Privacy Policy

Iron Oak Property Solutions LLC ("Iron Oak," "we," "us," or "our") operates www.selltoironoak.com (the "Site"). Iron Oak is a Texas real estate investment company that buys properties directly from owners for cash and may assign or resell its contractual rights to investor buyers.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information obtained through the Site, related forms, communications, and services.

3. How We Use Information

We may use personal information to:

• Respond to inquiries and requests;
• Evaluate properties and ownership information;
• Prepare, present, negotiate, and communicate cash offers;
• Contact property owners by telephone, text message, and email;
• Coordinate property inspections, appraisals, title work, escrow, and closings;
• Prepare, administer, assign, or complete purchase contracts and related transactions;
• Provide property and seller information to title companies, escrow companies, lenders, contractors, appraisers, and prospective assignee buyers or investors as reasonably necessary to evaluate, fund, close, assign, or complete a transaction;
• Use rental information to evaluate rental applications, manage tenancies, and comply with applicable law;
• Market Iron Oak's services, properties, investment opportunities, and related services;
• Maintain and manage our customer, seller, investor, and vendor relationships;
• Operate, maintain, personalize, secure, and improve the Site and our services;
• Analyze Site use, campaign performance, and business trends;
• Detect, investigate, prevent, and respond to fraud, security incidents, misuse, and unlawful activity;
• Comply with legal obligations, court orders, governmental requests, and regulatory requirements;
• Establish, exercise, or defend legal claims; and
• Accomplish other purposes disclosed when information is collected or otherwise permitted by law.

We may use deidentified, aggregated, or anonymized information for lawful business purposes. We will not attempt to reidentify information that we maintain in deidentified form except as permitted by law.

6. Legal Bases and Consent

Although United States privacy laws generally do not require a formal "legal basis" framework for all processing, we process personal information based on one or more of the following grounds:

• Your consent or direction;
• The need to respond to your request or perform a contract;
• Our legitimate business purposes, including evaluating properties, making offers, completing transactions, operating the Site, improving services, preventing fraud, and communicating with you;
• Compliance with legal obligations; and
• Protection of our rights, property, users, and business operations.

Where we rely on consent, you may withdraw consent as permitted by law. Withdrawal will not affect processing already completed or processing based on another lawful basis.

9. Data Retention

We retain personal information for as long as reasonably necessary to:

• Provide requested services;
• Evaluate, document, administer, and complete transactions;
• Maintain business and transaction records;
• Comply with legal, accounting, tax, regulatory, insurance, and reporting obligations;
• Resolve disputes and enforce agreements;
• Detect and prevent fraud and security incidents; and
• Fulfill the purposes described in this Policy.

Retention periods vary based on the nature and sensitivity of the information, the purpose for which it was collected, the existence of a transaction, applicable legal requirements, and legitimate business needs, and the criteria used to determine the retention period for each category of personal data (including that rental application data is retained for the period necessary to evaluate the application and to comply with fair housing and landlord-tenant recordkeeping requirements).

When information is no longer reasonably necessary, we may delete it, deidentify it, or securely dispose of it, subject to legal and operational limitations.

12. Children's Privacy

The Site is not directed to children under 18 years of age. We do not knowingly collect personal information from children under 18.

If you believe a child has provided personal information to us, contact us using the information below. If we learn that we collected personal information from a child in circumstances requiring deletion, we will take reasonable steps to delete it.

15. Texas Residents — Texas Data Privacy and Security Act (Tex. Bus. & Com. Code Ch. 541)

To the extent the Texas Data Privacy and Security Act ("TDPSA"), Tex. Bus. & Com. Code Ch. 541, applies to Iron Oak, Iron Oak processes personal data in accordance with this section. The TDPSA exempts small businesses as defined by the U.S. Small Business Administration. Iron Oak provides these disclosures and honors these rights in addition to any obligation the TDPSA imposes, and nothing in this Policy is an admission that the TDPSA applies.

A. Categories of Personal Data We Process

Depending on your interactions with us, we may process the following categories of personal data:

• Identifiers and contact information (such as name, mailing address, email address, telephone number, and online identifiers);
• Property and transaction information (such as property address, ownership information, property condition, and transaction communications);
• Internet or other electronic network activity information (such as IP address, device information, pages viewed, and interaction data);
• General location information derived from IP address;
• Communications content and related information (such as messages and documents you submit);
• Rental application and tenancy information (such as income and employment information, references, and screening information); and
• Inferences derived from the information above.

