Privacy Agreement

Grovity Services LLC ("Grovity", "we", "us", or "our") is committed to protecting the privacy of the people who visit our websites ("Visitors"), the people and entities who register to use our services ("Clients"), the natural persons whose data is processed through the Grovity platform by our Clients ("Data Subjects"), and the people who attend our events ("Attendees"). This Privacy Agreement describes Grovity's privacy practices for our websites and the related services and applications offered by Grovity (collectively, the "Service").

Questions or complaints about this Privacy Agreement can be sent to our Data Protection Officer at privacy@grovity.ai.

This Privacy Agreement covers the websites and services that link to it, including https://www.grovity.ai, https://app.grovity.ai, https://api.grovity.ai, and associated subdomains, applications, APIs, and channels operated by Grovity.

Our websites may link to third-party websites. Grovity is not responsible for the practices or content of those websites.

Grovity receives and stores the information you provide when you request information about the Service, register for it, attend our events, or interact with our channels. This may include:

• Contact information: name, email address, phone number, and postal address.
• Professional information: company, job title, and, where needed for contracting, tax identification number.
• Account information: username, password (stored as a hash), and preferences.
• Billing information: billing contact and address. Payment instruments are processed by certified payment providers; Grovity does not store full card numbers.
• Content uploaded to the Service: text, files, audio, images, contact lists, knowledge bases, and any other data the Client chooses to process through the platform.
• Communications with Grovity's support, sales, or commercial teams.

When you visit our websites or use the Service, Grovity may automatically collect:

• Technical data: IP address, device identifiers, browser type, operating system, and language.
• Usage data: pages visited, features used, timestamps, referring URLs, and click paths.
• Cookies and similar technologies (see Section 5).

Grovity uses analytics providers (such as Google Analytics) to understand how our websites are used and to improve them. Non-essential analytics and marketing technologies are only activated after you accept them through the cookie banner, where required by law. Grovity does not sell personal information.

Grovity uses:

• Essential cookies, required for the website and the Service to function (for example, session and security cookies). These cannot be disabled.
• Analytics cookies, to measure website traffic and performance. These are optional.
• Marketing cookies, to measure the effectiveness of our campaigns. These are optional.

You can accept, reject, or configure optional cookies through the cookie banner shown on your first visit, and change your choice at any time through the "Cookie settings" link in the footer of our website. You can also manage cookies through your browser settings. Cookies set by third-party providers are governed by those providers' privacy policies.

Grovity Services LLC 600 Campana Ave, Miami, FL 33156, United States Data Protection Officer: privacy@grovity.ai Website: https://www.grovity.ai

Grovity is committed to protecting the personal information of its Clients, employees, suppliers, Visitors, and Data Subjects in accordance with the data protection laws applicable in each country where it operates.

This Privacy Agreement (the "Policy") explains the categories of data collected, the purposes of processing, the rights of data subjects, and how to exercise them. Grovity processes personal data in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality set out in Regulation (EU) 2016/679 (GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA), Colombian Law 1581 of 2012 and Decree 1377 of 2013, the Brazilian General Personal Data Protection Law (LGPD, Law 13,709/2018), and the other laws listed in the annexes to this Policy.

• Authorization or Consent: the prior, express, and informed consent of the Data Subject to the processing of their personal data.
• Database: an organized set of personal data subject to processing.
• Personal Data: any information relating to an identified or identifiable natural person.
• Sensitive Data: data that affects the privacy of the Data Subject or whose misuse may lead to discrimination, such as data revealing racial or ethnic origin, political opinions, religious beliefs, trade-union membership, health, sexual life, or biometric data.
• Health Data: personal data relating to the physical or mental health of a person, including the provision of health-care services.
• Data Controller: the person who, alone or jointly, decides on the purposes and means of processing.
• Data Processor: the person who processes personal data on behalf of the Data Controller.
• Subprocessor: a third party engaged by Grovity to process personal data on behalf of a Client.
• Processing: any operation performed on personal data, such as collection, recording, storage, use, circulation, or deletion.
• Transmission: the communication of personal data by a Data Controller to a Data Processor, inside or outside the country, for processing on the Controller's behalf.
• Transfer: the sending of personal data to a recipient that acts as a Data Controller, inside or outside the country.

