Data Processing Addendum

Growify Inc., 236 Lessin Ln, Unit A, Austin, TX 78731
Notice: support@growify.ai

This Data Processing Addendum (“DPA”) forms part of the Agreement between Growify Inc. (“Growify”) and the customer identified in the Agreement (“Customer”). It applies only to the extent Growify Processes Customer Personal Data as a processor (or service provider / contractor) on Customer’s behalf.

This is Growify’s online DPA. It is accepted by the required checkbox at signup (or in-product). No wet-ink signature is required for online acceptance. For electronic acceptance, Customer is the legal person associated with the Growify account, the account email is the contact unless Customer specifies otherwise, and Growify will record the DPA version, Terms version, timestamp, account identifier, and accepting user. The signed execution copy of this version contains the same processor terms.

This DPA is not a warranty that Customer’s use of the Services is lawful.

Commercial terms follow the Agreement (Ohio law / JAMS as applicable), which means any Customer Terms and Conditions / order form, or otherwise Growify’s Terms of Service.

1. Agreement; order of precedence

“Agreement” means (a) any Customer Terms and Conditions, order form, or other written services agreement between Customer and Growify covering the Services; or (b) if none, Growify’s Terms of Service at https://growify.ai/terms-conditions/ (or a successor URL), as updated from time to time.

If there is a conflict:

• Processing. This DPA controls on the Processing of Customer Personal Data.
• Commercial terms. The Agreement controls on fees, taxes, term, termination, refunds, warranties, limitation of liability, indemnification (except Section 4 of this DPA, which is in addition to the Agreement), dispute resolution, and all other commercial terms.

This DPA does not expand Growify’s liability, create a refund right, or create a warranty beyond the Agreement.

2. Definitions

“Account Data” means data about Customer’s Growify account and use of the Growify application, including account user identity and authentication data, billing and subscription data, support communications, security and application logs, and Growify’s product-analytics events about use of the Growify application. Growify is independent controller of Account Data (and processes it under Growify’s Privacy Policy and the Agreement). This DPA does not apply to Account Data.

“Customer Personal Data” means Personal Data that Customer (or a party acting for Customer) submits to the Services, or that the Services collect on Customer’s Instruction through PowerPixel, the Growify Shopify app / web pixel, GTM or other tags, conversion or lead events, or connected store/ad/email accounts, in each case to provide the Services to Customer. It includes shopper, visitor, and lead data such as identifiers, contact details Customer causes to be sent, order/product/lead event data, device and usage data, IP address, cookies and similar identifiers, and attribution parameters.

“Data Protection Law” means GDPR, UK GDPR, Swiss FADP, US State Privacy Laws (including the CCPA as amended by the CPRA), and other privacy, data-protection, or ePrivacy / cookie laws applicable to the Processing under this DPA.

“Instruction” means Customer’s documented instructions to Process Customer Personal Data, consisting of: (i) the Agreement and this DPA; (ii) Customer’s configuration and use of the Services (including installing or firing PowerPixel or the Shopify web pixel, GTM/tag setup, conversion and lead payloads, CAPI or integration toggles, and connected Third-Party Destinations); and (iii) other written instructions consistent with the Agreement.

“Personal Data Breach” means a breach of Growify’s security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data in Growify’s possession.

“Services” means Growify’s hosted marketing attribution, analytics, customer-journey, reporting, and related features provided under the Agreement, including PowerPixel, the Shopify app pixel, dashboards, and optional AI features Customer uses.

“Subprocessor” means a third party engaged by Growify to Process Customer Personal Data on Growify’s behalf in providing the Services. Third-Party Destinations are not Subprocessors.

“Third-Party Destination” means a product or platform Customer connects, authorizes, or instructs Growify to send data to or pull data from, including Meta (including Meta Pixel / CAPI), Google, Shopify, Klaviyo, and similar advertising, commerce, or messaging tools.

Other capitalized terms have the meaning in the Agreement or, if used here, GDPR-equivalent meaning (including “Controller,” “Processor,” “Process,” “Personal Data,” and “Data Subject”).

3. Roles and Instructions

(a) For Customer Personal Data, Customer is Controller (and “business” under US State Privacy Laws). Growify is Processor (and “service provider” / “contractor” where those laws use those terms).

