Terms of use

Capitalised terms used below have the meanings given to them here. Other terms are defined where they first appear.

1. 1.“Client”: the company or self-employed professional on whose behalf the Service is used. A self-employed professional is a Client whose professional activity is carried on by a single person, who has a workspace for their sole use.
2. 2.“User”: any natural person holding an Account linked to a Client, whatever their role: administrator, department head, member or self-employed professional.
3. 3.“Account”: the personal account giving access to the Service, linked to a Client.
4. 4.“Virtual Collaborators”: the artificial intelligence systems of the Service, each presented with a first name, a portrait and a profession.
5. 5.“Mission”: a task entrusted by a User to a team of Virtual Collaborators.
6. 6.“Client Content”: the information that Users enter, upload, dictate or make accessible to the Service, in particular by connecting a third-party service. It includes Outputs. It excludes the welcome interview, the team composition interviews and their summary, which are processed under Growthwing’s responsibility (Article 3.2 of the Privacy Policy, the “Policy”).
7. 7.“Outputs”: the deliverables and other results produced for the Client by the Service.
8. 8.“Sealed Content”: the part of Client Content that is end-to-end encrypted, as listed in Article 4.8.1 of the Policy.

2.1 Purpose

These General Terms of Use (the “Terms”) govern access to and use of the growthwing.ai website, the application available at app.growthwing.ai and the applications that reproduce its content (together, the “Service”).

The Service is published by a simplified joint-stock company (SAS) whose registration is in progress, referred to below as “Growthwing”. Its status as a company in formation is governed by Article 14.7.

2.2 Contractual documents

The contract between Growthwing and the Client consists of the following documents, in descending order of priority:

1. 1.any special terms signed between Growthwing and the Client;
2. 2.Annex 1 (data processing agreement), for all matters relating to personal data processed on the Client’s behalf;
3. 3.these Terms.

The Policy describes the processing of personal data, the providers involved and the security measures. It is an information document. The Terms refer to it for the facts it describes, without restating them.

The articles of the Policy to which Annex 1 refers form part of Annex 1 for the purposes of its application.

2.3 Acceptance

The Terms are accepted by ticking a checkbox, which is not pre-ticked, displayed on the Account information confirmation screen. The Account cannot be activated without this acceptance.

For each acceptance, Growthwing records: the identity of the User, the Client, the version and digital fingerprint of the documents accepted, the date and time, the IP address and the browser. It keeps the accepted version and provides it to the User on request.

The parties agree that this record constitutes proof of acceptance, unless proven otherwise.

Each new version of the Terms is subject to fresh acceptance, under the conditions of Article 13, including for existing Accounts.

2.4 Authority to bind the Client

The User who creates or administers the Client’s workspace represents that they have authority to bind the Client. The primary administrator, or the self-employed professional themselves, represents the Client in its dealings with Growthwing.

Each User personally accepts the Terms with regard to their own use of the Service.

2.5 Online conclusion of the contract

The contract is concluded in French. Before confirming their acceptance, the User may check and correct the information entered on the confirmation screen. Ticking the checkbox and confirming the screen concludes the contract.

3.1 Adult professionals

The Service is reserved for adult professionals acting for the purposes of their business. It is prohibited for persons under eighteen years of age. It is not intended for consumers.

By accepting the Terms, the User represents that they meet these conditions.

3.2 Private use

Where Growthwing finds that a person is using the Service for private purposes, it may close their Account after informing them in writing. The person may export their Outputs for fifteen days from that notice.

This provision does not deprive the person of any rights granted to them by mandatory law.

Where Growthwing finds that an Account is being used by a minor, it closes the Account under the conditions of Article 1.4 of the Policy.

3.3 Early access, by invitation

The Service is not open to the public. It is available in early access, only by invitation or by means of a code issued by Growthwing or by a Client administrator. There is no open registration.

Anyone may request an invitation from the website. Growthwing considers each request at its discretion. A request confers no right to an invitation or to access to the Service.

