Data processing addendum
Last updated: 2026-05-31 · Operated by Oconee Collective Realty, LLC
This addendum applies when Oconee Collective Realty, LLCprocesses personal data on behalf of a client (the “Controller”), and forms part of the agreement between the parties for the services provided.
1. Scope and roles
Oconee Collective Realty, LLCacts as a Processor (or Service Provider under the CCPA) of the Controller’s personal data when performing services such as managing contacts, sending communications, and storing transaction documents.
2. Categories of data
Contact identifiers (name, email, phone), property preferences, transaction milestones, and uploaded documents. We process only the categories of data required to provide the services.
3. Sub-processors
We use a small number of sub-processors to deliver the services (cloud hosting, transactional email, SMS, e-signature, MLS data). The current list is available on request. We notify the Controller of new sub-processors and give a reasonable objection window.
4. Security measures
- Encryption at rest (database) and in transit (TLS).
- Role-based access controls + row-level security.
- Access logging and quarterly access reviews.
- Backups with documented retention and restore procedures.
- Background-checked personnel with signed confidentiality terms.
5. International transfers
Where personal data is transferred outside its country of origin, we rely on the European Commission’s Standard Contractual Clauses (or equivalent for the UK, Switzerland, and Canada) plus any required supplementary measures.
6. Assistance with data subject rights
We help the Controller respond to data subject requests within the regulatory deadline (30 days under GDPR; 45 days under CCPA, with the ability to extend once).
7. Breach notification
We notify the Controller without undue delay (and in any case within 72 hours) after becoming aware of a personal data breach affecting the Controller’s data.
8. Return or deletion
On termination of the services, and at the Controller’s choice, we return or delete the personal data we hold for the Controller, subject to legal retention obligations.
9. Audit
We make available the information necessary to demonstrate compliance with this addendum, including third-party audit reports where available.
10. Contact
For a counter-signed copy or to add your organization to the notification list for sub-processor changes, email kyle@oconeecollective.com.