(b) Growify will Process Customer Personal Data only: (i) to provide, secure, and support the Services; (ii) to comply with this DPA and the Agreement; and (iii) in accordance with Customer’s Instructions. Growify will notify Customer if, in Growify’s reasonable opinion, an Instruction infringes Data Protection Law. Growify is not required to follow an unlawful Instruction.

(c) Customer alone determines whether to deploy tracking, on which properties, which events and fields to send (including email, name, phone, order IDs, product data, and hashed or plaintext identifiers), when tags fire, and which Third-Party Destinations to enable. Growify does not independently decide those matters and is not required to inspect, correct, or filter Customer Personal Data except as needed to operate or secure the Services.

(d) Installing PowerPixel, installing the Growify Shopify app, publishing a GTM/container tag, calling grp(“conversion”) / grp(“lead-generated”) or equivalent, enabling CAPI, or connecting an integration is an Instruction.

4. Customer responsibilities and indemnity

Customer is solely responsible for:

• configuration of pixels, SDKs, tags, GTM, Shopify Customer Events / web pixels, conversion and lead events, and related scripts;
• determining what data is collected and transmitted to Growify;
• providing privacy notices to Data Subjects;
• cookie / ePrivacy / similar device-access compliance, including whether and when tags may fire;
• lawful basis and any required consents before Customer Personal Data is collected or sent to Growify or a Third-Party Destination;
• Customer’s websites, apps, checkout (including Shop Pay and other third-party checkouts), advertising, and marketing practices;
• integrations and Third-Party Destinations, including Customer’s contracts and settings with those parties;
• compliance with laws applicable to Customer’s collection and use of the data; and
• not submitting children’s data (under 16 where GDPR Article 8 applies, otherwise under 13), payment card PAN/CVV, government identity numbers, or special categories of personal data within the meaning of Article 9 GDPR, unless the parties agree in a signed writing.

Customer will defend, indemnify, and hold harmless Growify and its officers, directors, employees, and agents from claims, investigations, fines, and proceedings (including privacy, cookie, ePrivacy, CIPA / similar wiretap, GDPR, and US State Privacy Law claims) arising out of: (i) Customer’s breach of this Section 4; (ii) Customer’s Instructions; (iii) Customer’s failure to provide notice or obtain a valid lawful basis or consent; (iv) data Customer submits or causes to be collected; or (v) a Third-Party Destination’s Processing after Customer instructs transmission to, or authorizes access from, that destination.

This indemnity is in addition to Customer’s indemnification obligations in the Agreement. It does not require Growify to indemnify Customer, and it does not make Growify liable for Customer’s Controller obligations.

Nothing in this DPA excludes Growify’s liability for Growify’s own material breach of this DPA, Growify’s unlawful Processing of Customer Personal Data contrary to Customer’s lawful Instructions, or liability that cannot be limited under applicable law. Growify is not liable to Customer for a Data Subject or regulator claim to the extent Growify Processed Customer Personal Data in accordance with Customer’s Instructions.

5. Growify processor obligations

Taking into account the nature of the Processing and the information available to Growify, Growify will:

• Process Customer Personal Data only on documented Instructions, unless required otherwise by law (and will notify Customer if legally permitted);
• ensure persons it authorizes to Process Customer Personal Data are bound by confidentiality;
• implement the measures in Annex II;
• use Subprocessors only as Section 7;
• provide reasonable assistance, insofar as technically feasible through the Services, for Customer to respond to Data Subject requests. If Growify receives a request that identifies Customer, Growify will forward it to Customer’s account email and will not act as Controller;
• provide reasonable assistance with Customer’s security, breach-notification, DPIA, and prior-consultation obligations, limited to information Growify actually has. Growify may charge a reasonable fee for assistance beyond ordinary operation of the Services;
• upon Customer’s written request while Customer’s account remains available, provide a reasonable export of Customer Personal Data then available to Growify. After the Agreement ends, or after ordinary offboarding, Growify will delete Customer Personal Data in its production environment within 90 days, except copies remaining in backup systems until the next ordinary deletion cycle (which Growify will put beyond operational use), retention required or authorized by law, and retention needed to resolve a dispute. Deletion is initiated on written request or as part of Growify’s ordinary offboarding after termination. Growify is not obligated to return data in a custom format, or to provide an export after Customer Personal Data has been deleted as this Section; and
• make available information reasonably necessary to demonstrate this DPA, and allow audits as Section 9.

