Data processing agreement

This data processing agreement ("DPA") forms part of the Grotivo terms of service between Dee-Twelve Technologies, the business behind Grotivo ("we", "us"), and the company that subscribes to Grotivo ("you", the "Customer"). It applies automatically when you use Grotivo. If you need a signed copy, print or save this page as a PDF, sign it and email it to privacy@grotivo.com, and we will countersign it.

1. Roles

For personal data that you or your team put into Grotivo, or that Grotivo receives from systems you connect, you are the controller and we are your processor. For our own account, billing and marketing records about you, we are the controller, as described in our privacy policy.

2. What we process (details of processing)

• Purpose: providing Grotivo: growth assessments, metrics, AI recommendations and reports, team chat, store and marketing tools, support and billing.
• Duration: for as long as you use Grotivo, then until deletion under section 8.
• People concerned: your staff and invited users; your customers, leads and contacts whose details you add or connect.
• Types of personal data: names, work email addresses, job titles and roles; business contact details; content you write (messages, notes, documents); customer and order details from connected stores and systems; usage records.
• Special category data: Grotivo is not designed for it. Please do not add health, biometric or similar sensitive data.

3. Our commitments

We will:

• process personal data only on your documented instructions, which are these terms, your settings and your use of Grotivo, unless the law requires otherwise (and if so, we will tell you unless the law forbids it);
• make sure everyone at Grotivo who can access personal data is bound by confidentiality;
• keep the security measures described on our security page (Annex 2) in place, and only change them in ways that keep or improve protection;
• not use your data to train AI models, and not sell it;
• help you respond to requests from people exercising their rights (access, correction, deletion, portability), including through the data export in Settings;
• help you with data protection impact assessments and with regulators, where they concern Grotivo;
• tell you without undue delay, and in any case within 48 hours of becoming aware, about a personal data breach affecting your data, with the information you need to meet your own duties.

4. Your commitments

You confirm that you have a lawful basis for the personal data you put into Grotivo or connect to it, that you have given people any notices the law requires, and that your instructions to us comply with data protection law.

5. Subprocessors

You authorise us to use the providers listed in Annex 3 and on our security page. Each is bound by a written agreement with data protection duties at least as protective as this DPA. We will tell you by email at least 30 days before adding or replacing a provider that processes your workspace data. If you object on reasonable data protection grounds, we will try to find a solution; if we cannot, you may cancel the affected service and receive a refund of any prepaid fees for the remaining period.

6. International transfers

Grotivo runs on Cloudflare's global network and uses providers in the USA and elsewhere. Where personal data from the UK, the EU or Nigeria is transferred to a country without an adequacy decision, the transfer is covered by the European Commission's Standard Contractual Clauses (and the UK Addendum to them), which are incorporated into this DPA by reference, by our providers' own approved transfer mechanisms, or by another lawful basis under the Nigeria Data Protection Act 2023.

7. Audits and information

On request, we will give you the information reasonably needed to show that we meet this DPA, including answering one security questionnaire a year. If that is not enough, you may carry out an audit once a year, at your cost, with at least 30 days' notice, during business hours and under confidentiality. Grotivo is not yet SOC 2 audited; when it is, we will share the report under a confidentiality agreement instead.

8. Return and deletion

Your super admin can download all of your company's data at any time from Settings. When you ask us to delete it (from Settings or by email), we delete it within 30 days, except where the law requires us to keep something, such as payment and invoice records for tax purposes. Backups that cannot be selectively edited are overwritten in the normal course, within 30 days.

9. Liability and conflicts

Each party's liability under this DPA is subject to the limits in the terms of service. If this DPA and the terms of service conflict on data protection, this DPA wins. This DPA is governed by the same law as the terms of service.

Annex 1: Contact details

Processor: Dee-Twelve Technologies (Grotivo), registered with the Corporate Affairs Commission of Nigeria. Data protection contact: privacy@grotivo.com. Customer: the company and super admin named in the Grotivo account.

Annex 2: Security measures

As described on our security page, including: separation between companies on every request; role-based access; HTTPS with HSTS; encryption at rest; AES-256 encryption of connection and saved-card tokens; hashed API keys; passwordless or code-verified sign-in with signed HttpOnly cookies; bot checks and rate limits; signed and verified payment messages; staff roles with an audit log; point-in-time database recovery; and browser security headers.

Annex 3: Subprocessors