Data Processing Agreement

Interim policy, pending final legal review. This is a good-faith interim version. Questions: [email protected]

1. The agreement (binding by incorporation)

This Data Processing Agreement ("DPA") forms part of, and is incorporated by reference into, the Terms of Service between you (the "Controller", the merchant operating a connected store) and The Growth Locker FZC, operator of Cervito (the "Processor"). By connecting a store to Cervito, or by accepting the Terms of Service, you agree to this DPA in respect of personal data relating to your storefront visitors that Cervito processes on your behalf.

Which document wins. This page is the binding DPA text — it is what the registration clickwrap references and what you accept. The document served at app.cervito.io/docs/legal/dpa-addendum is this agreement's technical annex and app-served copy; on any conflict it defers to this page, with one exception: its Annex A (Technical and Organizational Measures), which is the operative description of our measures. The canonical sub-processor register is app.cervito.io/docs/legal/sub-processors; the table in section 4 below and the table on cervito.io/security are mirrors of it, and where a mirror disagrees the canonical register is correct.

A counter-signed copy for your records is available on request at [email protected].

2. Roles and scope

Cervito acts as processor of storefront-visitor personal data on the Controller's behalf and processes it only to provide the service and on the Controller's documented instructions (these terms and the Controller's use of the dashboard being such instructions). The subject-matter is the operation of an AI shopping associate; the duration is the term of the Controller's subscription plus the deletion windows below.

3. Categories of data and data subjects

• Data subjects: the Controller's storefront visitors and shoppers.
• Categories: conversation messages and any details a visitor types (which may include a name); where the store has voice input enabled (it is on by default), the audio recording of a visitor speaking and the transcript returned from it — the audio is transcribed and discarded, never written to disk or to our database, never logged, and never attached to an event; anonymous session/visitor identifiers; email and optional phone where a visitor provides one; order and catalog metadata; attribution/interaction events.

4. Sub-processors

We engage the sub-processors below — with one exception: your connected store platform is your own vendor, not one we procured, and is listed for transparency. The canonical sub-processor list is the prevailing version; this table is a copy of it as of 15 September 2026, in the same order, and where the two differ the canonical list is correct.

The Google appointment-scheduler and Google Meet entries cover demo bookings on our marketing site, where we (The Growth Locker FZC) are the controller of the prospect's own data, and are listed here for transparency, not as processing carried out on your behalf as Controller.

Changes to sub-processors. We will give at least 30 days' notice before a new sub-processor begins processing your visitors' personal data (by email to your account contact), and we record the change as a dated entry in the canonical list's changelog. You may object on reasonable data-protection grounds within that period ([email protected], or [email protected]); if we cannot accommodate your objection (for example by routing your shop's data away from the new sub-processor), you may terminate the affected portion of the Service for cause, and we will refund any prepaid fees for the unused portion of the term.

5. International transfers

Some sub-processors are outside the EU/EEA (notably the United States, see section 4). Where personal data is transferred to them, we rely on the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, with additional safeguards. We are finalizing the formal transfer documentation with legal counsel and will make the relevant clauses available on request.

⚠ PROPOSED — FOR COUNSEL / FOUNDER SIGN-OFF. Not in force until executed or published as accepted. Transfers from you to us. The Growth Locker FZC is established in the United Arab Emirates, which is not the subject of a European Commission adequacy decision. Where you are established in the EEA and personal data is transferred to us under this DPA, the parties incorporate by reference Module Two (Controller to Processor) of the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, with you as data exporter and The Growth Locker FZC as data importer. The optional docking clause in Clause 7 applies. In Clause 9(a) the parties select Option 2, general written authorisation, with the notice period in section 4 above. The optional redress-body language in Clause 11(a) does not apply. For Clause 17 the governing law is that of the EEA State in which you are established, and for Clause 18(b) the forum is the courts of that State; where you are established in an EEA State whose law does not allow third-party-beneficiary rights, the law and forum are those of Ireland. Where you are established in the United Kingdom, or the transfer is otherwise subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the Information Commissioner under s.119A(1) of the Data Protection Act 2018, applies to those Clauses, with Tables 1 to 4 populated by the corresponding details in this DPA and "Importer" selected in Table 4. Annexes I, II and III of those Clauses are populated by sections 2, 3, 4 and 12 of this DPA and by the canonical sub-processor list. In the event of a conflict between those Clauses and this DPA or the Terms of Service, those Clauses prevail.

