17.1 Commitment to Privacy

Growwr is committed to protecting the privacy, confidentiality, and security of Personal Information entrusted to us by our users, customers, partners, and other individuals whose information is processed through the Services.

Growwr processes Personal Information in accordance with:

• these Terms;
• the Growwr Privacy Policy;
• any applicable Data Processing Agreement (“DPA”);
• applicable product-specific terms; and
• Applicable Data Protection Laws.

Our Privacy Policy forms an integral part of these Terms and is incorporated herein by reference.

17.2 Collection and Use of Personal Information

Growwr may collect, receive, generate, or otherwise process Personal Information that is reasonably necessary to:

• provide and operate the Services;
• create and manage user Accounts;
• verify identities and businesses;
• facilitate hiring, Projects, and marketplace activities;
• process payments;
• provide customer support;
• communicate with users;
• improve and personalize the Services;
• develop and improve Growwr AI;
• prevent fraud and abuse;
• maintain platform security;
• comply with legal and regulatory obligations; and
• enforce these Terms.

The categories of Personal Information we collect, the purposes for which it is used, and the legal bases for processing are described in our Privacy Policy.

17.3 User Responsibilities

Where you collect, upload, share, or otherwise process Personal Information through the Services, you represent and warrant that:

• you have obtained all necessary rights, permissions, notices, and consents required by Applicable Law;
• your processing of such Personal Information complies with Applicable Data Protection Laws;
• you have a lawful basis for processing the Personal Information;
• the Personal Information is accurate to the best of your knowledge; and
• your use of the Services does not violate the privacy rights of any individual.

You are solely responsible for ensuring that your collection and use of Personal Information complies with Applicable Law.

17.4 Data Sharing

Growwr may disclose or share Personal Information where reasonably necessary to:

• provide the Services;
• facilitate interactions between authorized users;
• process payments;
• perform verification services;
• provide AI-powered functionality;
• engage trusted Service Providers;
• comply with legal obligations;
• respond to lawful requests from governmental authorities;
• investigate fraud, abuse, or security incidents;
• enforce these Terms;
• protect the rights, property, or safety of Growwr, its users, or others; or
• complete a merger, acquisition, financing, restructuring, or sale of assets.

Growwr does not sell Personal Information except where expressly disclosed and permitted by Applicable Law.

17.5 Service Providers and Subprocessors

Growwr works with carefully selected third-party Service Providers and subprocessors that assist in providing the Services, including providers of:

• cloud infrastructure;
• identity verification;
• payment processing;
• artificial intelligence services;
• communications;
• customer support;
• analytics;
• fraud prevention;
• security;
• monitoring;
• email delivery; and
• other operational services.

These providers are contractually required to process Personal Information only as instructed by Growwr and in accordance with applicable legal and contractual obligations.

A current list of Growwr’s Service Providers and subprocessors is available through the Growwr Trust Center.

17.6 International Data Transfers

Because Growwr operates globally, Personal Information may be transferred to, stored in, or processed in countries other than the country in which it was originally collected.

Where required by Applicable Data Protection Laws, Growwr implements appropriate safeguards for international data transfers, which may include:

• Standard Contractual Clauses (SCCs);
• International Data Transfer Agreements (IDTAs);
• adequacy decisions;
• contractual safeguards;
• technical and organizational measures; or
• other lawful transfer mechanisms recognized under Applicable Law.

By using the Services, you acknowledge that your Personal Information may be transferred internationally in accordance with this Section and our Privacy Policy.

17.7 Data Security

Growwr implements reasonable administrative, technical, organizational, and physical safeguards designed to protect Personal Information against unauthorized access, disclosure, alteration, destruction, or loss.

Additional information regarding Growwr’s security practices is available in the Growwr Security documentation and Trust Center.

While Growwr employs commercially reasonable security measures, no method of transmission over the Internet or electronic storage is completely secure. Accordingly, Growwr cannot guarantee absolute security.

17.8 Data Retention

Growwr retains Personal Information only for as long as reasonably necessary to:

• provide the Services;
• fulfill the purposes described in these Terms and the Privacy Policy;
• comply with legal, regulatory, tax, accounting, or contractual obligations;
• resolve disputes;
• enforce these Terms;
• investigate fraud or abuse;
• maintain security; or
• protect the legitimate interests of Growwr and its users.

Retention periods may vary depending on the nature of the information, the applicable Service, legal requirements, and operational needs.

17.9 Privacy Rights

Subject to Applicable Data Protection Laws, individuals may have certain rights regarding their Personal Information, including the right to:

• access Personal Information;
• correct inaccurate information;
• request deletion;
• request restriction of processing;
• object to certain processing activities;
• withdraw consent where processing is based on consent;
• request data portability; and
• submit complaints to a competent supervisory authority.

The availability of these rights depends on the jurisdiction in which you reside and the applicable legal requirements.

Requests relating to privacy rights may be submitted using the contact information provided in our Privacy Policy.

17.10 Artificial Intelligence and Personal Information

Where Personal Information is processed through Growwr AI or other AI-powered Services, such processing shall be conducted in accordance with:

• these Terms;
• the Privacy Policy;
• the Growwr AI Terms;
• applicable product-specific terms; and
• Applicable Data Protection Laws.

Growwr implements reasonable safeguards intended to reduce privacy risks associated with AI-powered processing.

Users remain responsible for ensuring that any Personal Information they submit to AI-powered features is lawfully collected and processed.

17.11 Compliance with Applicable Data Protection Laws

Growwr is committed to complying with Applicable Data Protection Laws governing the processing of Personal Information, including, where applicable:

• the European Union General Data Protection Regulation (“GDPR”);
• the United Kingdom GDPR;
• the Nigeria Data Protection Act (“NDPA”);
• the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”);
• and other applicable privacy and data protection laws.

Nothing in these Terms shall be interpreted as limiting any non-waivable rights provided under Applicable Data Protection Laws.

17.12 Data Processing Agreements

Where required by Applicable Law or agreed between the parties, Growwr may enter into a separate Data Processing Agreement governing the processing of Personal Information on behalf of business customers.

To the extent a valid Data Processing Agreement conflicts with these Terms regarding the processing of Personal Information, the Data Processing Agreement shall govern solely with respect to those processing activities.

17.13 Reservation of Rights

Growwr reserves the right to modify, update, enhance, or replace its privacy practices, Privacy Policy, data retention practices, security measures, Service Providers, subprocessors, and data processing procedures to reflect changes in:

• Applicable Law;
• regulatory guidance;
• technology;
• security practices;
• operational requirements; or
• the Services.

Where required by Applicable Law, Growwr will provide appropriate notice before material changes become effective.