Data Processing Agreement (DPA)

3.1 — Dual Capacity of ENROW

The Parties acknowledge that ENROW acts in two distinct capacities:

(a) Independent Data Controller: ENROW acts as Data Controller in respect of the Personal Data which it collects, aggregates and maintains in its own enrichment database (professional emails, telephone numbers, LinkedIn profiles, company information). Such processing is predicated upon ENROW's legitimate interest (Article 6(1)(f) GDPR), as documented in a LIA reviewed on an annual basis.

(b) Data Processor: ENROW acts as Data Processor within the meaning of Article 28 of the GDPR when it processes Client Data (data transmitted by the Client for enrichment) on behalf of and on the instructions of the Client.

3.2 — The Client as Data Controller

The Client acts as Data Controller in respect of:

• The Client Data which it transmits to ENROW for enrichment;
• Its use of the Enriched Data returned by the Service.

The Client shall determine alone the purposes and means of its use of the Enriched Data downstream of the Service and shall be solely responsible for compliance with its obligations under the GDPR and the French Data Protection Act (Loi Informatique et Libertés) in that regard.

5.1 — Client's Instructions

ENROW shall process Client Data only on the documented instructions of the Client. These Terms and this DPA constitute the Client's initial instructions. Any additional instructions shall be transmitted in writing (by email to dpo@enrow.io).

If ENROW considers that an instruction constitutes a violation of the GDPR or any other applicable regulation, it shall inform the Client forthwith in writing.

5.2 — Confidentiality

ENROW warrants that persons authorised to process Personal Data have committed themselves to confidentiality or are subject to an appropriate statutory obligation of confidentiality. Only those persons whose access is strictly necessary for the performance of the Service shall have access.

5.3 — Security of Processing

ENROW shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR. Such measures are described in Annex 2 to this DPA. ENROW shall carry out regular reviews of the effectiveness of such measures.

5.4 — Data Breach Notification

In the event of a Data Breach affecting Client Data, ENROW undertakes to:

• Notify the Client without undue delay and in any event within seventy-two (72) hours of becoming aware thereof;
• Provide the following information: a description of the nature of the breach (categories and approximate number of Data Subjects and records affected), likely consequences, measures taken or proposed to be taken to remedy the breach, and contact details of the DPO;
• Document the breach in an internal register and cooperate with the Client to enable it to comply with its own notification obligations (Articles 33 and 34 GDPR);
• Notify the CNIL within 72 hours in its capacity as Data Controller in respect of data held in its own enrichment database.

5.5 — Assistance to the Client

ENROW shall assist the Client, insofar as is reasonably practicable having regard to the nature of the processing, in:

• Responding to requests by Data Subjects to exercise their rights (access, rectification, erasure, objection, portability, restriction);
• Complying with its obligations under Articles 32 to 36 of the GDPR (security, breach notification, data protection impact assessment);
• Responding to requests from and audits by any Supervisory Authority.

If ENROW receives a request directly from a Data Subject in respect of Client Data, it shall inform the Client without undue delay and shall not respond directly save on the Client's instructions.

5.6 — Fate of Data upon Termination

In accordance with Clause 14.3 of the Terms, upon termination of the Contract:

• Export: the Client shall have thirty (30) days in which to export its Client Data in CSV and/or JSON format via the Software, the API or upon request to support@enrow.io;
• Deletion: after such period, ENROW shall permanently delete all Client Data, including copies and backups, within a further period of thirty (30) days;
• Certification: ENROW shall provide the Client, upon request, with a written certificate of deletion.

The deletion of Client Data shall not affect anonymised and aggregated data used in accordance with Clause 9.6 of the Terms.

7.1 — General Authorisation

The Client hereby grants ENROW a general authorisation to engage Sub-Processors for the provision of the Service (including without limitation Third-Party enrichment Providers and hosting providers). The list of Sub-Processors currently engaged is set out in Annex 3 to this DPA and is also available upon request from the DPO.

7.2 — Notification and Right of Objection

In accordance with Clause 12.2 of the Terms, ENROW shall notify the Client of any change to the Sub-Processors (whether by addition or replacement) no fewer than fifteen (15) days prior to the effective date of such change. The Client may object in writing within fifteen (15) days. Failing agreement, the objection shall be deemed to constitute notice of termination of the Contract in accordance with Clause 12.2 of the Terms.