Grovity applies the following principles to the processing of personal data: legality; purpose; freedom and consent; veracity and quality; transparency; access and restricted circulation; security; confidentiality; and accountability. Grovity applies technical, human, and administrative security measures designed with reference to the SOC 2 Trust Services Criteria and ISO/IEC 27001, described in the Description of the Security of the Services.

Grovity acts as Data Controller for the personal data of Visitors, Attendees, prospects, Clients' contact persons and account users, suppliers, candidates, and employees. In that capacity, Grovity will:

• Guarantee Data Subjects the full and effective exercise of their rights.
• Obtain and keep evidence of the authorization granted by the Data Subject, where it is required.
• Inform the Data Subject of the purpose of the collection and of their rights.
• Keep information under security conditions that prevent its adulteration, loss, or unauthorized access.
• Process queries and claims within the terms set out in this Policy.
• Maintain internal procedures for handling data subject requests.
• Notify the competent data protection authority of security incidents as required by law.

When a Client uses the Service to interact with its own customers, leads, patients, or other individuals, the Client is the Data Controller and Grovity acts as Data Processor. In that capacity, Grovity will:

• Process personal data only on the Client's documented instructions and to provide the Service.
• Keep the data under appropriate security conditions, isolated by tenant.
• Update, rectify, or delete data following the Client's instructions.
• Assist the Client, to a reasonable extent, in responding to Data Subject requests.
• Allow access to information only to persons authorized by the Client or empowered by law.
• Notify the Client without undue delay, and within seventy-two (72) hours of becoming reasonably aware, of any security incident affecting personal data processed on its behalf.
• Engage only Subprocessors bound by written data-protection obligations, and inform Clients of changes to its Subprocessors in advance.
• Delete or return personal data at the end of the service, as set out in Section 12.
• Not use Client personal data for any purpose other than those instructed by the Client.

These obligations are formalized in Grovity's Data Processing Addendum (DPA), available at https://www.grovity.ai/dpa, which includes, where applicable, the obligations of Article 28 of the GDPR, the Standard Contractual Clauses adopted by the European Commission and by Brazil's ANPD, and a data transmission contract under Colombian Decree 1074 of 2015.

Grovity keeps personal data only for as long as necessary for the purposes that justified its collection, taking into account legal, accounting, tax, and contractual obligations.

Category	Retention
Client Content (conversations, files, knowledge bases)	For the duration of the Agreement, or less if the Client instructs earlier deletion
Client Content after termination	Deleted from active systems within thirty (30) days after the export window, and from backups at the end of their retention cycle
Account and billing data	For the duration of the relationship and up to ten (10) years thereafter, as required by accounting and tax law
Marketing data	Until the Data Subject withdraws consent or requests deletion
Website analytics data	According to the configuration of the analytics provider, not exceeding fourteen (14) months

Data Subjects may revoke their consent at any time, unless Grovity is legally or contractually required to continue processing, by writing to privacy@grovity.ai.

• Providing the services and products contracted, directly or with the participation of third-party providers.
• Informing about material changes to this Policy.
• Establishing and managing pre-contractual, contractual, commercial, labor, or civil relationships.
• Responding to requests, queries, claims, and complaints.
• Complying with legal obligations and requests from judicial or administrative authorities.
• Ensuring the security of the Service and preventing fraud.

Recruitment, selection, and hiring processes, including competency tests and reference checks.

Execution of the employment or service relationship, payroll, benefits, social security, training, performance assessment, assignment of work tools, access control, and compliance with labor obligations.

Management of the contractual relationship, payments, service evaluation, compliance with legal obligations, and access control.

Evaluation, registration, contracting, provision of the Service, support, satisfaction surveys, statistical analysis, credit risk assessment, and marketing communications (subject to opt-in where required).

Grovity processes the personal data of individuals who interact with a Client's AI agents exclusively to provide the Service to that Client and on its instructions. The Client, as Data Controller, is responsible for: (i) having a valid legal basis, including consent where required; (ii) informing Data Subjects about the processing, including the use of AI; and (iii) responding to Data Subject requests, with Grovity's reasonable assistance. Data Subjects who wish to exercise their rights regarding this data should contact the relevant Client; requests received by Grovity will be forwarded to the Client.

