Data processing agreement

This agreement forms part of the Terms of Service and specifies the obligations of the parties when handling personal data.

Controller (client): the customer.

Processor (contractor):

Zakomo FZCO
IFZA, Dubai Silicon Oasis
Dubai, United Arab Emirates

1. Subject matter and duration

1.1 The subject matter is the processing of personal data that the controller introduces in the course of using the Growmindr Platform or has collected via it.

1.2 The duration corresponds to the term of the main contract. The agreement ends automatically upon its termination; the obligations under Section 10 continue beyond that.

2. Nature, purpose and scope of the processing

2.1 Purposes: management and enrichment of contact data, creation and approval of content, planning and sending of outreach messages including reply and unsubscribe processing, research and monitoring of links, team and account management, and evaluation of the aforementioned operations for the controller.

2.2 Nature of the processing: collecting, recording, organising, storing, adapting, reading out, querying, using, transmitting, restricting, erasing and destroying.

2.3 Categories of data subjects: recipients of outreach messages, contact persons in target companies, and employees and agents of the controller who use the Platform.

2.4 Categories of personal data: contact data (name, business email address, telephone number, position, employer, publicly accessible profiles), communication content, delivery and interaction data (delivery, opens, clicks, replies, unsubscribes), scoring and status information, and account and role data of the users.

2.5 Special categories of personal data under Art. 9 GDPR are not the subject of the assignment. The controller will not introduce such data into the Platform.

3. Right to issue instructions

3.1 The processor processes personal data exclusively on documented instructions of the controller. The controller's use of the Platform functions is deemed an instruction; instructions going beyond this are given in text form to [email protected].

3.2 If the processor considers an instruction to be unlawful, it communicates this without delay and may suspend its execution until the matter is clarified.

3.3 Processing outside the instruction takes place only insofar as the processor is required to do so under Union law or the law of a Member State; in this case, it informs the controller in advance, unless the law prohibits this.

4. Confidentiality

The processor obliges the persons involved in the processing to confidentiality in writing, insofar as they are not already subject to a statutory duty of confidentiality. The obligation continues to exist even after the activity ends.

5. Technical and organisational measures

The processor takes the measures described in Annex 1 under Art. 32 GDPR. It may further develop them, as long as the level of protection is not reduced below the required standard.

6. Sub-processors

6.1 The controller grants a general authorisation for the engagement of the following sub-processors:

• Cloudflare — delivery and protection of the website. Seat USA; transfer on

the basis of Standard Contractual Clauses.

6.2 Paddle acts for payment processing as Merchant of Record and is in this respect its own controller, not a sub-processor.

6.3 The processor operates the database, object storage, reach measurement and the AI functions for text creation on its own infrastructure in Dubai, United Arab Emirates. No engagement of third parties takes place in this respect; for transfer to the United Arab Emirates, Section 12 applies.

6.4 Services that the controller connects itself by storing its own access key — in particular Hunter.io and Apollo.io for contact enrichment, and its own mail server for sending — act for the account and responsibility of the controller. The controller concludes the necessary agreements with these providers itself.

6.5 If the processor intends to engage a further sub-processor or to replace an existing one, it informs the controller in text form at least 30 days in advance. The controller may object within 14 days for an important data protection reason. If the objection cannot be resolved, either party may terminate the main contract as of the planned date of the change.

7. Duties to assist

7.1 The processor assists the controller with appropriate measures in responding to requests from data subjects. For this purpose, the Platform provides export and deletion functions as well as a permanent suppression list for unsubscribed addresses.

7.2 If a data subject contacts the processor directly, the processor forwards the request to the controller without delay and does not answer it on its own.

7.3 The processor assists the controller in complying with Art. 32 to 36 GDPR, in particular with a data protection impact assessment, insofar as the necessary information is available only to it.

8. Notification of personal data breaches

The processor notifies the controller of a personal data breach without delay, at the latest within 48 hours of becoming aware of it, in text form. The notification contains, insofar as known, the nature of the incident, the categories of data affected, the approximate number of data subjects, the likely consequences and the countermeasures taken. The processor does not notify the supervisory authority; this obligation falls to the controller.

9. Evidence and audits

9.1 On request, the processor demonstrates compliance with this agreement in an appropriate manner, in particular by providing information and submitting the documentation of the measures under Annex 1.

9.2 The controller is entitled to satisfy itself of compliance after prior announcement with reasonable notice during normal business hours. Audits are carried out without avoidable disruption of operations and at most once per calendar year, unless a particular occasion justifies an additional audit. The processor may reasonably charge for efforts that go beyond simple information.

