eXp New Zealand Privacy Policy

What is the Purpose of this Privacy Policy?

This Privacy Policy describes how we collect and use personal information about you, in accordance with the Privacy Act 2020 and any other regulations and secondary legislation, as amended or updated from time to time, in New Zealand ("Privacy Legislation").

This Privacy Policy supplements the eXp World Holdings, Inc. privacy policy located at https://expworldholdings.com/privacy-policy/ and it is important that you read this Privacy Policy together with any other privacy notice that we may provide to you on specific occasions when we are collecting or processing personal information about you so that you are fully aware of how and why we are using your information. This Privacy Policy supplements any other such notices that we may provide to you and is not intended to override them. Capitalized terms not defined herein shall have the same meaning as they are defined in the eXp World Holdings, Inc. privacy policy.

Who are We?

eXp New Zealand Limited is a company incorporated in New Zealand and its principal place of business is at Level 4 Floor, Dentons Kensington Swan, 40 Bowen Street, Pipitea, Wellington 6011 ("eXp NZ").

eXp NZ's parent company is eXp World Holdings, Inc., a company incorporated in the State of Delaware, United States ("eXp US"). In this Privacy Policy, references to "eXp", "we", "us" and "our" refer to eXp NZ and eXp US.

How We Collect Your Personal Information

We obtain information about you when you use our websites, for example: (i) when you fill in forms on our websites, subscribe to any service, request further services, or contact us about eXp's services; (ii) if you contact us online we may keep a record of that correspondence; and (iii) we collect details of your visits to our websites including traffic data, location data, weblogs and other communication data, and the resources that you access.

If you contact us by telephone, post, email or social media, we may keep a record of those communications.

If you are an eXp Agent then, in addition to the above, we will obtain information about you when you register with us as an eXp Agent and during the course of our interactions with you as part of that relationship including through your use of your back office and approved company channels including online platforms, electronic communications and official company materials provided to you.

We may also obtain your personal information from the following sources: third party online public platforms, Independent Third-Parties, Affiliates, social media, and the public domain ("Third Party Sources"). If you are a job applicant, we may obtain your personal information from a recruiter or a referee you have nominated. We may combine the information which you provide to us with information which we obtain about you from these Third Party Sources.

What Personal Information Do We Collect From You?

Summary

eXp will only collect personal information required to serve the purpose for which it was collected. The type of personal information we collect will depend upon the nature of your relationship with us (e.g. a customer or prospective customer, eXp Agent or applicant, job candidate, service provider, or visitor), the purpose for which the data is required, and our legal and regulatory obligations.

Please note that we may process your personal information without your knowledge or consent where this is required or permitted by law.

Customers

As a customer, the information we collect from you may include the following:

• Contact details (including names, postal addresses, email addresses and telephone numbers);
• A copy of your driver's licence, passport, or other suitable documentation to identify you as required by law;
• Your credit card or debit card details if you make a payment for any services;
• Your username and password for any online account with eXp NZ;
• Information about any services you have requested us to provide and your activities in relation to those services;
• Any information you send to us, including information relating to the matters about which you contact an eXp Agent; and
• Information as required by regulatory "know your client," anti-money laundering or proceeds of crime legislation — some of this information we may request or obtain from Third Party Sources.

Prospective customers

As a prospective customer of eXp NZ, the information we collect from you may include contact details (including names, postal addresses, email addresses and telephone numbers).

eXp Agents

As an eXp Agent, the information we may collect from you includes the following:

• Identity Data including first name, middle names, maiden name, last name, username or similar identifier, marital status, title, date of birth, place of birth, country of citizenship, first language, and gender.
• Contact Data including billing address, delivery address, email address and telephone numbers.
• Financial Data including bank account and credit card details.
• Transaction Data including details about payments to and from eXp and other details of products and services you purchased from or provided to eXp.
• Technical Data including internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on devices used to access our websites and other online services.
• Profile Data including username and password, interests, preferences, feedback and survey responses.
• Usage Data including information about the use of eXp websites and services.
• Marketing and Communications Data including preferences in receiving marketing from eXp and its third parties and communication preferences.

eXp may also compile aggregated data such as statistical or demographic data. Aggregated data may be derived from the eXp Agent's personal information but is not considered "personal information" as it does not directly or indirectly reveal the eXp Agent's identity.

Prospective employees

As a prospective employee of eXp NZ, the information we collect from you for recruitment purposes may include the following:

• Contact details (including names, postal addresses, email addresses and telephone numbers);
• Your racial or ethnic origin, sex and sexual orientation, religious or similar beliefs in order to undertake equal opportunity monitoring and reporting in the public interest;
• Information regarding your criminal and disciplinary records (if any), including from background checking authorities, agencies and any regulators, to carry out our legal and regulatory obligations;
• Details of your referees and references;
• Information about your previous academic and/or employment history, including details of any conduct, grievance or performance issues, appraisals, time and attendance, from references obtained about you from previous employers and/or education providers;
• Information regarding your academic and professional qualifications;
• Your nationality and immigration status and information from related documents, such as your passport or other identification and immigration information;
• A copy of your driver's licence or other suitable documentation to identify you and verify your identity; and
• Information we may request and/or obtain from third-party sources on disciplinary records.