B. Purposes of Processing

We process personal data for the purposes described in this Privacy Policy, including:

• Responding to inquiries and requests;
• Evaluating properties and ownership information and making and communicating offers;
• Administering, assigning, and completing transactions and related communications;
• Evaluating rental applications, managing tenancies, and complying with applicable law;
• Operating, maintaining, securing, and improving the Site and our services;
• Marketing our services and measuring campaign performance;
• Detecting, investigating, preventing, and responding to fraud, security incidents, misuse, and unlawful activity; and
• Complying with legal obligations and establishing, exercising, or defending legal claims.

C. Categories of Personal Data Shared With Third Parties and Categories of Third Parties

We may share the categories of personal data described above with the categories of third parties described in the "How We Share Information" section, including:

• Service providers (such as hosting, CRM, communications, analytics, advertising, security, storage, and professional advisers);
• Transaction participants (such as title and escrow companies, closing agents and attorneys, lenders, contractors, inspectors, appraisers, insurance providers, and governmental authorities);
• Prospective buyers, investors, and assignees (in connection with an assignment, resale, or purchase transaction); and
• Contractors, vendors, and real estate professionals involved in renovation or resale activities where applicable.

D. Texas Consumer Rights

Subject to applicable law and exceptions, Texas consumers have the right to:

• Confirm and access: Confirm whether a controller is processing personal data and access the personal data;
• Correct: Correct inaccuracies in personal data;
• Delete: Delete personal data provided by or obtained about the consumer;
• Portability: Obtain a portable copy of the consumer's personal data; and
• Opt out: Opt out of (a) the sale of personal data, (b) targeted advertising, and (c) profiling in furtherance of a decision that produces a legal or similarly significant effect.

E. How to Exercise Texas Rights; Timing of Our Response

To exercise your Texas privacy rights, you may submit a request using the methods in the "How Texas Residents May Submit a Request" section below. To the extent the TDPSA applies to Iron Oak, we will respond to a request within 45 days of receipt. We may extend the response period once by an additional 45 days when reasonably necessary, and we will notify you of the extension.

F. Appeal Process

If Iron Oak declines to act on your request, to the extent the TDPSA applies to Iron Oak, we will notify you within 45 days. You may appeal our decision by contacting us using the same methods described below and stating that you are submitting an appeal. To the extent the TDPSA applies to Iron Oak, we will respond to an appeal within 45 days of receipt with a written explanation of the reasons for the decision. If your appeal is denied, you may contact the Texas Attorney General to submit a complaint.

G. Sensitive Data and Consent

Iron Oak may collect information that constitutes sensitive data in limited circumstances, including financial account information and precise geolocation. To the extent the TDPSA requires consent before processing sensitive data, Iron Oak will obtain that consent before processing it, or will not process it. Iron Oak does not knowingly collect personal data from children under 18 years of age. Iron Oak does not knowingly sell or process the personal data of a known child without complying with applicable law.

How Texas Residents May Submit a Request

To submit a Texas privacy request, contact us using one of the methods below:

• Email: seth@selltoironoak.com;
• Online request form: /contact;
• Mail: 15901 Perdido Creek Trail, Prosper, TX 75078;
• Telephone: 214-225-1980.

We may need to verify your identity before completing a request. We may ask for information reasonably necessary to authenticate the request, but we will not require you to create an account solely to submit a request.

You may use an authorized agent where permitted by law. We may require proof of the agent's authority and may independently verify your identity.

To the extent the TDPSA applies to Iron Oak, we will respond to a request within 45 days of receipt. We may extend the response period once by an additional 45 days when reasonably necessary, and we will notify you of the extension. If we deny a request in whole or in part, we will explain the basis for the denial and provide appeal instructions when required.

The TDPSA is enforced by the Texas Attorney General and does not provide a private right of action. Texas consumers may submit a complaint to the Texas Attorney General's office if they believe their rights have been violated.

18. Updating or Deleting Your Information

You may request that we update or delete information by contacting us using the methods listed below. We may retain certain information when necessary to:

• Complete a transaction;
• Maintain business, tax, legal, accounting, or title records;
• Exercise or defend legal claims;
• Detect or prevent fraud;
• Comply with legal obligations; or
• Fulfill another lawful purpose.

Deleting or restricting information may affect our ability to communicate with you, evaluate a property, make an offer, or complete a transaction.