1. Parties, formation and scope

This proposed Data Processing Agreement (the “DPA”) is intended to be entered into between Media&Business Consulting Kft., registered at 1037 Budapest, Harang utca 12., Hungary, company registration number 01-09-989825, Hungarian tax number 24086844-2-41, operating the Growwwy service (the “Processor”), and the business customer identified in the relevant subscription or signed order form (the “Customer” or “Controller”, as applicable).

The DPA applies only where the Processor handles Customer Personal Data on behalf of the Customer through the Growwwy marketing intelligence, data connector and MCP services. If the Customer is itself a processor on behalf of another controller (for example, an agency serving a client), the Customer represents that it has the necessary authority to appoint Growwwy as a further processor and provide the documented instructions.

Execution: A downloadable page alone does not conclude a DPA. This document takes effect only when validly executed, expressly accepted through an appropriately implemented agreement flow, or expressly incorporated into an agreed services contract. Until then, this is a contractual draft. In the event of conflict on the processing of Customer Personal Data, an executed DPA takes precedence over the general Terms & Conditions to the extent permissible by law.

For Growwwy account registration, billing, fraud prevention and direct customer support, the Service Provider may act as an independent controller. Those processing activities are governed by the Privacy Policy, not by this DPA.

2. Definitions and instructions

“Data Protection Laws” means the EU General Data Protection Regulation (Regulation (EU) 2016/679), applicable Hungarian data protection law, and other mandatory data protection requirements applying to a particular processing activity. “Customer Personal Data” means personal data provided, connected or otherwise made available to Growwwy by or on behalf of the Customer for processing under the Service.

The Processor shall process Customer Personal Data only on documented instructions from the Customer, including those specified in this DPA, the connected service configuration and authorised user requests, unless EU or Hungarian law requires otherwise. Where legally permitted, the Processor will inform the Customer before legally required processing. The Processor shall promptly inform the Customer if an instruction, in its opinion, infringes Data Protection Laws, and may suspend the affected activity pending clarification.

The Customer determines the lawful basis, purpose and suitability of its connected personal data, ensures that any required notices and permissions are in place, and limits access to authorised users and accounts. The Customer must not intentionally provide special-category data, payment card numbers or other highly sensitive records through Growwwy unless a separately assessed, authorised arrangement expressly permits it.

3. Subject matter, duration and processing activities

The subject matter, categories and purposes of processing are detailed in Annex A. Processing may include reading and analysing advertising, analytics, search, tag management and ecommerce information; obtaining authorised account metadata; connecting selected accounts and properties; producing reports; storing the minimum connection, access and operational records required to operate the Service; and exposing permitted results to an AI client chosen by the Customer.

The DPA continues while the underlying Growwwy service is provided and thereafter solely for permitted deletion, return, backup rotation and legal retention. Growwwy is intended to operate as a read-only data connector: it does not use its MCP tools to change marketing budgets, publish tags, alter store orders or modify source accounts.

4. Confidentiality and access control

The Processor shall restrict access to Customer Personal Data to personnel and contractors with a genuine need to perform contracted tasks. Such persons shall be bound by confidentiality obligations or an appropriate statutory duty of confidentiality and be subject to appropriate access authorisation and security practices.

Each Customer's connection permissions, workspace access and available reports must be isolated from other customers. Customer account roles and data-source permissions govern what each authorised user or AI connection may retrieve.

5. Security measures

The Processor shall implement appropriate technical and organisational measures under Article 32 GDPR, taking account of the nature of the processing and the risks for individuals. The measures currently expected for the Growwwy deployment are summarised in Annex B and must be validated against the production environment before this DPA is finalised.

The Processor shall periodically review the effectiveness of those measures, take reasonable steps to address identified vulnerabilities and ensure that all subprocessors providing relevant services are contractually required to provide appropriate protection.

6. Subprocessors and changes

The Customer grants general written authorisation, effective only upon the valid conclusion of this DPA, for the Processor to engage subprocessors necessary to provide the Service, subject to Article 28(2) and (4) GDPR and the maintained Subprocessors register.

The Processor shall conclude appropriate written data protection agreements with subprocessors, imposing protections materially equivalent to the obligations under this DPA, and shall remain responsible to the Customer for their performance to the extent required by law.

Proposed notice procedure, to be operationally implemented before launch: The Processor will notify the Customer's registered administrator email at least 30 calendar days before a planned addition or replacement of a subprocessor. The Customer may raise a reasoned data protection objection within 15 calendar days of notice. The parties will seek an appropriate resolution; where none is reasonably available, the Customer may terminate the affected Service before the new subprocessor begins processing, subject to applicable mandatory rights. Emergency replacement needed to prevent imminent security harm will be notified as soon as reasonably possible. These notice periods are proposed commitments and must be supported by an actual notification process before publication as final terms.

7. International transfers

Customer Personal Data may be processed in the EEA or elsewhere where authorised vendors operate. For restricted transfers outside the EEA, the Processor shall ensure an applicable Chapter V GDPR transfer mechanism (such as an adequacy decision or the EU Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914), together with any required supplementary measures and transfer impact assessment.

This DPA is an Article 28 processing agreement; it does not, by itself, execute or replace the separate international-transfer SCCs or supply their mandatory annex details. Where a transfer requires SCCs involving the Processor directly, the parties will complete and enter into the appropriate module and annexes before the transfer. The Processor shall provide reasonably available information about relevant subprocessor transfer arrangements on request.

