly enables a corresponding client-facing function.

5.8 Storage of AI Outputs.

Where an AI Output is stored in Unitlogi, it forms part of the information held within the Customer’s Account and remains subject to the Customer’s instructions, the DPA and the applicable retention and deletion rules.

5.9 Changes to AI providers.

The Company may replace or update an AI provider or model where reasonably necessary for security, performance, availability or service development, provided that the change does not materially reduce the data-protection commitments in these Terms and the DPA.

Any notification or objection right concerning a new AI provider acting as a sub-processor shall be handled in accordance with the DPA.

6. Intellectual Property and Prohibited Use

6.1 Ownership of Unitlogi.

Intech Heritage and its licensors retain all rights, title and interest in and to Unitlogi and its underlying technology, including its source and object code, software, algorithms, matching logic, architecture, databases, interfaces, designs, workflows, documentation, trademarks, domain names, know-how, configurations, proprietary prompts, updates and improvements.

This ownership does not include Customer Data or intellectual property owned by the Customer. Third-party components remain subject to the rights and licences of their respective owners.

6.2 Limited right of use.

The Customer receives only the limited right to access and use Unitlogi under Sections 1 and 2 for the duration of its Subscription.

No intellectual property right is sold or transferred to the Customer, and no additional right is granted by implication.

6.3 Prohibited activities.

The Customer and its Authorised Users shall not, directly or indirectly:

a. copy, reproduce, modify, adapt, translate, duplicate or create derivative works from Unitlogi or any substantial part of it;

b. reverse engineer, decompile, disassemble or attempt to discover any source code, non-public algorithm, architecture, prompt, security control, trade secret or internal mechanism;

c. probe, scan or exploit a vulnerability or conduct penetration, security or technical testing without the Company’s prior written authorisation;

d. circumvent authentication, access controls, usage limits, account restrictions, payment controls or other protective measures;

e. access or attempt to access another Customer’s Account, Customer Data or any system or resource for which the Customer has not been authorised;

f. scrape, crawl or extract information through bots, scripts, automated agents or external collection tools, except through an import, automation, integration or application programming interface expressly provided by the Company;

g. sell, resell, sublicense, rent, lease, distribute, transfer or provide third-party access to Unitlogi, an Account or a Subscription;

h. use Unitlogi, its non-public functionality, Confidential Information, matching results or AI Outputs to copy, benchmark, train, improve, evaluate or assist in developing a competing product or service;

i. introduce malware, harmful code or material designed to disrupt, damage, overload or interfere with Unitlogi or another person’s systems;

j. use Unitlogi for any fraudulent, misleading, discriminatory, abusive, unlawful or professionally improper purpose, or in a manner that infringes privacy, confidentiality, intellectual property or other third-party rights;

k. remove, alter or obscure any copyright, trademark, proprietary, confidentiality or security notice; or

l. represent that the Customer is affiliated with, authorised to represent or able to make commitments on behalf of Intech Heritage.

6.4 Competitors.

A person or business that develops or offers a competing product may subscribe to Unitlogi for genuine professional real estate operations on the same basis as another eligible Customer.

That access does not authorise the competitor to evaluate Unitlogi for competitive intelligence, reproduce its features, perform technical benchmarking or use information obtained through Unitlogi to build, train, improve or market a competing product.

6.5 Public screenshots and commentary.

The Customer may publish an ordinary screenshot, screen recording or honest review concerning Unitlogi, provided that the publication:

a. does not disclose Personal Data, Customer Data belonging to another person, confidential information or non-public security information;

b. does not expose another person’s Account, contact information, property information or internal records without appropriate authority;

c. does not misrepresent Unitlogi or imply endorsement, partnership or approval by the Company; and

d. complies with applicable law and the rights of third parties.

Nothing in these Terms prohibits the Customer from expressing an honest opinion about its experience with Unitlogi.

6.6 Controlled technical publications and demonstrations.

The Company’s prior written authorisation is required before the Customer:

a. conducts or publishes a formal performance, comparative or technical benchmark;

b. conducts or discloses a penetration test, vulnerability assessment or security test;

c. publicly discloses a suspected vulnerability, non-public security control or technical weakness; or

d. uses Unitlogi in a commercial demonstration intended to sell, promote or support another product or service.

A Customer that identifies a suspected vulnerability shall report it privately to the Company and allow a reasonable opportunity for investigation and remediation before any legally permitted disclosure.

6.7 Feedback.

The Customer may voluntarily provide suggestions, ideas, corrections, feature requests or other feedback concerning Unitlogi.

The Customer grants the Company a worldwide, perpetual, irrevocable, royalty-free and sublicensable right to use, modify, combine, develop, commercialise or choose not to use that Feedback, without payment, attribution or obligation to implement it.

The Company shall not identify the Customer as the source of Feedback or disclose Customer Data or Confidential Information contained in it without authorisation.

6.8 Names, logos and testimonials.

The Unitlogi and Intech Heritage names, logos and other distinctive signs remain the property of the Company and may not be used in a manner that suggests an unauthorised affiliation, endorsement or representation.

The Company shall not use the Customer’s name, logo, trademark, image, review or testimonial for advertising, promotional material or a public customer reference without the Customer’s prior, specific and written authorisation.

6.9 Legally protected activities.

Where applicable law prevents a technical restriction in this Section from being enforced in full, the Customer may perform only the minimum activity that the law expressly permits.

Where legally allowed, the Customer shall give the Company advance notice and shall not disclose or use information obtained through that activity for any other purpose.

7. Service Availability and Changes

7.1 Availability.

The Company shall use commercially reasonable efforts to keep Unitlogi available, secure and operational.

Unitlogi is not provided under a guaranteed service level unless the Company expressly agrees otherwise in a separate written order or agreement. The Company does not guarantee:

a. any minimum percentage of availability;

b. uninterrupted or error-free operation;

c. a fixed support-response or resolution time; or

d. service credits or other compensation for ordinary downtime.

7.2 Support.

The Company shall provide reasonable technical support through the support channels it makes available.

Support requests will be handled according to their urgency, impact, available information and the Company’s operational resources. Support is not monitored continuously or guaranteed to be available twenty-four hours a day, seven days a week.

Any separate support level included in a future Subscription shall apply only if expressly stated in the applicable plan or written order.

7.3 Maintenance and protective actions.

The Company may perform scheduled or emergency maintenance and may temporarily restrict or suspend a feature, Account or part of Unitlogi where reasonably necessary to:

a. maintain, update or repair the Service;

b. investigate or contain a security incident;

c. protect Unitlogi, Customer Data, another customer or a third party;

d. address misuse, excessive traffic or technical instability;

e. comply with applicable law or an authority’s binding request; or

f. respond to an interruption or material change affecting a third-party provider.

Where reasonably possible, the Company shall provide advance notice of planned maintenance that is expected to cause a material interruption. Emergency or security-related maintenance may be carried out without prior notice.

7.4 Updates and changes.

The Company may correct, update, improve, replace or modify Unitlogi, including its interfaces, workflows, technical components and enabled features.

Routine improvements, security updates, bug fixes and changes that do not materially reduce the Customer’s paid Subscription may be implemented without prior notice.

If the Company intends to remove or materially reduce an essential feature expressly included in the Customer’s paid Subscription, it shall normally provide at least thirty (30) days’ prior notice. The change shall normally take effect from the Customer’s next renewal, allowing the Customer to cancel before the change applies.

The Company may make an immediate material change where reasonably necessary because of a security risk, legal requirement, provider failure or circumstance beyond its reasonable control. In that case, it shall inform affected Customers as soon as reasonably possible.

