Data Processing Addendum

1. Purpose

This Data Processing Addendum (“DPA”) forms part of the Master Services Agreement or other agreement between you (“Customer”) and GEOGrow.ai governing the provision of the Services (the “Agreement”). It applies when Customer Data includes personal data that is subject to data protection laws, and GEOGrow.ai processes that personal data on Customer’s behalf.

2. Definitions

• • “Data Protection Laws” means applicable privacy and data protection laws, including GDPR, UK GDPR, and the CCPA/CPRA.
• • “Customer Data” means personal data submitted by Customer or end users and processed by GEOGrow.ai on Customer’s behalf.
• • “Subprocessor” means any third party engaged by GEOGrow.ai to process Customer Data in connection with the Services.

3. Roles of the Parties

Customer is the controller (or business) of Customer Data, and GEOGrow.ai is the processor (or service provider). GEOGrow.ai will process Customer Data only according to Customer’s documented instructions, as described in the Agreement and this DPA.

4. Processing Details

The subject matter, nature, and purpose of processing involve delivering GEO audit, analytics, and related Services. Types of personal data may include contact information, online identifiers, and customer-provided context. The data subjects may include Customer’s employees, clients, or prospects. Processing continues for the term of the Agreement unless otherwise stated.

5. Security Measures

GEOGrow.ai implements technical and organizational measures to protect Customer Data, including access controls, encryption in transit, vulnerability management, logging, and employee training. Upon request, GEOGrow.ai will provide a summary of current security controls.

6. Subprocessors

Customer authorizes GEOGrow.ai to engage Subprocessors to provide the Services, provided that GEOGrow.ai ensures Subprocessors offer at least the same level of protection. GEOGrow.ai maintains a list of current Subprocessors at privacy@geogrow.ai. Customer may subscribe to updates and object to new Subprocessors on reasonable grounds.

7. Data Subject Requests

GEOGrow.ai will assist Customer in responding to requests from data subjects to exercise their rights under Data Protection Laws. Requests received directly by GEOGrow.ai will be forwarded to Customer, unless prohibited by law.

8. Incident Response

In the event of a confirmed personal data breach, GEOGrow.ai will notify Customer without undue delay, provide relevant information available at the time, and take steps to mitigate the impact. Customer is responsible for notifying data subjects or regulators when required by law.

9. Audits & Compliance

GEOGrow.ai will make available information necessary to demonstrate compliance with this DPA and will allow audits by Customer or an independent auditor, provided audits are limited to once per year and conducted during normal business hours with reasonable notice.

10. Data Transfers

When transferring Customer Data from the European Economic Area, United Kingdom, or Switzerland to countries without an adequacy decision, the parties rely on the Standard Contractual Clauses (controller-to-processor) incorporated by reference. GEOGrow.ai will not transfer Customer Data to a country lacking adequate protections without appropriate safeguards.

11. Return or Deletion

Upon termination of the Services, GEOGrow.ai will delete or return Customer Data within 30 days, unless retention is required by law. If deletion is not feasible, GEOGrow.ai will continue to protect the data and limit further processing.

12. Miscellaneous

In the event of conflict between this DPA and the Agreement, this DPA controls with respect to data protection obligations. Each party’s liability under this DPA is subject to the limitations of liability in the Agreement.