Heumix Data Processing Agreement

HEUMIX — DATA PROCESSING AGREEMENT (DPA)

Article 28 of Regulation (EU) 2016/679

Version: 2.1 — 21 October 2026

1. Parties

This Data Processing Agreement (the “DPA”) is entered into between the Customer identified in the order form, acting as Controller for the business processing it determines in Heumix, and HEUMIX, a French SASU with share capital of EUR 1.00, registered with the Paris Trade and Companies Register under number 108 744 889, whose registered office is at 47 rue Vivienne, 75002 Paris, France, acting as Processor.

Contact: [email protected]

This DPA forms an integral part of the Heumix SaaS contract.

2. Roles

2.1 Processing on behalf of the Customer

The Customer determines in particular the business purposes, legal bases, categories of data subjects, data processed, recipients, retention periods and authorised users.

Heumix processes such data on behalf of the Customer and on its documented instructions.

2.2 Heumix’s own processing

Heumix acts as an independent Controller for its own purposes, including account, contract, billing, security, support, incident management, Heumix prospecting and minimised technical metrics.

3. Subject matter, duration, nature and purposes

Subject matter: supply of an intelligent CRM SaaS for real estate professionals.

Duration: for as long as Heumix processes Customer Data, including the exit, return and deletion period.

Nature of operations: collection, import, hosting, structuring, normalisation, synchronisation, consultation, organisation, search, matching, extraction, OCR, classification, calculation of derived states, AI processing, export, archiving and deletion.

Purposes: real estate CRM, communications, documents, calendar, matching, migration, search, business intelligence, client sharing spaces, agency management and support for professional workflows.

4. Data subjects

Depending on the Customer’s use: prospects, customers, sellers, buyers, owners, tenants, correspondents, event or viewing participants, persons mentioned in documents, business contacts, staff and users.

5. Categories of data

Identity and contact data

First name, last name, email, phone number, identifiers, job title or relationship to the record.

Real estate data

Project, criteria, budget/stated financial information, properties, addresses, characteristics, viewings, proposals, mandates, deals/transactions, activities and business notes.

Communications

Senders/recipients, participants, subject line, message content where necessary, metadata, attachments, conversation grouping and synchronisation statuses.

Calendar

Events, times, organisers, participants, locations and descriptions where synchronised.

Documents

Files supplied by the Customer, surveys, evidence, attachments, metadata, OCR, extracts, versions and classifications.

Derived data

Provenance, contradictions, temporal information, confidence levels, deal status information, search results, priorities, recommendations, daily priorities and dashboard information, migration verification reports.

Technical data

Internal identifiers, statuses, timestamps, strictly necessary errors and source-service metadata.

6. Special-category data

Heumix does not request data falling within Article 9 GDPR as a normal condition of use. Such data may appear incidentally in an email, document, attachment or free-text field.

The Customer limits collection, selects the appropriate legal basis and implements the necessary safeguards.

7. Documented instructions

Documented instructions include:

• this DPA;
• the Terms;
• the order form/special terms;
• actions taken by an authorised user;
• requested imports/migrations;
• source-service connections voluntarily activated;
• the Customer’s written instructions.

Heumix informs the Customer where it considers that an instruction manifestly infringes the GDPR or another applicable rule and may suspend the relevant instruction to the extent necessary.

8. Customer obligations

The Customer:

1. processes data in accordance with applicable law;
2. documents its legal bases;
3. informs data subjects, including under Articles 13 and 14 where required;
4. warrants that it is authorised to import, connect or disclose the data;
5. limits access;
6. handles data-subject requests;
7. does not ask Heumix to perform manifestly unlawful processing;
8. complies with its professional obligations;
9. informs staff about team management functions where used;
10. verifies AI outputs before a binding decision.

9. Confidentiality

Heumix ensures that persons authorised to process Customer Data are subject to an appropriate confidentiality obligation and only access data to the extent necessary.

10. Security

Heumix implements technical and organisational measures appropriate to the risk in accordance with Article 32 GDPR.

Depending on the version of the Service used, the baseline includes in particular:

• separation between organisations’ data;
• row-level access controls (RLS);
• server-side checks of users’ access rights to resources;
• protection against unauthorised access to resources belonging to another organisation;
• server-side secrets;
• private storage;
• OAuth protections;
• roles and permissions;
• TLS/HTTPS;
• log minimisation;
• observability;
• backup/restore;
• incident response;
• security testing;
• integrity and provenance controls.

Heumix does not guarantee absolute security or claim a certification it does not hold.

11. Subprocessors

The Customer grants Heumix a general authorisation to engage subprocessors necessary to provide the Service.

Heumix:

• selects service providers offering appropriate safeguards;
• imposes appropriate obligations;
• remains responsible for its subprocessing obligations under Article 28;
• maintains a versioned list of subprocessors.

Heumix informs the Customer of a material addition or replacement at least 15 calendar days before activation where reasonably possible. The Customer may raise a reasonable, documented objection within 10 calendar days.

Where required by security, continuity or law, Heumix may act more quickly and informs the Customer as soon as reasonably possible.

12. Identified subprocessors

Subject to the scope actually active on the signature date:

The versioned list supplied to the Customer prevails when a provider is added, removed or disabled.

13. Google and Microsoft as source services

Google and Microsoft may provide the Customer with an email inbox or calendar that the Customer chooses to connect.

The Customer authorises the connection and Heumix processes the imported copy on its behalf.

The Google connection is commercially activated only where the Google requirements applicable to the project or Customer have been satisfied.