The Company may also suspend or discontinue all or part of Unitlogi for operational, commercial, legal or security reasons. Where reasonably practicable, the Company shall provide affected Customers with appropriate notice. Any mandatory rights and applicable billing obligations shall remain unaffected.

7.5 Third-party services.

Unitlogi relies on third-party infrastructure, software, payment, authentication, artificial intelligence and other technology services.

The availability or functionality of Unitlogi may be affected by an interruption, restriction or change made by one of those providers. The Company shall take reasonable steps to reduce the impact and restore or replace the affected functionality where commercially and technically practicable.

Where the Customer chooses to connect a third-party account or integration, the Customer is responsible for having authority to make that connection and for complying with the third party’s applicable terms. Data processing by providers acting on behalf of the Company remains subject to the DPA.

7.6 Customer systems and independent copies.

The Customer is responsible for maintaining compatible devices, browsers, internet access and other systems necessary to use Unitlogi.

The Customer shall retain independent copies of original documents, files and information whose loss could materially affect its activities. Any backup or recovery measure maintained by the Company is intended to support service resilience and does not make Unitlogi a permanent archival or guaranteed backup service.

7.7 Geographic and legal restrictions.

The Company may restrict or discontinue access from a country or territory where providing Unitlogi would violate applicable law, sanctions, export restrictions, provider requirements or another binding legal obligation.

Where reasonably possible, the Company shall notify affected Customers before applying a material geographic restriction.

8. Suspension, Account Closure and Data

8.1 Suspension and termination by the Company.

The Company may immediately restrict or suspend an Account where reasonably necessary because of:

a. a failed or overdue payment;

b. fraud, unlawful activity or misuse of Unitlogi;

c. a security risk or suspected unauthorised access;

d. conduct that threatens Unitlogi, Customer Data, another customer or a third party;

e. a binding legal or regulatory requirement; or

f. a serious breach of these Terms.

The Company may terminate an Account immediately where the relevant circumstances cannot reasonably be remedied or where continued access would create a legal, security or integrity risk. Persistent non-payment may result in termination after notice.

For another breach that can reasonably be corrected, the Company shall, where reasonably practicable, notify the Customer and provide a reasonable opportunity to remedy the breach before terminating the Account.

A suspension does not automatically cancel the Subscription, release the Customer from outstanding payment obligations or create a right to a refund.

8.2 Customer cancellation and Account closure.

When a Customer cancels its Subscription, access remains available until the end of the paid billing period in accordance with Clause 3.5.

At the end of that period, or when an Account is otherwise closed following non-payment or termination, the Customer may choose between:

a. restricted inactive retention for possible future reactivation; or

b. permanent deletion of the Account and Customer Data.

If the Customer does not make a choice when requested, the permanent-deletion option shall apply by default.

8.3 Inactive retention.

If the Customer chooses inactive retention, the Account and Customer Data shall be retained in a restricted inactive state for an initial period of twelve (12) months from Account closure.

Inactive retention is provided without a separate storage fee. During this period:

a. the Customer and its Authorised Users cannot access or ordinarily use the Account;

b. Customer Data may be processed only for secure storage, integrity, backup, legal compliance and possible reactivation; and

c. the Account does not generate a new Subscription charge.

Inactive retention does not guarantee that Unitlogi or any particular functionality will remain commercially available throughout the retention period.

8.4 Reactivation.

While Unitlogi remains commercially available, the Customer may request reactivation during an approved inactive-retention period. Reactivation is subject to the Customer satisfying the eligibility and compliance requirements then applicable and to the Company accepting the new Subscription. A reactivation request does not guarantee approval.

Reactivation requires the Customer to start a new paid Subscription at the price and on the terms then applicable. Reactivation does not automatically entitle the Customer to a new free or promotional period.

Following successful reactivation, the Customer’s retained Account and Customer Data shall again become available for ordinary use.

8.5 Renewal of inactive retention.

The Company shall give the Customer at least thirty (30) days’ notice before an inactive-retention period expires.

Before expiry, the Customer may:

a. reactivate the Account; or

b. affirmatively request one additional twelve (12)-month inactive-retention period.

Each additional twelve-month period is provided without a separate storage fee but requires a new affirmative request from the Customer. Inactive retention does not renew automatically.

If the Customer does not reactivate or request another period before expiry, the Company shall begin the permanent-deletion process.

8.6 Permanent-deletion process.

If the Customer requests permanent deletion, fails to choose an option at Account closure or does not renew an expiring inactive-retention period:

a. the Account and affected Customer Data shall become inaccessible for ordinary operational use;

b. the Company shall retain them in a recoverable state for thirty (30) calendar days; and

c. during those thirty days, the Customer may withdraw the deletion request and request reactivation.

Reactivation remains subject to Clause 8.4. The thirty-day recovery period does not create a separate right to access or export the Account.

8.7 Completion of deletion.

At the end of the thirty-day recovery period, the Company shall permanently delete the affected Customer Data from its active systems in accordance with its documented deletion processes.

After permanent deletion from the active systems, the Account and Customer Data cannot be restored through Unitlogi. Irreversible anonymisation shall not be used as an alternative to deletion following a valid deletion request.

Upon reasonable written request after completion, the Company shall confirm the deletion or explain the lawful basis applicable to any limited information that must remain.

8.8 Backups, security logs and legal records.

Limited copies may remain temporarily:

a. in backups until they are overwritten or deleted under the applicable backup cycle;

b. in restricted security or technical logs where necessary to protect Unitlogi or investigate an incident; or

c. in legal, accounting or compliance records where retention is required by law or reasonably necessary for the establishment, exercise or defence of legal claims.

These copies shall remain protected, isolated from ordinary operational use and accessible only where necessary for the applicable purpose. They shall be deleted or put beyond use when the relevant retention ground or technical cycle ends.

If a backup is restored, the Company shall reapply the relevant deletion and restriction controls.

8.9 Providers.

Where Customer Data has been processed by an authorised provider or sub-processor, the Company shall communicate the applicable deletion or restriction instruction in accordance with the DPA and the provider’s legally binding obligations.

8.10 Data return and export.

Unitlogi does not provide a general contractual right to export the entire Account and the Company does not undertake to develop a general self-service export tool.

This restriction does not affect:

a. an export function expressly made available within Unitlogi;

b. a right that cannot lawfully be waived;

c. a valid data-subject right; or

d. the Customer’s right under the DPA and applicable data protection law to request the return or availability of Personal Data processed on its behalf.

These exceptions do not create a right to obtain Unitlogi’s software, account structure, algorithms, internal logs, security information, other customers’ data or the Company’s intellectual property.

9. Warranties, Liability and Indemnity

9.1 Service provided as available.

To the maximum extent permitted by applicable law, Unitlogi, its support, matching results and AI Outputs are provided on an “as is” and “as available” basis.

Except for obligations expressly stated in these Terms, the Company disclaims all express, implied and statutory warranties, including warranties of merchantability, satisfactory quality, fitness for a particular purpose, non-infringement and compatibility.

The Company does not warrant that Unitlogi will be uninterrupted, error-free, entirely secure, compatible with every device or system, or capable of preventing every loss of data or unauthorised activity.

9.2 No real estate or professional service.

Unitlogi is a technology workspace and decision-support tool. Intech Heritage is not acting as a real estate broker, agency, property valuer, legal adviser, financial adviser, tax adviser or representative of the Customer.

The Company does not participate in, supervise, approve or guarantee any property, client relationship, communication, negotiation or transaction managed through Unitlogi.

