Data Processing Addendum

1Scope, definitions and roles#

This DPA applies when Growstack Inc., doing business as Turgo.ai ("Turgo"), processes Personal Data on behalf of Customer in providing the Services ("Customer Personal Data"). Terms such as controller, processor, personal data, processing and supervisory authority have the meanings given by Applicable Data Protection Law. Customer is the controller and Turgo is the processor to the extent those roles apply. Where Customer acts as a processor for another controller, Turgo acts as Customer's subprocessor. Each party remains independently responsible for processing for which it acts as a controller.

2Documented instructions#

Turgo will process Customer Personal Data only on documented instructions from Customer, including the Agreement, Customer's configuration, authorized workflows and other written instructions accepted by Turgo, unless applicable law requires otherwise. If law requires processing beyond Customer's instructions, Turgo will notify Customer before that processing unless legally prohibited.

If Turgo reasonably believes an instruction infringes Applicable Data Protection Law, Turgo will inform Customer without undue delay and may suspend the affected processing until the parties resolve the issue. Customer is responsible for the lawfulness of its instructions, Customer Personal Data, notices, consents and other legal bases needed for its use of the Services.

3Confidentiality and personnel#

Turgo will ensure that persons authorized to process Customer Personal Data are subject to confidentiality obligations, receive appropriate privacy and security training, and access Customer Personal Data only to the extent necessary for their responsibilities.

4Security#

Taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of processing, as well as risks to individuals, Turgo will maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Personal Data. The measures are summarized in Schedule 2 and may be updated so long as the overall level of protection is not materially reduced.

Customer is responsible for securely configuring its workspace, connected accounts, permissions, credentials, retention settings and Authorized Users.

5Subprocessors#

Customer gives Turgo general written authorization to engage Subprocessors to provide the Services. Turgo's current Subprocessors are listed at https://turgo.ai/legal/subprocessors. Turgo will enter into a written agreement with each Subprocessor imposing data-protection obligations that are no less protective, in all material respects relevant to the Subprocessor's processing, than the obligations imposed on Turgo by this DPA, and Turgo remains responsible for the Subprocessor's performance to the extent required by Applicable Data Protection Law.

Where Article 28(2) GDPR or equivalent law applies, Turgo will provide at least 30 days' advance notice of an intended new or replacement Subprocessor by email, in-product notice or another durable communication, unless a shorter period is reasonably necessary for security, service continuity or legal compliance. Customer may object during the notice period on reasonable data-protection grounds. The parties will work in good faith on a commercially reasonable solution. If no reasonable solution is available, Customer may terminate the affected Service before the new Subprocessor begins processing, and Turgo will refund prepaid fees for the unused portion of that affected Service.

6Data-subject requests#

Taking into account the nature of the processing, Turgo will provide reasonable assistance, through product functionality or other reasonable means, to help Customer respond to requests by individuals exercising rights under Applicable Data Protection Law. If Turgo receives a request relating to Customer Personal Data for which Customer is the controller, Turgo will not independently respond except on Customer's documented instructions or where required by law, and will direct or forward the request to Customer where reasonably practicable.

7Security Incidents#

Turgo will notify Customer without undue delay after becoming aware of a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data (a "Security Incident") where notification is required by Applicable Data Protection Law. Turgo will provide, as information becomes reasonably available, details needed for Customer to meet applicable breach-notification obligations, including the nature of the incident, categories of affected data and individuals where known, likely consequences, and measures taken or proposed. Turgo will take reasonable steps to contain, investigate and remediate the Security Incident. A notification is not an admission of fault or liability.

8Compliance assistance#

Taking into account the nature of the processing and information available to Turgo, Turgo will provide reasonable assistance with Customer's obligations concerning security, Security Incident notification, data-protection impact assessments, prior consultation with supervisory authorities, and other processor-assistance duties required by Applicable Data Protection Law. Customer will reimburse reasonable out-of-scope costs where the assistance is not caused by Turgo's breach of the Agreement.

9Return and deletion#

At Customer's choice, upon termination or expiration of the affected Services Turgo will return or make available for export Customer Personal Data where the Services support export, and will delete Customer Personal Data and existing copies after the return/export period, unless applicable law requires retention. Customer may instruct Turgo to delete Customer Personal Data instead of returning it.

Customer Personal Data contained in backups may remain until the applicable backup cycle expires, provided it is isolated from ordinary use, remains protected under this DPA, and is deleted in accordance with Turgo's backup-retention cycle. Security logs, suppression records, billing/tax records and legal-hold information that Turgo is legally required or permitted to retain may be retained only for the applicable purpose and retention period.