Growthwing may open the Service to the public by category of client, for example self-employed professionals, then startups, then small and medium-sized enterprises. A category not yet open to the public may benefit from early access, by invitation, under the conditions of this article. Opening a category to the public ends early access for that category.

3.4 Roles and responsibility of the Client

The primary administrator may appoint secondary administrators and department heads, invite members and set their rights. A self-employed professional alone holds all rights over their workspace.

The Client is responsible for the use of the Service by its Users and for the rights it grants them.

3.5 Security of credentials

The User keeps their password, authentication factors and passphrase confidential. They do not disclose them to anyone, including Growthwing staff, who never ask for them.

Where the Client is not a self-employed professional, its administrator may require two-factor authentication for all its Users. Growthwing recommends enabling it.

The User informs Growthwing without delay, at talk@growthwing.ai, of any loss or unauthorised use of their credentials.

3.6 Vault and passphrase

Sealed Content can only be read using keys protected by each User’s passphrase, under the conditions of Article 4.8.1 of the Policy.

The loss of both the passphrase and access to all of a User’s devices has the effects described in Article 4.8.3 of the Policy.

Where the Client is not a self-employed professional, it is for the Client to appoint several administrators in order to prevent such a loss. A self-employed professional is the sole holder of their keys: they keep their passphrase in a safe place, since if they lose it together with access to all their devices, the Sealed Content of their workspace becomes permanently unreadable.

Growthwing is not liable for any resulting loss of access, unless it is at fault.

4.1 The Service

The Service enables the Client to put together teams of Virtual Collaborators through a spoken or written interview, to entrust Missions to them, to follow their progress and to receive their Outputs. From one Mission to the next, the teams reuse the corrections and context the User has given them.

The Client may organise its teams into departments. This organisation, team messaging, calls and rooms are not offered to a self-employed professional; the provisions relating to them do not apply to them. Only the features available within the Service are owed. The examples presented on the marketing website are illustrative.

4.2 Nature of the Virtual Collaborators

The Virtual Collaborators are artificial intelligence systems. They are not people. Their first names and portraits are fictitious.

4.3 Limits of Outputs

Outputs are produced by artificial intelligence systems. They may be inaccurate, incomplete, out of date or unsuited to the Client’s situation.

Outputs do not constitute legal advice, accounting, tax or financial advice, or investment advice. The Client checks them before any use and alone assesses whether they are appropriate.

4.4 Human approvals and autonomy

A Mission may submit a plan for approval, ask a question or be carried out without intervention. The User may reply to, approve, reject or stop a Mission at any time.

The Client sets the autonomy level of the Virtual Collaborators by department and by type of action. It is responsible for the actions they carry out within the limits of the permissions and autonomy levels it has configured.

4.5 Outputs sent to third parties

Where a User has an Output sent to a third party, in particular through the connected mailbox or calendar, the Client ensures that the third party is informed that an artificial intelligence system was involved, to the extent required by Article 50 of Regulation (EU) 2024/1689.

4.6 Browsing and scheduled Missions

During a Mission, the Virtual Collaborators may consult websites. The Client may schedule Missions for a given date or at regular intervals.

4.7 Availability and changes

Growthwing endeavours to ensure access to the Service. It makes no availability commitment. It may interrupt the Service for maintenance, giving Users notice where possible.

Calls and rooms require a direct connection between participants. They may fail depending on how the networks are configured.

Growthwing may change the features of the Service. A change that removes an essential feature or substantially reduces the Service is subject to Article 13.

4.8 Retention by the Client

The Service is not an archiving tool. The Client keeps, under its own responsibility, a copy of the Outputs and other Client Content it wishes to retain.

4.9 Support

The User may send a support request from within the Service. Growthwing replies within the Service and notifies the User by email. Growthwing sets the priority of each request. It makes no commitment as to response times.

A resolved request is closed seven days after its resolution. The User may reopen it within fourteen days of its resolution or closure.

4.10 Support access to the User’s space

The User may authorise the Growthwing staff in charge of support to access their space, for the request they designate. This authorisation is optional: the User may give it when opening their request, or later, if the staff ask for it during the exchange. The User remains free to refuse it; the staff then assist them in writing. It ends when the request is resolved, and no later than seven days after it was given. The User may end it at any time, from the banner shown during the access, from the request or from their security settings.