The Customer remains solely responsible for its professional services, regulatory obligations, decisions, representations and transactions.

9.3 Excluded losses.

To the maximum extent permitted by applicable law, the Company and its affiliates, founders, directors, officers, employees, contractors and providers (together, the “Protected Persons”) shall not be liable for any indirect, incidental, special, exemplary, punitive or consequential loss, or for any loss of:

a. profits, revenue, commissions or anticipated savings;

b. business, opportunity, contracts or goodwill;

c. Customer Data or other information;

d. productivity or use of Unitlogi; or

e. costs of replacement services or business interruption.

These exclusions apply regardless of the legal basis of the claim and even if the Company was informed that such a loss might occur.

9.4 Aggregate liability cap.

To the maximum extent permitted by applicable law, the total aggregate liability of the Company, its affiliates, founders, directors, officers, employees, contractors and providers arising out of or in connection with:

a. Unitlogi or any Subscription;

b. these Terms;

c. the DPA;

d. Customer Data or its processing;

e. support, matching results or AI Outputs; or

f. any related act, omission, breach or claim,

shall not exceed five thousand United Arab Emirates dirhams (AED 5,000).

This is one fixed and cumulative cap for all claims and liabilities under or connected with the Terms and DPA together. It is not a separate cap for each claim, incident, Customer Data issue, contractual document, Subscription period or year.

The cap applies regardless of whether liability is asserted in contract, tort, negligence, breach of statutory duty, misrepresentation or otherwise.

9.5 Liabilities that cannot be limited.

Nothing in these Terms excludes or limits liability for fraud, wilful misconduct, gross negligence, death or personal injury caused by negligence, or any other liability that applicable law does not permit to be excluded or limited.

Nothing in this Section limits the direct statutory responsibilities of either party toward a regulator, authority or person where those responsibilities cannot lawfully be modified by contract.

9.6 Intellectual property claims concerning Unitlogi.

If a third party claims that Unitlogi infringes its intellectual property rights, the Company may, at its discretion:

a. obtain the right to continue providing the affected functionality;

b. modify or replace it with a reasonably comparable non-infringing functionality; or

c. restrict, suspend or remove the affected functionality.

The Company does not provide a separate contractual indemnity or promise to finance the Customer’s defence against such a claim. This Clause states the Customer’s contractual remedies for such a claim, subject to any right that cannot lawfully be excluded.

9.7 Customer indemnity.

To the extent permitted by applicable law, the Customer shall defend, indemnify and hold harmless the Company, its affiliates, founders, directors, officers, employees, contractors and providers against third-party claims, damages, losses, liabilities, penalties, costs and reasonable legal fees arising from:

a. Customer Data or the Customer’s lack of authority or lawful basis to process it;

b. the Customer’s infringement of privacy, confidentiality, intellectual property or other third-party rights;

c. the Customer’s real estate activities, professional services, communications, representations, recommendations or transactions;

d. unlawful, fraudulent, discriminatory or prohibited use of Unitlogi;

e. access to Unitlogi by the Customer’s Authorised Users or by a person to whom the Customer provided access; or

f. the Customer’s material breach of these Terms or the DPA.

The Customer is not responsible under this indemnity to the extent that the claim was caused by the Company’s own breach, fraud, wilful misconduct or gross negligence.

9.8 Indemnity procedure.

The Company shall notify the Customer of an indemnified claim within a reasonable time and provide reasonable cooperation.

The Customer may control the defence and settlement of the claim, but may not agree to a settlement that admits fault by the Company, imposes an obligation on the Company or affects the Company’s rights without the Company’s prior written consent.

A delay in notification reduces the Customer’s obligations only to the extent that the delay materially prejudices the defence.

9.9 Customer obligations not capped.

The liability cap in Clause 9.4 applies only to the Company and the Protected Persons. It does not limit:

a. the Customer’s obligation to pay subscription fees, taxes or other amounts due;

b. the Customer’s obligations under Clause 9.7;

c. infringement or misuse of the Company’s intellectual property;

d. breach of confidentiality; or

e. fraudulent, unlawful or deliberately harmful conduct by the Customer.

10. Governing Law and General Provisions

10.1 Notices and Contact.

Formal notices concerning these Terms must be sent by email.

Notices to the Company must be sent to contact@unitlogi.com. Notices to the Customer may be sent to the email address registered for the Account administrator. Operational, billing or security communications may also be displayed within Unitlogi.

Each party is responsible for keeping its contact details accurate and current. An electronic notice is considered received when it becomes available at the designated address, provided that the sender has not received an automated delivery-failure notification.

10.2 Good-Faith Dispute Resolution.

Before commencing court proceedings, the party raising a dispute shall send the other party a written notice describing the dispute and the remedy sought.

The parties shall then attempt in good faith to resolve the dispute through direct discussions between their authorised representatives for a period of thirty (30) calendar days from receipt of the notice.

This requirement does not prevent either party from seeking urgent interim or protective measures, preserving a claim before the expiry of a mandatory limitation period, or enforcing an existing judgment or order.

10.3 Governing Law and Jurisdiction.

These Terms, each Subscription and any non-contractual obligations arising out of or connected with them are governed by the laws of the Dubai International Financial Centre (“DIFC”), without regard to conflict-of-law principles.

Each party specifically, clearly and expressly agrees that the DIFC Courts shall have exclusive jurisdiction to resolve any dispute, claim or proceeding arising out of or connected with these Terms, a Subscription, the applicable DPA or the use of Unitlogi, including any question concerning their existence, validity, interpretation, performance or termination.

Either party may seek urgent interim or protective relief, or enforcement of a judgment, before any other court of competent jurisdiction where necessary.

Nothing in these Terms excludes any mandatory law, right or jurisdiction that cannot lawfully be excluded by agreement.

10.4 Changes to These Terms.

The Company may update these Terms when reasonably necessary to reflect changes to Unitlogi, its business model, applicable law, security requirements or contractual practices.

The Company shall provide at least thirty (30) days’ prior notice of any material change. A change is material when it significantly affects matters such as payment obligations, data rights, Account closure or deletion, liability, governing law, dispute resolution or the Customer’s principal obligations.

Material changes require the Customer’s affirmative electronic acceptance before they become binding on that Customer. Unless an earlier change is required by law or urgent security considerations, the previous Terms shall continue to govern until the end of the Customer’s current paid Subscription period. If the Customer does not accept the updated Terms, the Subscription shall not renew, and the Account shall be handled in accordance with Section 8.

Corrections, clarifications, contact-detail updates and changes that do not materially reduce the Customer’s rights or increase its obligations may take effect following notification or publication without requiring renewed acceptance.

Changes required by law or necessary to address an urgent security, integrity or abuse risk may take effect on shorter notice. The Company shall notify affected Customers and request renewed acceptance where required.

Price changes remain subject to Section 3. Changes concerning subprocessors or Personal Data processing remain subject to the applicable DPA.

10.5 Electronic Contract and Communications.

The Customer agrees that these Terms, Subscriptions, notices, consents, acceptances and related records may be created, delivered and retained electronically.

Electronic acceptance of these Terms has the same effect as a handwritten signature to the fullest extent permitted by applicable law. The Company may retain electronic records of the acceptance, including its date, time, Account and applicable version.

10.6 Assignment.

The Customer may not assign or transfer these Terms, a Subscription or an Account without the Company’s prior written consent.

The Company may assign or transfer its rights and obligations to an affiliate or to a successor in connection with a merger, reorganisation, financing, acquisition or sale of all or substantially all of the relevant business or assets, subject to applicable data-protection obligations.

