Data Processing Agreement

Last updated: August 15, 2026

This Data Processing Agreement ("DPA") forms part of the Terms and Conditions between you ("Customer", the controller) and DefoAI UG (haftungsbeschränkt) ("Growomat", "we", the processor). You accept this DPA when you accept the Terms; no separate signature is required. It applies to every customer on every plan.

1. Roles and scope

For personal data you send to the Service, or which the Service collects on your instructions, you are the controller and we are the processor. This includes, in particular, the conversion and customer data you send us for advertising measurement, and the data we retrieve from advertising platforms on your behalf.

For our own account, billing and security data we are the controller, and that processing is described in our Privacy Policy rather than here.

This DPA is written to satisfy Article 28 of the EU General Data Protection Regulation and of the UK GDPR as retained in UK law. Where this DPA and the Terms conflict on data protection, this DPA prevails.

2. Subject matter, duration, nature and purpose

• Subject matter: provision of the Service — campaign management, synchronization with advertising platforms, conversion measurement and reporting.
• Duration: for as long as your account is active, plus any retention period stated in section 8.
• Nature and purpose: storage, organization, retrieval, transmission to the advertising platforms you connect, and analysis for the reporting features you use.
• Types of personal data: identifiers you supply for conversion matching (such as hashed email addresses, click identifiers and order references), business contact details of your own users, and technical data such as IP addresses and device identifiers where a platform requires them for measurement.
• Categories of data subjects: your customers and prospects, and your own personnel who use the Service.

We do not require or want special categories of personal data (Article 9) and you must not send them to the Service.

3. Our obligations

• We process personal data only on your documented instructions, which include your use of the Service's features and settings. If we believe an instruction breaches applicable data protection law, we will tell you.
• We ensure that the people authorized to process personal data are bound by confidentiality.
• We implement appropriate technical and organizational measures (section 6).
• We assist you, taking into account the nature of the processing, with data subject requests and with your obligations under Articles 32 to 36.
• We make available the information necessary to demonstrate compliance with Article 28 and allow for audits as described in section 7.

4. Sub-processors

You give general authorization for us to engage the sub-processors listed below. We impose data protection obligations on each of them that are no less protective than those in this DPA, and we remain liable to you for their performance.

We will give at least 30 days' notice, by email to your account address, before adding or replacing a sub-processor. If you reasonably object on data protection grounds within that period, you may terminate the affected part of the Service without penalty for the remainder of your paid term.

The advertising platforms you choose to connect — Google Ads, Microsoft Advertising, Meta Ads and Reddit Ads — are not our sub-processors. You have your own relationship and your own terms with each of them, and when the Service sends data to a platform on your instruction, that platform acts as an independent controller or as your processor under your agreement with it, not under this DPA.

5. International transfers

Where a sub-processor listed above processes personal data outside the EEA or the UK, the transfer is made under the European Commission's Standard Contractual Clauses (Decision 2021/914), together with the UK Information Commissioner's International Data Transfer Addendum where UK data is involved, and supplemented by the technical measures in section 6.

6. Security measures

• Encryption of data in transit (TLS) between you, the Service, and every sub-processor and advertising platform.
• Advertising platform credentials and API tokens are stored encrypted and are never exposed to your browser or to any report.
• Identifiers used for conversion matching are hashed before transmission where the receiving platform's specification requires it.
• Access to production systems is restricted to personnel who need it, authenticated individually.
• Segregation of customer data by account and workspace at the storage layer.
• Logging of administrative and data-affecting actions, retained for a limited period for security and support purposes.

7. Audits

On reasonable written request, and no more than once in any twelve-month period unless required by a supervisory authority, we will provide the information reasonably necessary to demonstrate compliance with this DPA. Where an on-site audit is legally required, the parties will agree its scope and timing in advance, and you will bear its cost unless it reveals a material breach by us.

8. Deletion and return

You may export your data from the Service at any time. On termination, we delete or return personal data processed on your behalf within 90 days, except where retention is required by law — for example billing records — in which case we retain only what the law requires and continue to protect it under this DPA.

9. Personal data breaches

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting personal data processed on your behalf, and will provide the information you need for your own notification obligations as it becomes available.

10. Liability

The limitations of liability in the Terms apply to this DPA, except where applicable data protection law does not permit them to.

11. Contact

Data protection enquiries, including sub-processor objections and audit requests:

DefoAI UG (haftungsbeschränkt)
Wiltinger Straße 11
13465 Berlin, Germany
[email protected]