During the access, the staff see the User’s space in the company and the project of the request, within the limits described in Article 4.11 of the Policy. They may move around it, open menus and prepare entries. On their own, they save only the notification preferences. The other changes open to the staff, listed in Article 4.11 of the Policy, are saved only after the User’s approval, given for each change or, for fifteen minutes, for all of them. Without approval, nothing is saved.

In particular, the following remain reserved to the User and are refused to the staff even with their approval: changing the password, the second factor and the trusted devices; the vault and the encryption keys; payments; any deletion, including that of the Account or the Client; invitations and the removal of members; the User’s own support requests; launching a Mission or a scheduled Mission.

The Client is responsible for the changes approved by the User and for the actions taken by the staff within the limits of the authorisation given, save where Growthwing is at fault.

5.1 Execution Engine and model providers

Missions are carried out by the Service’s execution engine (the “Execution Engine”), operated by Growthwing with a specialist provider. The Virtual Collaborators and the assistance tasks rely on artificial intelligence models supplied by third parties (the “model providers”).

The providers, the data they receive and the applicable safeguards are described in Articles 4.2 to 4.6 and in the annex to the Policy.

5.2 Dependence on third parties

The operation of the Service depends on these third parties. Their unavailability or a change to their terms may affect the Service.

Growthwing may replace a third party under the conditions of Article 6 of Annex 1. If the replacement substantially reduces the Service, Article 13 applies.

5.3 Services connected by the Client

Each User may connect their Google mailbox and calendar to the Service, under the conditions and within the limits of Article 5.5.1 of the Policy. Where these features are enabled, the Client may connect accounts held with Qonto, Wise, Pennylane or Payfit.

The Client and its Users act under their own authority. They represent that they hold the rights needed to connect these services and to provide the corresponding access keys. They authorise Growthwing to access them on their behalf, within the limits of the rights granted, and may withdraw this authorisation at any time.

These services remain governed by the contracts entered into with their publishers. Growthwing is not responsible for their operation, unless it is at fault in the access it carries out.

5.4 Bank transfers

Where the feature is enabled, the User may issue transfer orders through Qonto. Each order requires two successive human approvals. It may only be made to a trusted payee designated by the Client and must stay within the limits set.

A transfer order is never triggered by a Virtual Collaborator, by the Execution Engine or by a model.

5.5 Reading of members’ mail

Reading of mail and calendars by the Sales department is enabled only for volunteer members, designated with their consent.

The Client informs its employees of this arrangement in advance, in accordance with Article L. 1222-4 of the French Labour Code, and limits its use to what the task to be performed justifies, in accordance with Article L. 1121-1 of the same code.

6.1 Permitted use

The Client and its Users use the Service for the purposes of their professional activity, in compliance with the law and the Terms.

6.2 Prohibited uses

The Service must not be used to:

1. 1.commit or facilitate any unlawful activity, fraud or infringement of the rights of others;
2. 2.carry out phishing, send unsolicited bulk communications or spread malicious code;
3. 3.impersonate a person or imitate their voice, or produce misleading content depicting them without their authorisation;
4. 4.monitor, rate or profile people, in particular employees, outside the conditions laid down by the French Labour Code and data protection law;
5. 5.screen job applications, assess employees, evaluate a person’s solvency or creditworthiness, or identify a person by their biometric characteristics, without Growthwing’s prior written consent;
6. 6.introduce special categories of data or data relating to criminal offences without a legal basis or a genuine need;
7. 7.infringe the intellectual property rights, privacy or image rights of a third party;
8. 8.circumvent security measures, usage limits, human approvals or autonomy levels, or access another Client’s data;
9. 9.insert instructions designed to divert the behaviour of the Virtual Collaborators or of the Execution Engine;
10. 10.decompile, disassemble or reverse engineer the Service, except where mandatory law permits it;
11. 11.systematically extract Outputs, model behaviour or Service parameters in order to train, evaluate or improve another artificial intelligence model;
12. 12.resell, rent or make the Service available to third parties without Growthwing’s written consent. Sharing a Mission by invitation or by public link, under the conditions provided for by the Service, does not constitute such making available;
13. 13.overload the Service or disrupt its operation.