10.7 Events Beyond Reasonable Control.

Neither party is liable for a delay or failure caused by circumstances beyond its reasonable control, including failures of telecommunications, cloud infrastructure or utilities, natural disasters, governmental measures, war, civil unrest, labour disruption, epidemics or widespread cyberattacks.

The affected party shall take commercially reasonable steps to limit the effects of the event. This Clause does not excuse payment obligations that became due before or during the affected event.

10.8 Entire Agreement and Order of Precedence.

These Terms, the applicable Subscription details, any order form or service schedule expressly accepted by both parties, and the applicable DPA constitute the entire agreement governing the Customer’s commercial use of Unitlogi.

In the event of a conflict:

1. the DPA prevails for the processing and protection of Personal Data;

2. any order form or service schedule expressly accepted by both parties prevails only for the commercial, service-level or support terms that it expressly varies;

3. the Subscription or checkout information prevails for the selected plan, price, billing period and applicable usage limits; and

4. these Terms prevail for all other matters.

Any Merchant of Record or payment-provider terms govern only the payment-processing, invoicing, taxation, refund-administration and payment-dispute services provided by that entity and prevail only to the extent that their mandatory terms are inconsistent with these Terms. The substantive refund policy in Clause 3.8 otherwise applies. The Privacy Policy describes the Company’s processing of Personal Data but does not replace or modify these Terms or the DPA.

10.9 Independent Parties.

The parties are independent contractors. These Terms do not create a partnership, joint venture, employment relationship, fiduciary relationship, franchise or agency between them.

Neither party may make commitments or representations on behalf of the other unless expressly authorised in writing.

10.10 No Waiver and Severability.

A failure or delay in exercising a right does not waive that right.

If any provision is found invalid or unenforceable, it shall be limited or modified only to the minimum extent necessary, and the remaining provisions shall continue in effect.

10.11 Third-Party Rights.

The Company’s affiliates, founders, directors, employees, contractors and service providers may rely on any provision that expressly protects or limits the liability of those persons.

Except for those protections, these Terms do not grant enforcement rights to any other third party.

10.12 Survival.

Provisions concerning accrued payments, intellectual property, confidentiality, Customer Data, Account closure and deletion, liability, indemnification, dispute resolution and any other provision that by its nature is intended to continue shall survive expiration or termination.

10.13 Language.

These Terms are written in English. Any translation is provided for convenience only. To the fullest extent permitted by applicable law, the English version prevails in the event of any inconsistency.

Unitlogi Global Data Processing Agreement

Version 1.0 | Last updated: 2 August 2026

1. Status, Scope and Order of Precedence

1.1 Incorporation into the Terms.

This Data Processing Agreement (the “DPA”) forms part of the Unitlogi Global Terms of Service (the “Terms”) between INTECH HERITAGE LLC - FZ, a company incorporated in Meydan Free Zone, Dubai, United Arab Emirates, under commercial licence No. 2528442.01 (the “Company”), and the professional or legal entity identified as the Customer under the Terms.

1.2 Effective date.

This DPA takes effect when the Customer electronically accepts the Terms and this DPA, or otherwise enters into a Subscription that expressly incorporates them. The individual accepting this DPA on behalf of the Customer confirms that they have authority to bind the Customer.

1.3 Scope.

This DPA applies whenever the Company processes Personal Data contained in Customer Data on behalf of the Customer in connection with the provision, operation, security, support or authorised use of Unitlogi.

1.4 Data-protection roles.

For the processing governed by this DPA, the Customer acts as the Controller and the Company acts as the Processor. The Customer determines the purposes of the processing and provides the Personal Data or the instructions under which it is processed.

The Company acts as an independent Controller for the processing activities identified in the Terms and the Unitlogi Privacy Policy, including Account administration, authentication, billing coordination, security, fraud prevention, legal compliance, corporate records and direct communications with the Customer or its Authorised Users. Such independent processing is not governed by the Processor obligations in this DPA.

In this DPA, “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach” and “Processing” have the meanings given by the data-protection law applicable to the relevant Processing.

1.5 Order of precedence.

If there is a conflict concerning the processing or protection of Personal Data:

a. any mandatory data-transfer clauses applicable to the relevant transfer shall prevail to the extent of that conflict;

b. this DPA shall prevail over the Terms; and

c. the remaining order of precedence stated in Section 10.8 of the Terms shall apply.

Nothing in this DPA excludes or restricts any obligation, right or protection that cannot lawfully be excluded or restricted.

2. Documented Instructions and Permitted Processing

2.1 Documented instructions.

The Company shall Process Personal Data contained in Customer Data (the “Customer Personal Data”) only on the Customer’s documented instructions.

The Customer’s documented instructions include:

a. the Terms, this DPA and its schedules;

b. the Customer’s use and configuration of the enabled Unitlogi features;

c. information, files, commands and requests submitted through the Account;

d. support, correction, deletion, return or other written requests submitted by an authorised representative of the Customer; and

e. any additional written instruction accepted by the Company.

2.2 Permitted purposes.

The Company may Process Customer Personal Data only as reasonably necessary to:

a. provide, operate, maintain and secure Unitlogi;

b. apply the Customer’s configured permissions to Authorised Users’ access to Customer Personal Data;

c. import, structure, store, organise, retrieve, display and manage Customer Data;

d. provide the enabled contact, property, interaction, task, opportunity, matching and client-facing sharing functions;

e. provide support, investigate and correct errors and maintain service functionality;

f. investigate or respond to a security incident, suspected misuse, fraud or unauthorised activity;

g. maintain service resilience, backups and recovery capabilities;

h. carry out valid retention, restriction, return and deletion instructions; and

i. comply with an obligation imposed by applicable law.

2.3 Access by the Company.

The Company may access Customer Personal Data without obtaining a separate authorisation for each intervention where that access is reasonably necessary for a purpose listed in Section 2.2.

Access shall be limited to authorised persons who require it for the relevant purpose and who are subject to appropriate confidentiality and security obligations.

2.4 Prohibited uses.

The Company shall not:

a. sell Customer Personal Data;

b. disclose or share Customer Personal Data for third-party advertising;

c. use Customer Personal Data to create unrelated commercial profiles;

d. use Customer Personal Data to train or fine-tune an artificial-intelligence model;

e. use Customer Personal Data to develop an unrelated product or service; or

f. otherwise Process Customer Personal Data for the Company’s independent advertising or marketing purposes.

The Company may use the Customer’s name, logo, approved testimonial or other specifically identified material for advertising or public communications only with the Customer’s prior, specific and written authorisation. That authorisation may be provided electronically and does not require a handwritten signature.

Such authorisation does not permit the disclosure of Personal Data relating to the Customer’s clients, prospects, property owners, contacts or other individuals unless the disclosure is separately lawful and expressly authorised.

2.5 Internal operational information.

The Company may generate and use technical, operational, security, usage, performance and cost information necessary to operate, secure, analyse and manage Unitlogi, including internal information showing service usage or infrastructure costs associated with a Customer or Account.

Where that information identifies the Customer or an Authorised User, the Company Processes it as an independent Controller in accordance with the Terms, the Unitlogi Privacy Policy and applicable data-protection law. The Company shall not sell that information or disclose it for third-party advertising.

The Company may also use aggregated or irreversibly anonymised information to analyse and improve Unitlogi, provided that the information cannot reasonably be used to identify the Customer, an Authorised User or another individual.

2.6 Artificial-intelligence processing.

The Company shall not submit Customer Personal Data to an external generative artificial-intelligence model.

