Data Processing Agreement

Draft. This document is a draft and must be reviewed and approved by an attorney before use. Items in square brackets must be completed. In case of discrepancy, the Czech version prevails.

Parties

Controller: [FILL IN: company name], company ID (IČO) [FILL IN: IČO], with its registered office at [FILL IN: registered office], contact e-mail [email protected] (the "Controller" or "ICORENT")

and

Processor: [FILL IN: partner name], company ID [FILL IN: partner company ID], with its registered office / place of business at [FILL IN: partner address], e-mail [FILL IN: partner e-mail] (the "Processor")

enter into this data processing agreement (the "Agreement") pursuant to Article 28(3) of Regulation (EU) 2016/679 (the "GDPR") and Czech Act No. 110/2019 Coll.

1. Purpose and relationship to the main agreement

1.1 The Controller provides advisory and intermediation of financing secured by real estate exclusively to businesses with a company ID. The Controller is not a bank and does not provide consumer credit under Czech Act No. 257/2016 Coll.

1.2 Under [FILL IN: cooperation agreement / framework agreement dated …] (the "Main Agreement"), the Processor performs activities on behalf of the Controller related to handling enquiries, in particular phone and e-mail contact with enquirers (caller activity), collecting documents and preparing opportunities.

1.3 This Agreement sets out the conditions under which the Processor processes personal data on behalf of the Controller. In the event of conflict with the Main Agreement, this Agreement prevails on data protection matters.

2. Investors and other independent controllers

2.1 An investor to whom the Controller discloses opportunity data and who decides on its use on its own and in its own interest (in particular on providing financing and on the scope of its own due diligence) is not a processor but an independent controller of personal data.

2.2 Where the parties agree in writing, this Agreement applies to such an investor mutatis mutandis to the extent of Articles 4 (confidentiality), 5 (security), 8 (personal data breach) and 10 (deletion after negotiations end). The investor must also fulfil its own obligations as a controller under the GDPR, in particular the duty to inform data subjects, and use the data solely to assess and execute the specific financing.

[FILL IN: attorney to consider a separate controller-to-controller data sharing agreement for investors, or a joint controllership arrangement under Article 26 GDPR.]

3. Subject matter, nature and duration of processing

3.1 The subject matter, nature, purpose, categories of personal data and categories of data subjects are described in Annex 1.

3.2 Processing takes place for the term of the Main Agreement. Obligations under Articles 4, 5 and 10 survive its termination for as long as the Processor holds any personal data of the Controller.

4. Obligations of the Processor

4.1 The Processor shall:

• process personal data only on documented instructions from the Controller, including with regard to transfers to third countries; instructions are contained in this Agreement, the Main Agreement and in written or e-mail instructions from the Controller,
• immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other law,
• not use personal data for its own purposes, in particular not to approach clients on its own behalf, offer other products, or disclose data to third parties,
• not contact clients or property owners other than for the purpose and in the manner determined by the Controller,
• ensure that persons authorised to process the data are bound by confidentiality, which continues after their engagement ends,
• not make copies of data outside the systems designated by the Controller (e.g. on private phones, personal e-mail or cloud storage) unless expressly permitted,
• assist the Controller in responding to data subject requests (Articles 15 to 22 GDPR) and forward any such request it receives to the Controller without delay, within 3 business days at the latest,
• assist the Controller in complying with Articles 32 to 36 GDPR, in particular security, breach notification and impact assessments,
• maintain records of processing activities under Article 30(2) GDPR where this obligation applies to it.

4.2 The Processor shall not access title deed data, insolvency register data or other sources beyond the specific enquiry assigned to it by the Controller.

5. Security

5.1 The Processor shall implement appropriate technical and organisational measures under Article 32 GDPR, at least to the extent set out in Annex 2.

5.2 The Processor shall ensure that devices used for processing (computer, phone) are protected by a password or biometrics, encrypted and kept up to date, and that accounts in the tools used (in particular Telegram, e-mail, CRM) are protected by two-factor authentication.

6. Sub-processors

6.1 The Controller grants the Processor general written authorisation to engage the sub-processors listed in Annex 3. The tools listed in Annex 3 are determined by the Controller and used by the Processor according to its instructions.

6.2 Engaging any other sub-processor requires the Controller's prior written consent. The Processor shall impose on any sub-processor the same obligations as under this Agreement and remains liable to the Controller for their performance.

