DATA PROCESSING AGREEMENT (DPA)

Version: v1.1.0

Effective Date: May 4, 2026

LANGUAGE NOTICE: This English version is the legally binding version. Translations are for reference only. In case of conflict, the English version prevails.

PARTIES

Data Processor: Global Modern Services ("GrowGRC"), 5204 NW 103 AVE. DORAL, FL 33178, USA

Data Controller: The Customer entity identified in the GrowGRC account ("Customer")

RECITALS

This Data Processing Agreement ("DPA") supplements the GrowGRC Terms of Service and governs the processing of Personal Data by Global Modern Services on behalf of the Customer in connection with the GrowGRC SaaS platform.

Order of Precedence: In case of conflict between documents, the following order applies:

1. This DPA

2. GrowGRC Terms of Service

3. Privacy Policy

4. Any other policies or agreements

1. DEFINITIONS

"Personal Data" means any information relating to an identified or identifiable natural person ("data subject") as defined under applicable data protection law, including GDPR, CCPA/CPRA, LGPD, and equivalent regulations.

"Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.

"Data Controller" means the Customer who determines the purposes and means of processing Personal Data.

"Data Processor" means Global Modern Services, which processes Personal Data on behalf of the Customer.

"Sub-processor" means any third party engaged by GrowGRC to assist in processing Personal Data.

"Supervisory Authority" means any data protection authority with jurisdiction over the parties.

"Security Incident" means any confirmed or reasonably suspected unauthorized access, disclosure, alteration, or destruction of Personal Data.

2. SCOPE AND NATURE OF PROCESSING

2.1 Subject Matter

GrowGRC processes Personal Data solely to provide the GRC SaaS platform services as described in the Terms of Service.

2.2 Instructions

GrowGRC shall process Personal Data only:

(a) In accordance with Customer's documented instructions;

(b) As necessary to provide the Service;

If GrowGRC believes an instruction violates applicable data protection law, it shall promptly notify Customer.

2.3 Nature of Processing Operations

Depending on Customer's use, processing may include:

Storage and organization of GRC data
Structured analysis and risk visualization
Automated GRC workflow processing
Report generation and audit support
System monitoring and security operations
AI-assisted analysis and content generation (see Section 6)

2.4 Categories of Personal Data

Depending on Customer's use, may include:

Employee and user identifiers (names, emails, roles)
Vendor and third-party contact data
Operational risk and control data
Compliance and audit records
System metadata and access logs

2.5 Duration

This DPA remains in effect for the duration of the Customer's use of GrowGRC services and until all Personal Data is deleted or returned per Section 12.

3. CUSTOMER OBLIGATIONS

Customer represents and warrants that:

(a) It has a valid legal basis for processing Personal Data and transferring it to GrowGRC;

(b) It has provided all necessary notices and obtained all required consents from data subjects;

(d) It will not instruct GrowGRC to process Personal Data in a manner that violates applicable law.

4. CONFIDENTIALITY

GrowGRC ensures that all personnel authorized to process Personal Data are subject to binding confidentiality obligations and access Personal Data only on a need-to-know basis. These obligations survive termination of employment or engagement.

5. SECURITY MEASURES

GrowGRC implements and maintains appropriate technical and organizational measures to protect Personal Data, including:

Encryption: Data encrypted in transit (TLS 1.2+) and at rest (AES-256 or equivalent)
Access Control: Role-based access control (RBAC) with multi-tenant data segregation
Monitoring: Security monitoring, intrusion detection, and anomaly alerting
Backup: Regular encrypted backups with integrity verification
Vulnerability Management: Periodic security assessments and patch management

These measures are aligned with ISO 27001, SOC 2, and NIST Cybersecurity Framework principles. GrowGRC may update security measures over time to maintain an appropriate level of protection.

6. SUB-PROCESSORS

6.1 Authorization

Customer hereby authorizes GrowGRC to engage sub-processors necessary for providing the Service. GrowGRC maintains a current list of sub-processors, including:

| Category | Examples (non-exhaustive) |

| Cloud Infrastructure & Hosting | Cloud service providers |

| Database Services | Managed database providers |

| Payment Processing & MoR | Paddle.com Market Ltd |

| Security & Monitoring | Security tooling providers |

| Communication Services | Email and notification providers |

| Artificial Intelligence Services | Large language model providers, AI analysis platforms, automated classification and content generation services |

| Customer Support | Help desk and ticketing platforms |

6.2 AI Sub-processors – Special Disclosure

GrowGRC may utilize Artificial Intelligence and Machine Learning services, including large language models (LLMs), from third-party providers to enhance platform functionality, including risk classification, content generation, and automated analysis. GrowGRC does not name specific AI providers in this DPA to preserve flexibility as the AI landscape evolves. Customer acknowledges and authorizes this category of processing.

