Data Processing Agreement

• Data Protection Law means the UK GDPR and the Data Protection Act 2018, as amended (including by the Data (Use and Access) Act 2025), and any other UK law on the processing of personal data.
• Terms means our Terms. Service has the meaning given in them.
• Customer Personal Data means the personal data we process on your behalf, as your processor, in providing the Service (described in section 3).
• Sub-processor means another processor we engage to process Customer Personal Data.
• You means the business that has accepted the Terms.

Words such as controller, processor, data subject, processing and personal data breach have their UK GDPR meanings.

You are the controller of Customer Personal Data, and we are your processor. It is the information about your clients and others that you or your team put into the Service, or that reaches your organisation through it, such as quotation-link responses, client details in your team's conversations with our WhatsApp assistant, and WhatsApp quote requests routed to you before 4 November 2026.

We are a controller in our own right for account and organisation data, usage analytics, and security and technical logs. We are also the controller of the record we keep of people who message our WhatsApp number without a connected account (their number, WhatsApp name and when they messaged), and of the use described in section 14. Our Privacy Policy covers that processing, not this DPA.

Subject matter: providing the Service to you under the Terms.

Duration: the term of the Terms and, after that, until the data is deleted under section 12.

Nature and purpose: collecting, storing, analysing, displaying, sharing and deleting data so that you can draft, price, send and manage quotes. This includes AI analysis of documents and job descriptions, quotation links, the WhatsApp assistant, exports, support, and keeping the Service secure.

Types of personal data:

• client names, contact details, site addresses, postcodes, project notes and descriptions of the work;
• plans, drawings, photos and documents (which may show names, addresses or people), and what our AI extracts from them;
• quotes, contracts, exports and saved versions;
• quotation-link records: messages and decline reasons, with any name given; on acceptance, the name typed, the date and time, the IP address and a copy of what was accepted; and view and download counts;
• what your team sends our WhatsApp assistant about your quotes (messages, photos and PDFs) and its replies, and WhatsApp quote requests routed to you before 4 November 2026 (the sender's number and profile name, their messages, answers, photos and PDFs, and our replies);
• AI Assistant conversations, your activity history, and the names of your staff where they appear in this data.

We do not ask for special category data or criminal offence data. Please leave it out unless the work needs it. If it appears, this DPA still applies.

Data subjects: your clients and prospective clients, such as homeowners; their contacts and representatives, and others named in your documents; homeowners whose WhatsApp quote requests were routed to you before 4 November 2026; and your personnel, where named in Customer Personal Data.

We process Customer Personal Data only on your documented instructions. These are the Terms, this DPA, your use of the Service and its settings (such as sharing a quotation link, or applying a change or sending a quote from WhatsApp), and other reasonable written instructions consistent with the Terms. They include the transfers in section 9. We do not sell Customer Personal Data or use it for our own purposes, except as section 14 allows.

We will tell you immediately if we think an instruction infringes Data Protection Law, and may pause that processing until you confirm or change it. If UK law requires us to process Customer Personal Data in another way, we will tell you first, unless that law forbids this on important grounds of public interest.

As controller, you are responsible for:

• having a lawful basis for the processing, and giving lawful instructions;
• putting in only the personal data the job needs;
• giving your clients your own privacy information, including that you use Gromatik. Your quotation links show your business, not our privacy notice;
• the accuracy of what you enter, and checking AI output before relying on it;
• handling your clients' requests about their data;
• keeping sign-in details secure and giving team members only the role they need;
• keeping your own copies of quotes and contracts, because erasing your organisation deletes them.

Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality, by contract or by law. They access it only as far as needed to provide, support or secure the Service.

We implement appropriate technical and organisational measures under Article 32 of the UK GDPR, taking into account the state of the art, costs and risks. Our current measures include:

• encryption in transit (HTTPS/TLS, enforced with HSTS), and encryption at rest by our hosting and database providers;
• separation between organisations, enforced by database row-level security;
• private file storage: uploaded files are served only through authenticated requests that check the file belongs to the user's organisation;
• checks on uploaded file types and sizes;
• role-based access (owner, estimator, viewer);
• automatic sign-out after 60 minutes of inactivity;
• quotation links built on long random codes, with an optional expiry, revocable until the quote is accepted, marked so search engines do not index them, and sending no analytics from the client's browser;
• signature verification of every WhatsApp webhook delivery, and WhatsApp numbers connected to an account only by a single-use, ten-minute code sent from that very number and confirmed with a tap naming the account, with the member's current role re-checked on every message;
• least-privilege access keys: browsers get only a restricted key bound by row-level security, and our privileged service key stays on our servers.

We may change these measures, but not so as to reduce overall protection.

You give us general written authorisation to engage sub-processors. Our current sub-processors are:

• Supabase: database, authentication, and account emails such as sign-up confirmation and password reset. EU (Frankfurt).
• Vercel, Inc.: hosting and serverless functions (Frankfurt), file storage, queues, the AI Gateway that routes AI requests, and Web Analytics with consent. A US company, so data may be processed in the USA.
• OpenAI, via the Vercel AI Gateway: AI processing of uploaded documents, job descriptions and AI Assistant messages to draft quotes. USA.
• Meta Platforms: the WhatsApp Business Platform, for the WhatsApp assistant. Data may be processed in the USA.
• PostHog: product analytics. In the browser it runs only after a user chooses Accept all on our cookie banner; session recordings, if used, mask all text and form inputs and leave out images. PostHog EU Cloud.

