Introduction 

eXp World Holdings, Inc. and its Listed Subsidiaries (“eXp”) values and protects your privacy. This EU & UK Supplemental Privacy Notice (“Privacy Notice”) supplements the eXp Privacy Policy and explains how your personal data is processed by eXp within the EU and the UK and the rights you have relating to eXp’s data processing. Capitalized terms not defined in this Privacy Notice shall have the same meaning as defined in the eXp Privacy Policy. It applies to: 

• Current, prospective, and former real estate brokers and agents affiliated with eXp (independent contractors or associates). 
• Customers and prospective customers engaging with eXp Sites and Services, including our Real Estate Services offered pursuant to a contract between the customer and eXp or other representation by eXp real estate professionals in a real estate transaction. 
• Users of eXp digital platforms 

This Privacy Notice complies with the EU GDPR, UK GDPR, and applicable national privacy laws, and supplements any additional notices provided for specific services or engagements, including the eXp Privacy Policy. 

We provide the Privacy Notice in additional languages for our customers around the globe. Please see the table below for our additional language options. Unless otherwise required by law, the English version will control in the event of any conflict.  

1. Who We Are & How Our Services Work 

This Privacy Notice covers the data processing activities of eXp, including the specific Listed Subsidiaries in the table below. When you are obtaining information on our Sites about eXp World Holdings, Inc., the publicly traded company in the United States, you are accessing that information and receiving those Services on systems and servers hosted in the United States and such data transfer is completed in order to provide you the information you are requesting. When you interact with our Sites or our Agents to receive our Real Estate Services we operate with local entities in the country you are inquiring about, as noted in the table below. Our Sites related to the Real Estate Services are hosted in the United States and such data transfer is completed in order to enable the Real Estate Services you are requesting on our Sites. When you interact with our Agents in person as part of their representation in a real estate transaction, whether pursuant to a written contract or other arrangement, the local entity that your Agent is directly affiliated with (the “Controller Entity” listed below) and where you are receiving the Real Estate Services (normally in the same country your property is located) is the Controller of your Personal Information. If you have signed a contract with eXp for representation by one of our Agents, that Agent is our Processor for the purposes of completing the requirements in eXp’s contract with you. Additionally, prior to a contract being executed with eXp, our Agents may have their own independent data processing activities in which they are a Joint Controller with eXp. Depending on the nature of your relationship to eXp and our Agent(s), the purpose and legal basis of processing may be different. However, eXp and its Agents work collaboratively to respond to data rights requests and ensure that our Services are provided in accordance with applicable data protection law, including GDPR and the UK GDPR.  

When the Controller Entity needs to transfer your Personal Information to a Listed Subsidiary outside of its country that data transfer is governed by an internal contract that provides the same level of data protection and purpose limitations on processing that are present for the Controller Entity. As part of the Real Estate Services, eXp uses a shared services model in order to provide you the most excellent service in every country we operate and to monitor the financial and compliance obligations of eXp. This shared services model means that our primary U.S. brokerage entity, eXp Realty, LLC, will be a Joint Controller in your jurisdiction for the limited purposes of service delivery, providing marketing communications you request through the use of U.S. based tools, financial monitoring, and compliance monitoring.  In all cases, our Senior Director, Privacy, April Halm is the eXp representative responsible for compliance with our data processing obligations. You may reach her at [email protected]. 

Table of eXp Entities 

2. What Data We Collect 

We collect and process personal data based on your relationship with us: 

• For current, former, and prospective Agents we collect the Personal Information described in our eXp Privacy Policy that is required to communicate with you during your application process, maintain that communication during your affiliation with eXp, process your payments to us and our payments to you, and communicate with you about various educational opportunities, events, and third-party services that are available to you because of your affiliation with eXp. For former Agents, we retain only the Personal Information that is necessary to process pending transactions when you leave the brokerage and meet our legal record retention obligations in the country you provided real estate services. 
• For current Clients we collect the information required to provide the Services you requested from us. If you are engaging us for our Real Estate Services we are required to process your Personal Information to complete your transaction and depending on the country your property is located that may include an obligation for us to perform anti-money laundering checks, retain copies of identification documents, and collect copies of deposits or initial payment transfers. 
• For prospective Clients we collect your contact information you provide in order to communicate with you upon request about our Services. You may withdraw your request to be contacted about the Services at any time. 
• For all visitors to our Sites, we will collect Usage Data about your visit which we may connect to a profile for your account if you create one.  