Grovity does not require sensitive data to provide its services to Visitors or Clients' account users. Clients may configure the Service to process sensitive data, including Health Data, of their own Data Subjects only in accordance with the Health Data Addendum and applicable law. In such cases:

• The Client must obtain the Data Subject's prior, express, and informed consent where required by law and, where required, inform the Data Subject that answering questions about sensitive data is optional.
• Grovity processes sensitive data only to provide the Service, with restricted access, and does not use it, even in aggregated or de-identified form, to improve the Service or to train any model.
• Grovity does not use sensitive data for advertising and does not sell it.
• Protected Health Information under U.S. HIPAA is processed only under a Business Associate Agreement executed with Grovity.

Grovity's services are not directed at children, and Grovity does not knowingly collect personal data from children through its websites. Clients that use the Service in contexts where minors may participate must obtain the authorization of their legal representatives as required by law and respect the best interests of the child.

Grovity does not sell or rent personal information. Grovity discloses personal data only:

• When the Data Subject has authorized it.
• To Subprocessors that help provide the Service (infrastructure, database, AI model, voice, and observability providers), under written data-protection agreements. The current list is published at https://www.grovity.ai/subprocessors.
• To the messaging, telephony, and integration providers that the Client selects and connects to the Service, which act under their own terms.
• In connection with a merger, acquisition, or other corporate restructuring, subject to confidentiality.
• When required by law or by a competent authority.

Grovity applies technical, human, and administrative measures to protect personal data against adulteration, loss, unauthorized access, or misuse, including:

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256), with an additional application-level encryption layer for the most sensitive credentials.
• Tenant isolation enforced server-side on every request.
• Least-privilege access with individual identities, and audit logging.
• Monitoring, alerting, and incident response procedures.
• Encrypted, redundant backups.

Details are available in the Description of the Security of the Services.

Subject to applicable law, Data Subjects have the right to:

• Access: know whether their personal data is being processed and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Deletion: request deletion when the data is no longer necessary or consent has been revoked.
• Restriction: request the restriction of processing in certain circumstances.
• Portability: receive their data in a structured, commonly used, machine-readable format.
• Objection: object to certain processing, including direct marketing.
• Withdraw consent: at any time, without affecting the lawfulness of prior processing.
• Not be subject to solely automated decisions with legal or similarly significant effects, where provided by law, and request human review.
• Lodge a complaint with the competent data protection authority.

These rights may be exercised by the Data Subject, their legal representative, or their successors. Rights of minors are exercised through their legal representatives.

Send your request to privacy@grovity.ai, including your identification, a clear description of the request, and a means of contact. Grovity may request additional information to verify your identity. Exercising your rights is free of charge.

Queries: answered within ten (10) business days of receipt. If this is not possible, Grovity will explain the reasons and the new date, which will not exceed five (5) additional business days.

Claims:

• The claim must be submitted in writing, with the Data Subject's identification, a description of the facts, an address, and supporting documents.
• If the claim is incomplete, Grovity will ask for the missing information within five (5) business days. If it is not provided within two (2) months, the claim will be deemed withdrawn.
• A "claim in process" note will be added to the database within two (2) business days and kept until the claim is resolved.
• Claims are resolved within fifteen (15) business days, extendable by up to eight (8) business days when justified.

Shorter periods established by local law (for example, the 15-day period of the LGPD for access requests) prevail.

Grovity's infrastructure is hosted in the United States. Grovity personnel who provide support may be located in the United States, Colombia, Brazil, Guatemala, and Jamaica. International transfers and transmissions of personal data are carried out with appropriate safeguards, including:

• The Standard Contractual Clauses adopted by the European Commission, for transfers from the EU/EEA.
• The standard contractual clauses approved by Brazil's ANPD (Resolution CD/ANPD No. 19/2024), for transfers from Brazil.
• Data transmission contracts meeting the requirements of Colombian Decree 1074 of 2015, or the Data Subject's authorization, for transmissions from Colombia.
• Equivalent mechanisms required by other applicable laws.