Voice dictation uses the speech service in the user's own browser (Google, Apple or Microsoft) under that provider's terms. It is not our sub-processor, and the audio never reaches us.

Changes. We will update this list and its date at least 30 days before a new or replacement sub-processor starts, or as early as we reasonably can if the change is urgent. Ask us at contact@gromatik.ai if you also want an email. You may object on reasonable data protection grounds before the change takes effect. If we cannot resolve your objection in good faith, you may stop using the affected feature or close your account without penalty, with a refund of any fees paid in advance for the period after closure.

Flow-down. We bind each sub-processor by a written contract with data protection obligations giving at least the same protection as this DPA, including sufficient guarantees of appropriate technical and organisational measures. We remain responsible to you for their performance, subject to section 15.

Our database and serverless functions are in Frankfurt. Some sub-processors may process data in the USA (section 8); you authorise these transfers. Transfers to the EU rely on the UK's adequacy regulations. Transfers to the USA are protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or, where the recipient is certified, the UK–US data bridge. We make no other transfer outside the UK without a lawful transfer mechanism. Ask us which mechanism applies to a sub-processor.

Data subject requests. You can view, correct and delete much Customer Personal Data yourself, and export it as section 12 describes. For records the tools cannot change, such as activity history entries, accepted quotes and their acceptance records, and WhatsApp conversations and requests, email contact@gromatik.ai and we will help. If a data subject contacts us about Customer Personal Data, we will pass the request to you without undue delay and will not answer it ourselves, except to refer them to you, unless the law requires us to.

Other obligations. Taking into account the nature of the processing and the information available to us, we will give you reasonable help with your obligations under Articles 32 to 36 of the UK GDPR: security, breach notification, data protection impact assessments and prior consultation with the Information Commissioner's Office (ICO).

If we become aware of a personal data breach affecting Customer Personal Data, we will notify your organisation's owners by email without undue delay, with the information available to us at the time, such as:

• what happened and when;
• the categories and approximate number of people and records concerned;
• the likely consequences;
• the measures taken or proposed; and
• a contact for more information.

We will add details as they become available, take reasonable steps to contain and investigate the breach, and help you with any duty to report it to the ICO or tell the people affected. Notifying you is not an admission of fault.

While the Terms last. We keep Customer Personal Data while your organisation exists. You can delete projects, quotes and files within the limits shown in the app. Some records stay until you erase your organisation: accepted quotes with their projects, acceptance records and saved versions; your activity history; and WhatsApp conversations and requests.

At the end, you choose return or deletion:

• Return. Download the quotes, exports and files you need in the app. An owner can also use Export (JSON) in Settings → Privacy. It contains your organisation's details, projects, quotes with their sections and line items, price list, supplier catalogues and a list of your documents (name, category, type, size and date, not the files). Other data, such as quotation-link messages and acceptance records, saved versions, activity history, AI Assistant conversations (in the app and on WhatsApp) and WhatsApp requests, is available on request.
• Delete. An owner can use Permanently erase organisation in Settings → Privacy. This permanently deletes its projects, quotes (including accepted ones and their acceptance records), files, price list, quotation-link records, activity history, WhatsApp conversations and routed WhatsApp requests, and the accounts of members with no other organisation. Or ask us, and we will do it within 30 days.

After erasing, tell us at contact@gromatik.ai and we will also delete anything the erasure tool does not reach, such as WhatsApp photos never attached to a quote. Deleted data may remain in our database provider's backups for a limited period, until they age out under its policy. If the Terms end for another reason, we will give you a reasonable period to export, then delete. We keep Customer Personal Data after the end only where UK law requires.

We will make available the information reasonably necessary to show that we comply with Article 28 of the UK GDPR, and will allow for and contribute to audits, including inspections, by you or an independent auditor you appoint:

• first, send us written questions. We will answer in writing, with relevant documents where we may share them;
• if that is not enough, or a regulator requires it, or after a personal data breach, you may audit further on at least 30 days' written notice (less if a regulator requires), at an agreed time in business hours, once in any 12 months unless a regulator or a breach requires more;
• audits are at your cost and confidential, must not unreasonably disrupt the Service, and give no access to other customers' data. For sub-processors, we will share their own audit reports or certifications where available.

Please note: this section permits a use that goes beyond providing the Service to you.

You permit us to use the uploaded content and quotes in your organisation, de-identified where practicable, solely to test and improve the accuracy of the Service. For this use we act as a controller, as our Privacy Policy explains, so your privacy information should mention it.

We keep any copies secure and confidential, and only as long as that testing needs them. We never sell them or share them with anyone for their own use, and never use them to train third-party AI models. We delete them when you erase your organisation. To opt out, email contact@gromatik.ai: we will stop and delete those copies.

Liability under or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms, and counts towards the same overall limit. Nothing in this DPA limits any liability that cannot lawfully be limited, or any rights that data subjects have directly under Data Protection Law.

This DPA forms part of the Terms and, if they conflict on the protection of personal data, this DPA prevails. We may update it for changes in the law, our sub-processors or the Service, with notice of material changes as set out in the Terms; sub-processor changes follow section 8.

This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, as under the Terms.

For questions about this DPA, objections, audit requests or breach queries, email contact@gromatik.ai. We have not appointed a Data Protection Officer, as we are not required to.