Data Processing Agreement

Data Processing Agreement

SALESCALING, in its capacity as Data Processor (hereinafter the "PROCESSOR"), will process personal data received from the CLIENT, as Data Controller (hereinafter the "CONTROLLER"), in relation to the execution of the Contract for the provision of Services, following the instructions and purposes determined by the CONTROLLER.

For the purposes of this Agreement, "CLIENT" refers to any natural or legal person or affiliated entity of the Client that has entered into a service provision contract with SALESCALING and processes personal data for which it is responsible to ensure the provision of services under the contract between them.

Both parties, in the exercise of their respective powers, agree to sign this Personal Data Processing Agreement (hereinafter, the "Agreement"), in compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, hereinafter "GDPR") and Organic Law 3/2018, of December 5, on Personal Data Protection and Guarantee of Digital Rights ("LOPDGDD"), in accordance with the following,

Stipulations

1. Purpose

1.1. The PROCESSOR, within the framework of this Agreement, will process personal data on behalf of the CONTROLLER in accordance with the terms and conditions established herein.

1.2. The purpose of the processing is the provision of the Services specified in the service provision contract that covers this Agreement.

1.3. The duration of the engagement will last as long as the contractual relationship between the parties is maintained and until the deletion of personal data as established in this Agreement.

1.4. In relation to the Agreement, the CONTROLLER is the person who determines the purposes and means for which the CONTROLLER's Data is processed by the processor (as defined below).

1.5. The personal data provided by the CONTROLLER to the PROCESSOR refer to the categories of data and data subjects indicated in Appendix I.

2. Obligations of the Data Processor

The PROCESSOR and all its personnel undertake the following obligations:

2.1. Use the personal data subject to processing, or those collected for inclusion, only for the purpose of this engagement. Under no circumstances may the data be used for its own purposes. 2.2. Process the data according to the documented instructions of the CONTROLLER. 2.3. If the PROCESSOR considers that any of the instructions infringe the GDPR, LOPDGDD, or any other data protection provision of the European Union or Member States, the PROCESSOR will immediately inform the CONTROLLER. 2.4. Not communicate the data to third parties, unless with the prior express written authorization of the CONTROLLER, in legally established and admissible cases. 2.5. The PROCESSOR may communicate the data to other processors of the same controller, in accordance with the CONTROLLER's instructions. In this case, the CONTROLLER will identify, in advance and in writing, the entity to which the data should be communicated, the data to be communicated, and the security measures to be applied to proceed with the communication. 2.6. The PROCESSOR will transfer personal data to a third country or an organization only under the documented instructions of the CONTROLLER. If the PROCESSOR must transfer such personal data to a third country or an international organization, pursuant to applicable European Union or Member State law, it will inform the CONTROLLER of that legal requirement in advance, unless such law prohibits it for important reasons of public interest. 2.7. Likewise, the PROCESSOR undertakes to return to the CONTROLLER, the medium or media containing the personal data, or to destroy them, at the latter's request, once the provision of services has ended, without retaining any copy thereof, unless otherwise established by the CONTROLLER.

2.8. Subcontracting.

a. The PROCESSOR may subcontract to third parties the execution of personal data processing activities for the proper provision of the services covered by this Agreement, including certain necessary technical and IT services and necessary auxiliary services.

b. Pursuant to the provisions of the GDPR and LOPDGDD, any subcontracting of the service carried out for the fulfillment of the contract that the PROCESSOR wishes to perform must be communicated to the CONTROLLER at the email address indicated in the Specific Conditions, indicating the processing activities intended to be subcontracted and clearly and unequivocally identifying the subcontractor company and its contact details. Subcontracting may be carried out if the CONTROLLER does not express its opposition within 5 days of the communication.

c. The list of authorized Sub-processors or providers is in Appendix I.

d. The subcontractor, who will also act as a processor, is equally obliged to comply with the obligations established in this document for the PROCESSOR and the instructions issued by the CONTROLLER.

e. It is the responsibility of the PROCESSOR to sign a new contract with the new processor so that it is subject to the same conditions and with the same formal requirements as itself, regarding the adequate processing of personal data and the guarantee of the rights of the data subjects. In the event of non-compliance by the sub-processor, the PROCESSOR will remain fully responsible to the CONTROLLER regarding the fulfillment of obligations.

