Data Processing Agreement

This Data Processing Agreement (DPA), including Annexes I–III, is Annexure A to the Customer Contract between Parashift Technologies B.V. (Growth Rocket, we or us) and the Customer named in that agreement (you).

This DPA sets out how we process personal data on your behalf when we provide the Services under the Agreement. It describes the roles of each party, the data we process, the security measures we apply, and the rules that govern our work for you.

Days include weekends and holidays unless we expressly say otherwise. Working Days have the meaning given in the Agreement. Hours run continuously, including outside business hours. Send routine requests to support@getgrowthrocket.com. For security incidents, use the contacts in clause 9.

In this DPA, the following terms have the meanings below. Terms not listed here, such as personal data, processing, controller, processor and personal-data breach, have their GDPR meanings.

Agreement: the Customer Contract between Growth Rocket and you, under which we provide the Services.

Annex: an annex to this DPA: Annex I (processing details), Annex II (security and support) or Annex III (sub-processors).

Customer Data: personal data we handle on your behalf to provide the Services, as described in clause 1 and Annex I.

EEA: the European Economic Area.

GDPR: Regulation (EU) 2016/679.

Hub: the Growth Rocket web application through which you access and manage the features provided under the Agreement.

Notice Email Address: the address recorded in your Agreement for contractual notices, or a replacement address you have notified to us. We also use it for personal-data breach notifications under clause 9.

Privacy Policy: our privacy policy, as referred to in clause 12.

Services: the services we provide to you under the Agreement.

Standard Contractual Clauses:the European Commission’s standard contractual clauses for transfers of personal data outside the EEA, as applicable under clause 6.

Sub-processor: a provider that handles Customer Data for us as part of delivering the Services. Clause 5 sets out how Sub-processors are authorised, and Annex III lists them.

You are the controller of the personal data we handle for you to provide the agreed services. This means you decide why and how that data is used. We act as your processor, handling it on your behalf. Customer Data includes personal data about the people described in Annex I.

This DPA covers Customer Data throughout the service: onboarding, preparing and building your website, preparing content, testing, publishing, updates and support. It also covers this work before your website goes live or your subscription starts.

Annex I explains what data we process, what we do with it and why.

We act as a separate controller only when we decide our own purposes and means of processing, as explained in clause 12 and our Privacy Policy. This does not change our responsibilities as your processor when we handle data for you.

We process Customer Data only on your recorded instructions. These include the Agreement, this DPA, authorised settings and actions in Growth Rocket, and recorded onboarding submissions, content requests, launch approvals and support requests from you or people you authorise. Send requests from your registered email address to support@getgrowthrocket.com or through the designated support system. Tell us who may give instructions and keep that information current. We may check their authority before acting. We may also process data where EU or EU Member State law requires it. In that case, we tell you beforehand unless that law prohibits notice for important public-interest reasons.

If we believe an instruction breaks the GDPR or other EU or EU Member State data-protection law, we tell you immediately. We pause that instruction while asking you to clarify it or give lawful revised instructions. We avoid unnecessarily interrupting other processing.

Everyone we authorise to process Customer Data must keep it confidential under a contract or a legal duty.

We use technical and organisational safeguards appropriate to the risks, as required by Article 32 GDPR and described in Annex II. We may update them without reducing the overall protection of Customer Data. Changes to expressly agreed safeguards or to the agreed purposes or scope of processing must be made in writing under the procedure in clause 15. We keep a dated record of significant updates and make the current description available to you.