Customer data processed by AI services is subject to data minimization principles — GrowGRC uses the minimum data necessary for AI-assisted functions.

6.3 Sub-processor Obligations

All sub-processors are bound by contractual data protection obligations equivalent to those in this DPA.

6.4 Changes to Sub-processors

GrowGRC will notify Customers of material changes to sub-processors with reasonable advance notice. Customer may object in writing; if the parties cannot resolve the objection, Customer may terminate the Service.

7. INTERNATIONAL DATA TRANSFERS

7.1 Transfer Mechanisms

Personal Data may be transferred to and processed in countries outside the Customer's jurisdiction, including the United States and countries where sub-processors operate. GrowGRC ensures such transfers are protected by:

(a) Standard Contractual Clauses (SCCs): EU Commission-approved SCCs for transfers from the EEA;

(b) UK Addendum: For transfers from the United Kingdom;

(d) Other lawful mechanisms as applicable under relevant data protection law.

7.2 US-Based Processing

GrowGRC is operated from the United States. By using the Service, Customer acknowledges and consents to the transfer and processing of Personal Data in the USA and other jurisdictions where GrowGRC or its sub-processors operate.

8. DATA SUBJECT RIGHTS

GrowGRC shall assist Customer, to the extent technically and commercially reasonable, in fulfilling data subject rights requests under applicable law, including:

Right of access (Art. 15 GDPR / CCPA right to know)
Right to rectification (Art. 16 GDPR)
Right to erasure / deletion (Art. 17 GDPR / CCPA right to delete)
Right to data portability (Art. 20 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to object (Art. 21 GDPR)

Customer is responsible for receiving and validating data subject requests. GrowGRC will provide reasonable cooperation at Customer's cost if extraordinary effort is required.

9. DATA PROTECTION IMPACT ASSESSMENTS

GrowGRC shall provide reasonable cooperation and information to assist Customer in conducting data protection impact assessments (DPIAs) or equivalent assessments required by applicable law.

10. SECURITY INCIDENTS

10.1 Notification

Upon becoming aware of a confirmed Security Incident affecting Customer's Personal Data, GrowGRC shall notify Customer without undue delay and, where feasible, within 72 hours of becoming aware — consistent with GDPR Article 33 requirements and applicable breach notification laws.

10.2 Notification Content

GrowGRC's notification shall include, to the extent available:

(a) Nature and scope of the incident;

(b) Categories and approximate number of data subjects affected;

(d) Measures taken or proposed to address the incident.

10.3 Responsibility

GrowGRC's notification of a Security Incident does not constitute an admission of fault or liability.

11. AUDIT RIGHTS

Customer may, with reasonable advance written notice (minimum 30 days) and no more than once per calendar year, request:

(a) GrowGRC's written responses to a security questionnaire; or

(b) A third-party audit report (e.g., SOC 2 Type II) subject to applicable confidentiality obligations.

Physical audits of GrowGRC infrastructure require mutual written agreement and occur at Customer's expense.

12. DATA RETURN AND DELETION

Upon termination of the Agreement, GrowGRC shall, at Customer's written election:

(a) Return Customer Data in a standard machine-readable format within 30 days; or

(b) Delete Customer Data within 30 days and certify deletion upon request.

GrowGRC may retain Customer Data for a commercially reasonable period not to exceed twenty-four (24) months after termination, unless a longer retention period is required by applicable law. Data retained solely for legal compliance purposes shall remain subject to the obligations of this DPA.

13. LIABILITY

GrowGRC's liability under this DPA is subject to the limitations set forth in the Terms of Service. Each party is liable for its own violations of applicable data protection law.

14. CONTACT AND DPO

For data protection inquiries or to exercise rights under this DPA:

Global Modern Services — Data Protection

5204 NW 103 AVE. DORAL, FL 33178, USA

Email: legal@growgrc.app