Where an enabled Unitlogi function uses Amazon Bedrock or another authorised artificial-intelligence provider, the Company shall apply programmed controls designed to remove Personal Data before external submission. Only non-personal or irreversibly anonymised information may be submitted to the external model.

The Company shall not permit an artificial-intelligence provider to use Unitlogi inputs or outputs to train or fine-tune a model. Any AI-generated output stored within the Customer’s Account forms part of Customer Data and remains subject to this DPA.

2.7 Legally required Processing.

If the Company is required by applicable law to Process Customer Personal Data outside the Customer’s documented instructions, the Company shall inform the Customer before carrying out that Processing unless the applicable law prohibits such notification.

2.8 Unlawful instructions.

If the Company reasonably believes that a Customer instruction infringes applicable data-protection law, it shall inform the Customer without undue delay and may suspend the affected Processing until the instruction is clarified, amended or confirmed as lawful.

3. Customer Responsibilities

3.1 Lawfulness and authority.

The Customer is responsible for determining the purposes and lawful basis of its Processing of Customer Personal Data.

The Customer shall ensure that it has the legal right and authority to collect, use, disclose and submit Customer Personal Data to Unitlogi and to instruct the Company to Process it under this DPA.

The Customer shall not submit Personal Data obtained unlawfully or issue any instruction that would cause the Company to infringe applicable data-protection law.

3.2 Transparency and consent.

The Customer is responsible for:

a. providing its clients, prospects, property owners, contacts and other Data Subjects with any privacy information required by law;

b. obtaining any consent, permission or professional authorisation required for the relevant Processing;

c. ensuring that its use of Personal Data remains compatible with the purposes communicated to the relevant Data Subjects; and

d. maintaining evidence of consent or another lawful basis where applicable law requires such evidence.

3.3 Data minimisation and accuracy.

The Customer shall limit Customer Personal Data to information that is relevant and reasonably necessary for its legitimate professional use of Unitlogi.

The Customer shall use reasonable efforts to ensure that Customer Personal Data is accurate, complete and kept up to date, and shall communicate valid correction, restriction, return or deletion instructions to the Company without undue delay where the Customer cannot carry them out directly through the enabled Unitlogi features.

3.4 Sensitive and prohibited information.

The Customer shall not use Unitlogi to store or Process medical information, biometric data, criminal records, payment-card details, financial-account credentials, government identification documents, Personal Data concerning children or another specially protected category of Personal Data.

An otherwise restricted category may be Processed only where:

a. the Company has expressly authorised that category in writing;

b. the relevant Unitlogi function has been specifically enabled;

c. the parties have agreed any necessary additional safeguards; and

d. the Customer has established a valid lawful basis for the Processing.

Unitlogi shall not be used as a general archive for passports, identity cards, banking documents or other sensitive records that are not necessary for an expressly authorised function.

3.5 Communications and client-facing sharing.

The Customer is responsible for ensuring that it is legally authorised to contact each intended recipient and to send any property link, property sheet, message or other communication made available through Unitlogi.

The Customer shall verify the intended recipient and the information selected for sharing before sending it. The Company does not determine whether the Customer has a lawful basis to contact a particular person.

3.6 Authorised Users and Customer-controlled access.

The Customer is responsible for:

a. selecting and authorising its Authorised Users;

b. assigning appropriate permissions within its Account;

c. protecting credentials and preventing account sharing;

d. promptly modifying or withdrawing access when an Authorised User changes role or is no longer authorised; and

e. notifying the Company without undue delay of any suspected unauthorised access, compromised credentials or unlawful use of Customer Personal Data.

3.7 Data Subject requests.

The Customer remains primarily responsible for receiving, assessing and responding to requests from Data Subjects concerning Customer Personal Data.

The Company shall provide the assistance required under this DPA, but shall not determine the Customer’s response or communicate substantively with the Data Subject on the Customer’s behalf unless instructed by the Customer or required by applicable law.

3.8 Privacy and security contacts.

The Customer shall maintain accurate and current contact details for privacy, security and legal communications and shall ensure that any person submitting an instruction to the Company is authorised to act on the Customer’s behalf.

4. Confidentiality and Authorised Personnel

4.1 Need-to-know access.

The Company shall limit access to Customer Personal Data to directors, employees and authorised contractors who require access for a permitted purpose under this DPA.

Technical access to production systems shall be limited to personnel responsible for infrastructure, development, security, maintenance, support or incident response whose duties reasonably require that access.

Personnel responsible for legal matters, customer communications or business administration may receive only the information reasonably necessary to perform those responsibilities. A person shall not receive permanent technical access to production systems solely because of their management position.

4.2 Confidentiality obligations.

Before receiving access to Customer Personal Data, each authorised person shall be bound by:

a. an enforceable contractual confidentiality obligation;

b. an applicable professional or statutory duty of confidentiality; or

c. another legally binding obligation providing equivalent protection.

Confidentiality obligations shall continue after the person’s access is withdrawn and after the end of their employment, engagement or other relationship with the Company.

4.3 Instructions and awareness.

The Company shall provide authorised personnel with privacy, confidentiality and security instructions appropriate to their roles.

Authorised personnel shall Process Customer Personal Data only as necessary to perform their assigned duties and in accordance with the Company’s instructions, this DPA and applicable data-protection law.

4.4 Access management.

Access rights shall be:

a. assigned through individual accounts wherever technically available;

b. limited to the permissions necessary for the person’s role;

c. modified when the person’s duties change;

d. reviewed at reasonable intervals and following a material security event; and

e. withdrawn without undue delay when the access is no longer required or the person’s engagement ends.

Shared accounts shall not be used where individual accounts are technically available. Any unavoidable technical or service account shall be restricted, protected and managed in accordance with the Company’s security controls.

4.5 Future personnel and contractors.

The Company may grant access to additional employees or authorised contractors without obtaining separate approval from each Customer, provided that:

a. the access is reasonably necessary to provide, maintain, secure or support Unitlogi;

b. the person is subject to the requirements of this section;

c. access is limited to the person’s assigned responsibilities; and

d. the Company remains responsible for the person’s compliance with this DPA.

The appointment of a third-party service provider that Processes Customer Personal Data on behalf of the Company remains subject to the Subprocessor requirements of this DPA.

5. Security Measures

5.1 Appropriate protection.

The Company shall implement and maintain appropriate technical and organisational measures designed to protect the confidentiality, integrity, availability and resilience of Customer Personal Data, taking into account the nature of the Processing, the available technology, implementation costs and the relevant risks to Data Subjects.

5.2 Principal measures.

The measures shall include, where appropriate:

a. encryption of Customer Personal Data in transit and at rest;

b. logical separation between Customer Accounts and between staging and production environments;

c. access restrictions based on operational need, supported by appropriate authentication controls;

d. secure management of credentials, keys and secrets; and

e. reasonable processes for identifying and addressing material errors, vulnerabilities and security issues.

5.3 Exceptional use outside production.

Customer Personal Data may be copied to the staging environment only where reasonably necessary to investigate or correct a technical error.

The Company shall limit the copy to the information reasonably necessary, protect it against unauthorised access, anonymise or reduce it where reasonably practicable and delete it when the relevant work has been completed.

5.4 Backups and recovery.

The Company shall maintain protected and access-restricted backup and recovery measures within its AWS environment for service-continuity and recovery purposes.

If a backup is restored, the Company shall reapply the relevant deletion and restriction controls.

5.5 Changes and limitations.

The Company may update its security measures as Unitlogi and the relevant risks evolve, provided that the overall level of protection is not materially reduced.