Growify will maintain records of its Processing of Customer Personal Data to the extent required by Article 30(2) GDPR.

Growify is not Customer’s data protection officer and does not determine whether the Services meet Customer’s legal obligations.

6. US State Privacy Laws

Where US State Privacy Laws apply and Growify acts as service provider/contractor, Growify will not: (a) sell or share Customer Personal Data; (b) retain, use, or disclose it except for the specific business purposes in Annex I, or as those laws otherwise permit; (c) retain, use, or disclose it outside the direct business relationship except to provide the Services or comply with law; or (d) combine it with personal information received from another person or from Growify’s own interactions with a consumer, except as needed to provide the Services (including identity resolution, attribution, and journey features) or as those laws allow.

Growify certifies that it understands these restrictions and will comply. Growify will notify Customer if it determines it can no longer meet its CCPA obligations. Customer may take reasonable steps consistent with Section 9 to stop or remediate unauthorized use.

Customer’s Instruction to transmit data to a Third-Party Destination is not a “sale” or “share” by Growify. Customer is solely responsible for whether that disclosure is a sale, share, or other regulated disclosure by Customer.

7. Subprocessors

Customer gives general written authorization for Growify to use the Subprocessors in Annex III and to appoint new Subprocessors. Growify will impose written terms on each Subprocessor that are no less protective of Customer Personal Data than this DPA, to the extent applicable to the subcontracted service. Growify remains responsible for Subprocessor acts as for its own, subject to the Agreement’s limitations of liability.

Growify will update Annex III (or a URL Growify designates) at least 30 days before a new Subprocessor Processes Customer Personal Data. Customer may object on reasonable data-protection grounds within 30 days. Growify will use commercially reasonable efforts to avoid that Subprocessor for Customer. If it cannot, Customer’s sole remedy is to terminate the affected Services in accordance with the Agreement. This DPA does not create a refund, credit, or termination right beyond the Agreement.

8. Third-Party Destinations

When Customer instructs Growify to transmit Customer Personal Data to a Third-Party Destination, or to retrieve data from one using Customer’s credentials, that party Processes the data under Customer’s relationship with that party.

Growify is not responsible for that destination’s subsequent collection, use, retention, disclosure, profiling, advertising, matching, or other Processing. Growify does not control Meta, Google, Shopify, Klaviyo, or similar platforms.

Examples of Instructions (non-exhaustive): enabling Meta CAPI or a Meta Pixel ID; the Shopify web pixel sending events to Meta; connecting Google Ads, Shopify, or Klaviyo; Customer’s browser or server sending events to those platforms.

Customer must have a lawful basis and any contract required by Data Protection Law with each Third-Party Destination. Those parties are not Growify Subprocessors.

9. Breach notice; audits

Growify will notify Customer without undue delay, and where GDPR/UK GDPR applies within 72 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data, at Customer’s account email. Notice will include, to the extent then known: nature of the incident; categories and approximate numbers of Data Subjects and records; likely consequences; and measures taken or proposed. Notice is not an admission of fault. Growify notifies Customer, not Data Subjects or regulators, unless law requires otherwise.

Upon written request, Growify will make available information reasonably necessary to demonstrate compliance with this DPA. For routine requests, no more than once per 12 months, Growify may satisfy this obligation by providing any third-party security reports or certifications it then maintains (if any) and/or completing a reasonable written security questionnaire.

Additional audits, including inspections, may be conducted if: (a) required by Data Protection Law or a supervisory authority; (b) following a Personal Data Breach affecting Customer Personal Data; or (c) Customer has a reasonable, documented suspicion of Growify’s material non-compliance with this DPA. On-site or invasive audits are a last resort if the information provided is insufficient to demonstrate compliance. They require reasonable prior written notice, agreed scope, duration, and confidentiality, may not unreasonably interfere with operations or expose other customers’ data, and (unless the audit confirms Growify’s material breach of this DPA) Customer pays Growify’s reasonable costs.

10. International transfers

Customer authorizes Processing in the United States and other countries where Growify or Subprocessors operate.

