Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Grovity Terms and Conditions or any signed agreement between Grovity Services LLC ("Grovity" or "Processor") and the Client ("Client" or "Controller") (the "Agreement"), and applies to Grovity's processing of personal data on behalf of the Client. Enterprise Clients may request a countersigned copy by writing to privacy@grovity.ai.

Terms such as "personal data", "processing", "controller", "processor", "data subject", and "supervisory authority" have the meaning given in applicable Data Protection Law. "Data Protection Law" means all laws applicable to the processing of personal data under the Agreement, including the GDPR, the CCPA/CPRA, Colombian Law 1581 of 2012, the Brazilian LGPD, and the laws listed in the Privacy Agreement. "Client Personal Data" means personal data processed by Grovity on behalf of the Client in providing the Services. "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Client Personal Data.

2.1. The Client is the controller and Grovity is the processor of Client Personal Data. Where the Client acts as a processor on behalf of a third party, Grovity acts as its subprocessor.

2.2. Details of processing:

Item	Description
Subject matter	Provision of the Services under the Agreement
Duration	Term of the Agreement plus the export and deletion periods in Section 10
Nature and purpose	Hosting, storage, transmission, and processing of conversations and related data through AI agents configured by the Client
Data subjects	The Client's end users, customers, prospects, patients, and other individuals who interact with its AI agents; the Client's authorized users
Categories of data	Identification and contact data; conversation content (text, audio, images, files); data obtained from the Client's integrations; technical data; and, where the Client so configures, sensitive data in accordance with the Health Data Addendum

3.1. Grovity will process Client Personal Data only on the Client's documented instructions, which consist of the Agreement, this DPA, and the Client's configuration of the Services, unless otherwise required by law, in which case Grovity will inform the Client unless legally prohibited. Grovity will inform the Client if, in its opinion, an instruction infringes Data Protection Law.

3.2. The Client is responsible for the lawfulness of the processing, including having a valid legal basis, obtaining any required consents, providing privacy notices to data subjects (including notice of the use of AI), and ensuring that its instructions comply with Data Protection Law.

Grovity ensures that persons authorized to process Client Personal Data are bound by confidentiality obligations and access the data only as needed to provide the Services.

Grovity implements the technical and organizational measures described in the Description of the Security of the Services (https://www.grovity.ai/security), which forms Annex II of this DPA. Grovity may update those measures provided that the overall level of protection is not materially reduced.

6.1. The Client grants a general authorization for Grovity to engage the subprocessors listed at https://www.grovity.ai/subprocessors.

6.2. Grovity will publish any new subprocessor at least thirty (30) days before it begins processing Client Personal Data. The Client may object on reasonable data-protection grounds within that period. The parties will discuss the objection in good faith; if it is not resolved, the Client may terminate the affected Services and receive a refund of prepaid fees for the period not yet provided.

6.3. Grovity will impose on each subprocessor data-protection obligations substantially equivalent to those in this DPA, including that Client Personal Data is not used to train the subprocessor's models, and remains responsible for its subprocessors' performance.

Grovity will promptly forward to the Client any request received directly from a data subject regarding Client Personal Data and will not respond to it except on the Client's instructions. Taking into account the nature of the processing, Grovity will provide reasonable assistance, including through the functionality of the Services, to help the Client respond to such requests.

Grovity will notify the Client without undue delay and, in any case, within seventy-two (72) hours of becoming aware of a Security Incident, unless a shorter period is set in the Agreement. The notification will include, to the extent available, the nature of the incident, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. Grovity will take reasonable steps to contain the incident and will cooperate with the Client in its notifications to authorities and data subjects. Notification of a Security Incident is not an acknowledgment of fault or liability.

9.1. Grovity will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, to the extent required by Data Protection Law and related to the Services.

9.2. Grovity will make available to the Client, upon written request and subject to confidentiality, the information reasonably necessary to demonstrate compliance with this DPA, including its security documentation, responses to security questionnaires, and the certifications and reports of its infrastructure providers.

9.3. Where this information is not sufficient to demonstrate compliance, or where required by a supervisory authority, the Client may conduct an audit, no more than once a year, with at least thirty (30) days' notice, during business hours, through an independent auditor bound by confidentiality, at the Client's expense, and without access to other clients' data or to infrastructure operated by Grovity's providers.

Upon termination of the Services, Grovity will make Client Personal Data available for export during the export window set out in the Terms and Conditions and will then delete it from its active systems within thirty (30) days, and from backups at the end of their retention cycle, unless retention is required by law. Upon request, Grovity will confirm deletion in writing.

11.1. Grovity processes Client Personal Data in the United States and may give access to it to its personnel and subprocessors in the countries listed in the Privacy Agreement and on the Subprocessors page.

11.2. To the extent required by Data Protection Law, the following apply and are incorporated by reference:

• From the EU/EEA: the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) or Module Three (processor to processor), as applicable, with Annex I completed by Section 2 of this DPA and Annex II by the Description of the Security of the Services. Supervisory authority: that of the Client's establishment. Governing law and forum for the clauses: Ireland.
• From Brazil: the standard contractual clauses approved by Resolution CD/ANPD No. 19/2024.
• From Colombia: this DPA constitutes a personal data transmission contract under Article 2.2.2.25.5.2 of Decree 1074 of 2015.

The processing of health data is additionally governed by the Health Data Addendum. Protected Health Information under HIPAA is processed only under a Business Associate Agreement executed separately.

The liability of each party under this DPA is subject to the limitations of the Agreement, except where Data Protection Law provides otherwise. In the event of conflict between this DPA and the Agreement regarding the processing of personal data, this DPA prevails; in the event of conflict with the Standard Contractual Clauses, the clauses prevail.