7.3 — Obligations Imposed on Sub-Processors

ENROW shall contractually impose on each Sub-Processor data protection obligations substantially equivalent to those contained in this DPA, in particular as regards confidentiality, security, purpose limitation and data deletion.

7.4 — Liability

ENROW shall remain fully liable to the Client for the performance by its Sub-Processors of their data protection obligations.

13.1 — Hierarchy

This DPA forms an integral part of the Contract. In the event of any inconsistency between this DPA and the Terms, this DPA shall prevail in respect of any matter relating to the processing of Personal Data. In all other respects, the Terms shall prevail.

13.2 — Amendment

ENROW may amend this DPA in order to comply with changes in applicable regulations. Any material amendment shall be notified to the Client thirty (30) days prior to its coming into effect.

13.3 — Governing Law

This DPA shall be governed by French law. The courts of Paris shall have exclusive jurisdiction.

A. Encryption

• In transit: all communications are encrypted via TLS 1.2 or higher (HTTPS). Unencrypted connections are rejected.
• At rest: stored data is encrypted via AES-256 (native AWS encryption).
• Passwords: irreversible hashing using the bcrypt algorithm with individual salting.

B. Access Control

• Authentication: identification by email and password, with multi-factor authentication (MFA) available and recommended.
• Access management: strict RBAC (Role-Based Access Control) model. Each access right is limited to what is strictly necessary (principle of least privilege).
• Sessions: signed JWT tokens with automatic expiry.

C. Infrastructure and Hosting

• Hosting provider: Amazon Web Services (AWS), region eu-west-3 (Paris). AWS holds ISO 27001, SOC 1/2/3 certifications and is GDPR-compliant.
• Network isolation: databases and internal services are isolated within a Virtual Private Cloud (VPC) with no direct public access.
• Backups: automatic daily backups, encrypted, with configured retention.

D. Logging and Monitoring

• Access logs: traceability of user actions (identifier, action, timestamp, IP address). Logs encrypted at rest.
• Monitoring: continuous infrastructure monitoring with automated alerts in the event of anomalies.

E. Minimisation and Retention

• Only data strictly necessary for the provision of the Service shall be collected and processed;
• Client Data: maximum 90 days, followed by automatic deletion;
• Technical cache: 48 hours;
• Effective and irreversible deletion at the end of the retention period.

F. Organisational Security

• Data protection awareness training for all staff;
• Robust password policy for internal access;
• Principle of least privilege applied across all teams;
• Confidentiality undertaking signed by each member of staff with access to Personal Data.

G. Incident Management

• Internal security incident management procedure;
• Notification to the Client within 72 hours (Clause 5.4 of this DPA);
• Register of breaches maintained and kept up to date.

These measures are reviewed and updated on a regular basis to take account of the state of the art, implementation costs and the nature of the risks.

Part A — Published Sub-Processors (list in force as at 26 February 2026)

Part B — Data Enrichment Providers (Confidential List)

In connection with the provision of the enrichment Service, ENROW engages specialist providers in the following categories:

Confidentiality of the nominative list: the complete nominative list of enrichment providers, including their identity, location and the applicable transfer mechanism, constitutes a trade secret of ENROW within the meaning of Directive (EU) 2016/943 on the protection of undisclosed know-how and business information, and of Loi n°2018-670 of 30 July 2018 transposing such Directive into French law.

Communication to the Client: such list shall be communicated upon written request to the DPO (dpo@enrow.io), subject to the prior execution of a non-disclosure agreement (NDA) by the Client. The Client undertakes not to disclose such list or the information contained therein to any third party, and to use it solely for the purposes of verifying ENROW's compliance with the GDPR.

Right of objection: the notification and right of objection mechanism provided for in Clause 7.2 of this DPA and Clause 12.2 of the Terms shall apply in full to enrichment providers. The Client shall be notified of any change no fewer than fifteen (15) days prior to the effective date, even where the name of the new provider is communicated under NDA.

Common safeguards: ENROW warrants that each enrichment provider (a) is contractually bound by data protection obligations substantially equivalent to those contained in this DPA, (b) is located within the EEA or covered by a transfer mechanism compliant with Chapter V of the GDPR, and (c) processes Personal Data solely within the strict scope of ENROW's instructions and solely for the purposes of enrichment.