Data Processing Addendum

1. Parties and scope

This Data Processing Addendum (the "DPA") is between PeakCore LLC, a Wyoming limited liability company that operates AIGROW ("we", "us"), and the business that accepts our Terms of Service ("you"). It forms part of the agreement made up of the Terms and the documents they name (the "Agreement").

It applies whenever we process Customer Personal Data in providing the Services to you. It applies automatically, without a signature, from the moment you first give us such data. Typical cases are:

• the business facts, competitors and Google Analytics traffic totals you save on a monitor;
• an agency’s client details, branding and white-label reports;
• the leads an agency’s embedded checker collects from the agency’s site visitors;
• Search Console data and the key you connect to the blog engine;
• the messages, memories and documents you give the assistant, and the content of the blog engine;
• prompts and responses that pass through our API;
• the materials you send us for done-for-you work and press releases, such as customer reviews, quotes and the names of your staff.

This DPA applies only to business customers. It does not apply to personal data we process as a controller, such as your account, billing and contact details, which the Privacy Policy covers.

2. Definitions

Words defined in the Terms have the same meaning here. "Controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the GDPR. In addition:

• Customer Personal Data means personal data we process on your behalf in providing the Services.
• Data Protection Law means the laws that apply to that processing, which may include the EU General Data Protection Regulation 2016/679 (the "GDPR"), the GDPR as it forms part of UK law (the "UK GDPR"), the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection (the "FADP"), the California Consumer Privacy Act and similar US state laws.
• Sub-processor means a third party we engage to process Customer Personal Data.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data on systems we or our Sub-processors control.
• SCCs means the Standard Contractual Clauses approved by European Commission Implementing Decision 2021/914.
• UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.

3. Roles

You are the controller of Customer Personal Data and we are your processor. Where you act for your own client, as an agency does, you are a processor, your client is the controller and we are your sub-processor. You confirm that your client has authorised you to give us these instructions, including the appointment of our Sub-processors, and you remain our only point of contact.

We are a controller, not a processor, for the data we need to run our business: account and billing details, records of usage and costs, security and abuse logs, and statistics that identify no one. We may use usage records and such statistics to operate, secure, bill and improve the Services, and never to identify your data subjects.

United States. Where US state privacy laws apply, we act as your service provider or contractor. We do not sell or share Customer Personal Data. We do not retain, use or disclose it for any purpose other than providing the Services under the Agreement, or outside our direct business relationship with you, and we do not combine it with personal data from other sources, except as those laws allow. We comply with the obligations those laws place on us and will tell you if we can no longer meet them. You may then take reasonable and appropriate steps to stop and remedy unauthorised use.

4. Processing on your instructions

We process Customer Personal Data only on your documented instructions, including with regard to international transfers, unless the law requires otherwise. In that case we tell you of the legal requirement before processing, unless the law forbids it.

Your instructions are this DPA, the Agreement, the settings you choose and the way you use the Services, and any further written instructions we agree to. Choosing a feature, a model or a delivery address is an instruction. For example, when you choose a model in the assistant or the API, sending your content to the provider of that model is part of your instructions.

We will tell you if, in our opinion, an instruction infringes Data Protection Law. We are not required to check your instructions for legal compliance, and we may suspend the processing concerned until you confirm or change the instruction.

You are responsible for the lawfulness of the processing you instruct: having a legal basis, giving the notices and obtaining the consents the law requires, and the accuracy of the data you provide. The Services are not designed for special categories of personal data, criminal records or the data of children. Do not give us such data unless it is necessary for the Service and lawful.

5. Confidentiality

We allow access to Customer Personal Data only to people who need it to provide, support or secure the Services, and who are bound by confidentiality obligations or a statutory duty of confidentiality.

If a court, authority or other third party asks us for Customer Personal Data, we refer it to you where we can. We tell you of the request unless the law forbids it, and we disclose only what we are legally required to.

6. Security

We implement technical and organisational measures that ensure a level of security appropriate to the risk, as Article 32 of the GDPR requires, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. The measures in place today are set out below and form Annex II for the purposes of the SCCs.

We may change these measures as technology and risks evolve, provided the change does not materially reduce the overall level of security. You are responsible for the security of your own account, devices, API keys and report links, and for the data you choose to upload. Our security page describes how AIGROW works.

7. Sub-processors

You give us general authorisation to engage Sub-processors. The categories we use, with their locations, are set out in the annex below. The current list of Sub-processors is available on request from privacy@aigrow.gg.

We will notify you by email, at the address on your account, at least 14 days before a new Sub-processor starts processing Customer Personal Data. You may object on reasonable grounds relating to data protection by writing to privacy@aigrow.gg within that period. We will discuss your concerns in good faith. If we cannot resolve them, you may end the affected Service by written notice, and the Refund Policy applies to any amounts paid. This is your only remedy for an objection.

Where we must replace a Sub-processor urgently, for security or to keep the Services running, we may do so at once and will notify you as soon as possible afterwards, with the same right to object.

We impose on each Sub-processor, by written contract, data protection obligations that in substance offer the same protection as this DPA, as Article 28(4) of the GDPR requires. We remain responsible to you for the performance of our Sub-processors’ obligations.

8. Assistance

Taking into account the nature of the processing and the information available to us, we assist you with:

• responding to requests from data subjects to exercise their rights, through the features of the Services and, where those are not enough, on request to privacy@aigrow.gg;
• your security obligations, data protection impact assessments and prior consultations with supervisory authorities, by providing information about the Services.

If a data subject contacts us directly about Customer Personal Data, we refer them to you and do not respond ourselves, except to confirm that we passed on the request.