These measures are risk-based commitments and do not constitute a guarantee that every attack, interruption, error or Security Incident will be prevented.

6. Security Incidents

6.1 Notification.

A “Security Incident” means a confirmed breach of security resulting in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data.

The Company shall notify the Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data. Unsuccessful attempts or technical events that do not compromise Customer Personal Data are not Security Incidents.

6.2 Available information.

To the extent reasonably available, the Company shall provide information concerning:

a. the nature of the Security Incident;

b. the categories of data and Data Subjects affected;

c. the likely consequences;

d. the measures taken or proposed to contain, investigate and mitigate the incident; and

e. an appropriate contact point.

The Company may provide information in stages as its investigation progresses.

6.3 Response and assistance.

The Company shall take reasonable steps to contain, investigate, mitigate and remediate the Security Incident and shall provide the Customer with reasonable assistance necessary to assess its obligations under applicable data-protection law.

6.4 External notifications.

The Customer remains responsible for deciding whether it must notify a Data Subject, regulator or other third party, except where applicable law independently requires the Company to notify.

The Company shall not identify the Customer publicly in connection with a Security Incident unless legally required or authorised by the Customer. A notification under this section does not constitute an admission of fault or liability.

7. Data Subject Rights and Compliance Assistance

7.1 Assistance.

Taking into account the nature of the Processing, the Company shall provide reasonable technical and organisational assistance to help the Customer respond to valid requests from Data Subjects concerning Customer Personal Data.

7.2 Direct requests.

If the Company receives such a request directly, it shall refer the request to the Customer where legally permitted and shall not provide a substantive response except on the Customer’s documented instruction or where required by law.

7.3 Customer responsibility.

The Customer remains responsible for verifying the requester’s identity, determining whether the request is valid, deciding the response and complying with applicable deadlines.

The Company may request the information reasonably necessary to locate the relevant data and carry out the Customer’s instruction securely.

7.4 Additional compliance assistance.

The Company shall provide reasonable assistance with security and breach obligations, data-protection impact assessments, prior consultation and regulatory enquiries relating to the Processing, where required by applicable data-protection law.

Normal assistance is included in the Service. The Company may charge reasonable costs agreed in advance for exceptional or disproportionate assistance, unless that assistance is required because of the Company’s breach of this DPA.

8. Subprocessors

8.1 General authorisation.

A “Subprocessor” is a third-party provider appointed by the Company to Process Customer Personal Data on its behalf.

The Customer gives the Company general authorisation to use the Subprocessors identified in Schedule 3 and to appoint or replace Subprocessors in accordance with this section.

8.2 Changes.

The Company shall provide reasonable advance notice before a new or replacement Subprocessor begins Processing Customer Personal Data. Notice may be provided by email, through Unitlogi or through an updated Subprocessor list made available to the Customer.

A shorter notice period may be used where reasonably necessary for security, service continuity, legal compliance or circumstances outside the Company’s reasonable control.

8.3 Objections.

The Customer may object to a proposed Subprocessor on documented and reasonable data-protection grounds.

The parties shall attempt in good faith to identify a reasonable solution. If no reasonable solution is available, the Company may decide not to appoint the Subprocessor, use an alternative provider, modify or disable the affected functionality, or suspend or terminate the affected Processing in accordance with the Terms.

8.4 Subprocessor obligations.

Before a Subprocessor Processes Customer Personal Data, the Company shall ensure through a written agreement that, to the extent applicable to the delegated Processing, the Subprocessor is subject to the same data-protection obligations as those imposed on the Company under this DPA, including appropriate confidentiality and security obligations.

The Company remains responsible for the Subprocessor’s delegated data-protection obligations to the extent required by applicable law, subject to the liability provisions of the Terms and this DPA.

9. International Transfers and Processing Locations

9.1 Processing locations.

Customer Personal Data may be processed by the Company in the United Arab Emirates and hosted primarily through Amazon Web Services in the ap-southeast-2 region in Sydney, Australia.

The Company and its authorised Subprocessors may also Process Customer Personal Data from other locations where reasonably necessary to provide, secure or maintain Unitlogi, subject to this DPA and applicable law.

9.2 Material location changes.

The Company shall provide reasonable notice of any material change involving a new country, recipient or transfer arrangement that materially affects the protection of Customer Personal Data. Notice is not required for routine technical routing, resilience measures or infrastructure changes that do not materially affect such protection.

9.3 Transfer safeguards.

Where applicable law restricts an international transfer of Customer Personal Data, the parties shall rely on an applicable adequacy decision or another valid transfer mechanism.

Where required:

a. the European Commission Standard Contractual Clauses adopted under Decision (EU) 2021/914 shall be incorporated into this DPA using Module Two (Controller to Processor);

b. the United Kingdom International Data Transfer Addendum to the European Commission Standard Contractual Clauses shall be incorporated into this DPA; and

c. the European Standard Contractual Clauses shall apply to transfers governed by Swiss data-protection law with the adaptations required under that law.

The applicable selections and transfer information are set out in Schedule 4.

9.4 European clauses.

For the European Standard Contractual Clauses only, the parties select the law and courts of the Republic of Ireland. This selection does not change the governing law or jurisdiction applicable to the remainder of this DPA or the Terms.

9.5 Replacement mechanisms.

If an applicable transfer mechanism becomes invalid or unavailable, the parties shall reasonably cooperate to implement a valid replacement. The Company may suspend the affected Processing where no lawful alternative is reasonably available.

9.6 Cross-region inference.

Cross-region inference may be used only for information permitted under Section 2.6 and shall not be used to Process Customer Personal Data.

10. Retention, Return and Deletion

10.1 Active Account.

The Company shall retain and Process Customer Personal Data while the Customer’s Account remains active, subject to the Terms, this DPA and applicable law.

10.2 Account closure options.

Upon Account closure, the Customer may choose either:

a. an initial inactive retention period of twelve months, during which the Account may be reactivated; or

b. permanent deletion in accordance with Section 10.3.

If the Customer makes no choice, permanent deletion shall apply by default.

The Company shall provide at least thirty days’ notice before an inactive retention period expires. Each additional twelve-month extension requires a new affirmative request from the Customer. The Customer may request permanent deletion at any time.

10.3 Permanent deletion.

Following a permanent deletion request, Customer Personal Data shall remain recoverable for thirty days. During this period, the Customer may withdraw the request to reactivate the Account.

After the thirty-day period, the Company shall delete Customer Personal Data from its active systems, and the Account and its data shall no longer be recoverable through Unitlogi.

10.4 Return of data.

Before permanent deletion is completed, the Customer may request the return of its Customer Personal Data. The Company shall provide the data in a commonly used, structured and technically feasible format reasonably requested by the Customer.

The Customer is responsible for securely receiving and retaining any returned data.

10.5 Limited residual copies.

Limited copies may remain temporarily in protected backups, security records or legally required archives. Such copies shall remain subject to appropriate access restrictions, shall not be used for ordinary business operations and shall be deleted or rendered inaccessible when their applicable retention purpose ends.

10.6 Backup restoration.

If a backup containing Customer Personal Data subject to deletion is restored, the Company shall reapply the relevant deletion and access restrictions.

10.7 Required retention.

The Company may retain the minimum Customer Personal Data required by applicable law or reasonably necessary for the establishment, exercise or defence of legal claims. Any retained data shall remain protected and shall be used only for the applicable purpose.

10.8 Anonymised information.

A deletion request shall not be replaced by retaining Customer Personal Data in identifiable form. This section does not require the deletion of information that was irreversibly anonymised so that it can no longer be linked to the Customer or any Data Subject.

