Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Company Terms between GRTwo Digital LLC ("Gryz", "we") and the Company. Every Company gets it, without a separate signature. It covers personal data in Company Content and Company Records. Words defined in the Company Terms mean the same here.

It is written to meet Article 28 of the EU and UK GDPR and the service provider rules in US state privacy laws.

• For Company Content and Company Records, the Company is the controller and we are the processor. We handle that data only to run Gryz for the Company.
• [S8 placeholder, not built yet] The same applies to the private space of a managed work account.
• For account data, billing, security, abuse moderation and product analytics, we are the controller. Our Privacy Policy covers that data.

• Subject matter and purpose: hosting, storing, indexing for search, sharing and showing Company Content to the people and connected apps the Company allows, and keeping Company Records.
• Duration: while the Company uses Gryz, then until deletion as set out in "At the end".
• People the data is about: the Company's members and anyone named in Company Content.
• Kinds of personal data: names, sign-in emails, roles, invitations, last sign-in and two-factor state, activity records (who or which agent did what, with which tool, in which project, and the outcome), item records if the Company turns them on (ids only), and any personal data the Company puts in its content.
• Special categories: we do not ask for them. If the Company puts them in its content, it is responsible for having a legal basis.

The Company's settings in Gryz, and requests its owners send us, are its instructions. We follow them, and we tell the Company if we think an instruction breaks data protection law. We only process Company personal data for other reasons when the law requires it, and then we tell the Company first unless the law forbids that.

• People at Gryz who can reach Company personal data are bound to keep it confidential.
• We protect it with appropriate technical and organisational security measures.
• We help the Company answer requests from people about their data (for example access or deletion), mainly through the tools in Gryz, and pass on any request we get directly.
• We help the Company with security, breach notices, data protection impact assessments and talks with regulators, taking into account what we know about the processing.

For counsel [COUNSEL]: Add a security measures annex (Article 28(3)(c) and 32). There is no published security page yet.

The Company agrees that we use the sub-processors on our sub-processors page. We bind each one to data protection terms at least as protective as this DPA, and we stay responsible for them.

We will email company owners at least [30] days before a new sub-processor starts handling Company personal data. The Company can object on reasonable data protection grounds within that time. If we cannot address the objection, the Company may end the affected part of the service.

For counsel [COUNSEL]: Confirm the notice period, the objection right, and what happens if an objection is not resolved (refund of prepaid fees, for example).

AI apps that the Company or its members connect to Gryz (for example Claude, ChatGPT or Cursor), and the AI providers behind them, are not our sub-processors. The Company or its members choose them and send data to them under their own agreements. We check access on every call and keep records for the Company, but we do not control what an app does with what it reads. Google and GitHub sign-in are identity providers a person chooses, not our sub-processors for Company Content.

If we become aware of a personal data breach affecting Company personal data, we tell the Company without undue delay, and within [48 / 72] hours, with what we know and what we are doing about it.

For counsel [COUNSEL]: Pick the notice deadline and who at the Company receives notices (all owners by email is the current default for other company notices).

When the Company is deleted or its plan ends, owners can export Company Content first. We then delete Company personal data within [30 / 90] days, except backups that expire on their own schedule and anything the law makes us keep.

For counsel [COUNSEL]: Article 28(3)(g) lets the Company choose deletion or return. There is no whole-company export yet, so return needs a product build or a support-run export. Keep this window the same as in the Company Terms.

We give the Company the information it reasonably needs to show that this DPA is met. If that is not enough, the Company may ask for an audit, with reasonable notice, at its own cost, and no more than once a year unless a regulator requires it or there was a breach.

For counsel [COUNSEL]: Confirm the audit terms. We have no third-party audit report (for example SOC 2) to offer instead today.

We host Gryz and store Company Content and Company Records in the United States. Where EU, UK or Swiss law applies to a transfer to us, the EU Standard Contractual Clauses (and the UK addendum and Swiss changes where needed) apply and are part of this DPA.

For counsel [COUNSEL]: Confirm the SCC modules (Module 2 controller to processor, Module 3 for onward transfers to sub-processors), the governing law and court choices inside them, and whether to certify to the EU-US Data Privacy Framework (and UK extension and Swiss framework) instead of, or as well as, the SCCs. GRTwo Digital LLC is not certified today.

Where the California Consumer Privacy Act or a similar US state law applies, we act as the Company's service provider or processor. We do not sell or share Company personal data, and we do not keep, use or disclose it for any purpose other than running Gryz for the Company, or combine it with other data except as those laws allow.

For counsel [COUNSEL]: Confirm the service provider terms for the CCPA and CPRA and which other state laws to name.

If this DPA conflicts with the Company Terms on personal data, this DPA wins. If the Standard Contractual Clauses conflict with this DPA, the Clauses win.

Questions about this DPA? Email us at info@grtwo.com.