Where assistance goes beyond the features and information the Services already provide, we may charge reasonable costs, which we will tell you in advance, unless the assistance is needed because we breached this DPA.

9. Personal data breaches

We notify you without undue delay after becoming aware of a Personal Data Breach, by email to the address on your account. As it becomes available, we give you the information listed in Article 33(3) of the GDPR:

• the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned;
• a contact point for more information;
• the likely consequences of the breach;
• the measures taken or proposed to address it and to mitigate its possible adverse effects.

We take reasonable steps to contain and remedy the breach. You are responsible for any notification to supervisory authorities and data subjects, and we will assist you as the section on assistance describes.

Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as failed sign-in attempts, pings, port scans or blocked attacks, are not Personal Data Breaches. Our notice of a breach is not an admission of fault or liability.

10. Return and deletion

While you use the Services, you can delete much of your data yourself, such as a monitor, a connected blog site, a document or a memory of the assistant, and you can ask privacy@aigrow.gg for a copy of the rest.

When the Services end, or at any time on your written request to privacy@aigrow.gg, we return or delete Customer Personal Data within a reasonable time, at your choice, unless the law requires us to keep it. We confirm the deletion in writing if you ask. If you make no request, we delete Customer Personal Data when we no longer need it to provide the Services, as the Privacy Policy describes.

Data we must keep by law remains protected by this DPA and is processed only for the purpose that requires it.

11. Information and audits

We make available to you the information necessary to demonstrate compliance with Article 28 of the GDPR. We do this first in writing: through this DPA, our security page and written answers to your reasonable questions about our processing. We do not hold third-party certifications such as SOC 2 or ISO 27001.

An inspection takes place only where Data Protection Law or a supervisory authority requires one and the written information does not satisfy that requirement. In that case:

• you give us reasonable prior written notice and agree the scope, timing and duration with us;
• it is carried out by you or an independent auditor bound by confidentiality who is not our competitor;
• it takes place during business hours, avoids disruption to the Services and gives no access to other customers’ data or to our confidential information beyond what the inspection needs;
• you bear its costs, including ours;
• it happens at most once a year, unless a supervisory authority requires more.

Audits under the SCCs are carried out in the same way, to the extent the SCCs allow.

12. International transfers

We process Customer Personal Data in the United States and in Germany, and you authorise transfers to those countries and to the locations of our Sub-processors.

Transfers subject to the GDPR

Where Customer Personal Data subject to the GDPR is transferred to us, or by us to a Sub-processor, in a country without an adequacy decision, the SCCs are incorporated into this DPA by reference: Module 2 where you are a controller and Module 3 where you are a processor. You are the data exporter and we are the data importer. For the SCCs:

• the docking clause in Clause 7 applies;
• in Clause 9, option 2 applies, with the notice period set out in the section on Sub-processors;
• the optional wording in Clause 11 does not apply;
• in Clause 13, the competent supervisory authority is determined as Clause 13(a) provides;
• in Clauses 17 and 18, the law and courts of Ireland apply;
• Annex I is completed by the parties named in this DPA and the annex on processing details, Annex II by the security measures in this DPA, and Annex III by the list of Sub-processors available on request.

Where you are an agency acting for your clients, a client that is a controller may accede to the SCCs under Clause 7 by written notice to privacy@aigrow.gg, with your agreement.

United Kingdom. For transfers subject to the UK GDPR, the UK Addendum is incorporated by reference. Table 1 is completed with the parties’ details in this DPA, Table 2 by the SCCs as set out above, and Table 3 by the annexes of this DPA. In Table 4, the importer may end the UK Addendum as its Section 19 allows.

Switzerland. For transfers subject to the FADP, the SCCs apply with these changes: the Federal Data Protection and Information Commissioner is the competent supervisory authority, references to the GDPR are read as references to the FADP, and data subjects in Switzerland may bring proceedings where they habitually reside.

Where a recipient is certified under the EU-US Data Privacy Framework, or its UK or Swiss extension, we may rely on that certification instead. If a transfer mechanism is replaced or ceases to be valid, we may adopt another lawful mechanism and will tell you.

If the SCCs or the UK Addendum conflict with this DPA, they prevail for the transfers they cover.

13. Liability

To the extent the law allows, each party’s liability arising out of or relating to this DPA, including the SCCs, is subject to the limitations and exclusions of liability in the Terms of Service. Those limits apply to the Agreement and this DPA together, not separately.

Nothing in this DPA limits liability to data subjects under the SCCs, or any liability that cannot be limited under the applicable law.

To the extent the law allows, you will indemnify us against third-party claims, fines and costs arising from processing carried out on your instructions where those instructions, or the data you provided, infringed Data Protection Law.

14. Term, precedence and changes

This DPA lasts as long as we process Customer Personal Data. It survives the end of the Agreement until that data is returned or deleted.

If documents conflict, this order applies: an order or written agreement signed by both parties, then the Service Terms for the product concerned, then this DPA on matters of data protection, then the Terms, then our other policies. The SCCs and the UK Addendum prevail as the section on international transfers states. Mandatory law prevails over all of them.

We may update this DPA, for example to reflect changes in the law or in our Sub-processors. We will give you at least 30 days’ notice by email of any change that materially reduces the protection of Customer Personal Data. No change reduces the protection Data Protection Law requires.

This DPA is governed by the law that governs the Terms, except that the SCCs are governed by the law their clauses specify. If you need a countersigned copy for your records, write to legal@aigrow.gg.

15. Annex: processing details

This annex describes the processing for the purposes of Article 28(3) of the GDPR and Annex I of the SCCs.

16. Annex: Sub-processor categories

These are the categories of Sub-processors that may process Customer Personal Data, with their locations. The current list of named Sub-processors is available on request from privacy@aigrow.gg.