• Sub-processors are providers that handle Customer Data for us as part of delivering your services. You give us general written authorisation to use those listed in Annex III, subject to this clause. Annex III records the list accepted with this DPA. We maintain the current list, version date and change history at getgrowthrocket.com/sub-processors. Adding a provider to that page does not, by itself, authorise its use.
• Before adding or replacing a sub-processor, we give you at least 45 calendar days’ written notice at your designated notice email address and update the list. The notice identifies the provider’s legal entity, service, processing activities, relevant countries and safeguards for international transfers, with enough information for you to assess the change. You do not need to subscribe separately to receive these notices. Keep your notice contact current.
• You may object within that notice period on reasonable data-protection grounds. We discuss your concerns and seek a reasonable solution before the new provider processes your Customer Data. If no solution is agreed, you may terminate the affected service before the change takes effect. If the affected service cannot reasonably be separated, you may terminate the inseparable service package. We refund prepaid subscription fees for the unused period after termination within 14 calendar days of termination. The refund is calculated proportionately for the terminated service, or for the whole package if the inseparable package is terminated. Future instalments for that period stop and do not become payable early. Fees properly due for services already supplied remain payable. This specific remedy takes priority over ordinary voluntary early-departure and no-refund terms. Data return and deletion follow clause 10.
• We require each sub-processor, by written contract, to follow the same data-protection duties that apply to its work under this DPA, including security requirements. We remain fully responsible to you for its compliance. We also keep details of relevant further suppliers and provide the information you need to assess them on request, while protecting confidential information.

Annex III lists where Customer Data is stored, processed or accessed, including access from outside the EEA, and the safeguards used for those transfers. We make transfers outside the EEA only under your documented instructions, including arrangements authorised under this DPA, or as required by EU or Member State law in accordance with clause 2. Each transfer must meet Chapter V GDPR. If a transfer arrangement is no longer legally valid, we put a lawful alternative in place before continuing or pause the affected transfer.

• We provide the tools described in Annex II to help you handle requests about personal data, including access, export, correction, deletion, restrictions on use and objections. The tools may not cover every relevant record or copy.
• Where further help is needed, we acknowledge your request within 2 calendar days and help without unnecessary delay, normally within 7 calendar days or sooner where reasonably needed to meet a legal deadline. You decide how to respond and remain responsible for replying to the individual.
• If someone contacts us directly about their Customer Data, we forward the request to you without unnecessary delay. We do not answer the request ourselves.

We help you meet your duties under Articles 32–36 GDPR, taking account of the processing and the information available to us. This includes security, breach notifications, assessments of risks to people’s data-protection rights (data-protection impact assessments), and consultation with the regulator before processing where required.

• We notify you of a personal-data breach affecting Customer Data without unnecessary delay and no later than 24 hours after we become aware of it, without waiting for a complete investigation. We notify your designated notice email address and any agreed security contact. For security incidents and urgent follow-up, contact support@getgrowthrocket.com.
• In the initial notice and updates, we provide the following as it becomes available, without unnecessary delay: what happened; the types and approximate numbers of people and records affected; the name and contact details of our data protection officer or other contact who can provide more information; the likely consequences; and the steps taken or proposed to deal with the breach and reduce its effects.
• We record the incident and work with you to assess and contain it and support legally required notifications. These duties apply outside routine support hours too.

• For 30 calendar days after the Agreement expires or ends, you have export-only access to retrieve Customer Data through the Hub. Sign-in ends after day 30. You may request a secure full export from us until the scheduled deletion date; we provide it within 14 calendar days. Retrieval is free even if fees remain unpaid. We preserve data needed to complete a timely export request until delivery. You are responsible for keeping your issued invoices and other records required by your own tax law.
• We notify you of the retrieval deadline and planned deletion date when the Agreement ends, and send a final reminder on day 23, at least seven calendar days before the retrieval window closes. If the reminder is late, the deletion date moves back by the same delay.
• We retain the account’s Customer Data until the scheduled deletion date and delete the account and remaining Customer Data from live systems on day 60 after termination, not before, subject to the late-reminder extension, timely-export protection and exceptions in this clause. This includes your quotes, invoices and PDFs. You may request an earlier return or deletion of specified Customer Data in writing. Before early deletion, we verify the instruction by confirming it through your account’s login email address. Mandatory law continues to apply.
• Mailbox copies and routine record retention follow Annex I; support tickets follow clause 12. Customer Data within them remains subject to our processor duties and applicable deletion instructions.
• Database restore history lasts seven calendar days. File backups, server backups and manual snapshots are deleted or expire within 30 calendar days after deletion from live systems, normally by day 90 after the Agreement ends. These periods move with any lawful extension of the live deletion date. Backups remain protected and are not used for normal operations. If restored, deletion instructions and restrictions are reapplied before normal processing resumes. Google Workspace recovery and residual copies follow the separate provider process described in Annex I.
• Where EU or Member State law requires us to preserve particular Customer Data, we identify the records and applicable law unless disclosure is prohibited. We protect those records, use them only for the required purpose and delete them when the requirement ends. Our own accounting and contract records, and necessary evidence for our own legal disputes, are handled under clause 12. This does not give us a general right to retain your customer database.
• On request, we confirm completed return or deletion in writing, identify any records we must still keep by law, and state when remaining backups will expire.
• Returning data does not transfer ownership of our platform code, design templates or backend systems. Your contractual rights to your content, final copy and domain remain unchanged.
• Any wider rights or longer periods for switching providers, exporting or retrieving data required by law take priority, including under the EU Data Act where it applies.