Service Providers

We collect limited information that could be considered personal information from providers of services to eXp. The information we collect from you may include the following:

• Your name and contact details;
• Your qualifications and employment history; and
• Bank account details, should we need to transfer funds to you.

Website Users

As a user of one of our websites or any other web address operated by or on behalf of eXp that links to this Privacy Policy, we collect information that you submit to us when you interact with features of the websites such as logging into your account. When you do this we may collect:

• Your name and contact details (i.e., address, home and mobile phone numbers, email address);
• Your username and password;
• Anything you download from the websites; and
• Any information that you input into the websites.

In addition to collecting information, we collect analytics relating to your time spent on the Sites. We collect your internet protocol (IP) address; your login data, browser type and version; time zone setting and location; browser plug-in types and versions; operating system and platform; and other technology on the devices you use to access the websites.

More information can be found within our Cookies Policy.

Visitors to our premises

eXp NZ's premises is a service office address only and we do not receive visitors in person. You may visit an office of an eXp NZ Agent, in which case you should review their privacy policy and any display signs in place that indicate the presence of CCTV cameras.

The Ways We Use and Disclose Information

We use and disclose your personal information for purposes necessary for the performance of a contract with you, for example, for the processing or fulfilment of the provision of our services and to comply with our legal obligations.

This includes use and disclosure for marketing, business creation, development, management and statistical and research purposes, which will include analysis and tracking of transactions and the delivery of advertisements based on your activity on our websites.

Your personal information may be used and disclosed for the following purposes, to the extent that they apply to you:

• To perform customer services to fulfil our contractual obligations toward you and to provide the best customer service we can;
• To support our business processes including our information technology, electronic communications and electronic documents storage, management and transmissions;
• To support eXp's business operations, administration and to prevent fraud;
• To safeguard your personal information and our IT systems with appropriate security;
• To exchange information, conduct due diligence and answer your initial questions, to take steps required to enter into a contract with you, to protect our legal rights and a third party's rights or on the basis of your consent;
• In the case of a prospective employee, for our recruitment purposes, including in the context of a selection and recruitment procedure, to take steps prior to entering into an employment relationship or contract with you to ensure that we can make the best recruitment decisions — we will not process any personal information except where we are able to do so under applicable legislation or with your explicit consent;
• To keep you up-to-date with real estate news that may be of interest to you;
• To present our websites and online content in the best possible way for you and on your computer or device and to develop our outreach and business operations, and to develop marketing strategy;
• For business transactions such as a merger, acquisition by another company, or sale of all or a portion of our assets; and/or
• To comply with legal and regulatory requirements applicable to us (including the need to prevent and combat money laundering).

If you are an eXp Agent, we may use and disclose your personal information for the following additional purposes:

• Processing the eXp Agent's application and Independent Contractor Agreement;
• Developing revenue share group reports and other related business reports;
• Providing support services to the eXp Agent such as planning and facilitating meetings and training;
• Administering the eXp Agent's benefits including under the Revenue Share Plan;
• Developing and implementing policies, marketing plans, and strategies;
• Publishing personal information in eXp's newsletters, promotional materials and company and intra-group communications, including for recognition purposes;
• Complying with applicable laws and regulatory requirements and assisting with any governmental or police investigation; and
• Other purposes directly relating to any of the above.

Marketing

You may receive marketing communications from us if you are an existing customer or if you provided us with your consent or where we have a lawful right to do so and, in each case, you have not opted out of receiving that marketing. You can ask us to stop sending you marketing messages at any time by following the unsubscribe links on any marketing message sent to you or by contacting privacy@expnewzealand.co.nz at any time.

Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will ordinarily notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, where this is required or permitted by law.

Third Parties

We will share your personal information with third parties where required by law, where it is necessary to administer the relationship with you or where we have another legitimate interest in doing so. Some of these transfers will involve international transfers of your personal information outside New Zealand including to our data centres or those of our service providers or public and regulatory bodies.

Where permitted by Privacy Legislation, eXp may share such information from time to time with the following third parties:

• Other entities within the eXp group and those employees, directors and managers of eXp and its local and foreign associated/affiliated companies who have a need to access your personal information in carrying out their responsibilities;
• eXp Agents, including Sponsors and eXp Agents in your revenue share group who may need access to the personal information of eXp Agents in their revenue share group in order to monitor sales activity and business development in their revenue share groups;
• Any agent, contractor, supplier, vendor or third party service providers who provide administrative, payment processing, IT, marketing, printing, shipping, fulfilment, web-tools, fraud prevention or other services to eXp or its affiliated companies;
• Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, security, insurance and accounting services; and
• Tax authorities, regulators and others who require reporting of processing activities in certain circumstances.