10. Deletion and return

10.1 After the main contract ends, the processor makes the data available to the controller for export for 30 days and then deletes it.

10.2 Backup copies are overwritten on a rolling basis and permanently removed at the latest 14 days after deletion in the production system.

10.3 Exempt from deletion are data for which a statutory retention obligation exists, as well as the suppression list of unsubscribed addresses, the retention of which is necessary to fulfil the obligation under Art. 21(3) GDPR; the processing of this data is restricted accordingly.

11. Liability and final provisions

11.1 For liability, Section 10 of the Terms of Service applies accordingly; Art. 82 GDPR remains unaffected.

11.2 In the event of conflicts between this agreement and the main contract, this agreement takes precedence in data protection matters.

11.3 The law of the Federal Republic of Germany applies.

12. Transfer to a third country

12.1 The processor has its seat and operates its systems in the United Arab Emirates. For this country there is no adequacy decision of the European Commission under Art. 45 GDPR.

12.2 For transfers of personal data from the European Economic Area to the processor, the Standard Contractual Clauses of the European Commission under Implementing Decision (EU) 2021/914 of 4 June 2021 therefore apply, namely Module 2 (controller to processor). They are hereby incorporated in full into this agreement and take precedence over it in the event of conflicts.

12.3 For completing the annexes of the Standard Contractual Clauses, the following applies:

• Annex I.A (Parties): the data exporter is the controller, the data importer

the processor; the details follow from the preamble of this agreement and the controller's account master data.

• Annex I.B (Description of the transfer): Section 2 of this agreement.
• Annex I.C (Competent supervisory authority): the supervisory authority of

the Member State in which the controller is established; if it is not established in the Union, the authority of the Member State in which the data subjects are located.

• Annex II (Technical and organisational measures): Annex 1 of this

agreement.

• Annex III (List of sub-processors): Section 6 of this agreement.

12.4 For the options in the clauses, the following applies: Clause 7 (docking clause) applies. For Clause 9, Option 2 (general written authorisation) applies with the period agreed in Section 6.5. The optional Clause 11(a) (independent dispute resolution body) does not apply. For Clause 17, the law of Ireland applies; for Clause 18(b), the courts of Ireland have jurisdiction. Section 11.3 of this agreement and the choice of law of the Terms of Service remain unaffected by this and apply to all other matters.

12.5 The processor confirms that it is not aware of any laws that would prevent it from fulfilling the Standard Contractual Clauses. If it receives an official order to hand over transferred data, it informs the controller of this insofar as this is legally permissible, and challenges the order insofar as there are sufficient prospects of success. In addition, the measures of Annex 1 apply.

12.6 On request, the processor provides the controller with a signed copy of the Standard Contractual Clauses.

13. Applicable law of the United Arab Emirates

Independently of the GDPR, the processor is subject to Federal Decree-Law No. 45 of 2021 of the United Arab Emirates on the Protection of Personal Data (PDPL). Insofar as obligations arising from it overlap with those of this agreement, the processor fulfils the more extensive obligation in each case.

Annex 1 — Technical and organisational measures under Art. 32 GDPR

Confidentiality — physical access control. The systems are operated in a data centre in Dubai, United Arab Emirates. Physical access is limited to authorised persons and is logged.

Confidentiality — system access control. Sign-in via individual accounts with passwords hashed according to the state of the art. Sessions expire after 15 minutes of inactivity. Session cookies are httpOnly, SameSite=Strict and are transmitted exclusively over HTTPS. Administrative access to the production systems is exclusively via SSH with key authentication.

Confidentiality — data access control. Role-based permissions (Owner, Administrator, Editor, Reviewer, Viewer). The separation of tenants is additionally enforced at the database level by Row-Level Security, which denies access in the event of an error rather than allowing it. Machine access between services takes place only via short-lived, signed service tokens.

Confidentiality — separation control. Each customer works in its own tenant; each service uses its own database without external access. Records without a valid tenant reference cannot be retrieved.

Integrity — transfer control. Transport encryption with TLS for all connections to and from the Platform. Internal services are reachable exclusively via the local interface and are not publicly exposed.

Integrity — input control. Security-relevant operations are recorded with the time and the acting account in an activity log.

Availability and resilience. Daily automatic backup of the database with a retention period of 14 days. Monitoring of the services with automatic restart in the event of a disruption. Protection against overload through rate limiting.

Procedures for review and evaluation. Dependencies are regularly checked for known vulnerabilities and updated. Access credentials are kept outside version control. Changes to the production environment are made via a traceable deployment process.

Assignment control. Sub-processors are engaged only in accordance with Section 6 of this agreement and are contractually obliged to a corresponding level of protection.