The Service is not certified for hosting health data within the meaning of Article L. 1111-8 of the French Public Health Code. A Client who practises a health profession, or whose activity leads them to collect health data about their patients or clients, does not include any such data in it.

A breach of this article may lead to the suspension provided for in Article 11.

6.3 Reporting unlawful content or use

Anyone may report to talk@growthwing.ai any content or use they consider unlawful, in particular content accessible via a public link. The report specifies the content concerned, its location and the reasons.

Growthwing reviews the report. It may take the measures provided for in Article 11.

6.4 Reporting a vulnerability

Any vulnerability may be reported to talk@growthwing.ai. The person making the report refrains from accessing, modifying or disclosing the data of others, and from disrupting the Service. They give Growthwing a reasonable period to fix the issue before any publication.

Growthwing acknowledges receipt of the report. Insofar as the matter is within its control, it takes no action against a person who makes a report in good faith and in compliance with these conditions.

7.1 Client Content

The Client retains all rights it holds in Client Content.

It grants Growthwing, solely for the provision of the Service, a non-exclusive, royalty-free right to reproduce, store, transmit to its subcontractors, adapt and format Client Content. This right applies worldwide, in view of the transfers described in Article 6 of the Policy. It ends when the Client Content is deleted.

The Client warrants that it holds the necessary rights in Client Content and that its processing by the Service is lawful.

7.2 Outputs

To the extent that rights exist, Growthwing assigns to the Client, as and when the Outputs are produced, the economic rights it holds in them. The assignment covers:

1. 1.the right of reproduction, on any medium;
2. 2.the right of communication to the public, by any means of communication;
3. 3.the right of adaptation, modification and translation;
4. 4.the right to exploit those reproductions, communications to the public and adaptations commercially.

It applies worldwide, for the full legal term of the rights, free of charge, for any professional use by the Client.

Growthwing does not guarantee that the Outputs are capable of protection, nor that they are original. Similar Outputs may be produced for other clients. Illustrative images taken from free stock image libraries remain subject to their original licence.

7.3 The Service

The Service, its software, the Execution Engine, the templates and the configuration of the Virtual Collaborators (first names, profiles, portraits), excluding any elements of Client Content that this configuration incorporates, belong to Growthwing and its licensors.

Growthwing grants the Client, for the term of the contract, a personal, non-exclusive and non-transferable right to use the Service for the purposes of its business, through its Users. No other right is granted.

7.4 Feedback

The User may send Growthwing suggestions about the Service. The User grants Growthwing a non-exclusive, royalty-free, worldwide right in those suggestions, for the full legal term of the rights, to reproduce, adapt and exploit them in order to improve the Service.

This right never extends to Client Content.

7.5 No training

Growthwing does not use Client Content to train any artificial intelligence model.

8.1 Roles

The respective capacities of Growthwing and the Client are defined in Article 1.3 of the Policy. The processing that Growthwing carries out on the Client’s behalf is governed by Annex 1.

8.2 Obligations of the Client

The Client, as controller of Client Content:

1. 1.has a legal basis for each item of personal data it has processed;
2. 2.informs the data subjects, in particular its employees and the third parties whose data appears in Client Content;
3. 3.carries out a data protection impact assessment where one is required.

8.3 Confidentiality

Each party keeps confidential the non-public information of the other party that comes to its knowledge in connection with the contract. For Growthwing, this includes in particular Client Content. For the Client, this includes in particular non-public information about the operation and security of the Service.

Each party uses this information only to perform the contract. It discloses it only to persons who need it for that purpose and who are bound by the same obligation.

This obligation does not apply to information that has become public through no fault of the receiving party, that was already known to it, or whose disclosure is required by law or by an authority. It lasts for the term of the contract and for five years after it ends.