11. Compliance Information and Audits

11.1 Compliance information.

Upon reasonable request, the Company shall provide the Customer with information reasonably necessary to demonstrate compliance with this DPA, subject to appropriate confidentiality and security restrictions.

The Company is not required to create bespoke certifications or reports that it does not ordinarily maintain, unless required by applicable law.

11.2 Remote review first.

The Customer shall first use available documentation and remote verification. An on-site or more intrusive audit may be requested only where this information is reasonably insufficient.

11.3 Audit conditions.

Unless otherwise required by a competent authority or applicable law, an audit shall:

a. occur no more than once in any twelve-month period;

b. be requested with reasonable advance notice;

c. take place during normal business hours;

d. be conducted by the Customer or an independent auditor bound by confidentiality; and

e. avoid unreasonable disruption to the Company’s operations.

The annual limitation does not apply following a Security Incident materially affecting the Customer’s Personal Data or where the Customer has documented reasonable grounds to suspect a material breach of this DPA.

11.4 Protection of the Company and other customers.

An audit shall be limited to matters relevant to the Customer Personal Data and shall not provide access to another customer’s data, unrelated systems, source code, trade secrets or information that would create a security risk.

The Company may provide appropriate alternative evidence where direct access would compromise confidentiality or security.

11.5 Costs and findings.

The Customer shall bear its audit costs unless the audit establishes a material breach of this DPA by the Company. In that case, the Company shall bear the reasonable audit costs directly attributable to verifying that breach and shall take reasonable corrective action.

11.6 Regulatory authorities.

Nothing in this section limits the powers of a competent supervisory or regulatory authority under applicable law.

12. Duration, Suspension and Termination

12.1 Duration.

This DPA takes effect when the Customer accepts the Terms and remains in effect for as long as the Company Processes Customer Personal Data on behalf of the Customer.

12.2 Suspension of Processing.

The Company may suspend an affected Processing activity where it reasonably believes that:

a. a Customer instruction violates applicable law;

b. continued Processing would create a material security or data-protection risk; or

c. suspension is required by a competent authority.

Where reasonably possible and legally permitted, the Company shall notify the Customer and allow a reasonable opportunity to correct the issue.

12.3 Effect of termination.

Termination or expiry of the Terms ends this DPA, except for provisions that must continue while Customer Personal Data remains subject to inactive retention, deletion, legal preservation or limited residual storage.

12.4 Continuing obligations.

The confidentiality, security, transfer, deletion, liability and other provisions intended by their nature to continue shall remain effective for as long as the Company retains Customer Personal Data.

13. Liability

13.1 Application of the Terms.

The exclusions and limitations of liability set out in the Terms apply to this DPA and to all Processing carried out in connection with Unitlogi.

13.2 Single aggregate cap.

To the fullest extent permitted by applicable law, the Company’s total aggregate liability arising out of or relating to the Terms, this DPA, Unitlogi or the Processing of Customer Personal Data shall not exceed AED 5,000, regardless of the legal basis of the claim.

This is one combined aggregate cap and not a separate cap for each claim, event or document.

13.3 Mandatory liability.

The limitation in Section 13.2 does not apply to the extent that liability cannot lawfully be excluded or limited or where mandatory transfer clauses expressly require otherwise.

13.4 No double recovery.

The DPA does not create a separate right to recover twice for the same loss under both this DPA and the Terms.

14. Governing Law, Notices and Changes

14.1 Governing law and jurisdiction.

Except where mandatory transfer clauses require otherwise, this DPA is governed by the same law and jurisdiction as the Terms.

14.2 Notices.

Notices to the Company concerning this DPA shall be sent to contact@unitlogi.com.

Notices to the Customer may be sent to the contact details associated with its Account, through Unitlogi or by another reasonable electronic method.

14.3 Changes.

The Company may update this DPA to reflect changes in applicable law, regulatory requirements, Unitlogi or its Processing activities.

The Company shall provide reasonable notice of material changes. Where required by the Terms or applicable law, the Customer must accept the updated version before continuing to use Unitlogi.

14.4 Electronic acceptance.

This DPA may be accepted electronically. The Company may retain evidence of acceptance, including the Customer’s Account, the date and time of acceptance and the accepted version.

14.5 General provisions.

The provisions of the Terms concerning notices, interpretation, severability, waiver, assignment and the entire agreement apply to this DPA unless expressly stated otherwise.

Schedule 1

Details of the Processing

1. Subject matter.

The Processing of Customer Personal Data through Unitlogi on behalf of the Customer.

2. Duration.

Processing continues for the duration of the DPA and for any subsequent inactive retention, recovery, deletion, backup or legally required retention period described in Section 10.

3. Nature of the Processing.

The Processing may include collection, recording, organisation, structuring, import, storage, retrieval, consultation, matching, analysis, use, authorised sharing, backup, support, return and deletion.

4. Purposes.

Customer Personal Data is Processed only as reasonably necessary to:

a. provide and operate Unitlogi;

b. manage the Customer’s contacts, properties, interactions, tasks, opportunities and property requirements;

c. import and structure information submitted by the Customer;

d. calculate matching results and generate enabled Unitlogi outputs;

e. provide authorised client-facing property information;

f. provide support, maintenance, security and recovery; and

g. comply with the Customer’s documented instructions and applicable law.

5. Categories of Data Subjects.

Data Subjects may include:

a. the Customer’s clients and prospects;

b. buyers, tenants and investors;

c. sellers, landlords and property owners;

d. brokers, agents, representatives and counterparties;

e. the Customer’s personnel and Authorised Users where their Personal Data is included in Customer Data; and

f. other individuals whose Personal Data is lawfully submitted to Unitlogi by or on behalf of the Customer.

6. Categories of Customer Personal Data.

Customer Personal Data may include:

a. names, contact details and professional or relationship information;

b. property requirements, preferences, budgets and search criteria;

c. interactions, communications, notes, tasks and opportunities;

d. property information linked to an identifiable individual;

e. documents, files, photographs, videos and other uploaded content;

f. information contained in authorised PDF, Excel or CSV imports; and

g. matching results, summaries or other Unitlogi outputs where they relate to an identifiable individual.

7. Sensitive information.

Unitlogi is not intended to Process medical information, biometric data, criminal records, payment-card details, financial-account credentials, government identification documents, information concerning children or other specially protected information, unless the Company has expressly authorised the relevant category in writing and appropriate safeguards have been agreed.

8. Excluded Processing.

This Schedule does not govern Personal Data for which the Company acts as an independent Controller, including Account administration, authentication, billing coordination, security, fraud prevention, legal compliance, corporate records, direct communications and internal operational or cost metrics.

9. Frequency of transfers.

Customer Personal Data may be transferred on a continuous basis while the Account is active and as reasonably necessary during any permitted inactive retention, recovery, deletion, backup or legally required retention period.

Schedule 2

Technical and Organisational Measures

1. Infrastructure and encryption.

Unitlogi is hosted through Amazon Web Services. Customer Personal Data is protected by encryption in transit and at rest using the controls supported by the applicable AWS services.

2. Authentication and access.

User authentication is managed through AWS Cognito. Access to production infrastructure and Customer Personal Data is restricted to authorised technical roles according to operational need.

Administrative access to AWS is protected by multifactor authentication. Credentials, keys and secrets are managed through appropriate AWS controls and are not intended to be exposed in application code.

3. Customer and environment separation.

The application and backend enforce logical separation between customers.

Production and staging are maintained as separate environments. Where limited production data is exceptionally required to reproduce an error, only the minimum necessary data may be used, it shall remain protected and it shall be deleted when the work is completed.