Our third-party service providers are required to take appropriate security measures to protect your personal information and we do not allow those third-party service providers to use your personal information for their own purposes; we only permit them to process your personal information for specified purposes and in accordance with our instructions.

However, certain third-party service providers, such as payment gateways and other payment transaction processors, have their own privacy policies in respect to the information we are required to provide to them for your purchase-related transactions. For these providers, we recommend that you read their privacy policies so you can understand the manner in which your personal information will be handled by these providers.

We may share your personal information with other third parties, for example, in the context of the possible sale or restructuring of the business. We may also need to share your personal information with a regulator or to otherwise comply with the law.

Transferring information outside of New Zealand

Your personal information may be stored and processed in any country where we have operations. For example, our parent company, eXp US is based in the USA and your personal information will be transferred to and processed in the USA. eXp US will process your personal information in the USA in compliance with Privacy Legislation.

Many of our external third party data processors are based outside New Zealand so their processing of your personal information will involve a transfer of data outside New Zealand. These third party service providers are located in Australia and the United States.

Unless we have your consent or an exception under the Privacy Act applies, we will only disclose your personal information to overseas recipients where we have taken reasonable steps to ensure that the overseas recipient does not breach the Privacy Act in relation to your personal information.

Please contact us at privacy@expnewzealand.co.nz if you want further information on the specific mechanism used by us when transferring your personal information out of New Zealand.

Security

We have appropriate security measures in place designed to protect against the accidental loss, misuse, access and/or alteration of the information you provide. For example, any personal information you provide to us will be processed on eXp's secure servers. eXp's secure server software encrypts the information to protect your information against unauthorised access, use and disclosure. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

However, transmissions protected by industry standard security technology and implemented by human beings cannot be made absolutely secure, and we do not represent or warrant that transmissions will be free from delay, interruption, interception, or error. We have put in place procedures to deal with any suspected or actual data security breach and will notify you and any applicable regulator of a suspected or actual breach where we are legally required to do so.

Data Retention

We will only retain your personal information for as long as is necessary to fulfil the purposes for which it is collected - the retention period is determined by the nature and duration of your relationship with us and our legal obligations. To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means and the applicable legal requirements.

In some circumstances, eXp may anonymise or de-identify the personal information so that it can no longer be associated with you, in which case eXp may use such information without further notice to you.

Where your personal information is no longer needed for a purpose for which it may be used or disclosed under the Privacy Act, eXp takes reasonable steps to destroy the information or ensure that it is de-identified unless we are required to retain the personal information by law or an order of a court or tribunal. If you request that we stop sending you marketing materials, we will continue to keep a record of your contact details and appropriate information to enable us to comply with your request not to be contacted by us.

Rights of Access and Correction

Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes.

Your rights in connection with personal information

You have the right to:

• Request access to your personal information. This enables you to receive details of the personal information we hold about you.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request that we stop using your personal information for direct marketing purposes.

If you want to exercise any of the above rights, please contact us using the contact details below.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, you may be charged for the reasonable time and expense incurred in compiling information in response to your access request.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

We may decline your request to access or correct your personal information in certain circumstances in accordance with the Privacy Act. If we do refuse your request, we will provide you with a written reason for our decision and, in the case of a request for correction, we will include a statement with your personal information about the requested correction.

Right to complain

We hope we can resolve any query or concern you raise about eXp's use of your personal information. However, if you believe that your personal information is not being lawfully processed by eXp under applicable Privacy Legislation, you may make a complaint to eXp's Privacy Officer using the contact details set out below or by completing our webform.

Our Privacy Officer will first consider your complaint to determine whether there are simple or immediate steps which can be taken to resolve the complaint. Your complaint will then be investigated. We may ask you to provide further information about your complaint and the outcome you are seeking. We will then typically gather relevant facts, locate and review relevant documents and speak with individuals involved.

In most cases, we will investigate and respond to a complaint as soon as reasonably practicable, usually within 20 working days of receipt of the complaint. If the matter is more complex or our investigation may take longer, we will let you know.

If you are not satisfied with our response to your complaint, you may make a complaint to the Privacy Commissioner. The Privacy Commissioner can be contacted by telephone on 0800 803 909 or by using the contact details on the website www.privacy.org.nz.

Changes to this Policy

Any changes we may make to our Privacy Policy in the future will be posted on this webpage.

Questions Regarding this Policy / Contact Details

Should you have any questions regarding this Privacy Policy, you can contact us either by email: privacy@expnewzealand.co.nz, or by webform. Please mark all email correspondence with: "Privacy".

Last updated: August 1, 2023