Client Representative Consent to Personal Data Processing (B2B)

Version 1.0 from 15.10.2025

This consent is provided by a natural person acting on behalf of and in the interests of the gro.now Platform client – a legal entity or an individual entrepreneur with whom the Platform Customer Agreement (B2B) is being concluded/has been concluded (hereinafter – the “Client”). Such person registers or uses the Client's account and/or otherwise interacts with the Platform on behalf of the Client (hereinafter – “I”, “Client Representative”).

This consent does not apply to Respondents participating in Activities on the Platform; the processing of Respondent personal data is governed by separate gro.now documents.

1. Personal Data Operator (Controller)

The Operator (Controller) of my personal data is:
“Pwron” LLP (gro.now brand), BIN 241040012133,
Republic of Kazakhstan, Almaty, Satpayev St., 90/54, apt. 5, 050000;
e-mail: t@gro.now; website: https://www.gro.now/ (hereinafter – “gro.now”, “Operator”).

The processing of personal data is carried out in accordance with the legislation of the Republic of Kazakhstan, as well as gro.now documents published on the Website and/or in the Platform interfaces, including:

Platform Customer Agreement (B2B);
General Personal Data Processing Policy;
Cookie Policy;
Data Processing Addendum (DPA) – in terms of relations with the Client as the data controller or when gro.now acts as the data processor on behalf of the Client.

2. Consent and Actions Confirming its Provision

I give this consent to gro.now for the processing of my personal data when I perform one of the following actions (depending on the interface):

check the box (checkbox) about consent and/or
click the button “Register” / “Continue” / or other similar button in the Platform interface,

while a link to the text of this Consent and the General Personal Data Processing Policy is placed in the interface.

gro.now has the right to record the fact of consent provision (date/time, version of consent, channel, IP address, account/device identifier) in the electronic consent log.

3. Composition of Processed Personal Data

The following personal data of the User may be processed within the framework of this Consent (depending on the filled-in fields and Platform functionality):

surname, first name, patronymic (if any);
position, name of the organization/Client, business role;
work email, phone numbers, links to business profiles (if indicated);
account and authentication data (login, ID, technical tokens, SSO identifiers when logging in through external providers);
business correspondence and requests to the support service, comments in the Platform interface;
data on the use of the Platform (login dates and times, actions in the account, technical journals/logs);
technical information and device identifiers, IP address, information about the browser and OS, cookies and similar tracking technologies – to the extent provided for in the Cookie Policy;
other information voluntarily provided by me to gro.now during registration, profile setup, interaction with support, and use of the Platform.

The Operator does not seek to collect special categories of personal data (biometric, medical, information about views, etc.). In case of their accidental provision, such data are processed only to the extent necessary for gro.now to fulfill its obligations or protect rights, or are subject to deletion/anonymization.

4. Personal Data of Third Parties Entered by the Client Representative

I understand that when working with the Platform, I may enter or upload personal data of third parties (e.g., Client employees, contact persons, other Client users, other persons).

**Before entering such data, I undertake to:**

Ensure that the Client has a proper legal basis for processing the personal data of the specified persons and transferring them to gro.now (including obtaining the consent of the personal data subject, if required by law, or having other legal grounds).
If necessary – ensure that such persons themselves are properly notified of the processing of their personal data by the Client and gro.now, including through the Client's local acts or by other means provided for by law.

**By continuing to enter (upload) personal data of third parties into the Platform, I confirm and guarantee that:**

gro.now has the right to assume that when entering third-party data, the Client has ensured the obtaining of all necessary consents and notifications, and is not obliged to independently verify the availability of such consents, except in cases explicitly provided for by law.

The relations regarding the processing of personal data of such third parties (as a rule, Client employees/contacts) are governed by agreements between gro.now and the Client (including DPA/personal data processing agreement), as well as the Client's internal acts.

