Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of LokAlGrow's Terms of Service and establishes the parties' obligations regarding the processing of personal data. - "Data Controller": The business using LokAlGrow services that determines the purposes and means of processing their customer data. - "Processor": LokAlGrow, S.L., which processes personal data on behalf of the Controller. - "Personal Data": Any information relating to an identified or identifiable natural person provided by the Controller through the platform.

In the context of reactivation and birthday club services, LokAlGrow processes: - Contact names - Phone numbers (WhatsApp/SMS) - Email addresses (when provided) - Birth dates (for VIP Club) - AI agent interaction history - Conversation and reservation status This data is provided exclusively by the Business, who declares having a legal basis for its processing.

LokAlGrow implements appropriate technical and organizational measures to ensure data security: - Data encryption in transit (TLS 1.3) and at rest - Restricted access through multi-factor authentication - Logical data segregation by business - Encrypted backups with 30-day retention - Periodic security audits - Staff with confidentiality agreements Each campaign's conversations are isolated and accessible only by the owner Business and authorized LokAlGrow personnel.

LokAlGrow will assist the Business in fulfilling its obligations regarding data subject rights: - Right of access: We will provide data export upon request - Right of rectification: The Business can update data from their dashboard - Right of erasure: We implement immediate opt-out when a contact requests it - Right to object: Contacts expressing unwillingness to be contacted are automatically marked as "Do Not Contact" When a contact requests deletion of their data, LokAlGrow will process it within 72 hours.

LokAlGrow uses the following sub-processors to provide its services: - Twilio Inc. (USA): SMS and WhatsApp sending - SOC 2 certified - Anthropic (USA): Natural language processing - With standard contractual clauses - MongoDB Atlas (EU/USA): Data storage - ISO 27001 certified - Brevo (France): Email sending - GDPR compliant International transfers are made under the EU Standard Contractual Clauses framework.

This DPA will remain in effect while the Business uses LokAlGrow services. Upon service termination: - Contact data will be deleted within 90 days - The Business may request a complete export before deletion - Audit logs will be retained for the legally required period - AI agent conversations will be anonymized for service improvement purposes The Business may request early deletion of all their data at any time from the settings panel.