6.3 The Controller shall inform the Processor of intended changes to Annex 3 at least 14 days in advance.

7. Transfers to third countries

The Processor shall not transfer personal data outside the EU/EEA other than through the tools listed in Annex 3 or with the Controller's prior written consent and under the conditions of Chapter V GDPR.

8. Personal data breach

8.1 The Processor shall notify the Controller of any personal data breach without undue delay and in any event within 24 hours of becoming aware of it, by e-mail to [email protected] and by phone.

8.2 The notification shall include at least a description of the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken. Typical breaches include loss or theft of a phone, compromise of a Telegram or e-mail account, or sending data to the wrong recipient.

8.3 Unless required by law, the Processor shall not notify data subjects or the Czech Office for Personal Data Protection of a breach without the Controller's consent.

9. Audits and inspections

The Processor shall make available to the Controller all information necessary to demonstrate compliance with this Agreement and allow audits and inspections by the Controller or an auditor it appoints, with at least 5 business days' prior notice, unless there is reason for an immediate inspection.

10. End of processing

10.1 Upon termination of the Main Agreement, upon completion of a specific enquiry or on the Controller's instruction, the Processor shall, at the Controller's choice, delete or return the personal data and delete existing copies, including messages in Telegram and e-mails, within 14 days.

10.2 On request, the Processor shall confirm deletion in writing. The Processor may retain data only where required by law.

11. Liability and contractual penalties

11.1 The Processor is liable to the Controller for damage caused by breach of this Agreement or the GDPR, including fines imposed on the Controller where caused by the Processor's conduct.

11.2 For each breach of Articles 4 and 7, the Controller may claim a contractual penalty of CZK [FILL IN: amount]. Payment of the penalty does not affect the right to compensation for damage.

12. Final provisions

12.1 This Agreement is governed by the laws of the Czech Republic.

12.2 This Agreement may only be amended in writing. The Controller may unilaterally update Annex 3 under Article 6.3.

12.3 This Agreement enters into force and effect on the date of signature by both parties.

In [FILL IN: place] on [FILL IN: date]

For the Controller: ____________________ [FILL IN: name and position]

For the Processor: ____________________ [FILL IN: name and position]

Annex 1 – Description of processing

• Subject matter and nature: receiving, storing, viewing, supplementing, verifying by phone and e-mail, forwarding and deleting financing enquiry data.
• Purpose: handling the client's enquiry, preparing documentation for financing intermediation and communicating with the client on behalf of the Controller.
• Categories of data subjects: self-employed individuals, contact persons, representatives and statutory bodies of legal entities, owners and co-owners of real estate and other persons recorded on the title deed.
• Categories of personal data: identification data (name, company ID, date of birth where shown in a register or title deed), contact details, requested financing details, property and Land Registry entry data, insolvency proceedings and VAT payer status, content of communications.
• Special categories of data: not processed. The Processor must not request health data or other special categories of data from clients.

Annex 2 – Minimum technical and organisational measures

• access to data only for persons who strictly need it, with individual accounts,
• two-factor authentication on all accounts used,
• encryption and screen lock on all devices, remote wipe of a lost phone,
• prohibition on storing data in private storage or sharing it via unauthorised channels,
• regular deletion of messages and attachments after an enquiry is completed,
• training on data protection and confidentiality,
• incident reporting procedure under Article 8.

Annex 3 – Authorised sub-processors and tools

Category	Provider	Purpose	Location / safeguards
Hosting and database	[FILL IN: hosting provider]	operating the website, forms, CRM and investor portal	[FILL IN: EU / other]
Internal notifications	Telegram (Telegram Messenger Inc. / Telegram FZ-LLC)	notifying staff and partners of new enquiries	outside the EU; [FILL IN: attorney to verify safeguards under Chapter V GDPR]
Artificial intelligence	Anthropic, PBC and its European entities	generating the automatic reply to enquiries	USA; standard contractual clauses / EU–US Data Privacy Framework [FILL IN: verify]
E-mail	[FILL IN: e-mail service provider]	sending and receiving e-mails	[FILL IN]
Analytics and tag management	Google Ireland Limited	Google Tag Manager, Google Analytics 4 (only with visitor consent), and Google Workspace where used	EU / USA; EU–US Data Privacy Framework