Data Processing Addendum

Effective date: November 11, 2026

This Data Processing Addendum ("DPA") is part of the Terms of Service between Gorvado ("Gorvado") and a business customer ("Customer") when Gorvado processes personal information on the Customer's behalf, for example contact details of the Customer's employees.

1. Roles

For account and platform operation, Gorvado acts as a business / controller. Where Gorvado processes personal information that the Customer provides about its own staff or contacts, Gorvado acts as a service provider (CCPA) / processor.

2. Instructions and restrictions

Gorvado processes such information only to provide the Platform and as the Customer instructs through its use. As a CCPA service provider Gorvado will not sell or share it, retain, use or disclose it for any other purpose, or combine it with other data except as the CCPA allows.

3. Confidentiality and security

Personnel with access are bound by confidentiality. Gorvado maintains reasonable technical and organizational measures, including encryption in transit, access controls, hashed session tokens, backups and logging.

4. Subprocessors

The Customer authorizes the subprocessors listed on the Subprocessors page. Gorvado remains responsible for their compliance and updates the list before adding new ones.

5. Security incidents

Gorvado notifies the Customer without undue delay, and in any case within 72 hours after becoming aware of a breach affecting the Customer's personal information, and cooperates on required notifications.

6. Assistance

Gorvado helps the Customer respond to privacy requests and, where required, with assessments, using the self-service tools in the account or on request to info.gorvado@gmail.com.

7. Deletion

On account deletion, Gorvado deletes or de-identifies the Customer's personal information within 30 days, except where retention is required by law. Backups are overwritten within 14 days.

8. Audits

Gorvado provides information reasonably needed to demonstrate compliance, once a year on written request.

9. Order of precedence

If this DPA conflicts with the Terms on data protection, this DPA prevails.

To receive a countersigned copy, email info.gorvado@gmail.com.