Data Processing Addendum

Closima LLC · Effective October 18, 2026 · Part of the Closima Terms of Service

1.What this covers

This Data Processing Addendum ("DPA") is part of the agreement between Closima LLC ("Closima", "we") and the business that uses Closima ("Customer", "you"), made up of the Closima Terms of Service and this DPA. It applies when Closima processes Customer Personal Data on your behalf. If this DPA and the Terms disagree about Customer Personal Data, this DPA controls.

2.Definitions

• Customer Personal Data means personal information that you or your team put into Closima, or send to it, about other people. That includes your clients, agents, escrow and title officers, lenders and other contacts, and it includes what's in the documents and emails you send to Closima.
• Privacy Laws means the U.S. federal and state laws that apply to Customer Personal Data. That includes the California Consumer Privacy Act as amended by the CPRA ("CCPA") and comparable state consumer privacy laws.
• Subprocessor means a company Closima engages that processes Customer Personal Data to help provide Closima.
• Security Incident means a confirmed breach of security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Personal Data.

Terms such as "business", "service provider", "controller", "processor", "sell", "share" and "consumer" have the meanings given in the Privacy Laws.

3.Roles

For Customer Personal Data, you are the business or controller, and Closima is your service provider or processor. Closima is a separate business for information about your own account (for example, your name, email and billing details). Our Privacy Policy covers that information.

4.How we use Customer Personal Data

1. Only to provide Closima. We process Customer Personal Data only to provide, support, secure and improve Closima for you, as described in Annex 1, and as you direct through your use of Closima. Your use of Closima's features, settings and the actions you take in it are your instructions. We'll tell you if we believe an instruction breaks the law.
2. What we don't do. We don't:
   • sell or share Customer Personal Data, including for cross-context behavioral advertising;
   • keep, use or disclose it for any purpose other than the business purposes in this DPA, or outside our direct business relationship with you;
   • combine it with personal information we get from others or collect ourselves, except as the Privacy Laws allow a service provider to;
   • use the documents, emails or transactions you put into Closima to train AI models, or allow our providers to.
3. Improving Closima. We may use information about how Closima is used to fix and improve it, but only in a form that doesn't identify the people in your transactions.
4. Telling you if we can't comply. We'll tell you if we can no longer meet our obligations under the Privacy Laws. You may then take reasonable and appropriate steps to stop and remedy any unauthorized use of Customer Personal Data.
5. Our certification. We understand the restrictions in this section and will comply with them.

5.Your responsibilities

You're responsible for having the right to put Customer Personal Data into Closima, and for giving any notices and getting any consents the Privacy Laws require for that. Don't upload information Closima doesn't need. For example, Social Security numbers and full bank account numbers usually don't belong in a transaction file. When Closima recognizes sensitive documents such as bank statements and IDs, it deletes them automatically 90 days after they arrive.

6.Subprocessors

1. Approval. You approve the Subprocessors listed in Annex 3.
2. Contracts. We have a written contract with each Subprocessor that protects Customer Personal Data at least as well as this DPA, and we're responsible for their compliance.
3. Changes. We'll update the list at least 15 days before a new Subprocessor starts processing Customer Personal Data, and we'll email account owners about the change. If you object for a reasonable privacy or security reason, tell us within those 15 days. We'll try to resolve it. If we can't, you may close your account and we'll refund any unused, purchased credits.

7.Security

We keep up the technical and organizational measures in Annex 2 to protect Customer Personal Data. Everyone at Closima who can access it is bound to keep it confidential and accesses it only as needed to run and support Closima. We may update these measures, as long as the update doesn't lower the overall level of protection.

8.Security incidents

If we confirm a Security Incident affecting your Customer Personal Data, we'll tell you without undue delay, and within 72 hours of confirming it. We'll tell you what we know (what happened, what data was involved, and what we're doing about it) and keep you updated as we learn more. We'll take reasonable steps to contain it and help you meet any notice obligations you have. Telling you about an incident isn't an admission of fault.

9.Requests from people

If someone asks us to access, correct, delete or copy their information in your account, we'll send them to you, or tell you about it, and we won't respond to them directly unless you ask us to or the law requires it. Taking into account how Closima works, we'll help you respond to these requests, mostly through features in Closima that let you find, edit, download and delete information. We'll also give reasonable help with any data protection assessments you're required to do.

10.Information and audits

On written request, no more than once a year (or more often if a regulator requires it or after a Security Incident), we'll answer a reasonable security questionnaire and give you the information you need to show compliance with this DPA. If the Privacy Laws require more, we'll agree on a reasonable, confidential assessment by you or an independent assessor, at your cost, with reasonable notice and without disrupting Closima.

11.Deletion when you leave

While your account is open, you can download each transaction's documents at any time, and you can ask us for a copy of the rest of your data. After your account closes, we delete Customer Personal Data within 30 days, and it leaves our backups as they're replaced. The exception is anything the law requires us to keep, which we keep only as long as required and protect under this DPA.

12.Location, liability and term

• Location. We store and process Customer Personal Data in the United States.
• Liability. Each party's liability under this DPA is subject to the limitations in the Terms of Service.
• Term. This DPA lasts as long as we process Customer Personal Data for you.
• Changes. We may update this DPA to reflect changes in the law or in Closima. We'll tell you before a material change takes effect, and changes won't reduce the protection of Customer Personal Data.

Annex 1 · Details of the processing

Purpose

Providing Closima, software for real estate transaction coordinators. That includes filing documents, reading contracts to fill in transactions, calculating deadlines, sending emails and reminders at your direction, agent pages, e-signatures, invoices, reports and support.

Duration

While your account is open, then until deletion under section 11.

People

Buyers, sellers, agents, brokers, escrow and title officers, lenders, inspectors and other parties to your transactions, and anyone who emails your Closima address.

Information

Names, email addresses, phone numbers, property addresses, and transaction terms, prices and dates. Also documents and emails and what's in them, signatures and signing records, and invoice details.

Sensitive information

Not required by Closima. Documents can contain financial or identity information (for example, proof of funds or a driver's license). Closima deletes documents it recognizes as sensitive 90 days after they arrive.

Annex 2 · Security measures

• Encryption in transit. All traffic to and from Closima uses HTTPS.
• Sign-in. Sign-in is handled by a dedicated provider (Clerk). Closima never sees or stores passwords.
• Separate accounts. Every request is checked against the business it belongs to, so one customer can't see another's data.
• Access by our team. Access is limited to people who need it to run and support Closima. Our admin tools require a separate second sign-in step (an authenticator code), and admin actions are logged.
• Shared links. Links you share, such as agents' pages, use long random codes you can reset at any time. Agents' pages never show sensitive financial or identity documents.
• Sensitive documents. Documents recognized as sensitive are deleted automatically 90 days after they arrive.
• Monitoring. Errors are monitored, with personal data collection turned off for user details, cookies, headers, request bodies and query strings.
• Backups and deletion. Backups are kept by our hosting provider. Deleted data leaves backups as they're replaced, within about 30 days.
• Our providers. We use established providers with their own security programs (see Annex 3).

Annex 3 · Subprocessors

These companies process Customer Personal Data to help us provide Closima. All of them process it in the United States.

Questions about this DPA: write to Closima LLC, 1501 S Greeley Hwy #1355, Cheyenne, WY 82007, or contact us.