2.9. The PROCESSOR may share the CONTROLLER's personal data with service providers or third-party companies, including artificial intelligence services, at the CONTROLLER's instruction. In such a case, since the PROCESSOR acts following the CONTROLLER's instructions, it will not need to give prior notice, and it will be the CONTROLLER who ensures that said provider complies with data protection guarantees and applicable regulations.

2.10. Maintain the duty of secrecy regarding personal data to which the PROCESSOR has had access by virtue of the services provided to the CONTROLLER, even after the relationship between them has ended.

2.11. Ensure that persons authorized to process personal data expressly and in writing commit to respecting confidentiality and complying with the corresponding security measures, of which they must be duly informed.

2.12. Keep available to the CONTROLLER the documentary evidence of compliance with the obligation established in the previous section.

2.13. Guarantee the necessary training in personal data protection for persons authorized to process such data.

2.14. Assist the CONTROLLER, taking into account the nature of the processing, through appropriate technical and organizational measures, whenever possible, so that the CONTROLLER can fulfill its obligation to respond to requests aimed at exercising the rights of data subjects.

2.15. When data subjects exercise their rights of access, rectification, erasure, and opposition, restriction of processing, data portability, and not to be subject to automated individual decisions, before the PROCESSOR, the latter must communicate it by email to the address indicated by the CONTROLLER. The communication must be made as soon as possible, making its best efforts to ensure it occurs within 3 working days from the receipt of the request, and will include, where appropriate, other information that may be relevant to resolve the request.

2.16. Right to information. It is the CONTROLLER's responsibility to facilitate the right to information at the time of data collection.

2.17. Notification of data security breaches

a. The PROCESSOR will notify the CONTROLLER, without undue delay, and in any case before the maximum period of 36 hours, and through a simple communication, of security breaches of the data under its responsibility of which it becomes aware, along with all relevant information and documentation of the incident.

b. Notification will not be necessary when it is unlikely that such a security breach will result in a risk to the rights and freedoms of natural persons.

c. The notification will include at least the following information:

  i. Description of the nature of the personal data security breach, including, where possible, the categories and approximate number of data subjects affected, and the categories and approximate number of personal data records affected.

  ii. The name and contact details of the data protection officer or other contact point where more information can be obtained.

  iii. Description of the likely consequences of the personal data security breach.

  iv. Description of the measures taken or proposed to address the personal data security breach, including, where appropriate, measures to mitigate its possible negative effects. If it is not possible to provide the information simultaneously, and to the extent that it is not, the information will be provided gradually without undue delay.

2.18. Support the CONTROLLER in carrying out data protection impact assessments, where appropriate.

2.19. Support the CONTROLLER in carrying out prior consultations with the supervisory authority, where appropriate.

2.20. Make available to the CONTROLLER all information necessary to demonstrate compliance with its obligations, as well as for the performance of audits or inspections carried out by the controller or another auditor authorized by it, when required.

2.21. Security Measures. The PROCESSOR undertakes to apply to personal data the necessary security measures to prevent their alteration, loss, unauthorized processing or access, taking into account the state of technology, the nature of the stored data, and the risks to which they are exposed, whether from human action or the physical or natural environment. In this regard, in accordance with Articles 24 and 32 of the GDPR, the PROCESSOR is obliged to have appropriate technical and organizational security measures implemented.

2.22. Specifically, the PROCESSOR will adopt the security measures established in Appendix I.

2.23. Data Destination. The PROCESSOR undertakes to destroy the data once the service has been completed. However, the PROCESSOR may retain a copy, with the data duly blocked, as long as liabilities may arise from the execution of the service.

