Data Processing Addendum

• Applicable Privacy Laws means all privacy and data protection laws applicable to the processing described in this DPA, including the California Consumer Privacy Act as amended by the CPRA, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, and similar US state laws, each as applicable.
• Personal Information has the meaning given in Applicable Privacy Laws and includes any information that identifies, relates to, describes or could reasonably be linked with a consumer or household.
• Process and Processing mean any operation performed on Personal Information, including collection, use, storage, disclosure, analysis, deletion or disposal.
• Services means the products and services we provide under our agreement, including the GrowthXL Platform, the websites we build, communications tools and related support.

You are the business or controller of the Personal Information you submit to the Services about your customers, leads or personnel. We act as your service provider or processor, and we will Process that Personal Information only on your documented instructions and as described in this DPA and our agreement, unless the law requires otherwise.

• We will Process Personal Information only to provide the Services, to comply with law, or as otherwise agreed in writing.
• We will not sell Personal Information, and we will not retain, use or disclose it outside the direct business relationship with you, except as permitted by Applicable Privacy Laws or our agreement.
• We will not use Personal Information for our own advertising, and we will not share it with advertising partners.
• We will not combine Personal Information received in connection with the Services with Personal Information from other sources, except as necessary to provide or improve the Services, to detect security incidents, or as permitted by law.

We ensure that anyone authorised to Process Personal Information is bound by appropriate confidentiality obligations, whether contractual or statutory, and receives data protection training appropriate to their role. Access is limited to those who need it to do their job, and staff access to a customer account is logged.

We implement and maintain appropriate technical and organisational measures designed to protect Personal Information against unauthorised access, loss or alteration, taking into account the nature of the processing and the risks involved. Measures include access controls and authentication, encryption in transit, encryption at rest with our hosting providers, logging, vendor review and incident response procedures.

Breach notification. If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of Personal Information we Process on your behalf, we will notify you without undue delay and give you the information you reasonably need to meet your own notification obligations.

Taking into account the nature of the Processing, we will assist you by appropriate technical and organisational measures, insofar as possible, to fulfil your obligation to respond to consumer rights requests under Applicable Privacy Laws. Where a request is submitted directly to us, we will instruct the requester to contact you, unless we are legally required to respond directly.

We retain Personal Information only as long as necessary to provide the Services and as described in our Privacy Policy. On termination of the Services, or on your written request, and subject to legal retention requirements, we will delete or return the Personal Information in our possession. Client Content is retained for 30 days after termination so that you can export it, as described in the Terms.

On reasonable written request, and not more than once a year unless a regulator requires otherwise, we will make available the information reasonably necessary to demonstrate compliance with this DPA, including summaries of our security practices or completed security questionnaires. Where an on-site audit is required by Applicable Privacy Laws, it will be conducted during business hours, with reasonable advance notice, and subject to confidentiality and security controls.

Personal Information may be Processed in the United States. If we transfer Personal Information across borders where the law requires safeguards, we will implement the appropriate safeguards described in our agreement or otherwise required by Applicable Privacy Laws.

Liability arising from our Processing of Personal Information under this DPA is subject to the limitations and exclusions in your agreement with us, except where Applicable Privacy Laws prohibit that limitation. Nothing in this DPA limits either party's own direct obligations under Applicable Privacy Laws.

For questions about this DPA or our Processing of Personal Information on your behalf:

Delegated AI Inc
Delegated AI Inc, 1130 Ogletown Road, Suite 2, #2749, Newark, DE 19711, USA
Email: care@growthxl.ai