• On request, we give you the information needed to show that we meet this DPA, including its annexes and our sub-processors’ data-protection terms. You may first use relevant independent reports and certifications if they give enough assurance.
• You may also carry out an audit, including an inspection, yourself or through an independent auditor who must keep information confidential. Audits must be proportionate to their purpose. Routine audits normally take place once a year, with at least 30 days’ notice, at your cost.
• Extra audits or shorter notice are allowed where reasonably justified by a breach, credible signs of noncompliance or a regulator’s request.
• We agree reasonable arrangements with you to protect security, confidentiality and other customers’ data and to minimise disruption. Those arrangements must not prevent effective checks or access by the competent authorities.
• We use sub-processors’ certifications and reports as audit evidence, share relevant evidence with you, and seek further information or checks where needed.

Processing solely to provide or secure your service remains covered by this DPA. Where we use personal data for separate purposes that we decide, we act as controller and meet the related data-protection duties. Our Privacy Policy explains those uses, their legal basis, retention periods and individuals’ rights.

• Bounce records and opt-outs. When an address permanently bounces or generates a complaint, we record the delivery failure and place the address on a platform-wide suppression list so that our customers do not keep sending messages to it. This suppression list is maintained by Growth Rocket as a separate controller for email-delivery protection, ordinarily for three years after the last bounce. Review-request opt-outs apply only to the relevant customer account and stop review requests and reminders; a bounce is different from a review or marketing opt-out.
• Activity, security and support records.For our separate account administration, security and support purposes, we rely on legitimate interests, subject to the required assessment and individuals’ rights. Sign-in and password-change logs are kept for 180 days, other account activity logs for 400 days, and server request logs for 14 days. We keep our own invoices and payment records for seven years to meet applicable accounting duties. Client names and emails are removed from financial activity entries after 400 days; legally required accounting records are kept separately. Evidence of acceptance of our Terms and acknowledgement of our Privacy Policy is kept for the account’s life plus five years. Acknowledging the Privacy Policy does not itself constitute consent to processing.

Support tickets, messages and attachments are deleted three months after closure. Customer Data supplied within tickets remains subject to this DPA where processed on your behalf. For our own legal dispute, we retain only necessary evidence: the relevant ticket stays open and its email thread is saved separately, with access restricted to that purpose. We delete both when the dispute is over. This is not a general exception for unrelated Customer Data.

• Anonymous statistics. Statistics are anonymous only when people cannot reasonably be identified; replacing names with codes is not enough. Creating statistics from Customer Data must follow the authorised purposes and data-protection duties that apply.