3. Obligations of the Data Controller

The CONTROLLER undertakes to:

3.1. Be responsible for the personal data subject to processing.

3.2. Carry out a data protection impact assessment of the processing operations to be performed by the processor, where appropriate.

3.3. Guarantee the duty of information to data subjects in accordance with Articles 13 and 14 GDPR.

3.4. Carry out the necessary prior consultations.

3.5. Ensure, prior to and throughout the processing, compliance with the GDPR and LOPDGDD by the PROCESSOR.

3.6. Communicate changes in the basic data structure that imply or may imply a change in the application of security measures.

3.7. Provide the PROCESSOR with access only to data that is adequate, relevant, and not excessive, for the purpose of the contracted service.

3.8. The CONTROLLER must guarantee to the owner of the personal data, depending on the nature, scope, context, and purposes of the processing, based on the provisions of Article 24 of the GDPR, that it has adopted appropriate technical and organizational measures to maintain the security of the personal data provided.

3.9. It is the CONTROLLER's responsibility to communicate data security breaches to data subjects as soon as possible, when the breach is likely to result in a high risk to the rights and freedoms of natural persons.

The communication must be made in clear and plain language and must, at a minimum:

a. Explain the nature of the data breach.

b. Indicate the name and contact details of the data protection officer or other contact point where more information can be obtained.

c. Describe the likely consequences of the personal data security breach.

d. Describe the measures taken or proposed by the controller to address the personal data security breach, including, where appropriate, measures to mitigate its possible negative effects.

3.10. The CONTROLLER will ensure that service providers or third-party companies to whom the PROCESSOR communicates personal data under the CONTROLLER's instruction comply with data protection guarantees and other current regulations and is responsible to the PROCESSOR.

Appendix I to the Data Processing Agreement on processing details

1. Purpose(s) of processing:

To ensure the provision of the service(s) contracted by the CONTROLLER, in accordance with the Service Provision Contract. Such processing may include various technological services, such as the recording and transcription of calls and meetings, as well as the use of SDRs through AI Agents between the CONTROLLER and its employees or end customers.

2. Type of personal data provided by the CONTROLLER to the PROCESSOR:

1. Identification data (e.g., name and surname, phone number, email, etc.)
2. Professional and company data (e.g., position, company, sector of activity, professional contact details, user ID in internal systems)
3. System access and usage data (e.g., user identifiers, access logs, IP addresses, cookies, logs)
4. Technical and operational data.
5. Audio and video recordings of calls.
6. The Parties will not intentionally collect or process any special categories of data. The PROCESSOR will immediately report any unintentional receipt of special categories of data.

3. Categories of personal data processed by the PROCESSOR:

1. CONTROLLER's employees.
2. CONTROLLER's customers, potential customers, their employees, contacts, or end-users.

4. Type of processing performed

The Engagement will involve the following personal data processing activities:

1. Data storage and retention, recording, retrieval, and data entry.
2. Access and consultation of information
3. Voice recording.
4. Information processing using AI.
5. Audio transcription using AI.
6. Semantic text analysis.
7. Data analysis and processing
8. Integration with AI platforms or third-party systems
9. Data anonymization or pseudonymization.
10. Data deletion or destruction.
11. Data updating, including correction, adaptation, alteration, alignment, and combination.

5. Security measures

Category | Implemented security measure

Organizational measures

• Periodic security assessments.
• Secure and automated processes (CI/CD).

Technical measures

• Data encryption at rest and in transit.
• Session tokens.
• Antivirus scanning.
• Protection against attacks (injection, XSS, SSRF).

Access control measures

• Authentication by trusted providers and OTP.
• Role-based authorization (OpenFGA).
• 2FA on administrative interfaces.

Continuity and recovery measures

• Automated deployments with <10 min recovery.
• Monitoring and verification of configurations.
• Periodic backups.

6. Authorized Sub-processors