6. Connected-platform data terms (Shopify Protected Customer Data)

When you connect a store, your platform's data-protection terms apply in addition to this DPA. For Shopify stores, Cervito accesses customer data under Shopify's Protected Customer Data requirements; we limit the customer fields we request to those needed to operate the associate (product, order, and customer-identity data), honor the mandatory Shopify GDPR webhooks (section 7), and bind our sub-processors to data-protection terms at least as protective as those we owe you here.

Platform differences. The automatic GDPR webhooks are a Shopify feature. Other platforms differ. For example, Magento does not provide native deletion webhooks, so for a connected Magento store, erasure is handled through the self-service visitor portal and your written request to us, not by a platform webhook. We will tell you which mechanisms apply for each platform you connect.

7. Assistance with data-subject requests

Taking into account the nature of processing, we assist you in meeting your obligations to data subjects:

• Self-service visitor portal. A shopper can request a copy of, or the erasure of, their data directly after verifying control of their email address. Exports are delivered to the shopper; erasure is executed across the Cervito-powered stores that hold their data. This is the only path that delivers an export directly to a shopper.
• Shopify GDPR webhooks. For Shopify stores we honor all three mandatory webhooks: customers/redact and shop/redact automatically delete the relevant data; customers/data_request compiles the export and forwards it to you, the merchant, to deliver to the shopper. You remain responsible for delivering that export within the statutory deadline.

8. Erasure and the retained order record

On an erasure request we delete the visitor's conversation transcripts, conversation analyses, attribution touches, and contact records, and we anonymize the visitor profile. We retain a minimized order record (an order reference, amount, and date, with name, email, phone, address, and any gift/engraving/recipient details removed) only where you, as controller, instruct us to or are legally required to keep it (for example, your own financial-record obligations). We do not assert an independent legal obligation of our own to retain it.

9. Deletion or return on termination; audit

On termination you may elect to have us delete or return your storefront-visitor personal data. Unless you instruct return, we delete it within 30 days of termination, except (a) the minimized order record above and (b) data we are legally required to keep. Before deletion you may request an export. Data not affected by termination continues to be deleted automatically on the Privacy Policy retention windows.

Audit. We will make available the information reasonably necessary to demonstrate compliance, including, on request, a description of our technical and organizational measures and responses to a reasonable security questionnaire (no more than once per 12 months). Where a documented review is insufficient and an on-site or third-party audit is genuinely required, it will be on at least 30 days' written notice, during business hours, under a confidentiality agreement, limited to systems relevant to your data, conducted so as not to disrupt our operations or compromise other customers' confidentiality, and at your cost.

10. Personal data breach

If we become aware of a personal data breach affecting your storefront visitors' personal data, we will notify you without undue delay at your account contact and, to the extent then known, describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. We will reasonably assist you in meeting your own notification obligations. The deadline to notify a supervisory authority is the controller's obligation; our commitment is prompt notice and assistance.

11. Cookies and consent (merchant responsibility)

The associate may set cookies or similar storage on your storefront. Where the law of your shoppers' location requires consent for non-essential storage (e.g. EU ePrivacy, UK PECR), you, the merchant, are responsible for obtaining that consent, including running a consent platform if needed. Cervito reads consent signals from common consent platforms; where you enable consent gating, the associate restricts non-essential storage accordingly.

12. Security

We apply technical and organizational measures appropriate to the risk, including: encryption of platform credentials at rest (AES-256-GCM); tenant isolation at the database layer; sealed, rotating session binding; audit logging; and removal of email/phone/card numbers from conversation text before AI inference. We require our sub-processors to maintain appropriate measures.

13. Contact

DPA and data-protection matters: [email protected].