Data Processing Agreement.

Annex I of the Standard Contractual Clauses, in plain form.

Subject matter

Providing the grovs services: links, analytics, messaging, revenue and data delivery.

Duration

The term of the Agreement, plus the deletion period in section 10.

Nature and purpose

Collecting, storing, analysing and delivering data so the Customer can link to, measure and message the users of its apps and websites.

Data subjects

End users of the Customer's apps and websites, and people who open the Customer's links.

Categories of data

Device and app identifiers, IP address, user agent, link clicks and opens, in-app events, push tokens, purchase records, and user IDs and attributes the Customer chooses to send.

Special categories

None intended. The Customer agrees not to send special categories of data (such as health data) to grovs Cloud unless agreed in writing. For health data, use a dedicated Enterprise instance or self-hosted grovs.

Frequency

Continuous, while the Customer's apps send data.

• We process Customer Personal Data only on the Customer's documented instructions, which are the Agreement, this DPA and the Customer's use of the product settings. If an instruction appears to break data protection law, we tell the Customer.
• Everyone at grovs with access to Customer Personal Data is bound by confidentiality.
• We apply the technical and organisational measures in section 4.
• We use sub-processors only as described in section 5.
• We help the Customer respond to data subject requests (section 7), and with security, breach notifications, data protection impact assessments and prior consultations under Articles 32 to 36 GDPR.
• We delete or return Customer Personal Data at the end of the Agreement (section 10).
• We make available the information needed to show compliance with this DPA, and allow for audits (section 9).

Annex II. The measures we apply to grovs Cloud, reviewed at least once a year:

Encryption

TLS 1.2 or higher in transit. Data encrypted at rest on our storage.

Access control

Production access limited to named engineers who need it, with multi-factor authentication. Access is reviewed and removed when roles change.

Customer access

SSO over OIDC, SCIM provisioning and roles for the Customer's team.

Logging

A tamper-evident audit log of actions in the dashboard, exportable by the Customer.

Separation

Each Customer's data is logically separated by project and account.

Resilience

Backups and documented restore procedures. Hosting in EU data centres.

Vulnerabilities

Dependency and vulnerability monitoring, patching on the timelines in our SLA.

People

Confidentiality agreements and security training for staff with access.

Incidents

A documented incident response process, including the breach notice in section 6.

Annex III. The Customer authorises grovs to use these sub-processors:

• Each sub-processor is bound by written data protection terms at least as protective as this DPA. We remain responsible for their performance.
• We announce any new or replacement sub-processor at least 30 days before it starts, by email to the Customer's account contacts and on this page.
• The Customer may object on reasonable data protection grounds within those 30 days. We will then work in good faith on an alternative. If none is possible, the Customer may end the affected service and receive a pro-rata refund of prepaid fees.

If we become aware of a personal data breach affecting Customer Personal Data, we notify the Customer without undue delay, and within 48 hours. That leaves the Customer time for its own 72-hour notice to the supervisory authority.

The notice describes, as far as we know at that point: the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, and the measures taken or proposed. We send updates as we learn more, and we don't notify the Customer's users or authorities on its behalf unless asked.

The Customer can access, export and delete an end user's data through the dashboard and the API, which covers most requests directly.

If we receive a request from one of the Customer's users, we forward it to the Customer within 5 business days and don't respond to it ourselves, unless the Customer asks us to.

Customer Personal Data on grovs Cloud is stored in the EU. Where a sub-processor processes it outside the European Economic Area, the transfer is covered by:

• the EU Standard Contractual Clauses (Commission Decision 2021/914), or the EU-U.S. Data Privacy Framework where the recipient is certified under it;
• for data from the UK, the UK Addendum to the Standard Contractual Clauses; for data from Switzerland, the clauses as adapted for Swiss law.

Where the Customer is outside the EEA, the Standard Contractual Clauses (Module 2, controller to processor) are incorporated into this DPA by reference.

• We provide our security pack and answers to reasonable security questionnaires, which in most cases is enough to show compliance.
• Where that isn't enough, the Customer, or an independent auditor bound by confidentiality, may audit our compliance with this DPA once a year, with 30 days' notice, during business hours and without disrupting other customers.
• Audits required by a supervisory authority, or after a breach, are not limited to once a year.
• Each party pays its own costs, unless the audit finds a material breach of this DPA by grovs.

The Customer can export its data at any time during the Agreement, and for 30 days after it ends.

Within 30 days after the end of the Agreement, we delete Customer Personal Data from our systems, and from backups as they expire, at the latest 60 days after the end. We confirm the deletion in writing on request. We keep data longer only where the law requires it, and then only for that purpose.

• If this DPA and the Agreement conflict on data protection, this DPA applies. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses apply.
• Each party's liability under this DPA is subject to the limits in the Agreement, except where the law doesn't allow them.
• This DPA follows the governing law and courts of the Agreement. The Standard Contractual Clauses are governed by the law of the EU member state set in them.
• This DPA lasts as long as we process Customer Personal Data.

Our Data Protection Officer handles questions about this DPA, signed copies and reviews of the Customer's own DPA.