10Demonstrating compliance and audits#

Turgo will make available information reasonably necessary to demonstrate compliance with this DPA, including relevant current audit reports, certifications, security documentation and responses to reasonable security questionnaires. Where Applicable Data Protection Law gives Customer an audit right and those materials are insufficient, Customer or an independent auditor that is not Turgo's competitor may conduct an audit no more than once annually, unless a regulator or Security Incident reasonably requires more frequent review, on reasonable advance notice and subject to confidentiality, security, scope and non-disruption requirements. Audits may not expose information relating to other customers or create security risk.

11International transfers#

Where Customer Personal Data is transferred from the EEA, United Kingdom, Switzerland or another jurisdiction that restricts international transfers, Turgo will use a legally recognized transfer mechanism required by Applicable Data Protection Law.

11.1 EEA transfers

To the extent a transfer of Customer Personal Data to Turgo is subject to the GDPR and is not covered by an adequacy decision, the European Commission's Standard Contractual Clauses adopted by Decision (EU) 2021/914 (the "EU SCCs") are incorporated into this DPA by reference. Module Two (controller to processor) applies where Customer is a controller and Turgo is a processor; Module Three (processor to processor) applies where Customer is a processor and Turgo is a subprocessor. For Clause 9, Option 2 (general written authorization) applies with the notice period in Section 5 of this DPA. For Clause 17, the law of Ireland applies; for Clause 18(b), the courts of Ireland have jurisdiction. Annex I is completed using the parties and processing details in this DPA and the Agreement; Annex II is completed by Schedule 2; Annex III is the then-current Subprocessor list at the URL above. The competent supervisory authority is determined under Clause 13 of the EU SCCs.

11.2 UK transfers

For Restricted Transfers subject to the UK GDPR, the then-current International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner's Office is incorporated by reference and applies to the relevant transfer. The information required in its tables is supplied by the Agreement, this DPA, Schedule 1, Schedule 2 and the Subprocessor list. If the approved addendum is revised, the then-current mandatory version will apply from the date required by law.

11.3 Switzerland

Where the Swiss Federal Act on Data Protection applies, references in the EU SCCs to the GDPR will be interpreted to include the Swiss FADP where appropriate, and references to EU Member States and supervisory authorities will be adapted to Switzerland to the extent required for the transfer mechanism to be effective.

12U.S. state privacy terms#

To the extent Turgo processes Customer Personal Data as a "service provider," "contractor" or "processor" under the California Consumer Privacy Act or another applicable U.S. state privacy law, Turgo will process that data only for the specific business purposes described in the Agreement and Schedule 1; will not sell or share Customer Personal Data as those terms are defined by applicable law; will not retain, use or disclose Customer Personal Data outside the direct business relationship or for another commercial purpose except as permitted by applicable law; will not combine Customer Personal Data with personal information received from other persons or from Turgo's own interactions except as permitted by applicable law; will impose applicable contractual restrictions on subcontractors; will provide legally required assistance with consumer requests, risk assessments and audits; and will notify Customer if Turgo determines it can no longer meet an applicable legal obligation.

13Government and third-party requests#

Unless prohibited by law, Turgo will notify Customer of a legally binding government or third-party request for Customer Personal Data where Customer is the controller. Turgo will review requests for legal validity, challenge requests it reasonably believes are unlawful where appropriate, and disclose only the data it is legally required to disclose.

14Schedule 1 — Processing details#

15Schedule 2 — Technical and organizational measures#

• Governance and risk management: documented information-security and AI-governance responsibilities, risk assessment, internal policies, review and corrective-action processes.
• Access control: role-based access, least privilege, authentication controls, account lifecycle management and privileged-access restrictions.
• Encryption and communications security: encryption in transit using industry-standard protocols and encryption at rest where supported by the applicable storage service.
• Logging and monitoring: security-relevant logging, monitoring and investigation processes appropriate to the Services.
• Secure development and change management: development controls, code/change review, vulnerability remediation and controlled deployment practices.
• Vulnerability and incident management: vulnerability identification/remediation, incident response, escalation and post-incident review processes.
• Resilience: backup, recovery and continuity measures appropriate to service criticality.
• Supplier management: security and privacy review of relevant service providers and contractual protections for Subprocessors.
• Personnel: confidentiality commitments, access based on job responsibilities and periodic security/privacy awareness.
• Data lifecycle: data minimization, retention and secure deletion practices appropriate to the relevant data category and service configuration.

Where Growstack Inc. maintains current ISO/IEC 27001:2022 and ISO/IEC 42001:2023 certifications covering the Services, the applicable certificate scope may be made available during security review. Certification does not replace the specific legal obligations in this DPA.

16Contact#

Privacy or data-protection questions may be sent to info@turgo.ai. Formal contractual notices may be sent to info@turgo.ai. If Turgo designates a Data Protection Officer or an EU/UK representative where required by law, the current contact details will be published in Turgo's Privacy Policy.