5. Purposes of Personal Data Processing

My personal data are processed for the following purposes:

1) Account Registration and Maintenance
- creation and administration of the User account;
- providing access to the Platform functionality for the Client;
- authentication and authorization, including the use of SSO providers (e.g., Google).
2) Fulfillment of Contracts between gro.now and the Client
- ensuring the operation of the gro.now Platform and services under the SaaS model;
- interaction with the Client and its Users regarding the use of the Platform, rates, services;
- exchange of documents, notifications, and other legally significant communications.
3) Communication and Support
- processing of User appeals and requests;
- providing technical and user support;
- notifications about changes in functionality, rates, terms of use, security.
4) Analytics, Development, and Improvement of Services
- internal analytics of Platform operation (on anonymized or aggregated data, where possible);
- improvement of interfaces, functionality, stability, and security of the Platform;
- testing new features and services.
5) Marketing and Informational Communications
- sending business and marketing messages about gro.now products and events (email, messengers, phone, etc.) subject to separate consent to advertising and within the limits of the law;
- accounting for consents/unsubscriptions from mailings and communication preferences.
6) Compliance with Legal Requirements and Protection of Rights
- fulfillment of mandatory legislative requirements (accounting, reporting, responses to requests from authorized bodies);
- ensuring information security, anti-fraud, and prevention of abuse;
- establishment, exercise, or defense of legal claims of gro.now, the Client, or third parties.

6. Personal Data Operations

Within the framework of the specified purposes, the Operator and persons engaged by it may carry out the following actions (operations) with my personal data:

collection, recording, systematization, accumulation, storage, clarification (updating, modification), use, viewing, transfer (provision, access), anonymization, blocking, deletion, and destruction, as well as other operations provided for by the current legislation of the Republic of Kazakhstan.

Processing may be carried out both with and without the use of automation tools.

7. Transfer of Personal Data to Third Parties and Cross-Border Transfer

I agree that for the achievement of the specified purposes, my personal data may be transferred to third parties to the extent necessary to perform their functions, including:

providers of IT infrastructure, hosting, cloud, and communication services;
providers of analytics, monitoring, notifications;
consultants, auditors, legal, and other professional advisors of gro.now, provided they comply with the confidentiality regime;
partners and subprocessors of gro.now, specified in the relevant legal documents on the website;
state bodies and other authorized bodies – in cases and in the manner provided for by law.

The infrastructure and certain contractors of gro.now may be located outside the Republic of Kazakhstan. I give consent to the cross-border transfer of my personal data provided that the Operator applies the necessary contractual and technical protection measures (minimization, encryption, access restriction, logging).

8. Term of Consent and Data Retention

This consent is valid:

during the entire period of existence of my Account in the Platform and fulfillment of contracts between gro.now and the Client on whose behalf I act;
as well as during the personal data retention periods established by the General Personal Data Processing Policy of gro.now and applicable law.

Upon expiration of the specified terms or when the processing purposes cease to exist, my personal data are subject to deletion or anonymization, except in cases where further storage is required by law or necessary to protect the rights of gro.now or third parties.

9. Withdrawal of Consent

I have the right to withdraw this consent in full or in part at any time by sending an appeal:

through the Platform functionality (if such option is available);
or by e-mail: t@gro.now, indicating my Full Name, contact details, and a description of exactly which consent and in which part I wish to withdraw.

The withdrawal of consent is effective for the future and does not affect the legality of processing carried out before the withdrawal was received.

I understand and agree that upon full withdrawal of consent necessary for registration and use of the Platform:

At the same time, gro.now has the right to continue processing some of my data on other legal grounds (fulfillment of law, protection of rights, accounting and reporting, proof of consent, etc.).

10. Personal Data Subject Rights

I have been informed of and understand my rights as a personal data subject, including the right to:

receive information about my personal data and access to it;
demand clarification, correction, or addition of outdated or inaccurate data;
demand deletion or restriction of data processing – in cases provided for by law;
object to certain types of processing (where permitted by law);
withdraw consent to personal data processing;
receive information about data recipients and retention periods within the limits established by law;
appeal the actions/inaction of the Operator regarding the processing of my personal data to the authorized state body and/or to court.

The procedure for exercising rights, as well as additional information about the purposes, grounds, timeframes, and measures for personal data protection, are set out in the General Personal Data Processing Policy of gro.now, available on the Website.

11. Final Confirmation

Having read this Consent, I confirm that:

the text of the Consent is understandable to me;
I act as a natural person – a representative of the Client and provide reliable data;
by checking the box and/or clicking the button “Register” / “Continue”, I voluntarily and knowingly give gro.now consent to the processing of my personal data on the terms specified above.