3. How We Collect Your Data 

Your data is collected from: 

• Direct input via registration forms, communication, and real estate transactions. 
• Use of our platforms, mobile apps, and online tools. 
• eXp Agent interactions and service engagements. 
• Third-party sources: listing portals that you share your information with to learn about properties. 

4. Why We Process Your Data 

We process your data for the following purposes in accordance with Article 6 of the GDPR and UK GDPR: 

5. International Transfers 

Your personal data may be transferred outside the EU/UK (e.g., to eXp or approved third-party processors) under appropriate safeguards which include supplementary measures of encryption and access control in combination with one of the transfer methods below: 

• EU/UK Standard Contractual Clauses 
• Adequacy decisions by the EU or UK authorities 

6. Who we share Personal Information with 

During the provision of our Services we may need to share your Personal Information with our Listed Subsidiaries and third-parties that enable us to provide the Services. Additionally, when you request that we share your information with third-parties, we will do so. Depending on your relationship with us your Personal Information may be shared with: 

• Other eXp entities, including those supporting our Real Estate Services in your country. 
• eXp Agents that will be providing you the Real Estate Services. 
• Third-party service providers (CRM, payments, training, marketing). 
• Regulators and authorities, where legally required to do so. 

All third-parties are contractually bound to maintain your data securely and process it only as instructed. 

7. Your Rights 

As a data subject in the EU/UK, you can: 

• Access your personal data 
• Rectify inaccurate or outdated data 
• Erase data (“right to be forgotten”) where applicable 
• Restrict processing temporarily or permanently 
• Object to processing based on legitimate interest or marketing 
• Port your data to another provider 
• Withdraw consent at any time without affecting prior lawful processing 

To exercise your rights, please contact: 

Email: [email protected]  
Post: Address listed in the table of eXp Entities above 
Form: Data Request Portal 

We may verify your identity before fulfilling your request. There is no fee unless your request is unfounded or excessive. 

8. Personal Information Retention 

We retain Personal Information only as long as necessary to fulfill the purposes for which it was collected. The length of retention depends on: 

• Your relationship with us. For example, we must retain Personal Information for your real estate transaction for the full statutory period in your country as well as the full statutory period for our audit requirements in the United States as a publicly traded company.  
• Legal and regulatory requirements. For example, we may be subject to litigation or other statutory obligations to retain your Personal Information. 
• Operational needs (e.g., compliance audits, transaction history). We must retain certain Personal Information to be able to meet obligations as a publicly traded company and ensure our ability to defend ourselves in the event of later litigation. 

Where the information we collect is not considered Personal Information, either due to de-identification, anonymization, or pseudonymization we may retain such information indefinitely. 

9. Security of your Personal Information 

We implement physical, technical, and administrative safeguards to protect your Personal Information, including: 

• Encrypted data storage. 
• Secure access controls for personnel. 
• Regular security reviews and incident response protocols. 

We maintain enterprise security policies and training for all direct employees of eXp and offer a multitude of training opportunities and resources for our Agents to utilize in their independent data processing activities. 

10. Your Marketing Preferences 

If you request information about a property we are listing on a listing portal, on our Sites, or otherwise request information about eXp on our Sites, you may receive marketing communications related to your request. You may opt-out at any time by following the unsubscribe link options in your marketing email or by contacting us directly at [email protected]. If you are emailing us to opt-out of communications you have received from one of our Agents, please include the name of the Agent so we can ensure the Agent unsubscribes you from all marketing communications. 

11. Changes to this Privacy Notice 

We may update this Privacy Notice to reflect changes in our practices or legal obligations. Revisions will be posted on our website with the updated effective date. If you have provided us your contact information we will inform you of material changes to this Privacy Notice with as much advance notice as possible. 

Last Updated: September XX, 2025