For transfers from the EEA, UK, or Switzerland that require a transfer tool:

• EU SCCs. EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) Module 2 (Controller → Processor) are incorporated. Clause 7 (docking) does not apply. Clause 9 Option 2 (general authorization), 30 days. Clause 11 optional redress does not apply. Clause 17 Option 1: laws of the Netherlands. Clause 18: courts of the Netherlands. Annexes I–III of the SCCs are Annexes I–III of this DPA. Customer is exporter; Growify is importer.
• UK Addendum. The UK Addendum (ICO, to the EU SCCs) is incorporated, completed using the EU SCCs as configured above. Customer is exporter; Growify is importer.
• Swiss transfers. The EU SCCs apply as above, reading GDPR/Member State as the Swiss FADP and Switzerland, with the FDPIC as competent authority where required.

If Growify is self-certified under the EU-US / UK / Swiss Data Privacy Framework and that mechanism remains lawful, it applies first; otherwise the SCCs / UK Addendum apply. The SCCs prevail over this DPA only for that transfer.

Growify does not represent that it is DPF-certified unless it says so on a then-current public certification list.

Where a transfer tool is required, the parties rely on the SCCs (and UK Addendum / Swiss adaptations) as configured in this Section. Growify will notify Customer if it determines it can no longer comply with those clauses. Taking into account the information available to Growify, Growify will provide reasonable cooperation with Customer’s transfer risk assessment by sharing information Growify actually has about its Processing and Subprocessors. Growify is not required to disclose other customers’ data, legally privileged material, or information it is prohibited from disclosing. Growify does not warrant that the laws of the United States or any other third country provide equivalent protection to GDPR, and does not represent that it maintains supplementary measures beyond Annex II. Customer is responsible for determining whether the Services are appropriate for Customer’s transfers.

11. De-identified and aggregated data

Growify may create de-identified or aggregated data from Processing under the Agreement and use it to operate, secure, and improve the Services, provided Growify does not attempt to re-identify a Data Subject from that de-identified or aggregated data and does not disclose Customer-identifiable Customer Personal Data except as this DPA or the Agreement allows. This is consistent with the Agreement’s terms on derivative and aggregated use of User Content, and does not convert Account Data into Customer Personal Data.

12. Liability

Each party’s liability arising out of this DPA, the SCCs, the UK Addendum, and any related privacy or security terms is subject to the limitations of liability, exclusions of damages, disclaimers, and exclusive remedies in the Agreement. Any reference in the Agreement to a party’s liability includes liability under this DPA.

This DPA does not create uncapped liability, a separate damages cap, a service-level credit, or a refund. If the Agreement includes a monetary cap (including the cap in the Terms of Service, currently US $200, unless Customer Terms and Conditions state otherwise), that cap applies to this DPA.

Nothing in this Section limits: (a) Customer’s payment obligations; (b) Customer’s indemnification obligations; (c) liability that cannot be limited under applicable law; or (d) a Data Subject’s statutory rights against a party. As between the parties, Customer remains responsible for Controller-side claims as set out in Section 4.

13. Term; miscellaneous

This DPA lasts for the Agreement term and until Customer Personal Data is deleted as Section 5. This DPA may be accepted (a) by signature of an execution copy, or (b) by Customer’s required electronic acceptance in the Growify application (including a required signup checkbox). For electronic acceptance, Customer is the legal person associated with the Growify account, the account email is the contact unless Customer specifies otherwise, and Growify will record the DPA version, Terms version, timestamp, account identifier, and accepting user.

Growify may update this DPA by posting a revised version and providing notice to Customer’s account email (or the notice email in an execution copy). The updated DPA applies on the stated effective date. If Customer has signed an execution copy, that copy remains in effect until Customer signs a replacement or accepts a later version (including by a required checkbox in the Growify application). This Section does not create a refund or termination right beyond the Agreement.

Notices to Growify: support@growify.ai. Governing law, venue, and arbitration follow the Agreement (Terms of Service: Ohio law; Franklin County, Ohio; JAMS arbitration, except as the SCCs specify for SCC disputes). No third-party beneficiaries except Data Subjects to the extent Data Protection Law or the SCCs require. If a provision is unenforceable, the rest remains in effect. This DPA supersedes prior DPAs on Customer Personal Data, except that a signed execution copy remains in effect as stated in this Section.