Grovity uses artificial intelligence models to deliver the Service:

• Providers. AI models are accessed primarily through Amazon Bedrock, within Grovity's AWS environment, and, depending on the Client's configuration, through the enterprise APIs of other providers listed on the Subprocessors page.
• Data shared. Only the data necessary to perform each task is sent to the models (for example, the conversation context needed to generate a response). Payment card data is never included.
• Purposes. Generating responses, classifying intents, transcribing audio, synthesizing voice, evaluating conversation quality, and retrieving information from the Client's knowledge bases.
• No training. Client Content is not used to train AI providers' models, under the enterprise terms of each provider. Grovity does not train or fine-tune models with Client Content.
• Tenant isolation. Data from one Client is not used to configure or improve agents, knowledge bases, or models serving other Clients.
• Transparency and human oversight. Clients are required to inform their end users that they are interacting with an AI system and to provide a way to reach a human where appropriate. Grovity's Responsible AI statement is available at https://www.grovity.ai/responsible-ai.

Grovity may send commercial communications about products, services, and events where permitted by law and, where required, with your consent. Every communication includes an unsubscribe option. Unsubscribe requests are processed promptly and, in any case, within the term required by law.

Grovity may update this Policy. The current version will always be published on our website. Material changes will be notified in advance in accordance with the Terms and Conditions.

Grovity has designated a Data Protection Officer, who also acts as Grovity's encarregado under the LGPD and as the person responsible for handling data subject requests under Colombian law:

privacy@grovity.ai

This Policy is effective from the effective date indicated at the top and supersedes any prior version.

• Legal bases. Performance of a contract; compliance with legal obligations; legitimate interests (such as security, fraud prevention, and improvement of our websites); and consent (for example, for optional cookies and marketing).
• Categories. Identification and contact data, professional data, billing data, technical data, and Client Content.
• Recipients. Subprocessors under data-processing agreements; competent authorities when required by law. Grovity does not sell personal data.
• Retention. As set out in Section 12.
• Transfers. Under the European Commission's Standard Contractual Clauses.
• Rights and complaints. All rights in Section 18, including the right to lodge a complaint with the supervisory authority of your country of residence.

Processing is carried out in accordance with Law 1581 of 2012, Decree 1377 of 2013 (incorporated into Decree 1074 of 2015), and the instructions of the Superintendence of Industry and Commerce (SIC). Data Subjects may file a complaint with the SIC after exhausting the procedure in Section 20. Answering questions about sensitive data or data of children and adolescents is optional.

Processing is carried out in accordance with the LGPD (Law 13,709/2018). Data Subjects in Brazil have the rights set out in Article 18 of the LGPD, including confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary or excessive data, portability, deletion of data processed with consent, information about sharing, information about the possibility of refusing consent, revocation of consent, and review of automated decisions (Article 20). The encarregado is identified in Section 25. Complaints may be filed with the Autoridade Nacional de Proteção de Dados (ANPD).

Grovity does not sell or share personal information for cross-context behavioral advertising as those terms are defined in the CCPA. California residents have the right to know, delete, correct, and limit the use of sensitive personal information, and the right to non-discrimination for exercising them. Requests can be sent to privacy@grovity.ai. Residents of other U.S. states with comprehensive privacy laws have equivalent rights under those laws.

Processing is carried out in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties (2025). Data Subjects may exercise their ARCO rights (access, rectification, cancellation, and objection) through privacy@grovity.ai and file complaints with the competent authority.

Processing is carried out in accordance with Law 8968 on the Protection of Persons Regarding the Processing of their Personal Data and its regulations. Data Subjects may exercise their rights through privacy@grovity.ai and file complaints with the Agencia de Protección de Datos de los Habitantes (PRODHAB).

Grovity respects the constitutional rights to privacy and to access and rectification of personal records. Data Subjects may exercise the rights described in Section 18 through privacy@grovity.ai.

Processing is carried out in accordance with the Data Protection Act, 2020. Data Subjects may exercise their rights through privacy@grovity.ai and file complaints with the Office of the Information Commissioner.