8. Assistance to the Customer

Taking into account the nature of processing and the information available, the Processor shall provide reasonable assistance for requests to access, rectify, erase, restrict, transfer or object to processing of personal data. The Processor shall not respond to data subject requests on the Customer's behalf unless authorised or required by law, but will refer relevant requests to the Customer where practicable.

The Processor shall provide assistance, where reasonably appropriate, with security obligations, data protection impact assessments, prior consultations and data breach obligations under Articles 32–36 GDPR. Reasonable technical costs associated with extraordinary assistance may be handled in accordance with a separately agreed support arrangement, without limiting mandatory obligations.

9. Personal data breaches

The Processor shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Where information is not immediately complete, updates may be provided in stages. The Processor will provide information reasonably available about the nature and consequences of the incident, affected categories and data, containment, remediation and contact point.

The Customer remains responsible for assessing whether notification to a supervisory authority or affected individuals is required in its capacity as controller. The Processor shall cooperate with and assist that assessment. Nothing here replaces the GDPR obligations or statutory deadlines applicable to either party.

10. Return, deletion and retention

On termination or expiry, the Customer may request the return or deletion of Customer Personal Data, subject to available export functionality and the parties' documented instructions. The Processor shall delete or return such personal data and delete existing copies when no longer required, unless applicable law requires retention. Secure backup copies may remain until the relevant documented rotation cycle ends and must remain protected against ordinary access.

The precise export window, operational deletion service levels, backup retention and log-retention schedule must be verified and published before this DPA becomes binding. Billing records and other information for which the Service Provider is an independent controller are dealt with under the Privacy Policy and applicable law.

11. Information, compliance and audits

The Processor shall make available information reasonably necessary to demonstrate compliance with Article 28 GDPR and shall allow for and contribute to appropriate audits, including inspections, by the Customer or an appropriately mandated auditor, subject to reasonable confidentiality, security and scheduling safeguards.

Where practical, current third-party assurance reports and written security evidence will be considered before arranging an on-site audit. Audit arrangements shall not prevent the Customer from exercising mandatory rights under the GDPR. The Processor shall notify the Customer if an instruction is considered unlawful.

12. Customer-selected connections and AI tools

The Customer controls which Google, Meta, Shopify, BigCommerce, WooCommerce, GTM, Search Console and other supported resources it connects, subject to each external platform's terms and permissions. These external data-source platforms are not automatically appointed by Growwwy as its own subprocessors merely because the Customer connects an account.

The Customer may configure ChatGPT, Claude, Gemini or another compatible AI application to access the Growwwy MCP endpoint. Where the chosen AI provider independently receives personal data via a Customer-initiated connection, its processing terms and role must be assessed by the Customer. If Growwwy later operates its own AI inference or storage service, the Provider must reassess the arrangement and update its subprocessor register before making a claim about that processing.

13. Liability, law and changes

Each party remains subject to its respective obligations under Data Protection Laws, including liability rules that cannot be excluded by contract. The applicable service terms govern other contractual matters only to the extent they do not conflict with mandatory data protection rights.

This DPA is governed by Hungarian law, without prejudice to applicable EU data protection law. Material changes to this DPA must be notified appropriately and agreed where required; a published page update alone does not silently amend an executed data processing agreement.

Annex A — Processing specification

Annex B — Technical and organisational safeguards (verification required)

The following descriptions reflect the intended controls for the currently developed deployment and should be checked against actual infrastructure settings before final acceptance:

• Tenant access segregation: access to accounts, reports, websites and sources is constrained by authenticated workspace and explicit permissions.
• Credentials and secrets: API access credentials are handled through the existing encrypted connection store; encryption key access is restricted. Actual key rotation and recovery procedures must be documented.
• In-transit security: externally exposed service endpoints use HTTPS/TLS, with protected application-level sessions and authorisation.
• Restricted operation: Growwwy MCP tools are designed read-only for connected marketing and ecommerce systems; credential permissions should be least privilege.
• Application security: input validation, sensitive-output filtering, dependency patching and review of security logs should form part of maintenance.
• Availability and backup: encrypted state backups are maintained separately from publicly served application files; backup schedule, retention, restore tests and geographic location require operational verification.
• Monitoring and incident response: access events and relevant security incidents are logged within applicable minimisation and retention limits, with escalation and notification procedures.
• Data minimisation: aggregate or pseudonymised output is preferred where it meets the analysis purpose. Personal identifiers must not be unnecessarily exposed in reports.
• Staff and customer access: access is restricted to authorised roles, and customer-selected connections can be revoked or disabled.
• Subprocessor governance: written vendor DPAs and location/transfer assessments are maintained for each authorised subprocessor; review status appears in the Subprocessors register.

Annex C — Contact and execution

Processor: Media&Business Consulting Kft. · 1037 Budapest, Harang utca 12., Hungary · Company no. 01-09-989825 · Tax no. 24086844-2-41 · elemer@growwwsites.com.

Customer: The contracting business identified in the order form or subscription agreement; a separate acceptance record or signature should identify the authorised person, contracting entity, document version and effective date.

Status: Prepared for customer agreement and legal review. There is no representation that an electronic DPA acceptance or signed PDF already exists. The current signup's acceptance of general Terms & Conditions should not be represented as a separate executed DPA without confirming contractual incorporation and recorded assent.