You are responsible for:

• having a lawful basis under Article 6 GDPR and, where necessary, satisfying Article 9 requirements for special-category data or Article 10 requirements for criminal-offence data; supplying only Customer Data within the agreed purposes; and keeping copies of invoices you issue for as long as your own tax law requires
• publishing a privacy notice and, where your country requires one, an imprint (legal business information) on your website
• making sure review requests and other customer messages have the required lawful basis, privacy notices and, where needed, consent or other permission under electronic-communications law; respecting opt-outs and using tracking only when the required conditions are met
• keeping your login details secure

The service is intended for enquiries and contact information, not medical records, diagnoses or treatment histories. Health-business websites display: “Please don’t include medical details here. We’ll discuss them with you in person.” If health details are nevertheless submitted, you can edit or delete them in the dashboard or instruct us in writing to delete them. Before intentionally sharing information covered by professional secrecy, tell us the applicable obligations so permitted use, access and safeguards can be agreed in writing. Authorised personnel and relevant sub-processors must meet the applicable confidentiality duties, including section 203 of the German Criminal Code where relevant. On request, we explain authorised access and commitments. Intended criminal-offence processing requires separate written agreement.

This DPA must be agreed before we first process Customer Data, including during onboarding, and applies for as long as we process it, including retained copies and backups after the Agreement ends.

This DPA takes priority over conflicting data-protection terms in the Agreement or on our website. Applicable Standard Contractual Clauses take priority where required by their terms.

Subject to the exceptions below, Growth Rocket’s total liability to you under the Agreement and this DPA combined is limited to:

• €100 for all events during onboarding before the subscription starts. If the subscription never starts, this limit also covers subsequent processing and deletion of the onboarding data.
• The subscription fees paid or due for the relevant subscription year, for all events during that year. Events after the subscription ends, including while Customer Data is retained or deleted, count towards the final subscription year’s limit and do not create a new limit.

These are shared limits, not separate limits for each claim or document. Related events with the same underlying cause count towards the period in which the first event occurred. A claim made later remains subject to that period’s limit. Completion of deletion does not extinguish claims arising from earlier events.

The limits do not reduce agreed refund obligations. They do not apply to fraud, deliberate misconduct or liability that applicable law does not allow us to limit. They do not restrict individuals’ statutory data-protection rights, either party’s mandatory data-protection duties, or liability under applicable Standard Contractual Clauses where a restriction would contradict those clauses. The Agreement’s other liability terms continue to apply.

If Growth Rocket discontinues the service, we refund all prepaid subscription fees for unused days after termination. No further subscription fees are payable for those unused days.

This DPA replaces any earlier DPA between the parties for the services covered by the Agreement. Amendments must be in writing and follow the procedure below.

Growth Rocket may reasonably update this DPA, including Annexes I–III to reflect changes in law, security or how the agreed services operate. Updates cannot change the agreed core services, contract tenure, price protection or liability caps, retrospectively change accrued rights, or override mandatory rights or applicable Standard Contractual Clauses.

We email the revised wording or a downloadable copy, a summary and the effective date to your designated notice email address at least one calendar month before an update takes effect. Publishing a new website version alone does not amend the agreed version.

For a future substantive change, you may email support@getgrowthrocket.com before the effective date to end the Agreement immediately before the change takes effect, without an early-departure charge. We refund prepaid subscription fees for all unused days after termination within 10 Working Days; future fees for that period stop. Amounts properly due for services already supplied remain payable. Ordinary voluntary early-departure and no-refund rules do not restrict this right.

If you do not exercise that termination right, a permitted update notified under this procedure takes effect on its stated date without a fresh signature. This procedure does not permit changes to the signed commercial terms identified above.

Sub-processor changes follow clause 5, including its 45-calendar-day notice and objection procedure. Routine security updates permitted by clause 4 follow that clause; changes to expressly agreed safeguards or processing purposes or scope follow this clause. Return and deletion after termination follow clause 10.

Growth Rocket retains unchanged copies of accepted versions, acceptance records and subsequent update notices and versions. Archived copies are available to you on request.

Personal data processed

Retention

List version: 1.1. Date: 17 October 2026. The current direct-provider list, change history and links to providers’ downstream supplier lists are maintained at getgrowthrocket.com/sub-processors and reflect Annex III. The five direct providers are listed above; self-hosted n8n, Redis and BullMQ are our software, not separate providers. Neon and Cloudflare data-processing terms were accepted at signup, Google’s addendum through the Admin console, and Hostinger’s DPA forms part of its terms. Relevant downstream-provider information is also available on request. New and replacement providers follow clause 5; transfers follow clause 6.