4. Secure development and maintenance.

Source code and deployments are managed through controlled repositories and deployment processes. The Company maintains reasonable processes designed to identify and address material errors, vulnerabilities and security issues, with corrective measures applied according to the relevant risk.

5. Technical records and incidents.

Technical error records are designed not to contain Customer Personal Data, credentials or secrets.

Suspected or confirmed Security Incidents are handled in accordance with the Company’s incident-response process and Section 6 of this DPA.

6. Backups and recovery.

Backups and recovery functions are provided through protected AWS services and are restricted to authorised technical roles.

Following any restoration, applicable access restrictions, retention rules and deletion controls shall be reapplied.

7. Confidentiality.

Personnel and contractors authorised to access Customer Personal Data are subject to confidentiality obligations and may Process such data only for authorised purposes.

8. Review and changes.

The Company may update or replace these measures as technology, risks and Unitlogi evolve, provided that the overall level of protection is not materially reduced.

Schedule 3

Approved Subprocessors

Amazon Web Services EMEA SARL

Registered address:

38 Avenue John F. Kennedy, L-1855 Luxembourg.

Services provided:

Cloud infrastructure, application hosting, API services, database services, object storage, authentication, backups, networking, security and related support services.

Purpose of Processing:

To host, store, secure, transmit, back up and otherwise support the operation of Unitlogi.

Categories of data:

Customer Personal Data Processed through the AWS infrastructure as necessary to provide Unitlogi.

Primary hosting location:

AWS region ap-southeast-2, Sydney, Australia.

Other AWS processing or support locations may be used as permitted under Section 9 and the applicable AWS contractual terms.

Amazon Bedrock:

Amazon Bedrock may use cross-region inference only for non-personal information or information that has been irreversibly anonymised. Customer Personal Data shall not be transmitted to Amazon Bedrock for inference.

Additional AWS providers:

AWS may use its own authorised subprocessors in accordance with the AWS Data Processing Addendum and its published subprocessor information.

Schedule 4

International Transfer Mechanisms

1. Application.

This Schedule applies only where a transfer of Customer Personal Data requires an international transfer mechanism under Section 9.

2. Parties.

Data Exporter:

The Customer identified through the relevant Unitlogi Account.

Full legal name, trading name (if any), address, registration number (if any), and contact person’s name, position and contact details: as recorded in the Customer’s Account or Subscription records.

Activities: use of Unitlogi as a Controller for the Processing described in Schedule 1.

Role: Controller.

Signature and date: electronic acceptance in accordance with Section 14.4.

Data Importer:

INTECH HERITAGE LLC - FZ

Meydan Free Zone, Dubai, United Arab Emirates

Commercial Licence No. 2528442.01

Data-protection contact: Nicolas Elorduy, CEO & Co-Founder, contact@unitlogi.com.

Activities: provision and operation of Unitlogi as a Processor for the Processing described in Schedule 1.

Role: Processor.

Signature and date: electronic acceptance in accordance with Section 14.4.

The parties enter into the applicable transfer mechanism electronically when the Customer accepts this DPA. The effective date and evidence of acceptance are recorded in accordance with Section 14.4.

3. European Economic Area transfers.

Where required for a transfer governed by the GDPR, the Standard Contractual Clauses adopted through Commission Implementing Decision (EU) 2021/914 are incorporated into this DPA as follows:

a. Module Two, Controller to Processor, applies;

b. Clause 7, the optional docking clause, applies;

c. Clause 9(a), Option 2 for general written authorisation, applies, with a notice period of thirty (30) calendar days for Customer Personal Data transferred under the Standard Contractual Clauses;

d. the optional wording in Clause 11 does not apply;

e. for Clause 17, Option 1 applies and the governing law is the law of the Republic of Ireland;

f. for Clause 18, the courts of the Republic of Ireland are selected; and

g. for Annex I.C and Clause 13, the competent supervisory authority shall be the authority having responsibility for the Customer under Clause 13 and shall be identified in the Customer’s Account or Subscription records.

For the annexes to the Standard Contractual Clauses:

• Annex I.A is completed by Section 2 of this Schedule;

• Annex I.B is completed by Schedule 1;

• Annex I.C is completed by Section 3(g) above;

• Annex II is completed by Schedule 2; and

• Annex III is completed by Schedule 3.

4. United Kingdom transfers.

Where required for a transfer governed by United Kingdom data-protection law, the International Data Transfer Addendum to the European Commission Standard Contractual Clauses, Version B1.0, is incorporated into this DPA.

For its Part 1 Tables:

a. Table 1 is completed by Section 2 of this Schedule;

b. Table 2 uses Module Two, with Clause 7 applying, Clause 9(a) Option 2 applying and the optional wording in Clause 11 not applying;

c. Table 3 is completed by Schedules 1, 2 and 3; and

d. for Table 4, the Data Importer may end the Addendum in accordance with Section 19 of its Mandatory Clauses.

Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

5. Swiss transfers.

Where required for a transfer governed by the Swiss Federal Act on Data Protection, the European Standard Contractual Clauses apply with the following adaptations:

a. references to the GDPR include the Swiss Federal Act on Data Protection where applicable;

b. references to Personal Data and sensitive data include the corresponding terms under Swiss law;

c. the Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed exclusively by Swiss law;

d. references to a Member State shall not prevent Data Subjects in Switzerland from exercising their rights in Switzerland; and

e. where the transfer is governed exclusively by Swiss law, the clauses are governed by Swiss law and disputes may be brought before the competent courts of Switzerland.

Where both the GDPR and Swiss law apply, the selections in Section 3 remain effective without limiting any mandatory rights under Swiss law.

6. Priority.

The applicable mandatory transfer mechanism prevails over this DPA and the Terms only to the extent of an unavoidable conflict.

Schedule 5

United States State Privacy Terms

1. Application and roles.

This Schedule applies only where a United States state privacy law governs the Processing of Customer Personal Data.

For that Processing, the Customer acts as the Business or Controller and the Company acts as the Service Provider, Contractor or Processor, as those terms are used under the applicable law.

2. Processing restrictions.

The Company shall:

a. Process Customer Personal Data only for the purposes described in this DPA and on the Customer’s documented instructions;

b. not sell or share Customer Personal Data;

c. not use Customer Personal Data for targeted or cross-context behavioural advertising;

d. not retain, use or disclose Customer Personal Data outside the purposes described in this DPA or outside the direct business relationship with the Customer, except as permitted or required by applicable law; and

e. not combine Customer Personal Data with Personal Data received from another person or collected through the Company’s independent interactions with a Data Subject, except where expressly permitted by applicable law to provide the services.

3. Required protection.

The Company shall provide the level of privacy protection required by applicable law and shall notify the Customer if it determines that it can no longer comply with its applicable obligations.

The Customer may take reasonable and appropriate steps to stop and remediate any unauthorised Processing.

4. Consumer rights and compliance.

The Company shall provide the reasonable assistance described in Section 7 for applicable consumer requests, security obligations and data-protection assessments.

The information and audit rights in Section 11 apply to the Processing covered by this Schedule.

5. Deidentified information.

Where the Company uses information that qualifies as deidentified data under applicable law, it shall take reasonable measures to maintain that information in deidentified form and shall not attempt to reidentify it except as permitted by law to verify the effectiveness of the deidentification process.

6. Certification.

The Company certifies that it understands the restrictions in this Schedule and shall comply with them where applicable.

7. Priority.

If this Schedule conflicts with another provision of the DPA, this Schedule prevails only to the extent required by the applicable United States state privacy law.