9.1 Early Supporter programme

The “Early Supporter” early access programme is granted by means of an early access code. At the date of these Terms, access to the Service is free of charge.

Growthwing may change the programme. It may also end it or make it chargeable, without having to give reasons for its decision, under the following conditions:

1. 1.any substantial change, the end of the programme or its move to a paid model is notified to the Client at least thirty days in advance, by email or within the Service;
2. 2.no invoicing may take place before that period expires. The notice specifies the price and the terms of the proposed invoicing;
3. 3.no payment is collected and no invoice is issued without the Client’s express acceptance of those terms;
4. 4.failing acceptance, the Client’s access ends when the period expires, at no cost. The Client may export its Outputs during that period.

9.2 Beta features

Some features are marked as beta or reserved for a test group. They are provided as is, with no availability commitment. Growthwing may change or withdraw them, for all Clients or for a single Client, after informing the Client concerned.

This provision does not exclude Growthwing’s liability for gross negligence or wilful misconduct, nor its obligations of security, confidentiality and personal data protection, nor any rights granted by mandatory law.

Article 7.5 applies to participants’ data.

9.3 Pricing

The Service is free of charge at the date of these Terms. Any future invoicing is subject to the conditions of Article 9.1.

10.1 Obligation of means

In providing the Service, Growthwing is bound by an obligation of means, not an obligation of result.

10.2 Security

Growthwing implements the security measures described in Article 4.9 of the Policy. The Client is responsible for the security of its own equipment and for the way its Users use their credentials.

10.3 Retention and deletion

Retention periods and deletion arrangements are described in Articles 3.2 to 3.5 of the Policy.

11.1 Suspension

Growthwing may suspend a User’s access, a feature or the Client’s access in the following cases:

1. 1.breach of the Terms;
2. 2.risk to the security of the Service, of Clients or of third parties;
3. 3.request from an authority or legal obligation.

The suspension is proportionate to the breach or the risk. It is preceded by a reasoned notice and a period of five working days in which to remedy the situation.

In an emergency, in particular a security risk, manifestly unlawful content or an order from an authority, the suspension takes effect immediately. The reasoned notice is then sent without delay.

The suspension is lifted as soon as its cause ceases. It does not entail any deletion. During the suspension, the Client may ask to export Client Content, unless the export would perpetuate the risk that gave rise to the suspension.

11.2 Termination by the Client

The Client may terminate the contract at any time and at no cost, by deleting its workspace from within the Service, under the conditions of Article 3.4 of the Policy, or by sending a request to talk@growthwing.ai.

11.3 Termination by Growthwing

Growthwing may terminate the contract:

1. 1.at any time, by giving the Client thirty days’ notice;
2. 2.in the event of a serious breach by the Client that has not been remedied within fifteen days of a reasoned notice;
3. 3.without notice, in the event of a breach so serious that it makes continuation of the contract impossible, in particular fraud or manifestly unlawful use. The Client may then export its Outputs for fifteen days, unless the export would perpetuate the breach.

11.4 Effects of the end of the contract

The end of the contract entails the closure of the Client’s Accounts. Data is deleted under the conditions and subject to the exceptions set out in Article 3.4 of the Policy.

A deletion request made from within the Service closes the Account immediately. The Client must therefore export its Outputs before making it.

11.5 Return of data and change of provider

The Client may download its Outputs from the Service at any time. On request sent to talk@growthwing.ai, Growthwing provides the Client, in a structured and commonly used format, with the other Client Content that it is able to read.

Sealed Content can only be read by authorised Users. Growthwing cannot export it on their behalf.

Growthwing gives the Client reasonable assistance in transferring this data to another provider. It charges no switching fees.

12.1 Principle

Growthwing is liable for direct and foreseeable damage caused to the Client through its fault in performing the contract.

It is liable in particular for failures attributable to the Service in the segregation of data between Clients, in the enforcement of the permissions and autonomy levels configured by the Client, and in the performance of Missions by the Execution Engine.