14. International transfers

Heumix does not guarantee that all processing remains exclusively within the European Union.

The configuration controlled by Heumix uses in particular:

• Supabase: Stockholm, Sweden;
• Vercel Functions: Stockholm;
• Sentry: EU storage region in the observed configuration.

Some providers and their own subprocessors may process data outside the EEA.

Where required by the GDPR, Heumix relies on applicable mechanisms: an adequacy decision, standard contractual clauses or another recognised safeguard.

15. Artificial intelligence and OpenAI

Some functions send the context required for an extraction, classification, summary, qualification or recommendation task to the OpenAI API.

Heumix applies:

• minimisation;
• exclusion of secrets/tokens;
• human control;
• separation of fact and inference;
• no reuse of Customer Data to train a Heumix model without a separate framework.

The OpenAI organisation settings verified by Heumix disable voluntary sharing of inputs/outputs, evaluation/fine-tuning data and model feedback.

Heumix does not claim a Zero Data Retention configuration without specific technical evidence.

16. Search and derived data

Results, deal status information, analyses and verification reports produced for the Customer’s business purposes remain processed on its behalf where linked to Customer Data.

They are subject to the same access, export, rectification where relevant, deletion and end-of-contract rules.

17. Data migration

The Customer is responsible for the right to export source data, the selected scope, the quality/lawfulness of the source and validation of anomalies.

Heumix processes migration files solely to perform the migration, handle errors and produce the agreed technical evidence.

18. Client sharing spaces

Where a client sharing space is activated:

• the Customer chooses the information published;
• it is responsible for the sharing and recipient;
• Heumix implements the available technical controls;
• recipient feedback does not automatically become reference data.

19. Agency and team management

Where the Customer acts as an employer or organisation managing staff, it remains responsible for the purpose of monitoring, information, proportionality, permissions, retention periods and any required staff-representation consultation.

20. Assistance with rights

Heumix assists the Customer, insofar as possible, in responding to requests for access, rectification, erasure, restriction, objection and portability where applicable.

Where a person contacts Heumix directly regarding data held in a Customer CRM, Heumix seeks to identify the relevant Customer, routes the request and performs technical actions on documented instructions.

21. Personal data breaches

Where Heumix becomes aware of a breach of Customer Data, it informs the Customer without undue delay and progressively communicates available information on the nature of the incident, data, persons potentially affected, impacts and measures taken.

The Customer remains responsible for deciding whether to notify the supervisory authority and data subjects where Heumix acts as Processor, unless a separate lawful instruction applies.

22. Security, DPIA and authority assistance

Heumix provides information reasonably required to help the Customer assess security, conduct a DPIA where necessary, respond to an authority and document subprocessors/transfers.

The Customer remains responsible for its DPIA and decisions.

23. Audits

Heumix makes available the information reasonably necessary to demonstrate compliance with its obligations.

A document-based audit is preferred. A more intrusive audit is arranged only where necessary and proportionate, while protecting other Customers’ data and technical secrets.

These arrangements do not restrict supervisory-authority powers.

24. Return, end of contract and deletion

At the end of the services, according to the Customer’s choice and subject to a legal obligation:

• Heumix enables return/export;
• stops new synchronisations;
• disconnects source services;
• deletes production data according to the applicable policy;
• lets backups expire according to their lifecycle;
• separately retains only data that Heumix must keep for its own obligations.

Unless special terms apply:

• exit/export period: 15 calendar days after the end of the contract;
• production-data deletion: target no later than 30 days after the end of that period.

Archiving data does not delete it.

25. Backups and deletion

Heumix maintains a procedure intended to prevent a backup restoration from durably reintroducing data that should have been deleted.

Backup cycles and their implementation must correspond to the technical evidence for the version of the Service used.

26. Data-related liability

This DPA does not affect data-subject rights or supervisory-authority powers.

Each party remains responsible for its own breaches under the GDPR and applicable law.

Any contractual limitation applies only to the extent permitted by law.

27. Term of the DPA

This DPA takes effect no later than when Heumix begins processing personal data on the Customer’s behalf and remains applicable until return/deletion, subject to surviving obligations.

SCHEDULE A — DESCRIPTION OF PROCESSING

SCHEDULE B — DATA SUBJECTS AND DATA

Data subjects: prospects, customers, sellers, buyers, owners, tenants, correspondents, participants, signatories, business contacts, staff and users.

Data: identity, contact details, real estate project, properties, stated budget, criteria, viewings, mandates, deals, communications, calendar, documents, attachments, OCR, metadata, provenance, contradictions, deal status information, search results, recommendations, migration reports and necessary technical data.

SCHEDULE C — SECURITY MEASURES — SUMMARY

Heumix relies in particular on: separation between organisations’ data, server-side access and resource checks, private storage, protection of technical credentials, OAuth connections, TLS communications, roles, limited technical monitoring, backup and restoration, incident response, isolation testing and checks before deployment.

SCHEDULE D — SUBPROCESSORS

The versioned list supplied to the Customer on the acceptance date forms part of this DPA.

Identified providers:

• Supabase, Inc.;
• Vercel Inc.;
• OpenAI Ireland Ltd. / OpenAI;
• Functional Software, Inc. (Sentry), where this service is used to process the Customer’s data.

SCHEDULE E — INTERNATIONAL TRANSFERS

The main data controlled by Heumix is configured in the EEA for Supabase and Vercel compute. Processing outside the EEA may occur within some provider chains. Applicable mechanisms are documented in the subprocessor list and transfer matrix supplied to the Customer.

End of the DPA — Version 2.1