Annex I – Description of Processing

This Annex completes Annex I of the EU Standard Contractual Clauses (I.A list of parties, I.B description of transfer, and I.C competent supervisory authority).

I.A List of parties

Importer (Growify): Growify Inc., 236 Lessin Ln, Unit A, Austin, TX 78731. Contact: support@growify.ai. Role: Processor. Activities: providing the Services.

Exporter (Customer): The legal person associated with the Growify account that accepted this DPA. Contact: the email address of that account, unless Customer has specified another notice email. Role: Controller. Activities: determining the purposes and means of Processing Customer Personal Data and using the Services.

I.B Description of transfer

• Subject matter: Hosted attribution, analytics, journey, reporting, and related Services.
• Duration: Agreement term, then deletion as Section 5.
• Nature: Collection (PowerPixel; Shopify app / web pixel; GTM or Customer-fired conversion/lead events; APIs Customer connects), storage, matching, analysis, display to Customer, optional AI querying Customer enables, and transmission to Third-Party Destinations Customer enables.
• Business purposes: Provide the Services: visit and conversion tracking; identity resolution and attribution; dashboards and reports; optional AI assistance; security and support.
• Data Subjects: Visitors, leads, and customers of Customer’s sites, stores, and campaigns; individuals whose data Customer causes to be submitted. Not visitors of growify.ai as such (Growify Privacy Policy).
• Personal Data (typical; Customer controls fields): Identifiers and contact data Customer sends (e.g. name, email); order, product, and lead-event data; cookie and device identifiers (including Growify visitor IDs); Google/Meta browser or click IDs if present on Customer’s site; IP address; URL, referrer, user agent; and UTM / Growify tracking parameters.
• Special categories (Art. 9 GDPR): Not intended. Customer shall not submit special categories of personal data within the meaning of Article 9 GDPR unless the parties agree in a signed writing.
• Frequency: Continuous during use of the Services.
• Customer rights: Access via the Services; export of Customer Personal Data upon Customer’s written request while the account remains available; instruct deletion per this DPA; audit per Section 9.

I.C Competent supervisory authority

The competent supervisory authority is determined in accordance with Clause 13 of the SCCs, being the supervisory authority of the Member State where the data exporter (Customer) is established. If Customer is not established in the EEA, Clause 13 applies as stated in the SCCs. This DPA does not designate a particular authority in advance.

Annex II – Security measures

This Annex also completes Annex II of the EU Standard Contractual Clauses.

Growify maintains administrative, technical, and organizational measures appropriate to the risk of this Processing, including: access control on a need-to-know basis; authentication for production access; TLS for Service interfaces in transit; hosting on reputable cloud infrastructure; logging and monitoring of production systems; personnel confidentiality obligations; and backup of core production data. Growify hosts Customer Personal Data with the Subprocessors in Annex III.

Growify does not warrant that Processing is invulnerable, that unauthorized access will never occur, or that any particular certification (including SOC or ISO) is maintained, unless Growify has provided a then-current report under Section 9. Security measures may change if the overall level of security is not materially reduced. Customer is responsible for its accounts, credentials, tokens, and tag implementations.

This Annex is a description of measures, not an extra warranty. The Agreement’s “as is” / security disclaimers apply.

Annex III – Subprocessors

Vendors that Process Customer Personal Data on Growify’s behalf. This Annex also completes Annex III of the EU Standard Contractual Clauses.

• Google LLC (Google Cloud) – United States – Pixel ingest, warehouse, identity store, and pixel-script hosting
• DigitalOcean, LLC – United States – Application database, ETL database, and ETL compute
• Amazon Web Services, Inc. – United States – Application hosting (including Elastic Beanstalk), object storage, and CDN (including pixel CDN, UI/assets, and ETL/forecast files)
• OpenAI, LLC – United States – AI Assistant, report insights, and related AI features, when Customer uses them (may include Customer Personal Data returned by those features, e.g. customer-list fields)

Not Subprocessors: Meta, Google Ads, Shopify, Klaviyo, and other Third-Party Destinations (Section 8). Stripe, SendGrid, Mixpanel, and Intercom Process Account Data as Growify’s service providers for billing, transactional email, and Growify-app analytics/support, not as processors of Customer Personal Data under this DPA.