12.2 Liability of the Client

The Client is responsible for the use of the Outputs, for the decisions it takes on the basis of them and for the actions of the Virtual Collaborators carried out within the limits it has configured (Article 4.4).

It is responsible for Client Content and for compliance with Article 6. It indemnifies Growthwing against any third-party claim based on Client Content or on a breach of Article 6.

12.3 Cap

The total liability of each party under the contract, for all causes combined, is limited, per twelve-month period, to the higher of the following two amounts:

1. 1.the sums paid by the Client to Growthwing during the twelve months preceding the event giving rise to liability;
2. 2.five hundred euros.

12.4 Exclusions from the cap

The cap does not apply:

1. 1.in the event of gross negligence or wilful misconduct;
2. 2.to personal injury;
3. 3.to breaches of the confidentiality obligation in Article 8.3;
4. 4.to breaches of obligations relating to personal data, including those in Annex 1;
5. 5.to the indemnity owed by the Client under Article 12.2.

No provision of the Terms deprives an essential obligation of Growthwing of its substance.

Growthwing may amend the Terms. Any substantial change is notified to the Client at least thirty days before it comes into force, by email or within the Service.

When the new version comes into force, each User accepts it in a dedicated window before continuing to use the Service. A Client that rejects the new version may terminate the contract at no cost before it comes into force, after exporting its Outputs.

A change required by law or by an authority may come into force within the period they set. A change that has no effect on the rights and obligations of the parties is simply notified.

14.1 Entire agreement

The contract sets out the entire agreement between the parties on its subject matter. It supersedes any prior document on the same subject matter.

14.2 Severability

Any provision declared void or deemed unwritten is deemed severable. The other provisions remain in effect.

14.3 No waiver

A party’s failure to rely on a breach does not constitute a waiver of its right to rely on it later.

14.4 Assignment

The Client consents in advance to the assignment of the contract by Growthwing to any successor taking over the business of the Service. The assignment takes effect against the Client from the date it is notified. The Client may terminate the contract at no cost within thirty days of that notice.

The Client may assign the contract only with Growthwing’s written consent.

14.5 Force majeure

Neither party is liable for a failure caused by a force majeure event within the meaning of Article 1218 of the French Civil Code. If the impediment lasts more than thirty days, either party may terminate the contract without compensation.

14.6 Hardship

Article 1195 of the French Civil Code applies to the contract, with the following adjustment. The party requesting renegotiation notifies the other in writing, stating its reasons. Failing agreement within thirty days, either party may terminate the contract without compensation, on thirty days’ notice.

14.7 Company in formation

Growthwing is a simplified joint-stock company (SAS) whose registration is in progress. The contract is entered into in its name and on its behalf.

The commitments arising from it are taken over by the company after its registration. Until they are taken over, the persons who acted in the name of the company in formation are bound by them, in accordance with Article L. 210-6 of the French Commercial Code.

14.8 Notices

Notices to the Client are sent to the email address of its primary administrator or, for a self-employed professional, to that of their Account. Notices to Growthwing are sent to talk@growthwing.ai.

14.9 Language

The Terms are drafted in French. Any translation is provided for information only; the French version prevails.

15.1 Governing law

The contract is governed by French law.

15.2 Amicable settlement

Any claim is sent in writing to talk@growthwing.ai. The parties seek an amicable solution for thirty days from its receipt. They may agree to refer the matter to mediation.

15.3 Jurisdiction

Where the Client is a trader, any dispute relating to the contract is submitted to the competent courts for the place where Growthwing’s registered office is located.

In all other cases, the ordinary rules of jurisdiction apply.

This annex constitutes the processing contract provided for in Article 28 of the GDPR (Regulation (EU) 2016/679). The Client is the controller; Growthwing is the processor.

1. Purpose and duration

This annex governs the processing of personal data that Growthwing carries out on the Client’s behalf in connection with the Service. It applies for the entire term of the contract, and thereafter until the data is deleted under the conditions of Article 11 of this annex.

2. Description of the processing

3. Documented instructions

Growthwing processes the data only on documented instructions from the Client. The Terms, this annex, the settings chosen by the Client and the use of the Service by its Users constitute those instructions. The Client may give additional instructions in writing.

The access authorisation given by a User for a support request (Article 4.10 of the Terms) constitutes a documented instruction. It is limited to that request, to its duration and to the actions necessary to handle it.

Transfers outside the European Union are those described in Article 6 of the Policy.

Growthwing immediately informs the Client if, in its opinion, an instruction infringes data protection law. If Union or Member State law requires Growthwing to carry out processing, it informs the Client before the processing, unless the law prohibits it from doing so.

4. Confidentiality

Growthwing ensures that the persons authorised to process the data are bound by a confidentiality obligation.

5. Security

Growthwing implements the measures described in Article 4.9 of the Policy.

The Client acknowledges that the Client Content needed for a Mission is processed in plaintext by the Execution Engine and by the model called upon, for the purposes of the processing, and then retained by the model provider under its own terms.

Files saved on the Execution Engine machine are not end-to-end encrypted (Article 4.8.3 of the Policy). The Client takes this into account when choosing the data it entrusts to the Service.

6. Sub-processors

The Client gives Growthwing general authorisation to engage the sub-processors listed in the annex to the Policy that process Client Content. The identity of the providers that this annex designates by category is disclosed to the Client on request, subject to a confidentiality undertaking.

Growthwing notifies the Client of any addition or replacement of a sub-processor at least thirty days before it takes effect. The Client may object during that period, giving reasons. If no solution is found, it may terminate the contract at no cost before the change takes effect.

In the event of a sub-processor’s failure or a security risk, Growthwing may replace the sub-processor without notice. It then informs the Client without delay; the Client has the same right to object and to terminate from the date of that notice.

Growthwing imposes on its sub-processors data protection obligations equivalent to those of this annex, by contract or by accepting their terms. It remains liable to the Client for their failures.

The public Google servers used to connect calls and rooms receive only the IP addresses of participants, under the public terms of that service (Article 5.6 of the Policy).

7. Assistance with data subject requests

Growthwing forwards to the Client, within five working days, any request to exercise rights that it receives concerning Client Content. It does not respond to the request itself, unless instructed by the Client.

It assists the Client, through appropriate technical and organisational measures and insofar as possible, in responding to such requests.

8. Assistance with security and impact assessments

Growthwing assists the Client in ensuring the security of the processing, managing personal data breaches, carrying out impact assessments and consulting the supervisory authority. To that end, it provides the Client with the information available to it.

9. Personal data breach

Growthwing notifies the Client of any personal data breach affecting Client Content without undue delay, and no later than forty-eight hours after becoming aware of it.

The notification describes, insofar as this information is known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Information that is not yet available is provided as soon as it becomes available.

10. Information and audit

Growthwing makes available to the Client the information needed to demonstrate compliance with this annex. It answers the Client’s questionnaires within a reasonable time.

The Client may carry out an audit, itself or through an independent auditor bound by confidentiality, once per twelve-month period, on thirty days’ notice. The audit is conducted without disrupting the Service and without access to other Clients’ data. Its costs are borne by the Client.

An additional audit is possible following a personal data breach affecting the Client or at the request of a supervisory authority.

11. Data at the end of the contract

At the end of the contract, and after enabling the Client to retrieve its data in accordance with Article 11.5 of the Terms, Growthwing deletes the data processed on the Client’s behalf.

Deletion takes place under the conditions and subject to the exceptions set out in Article 3.4 of the Policy, in particular for the Execution Engine files, technical copies of the database and data sent to the model providers.

Growthwing certifies the deletion at the Client’s request.

12. Obligations of the Client

The Client gives lawful instructions. It has a legal basis for each processing operation and informs the data subjects (Article 8.2 of the Terms).

13. Liability

The parties’ liability under this annex is governed by Article 12 of the Terms. Breaches of obligations relating to personal data are not subject to the cap (Article 12.4).

14. Order of priority

For processing carried out on the Client’s behalf, this annex prevails over the Terms, in accordance with Article 2.2.