Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service or other applicable agreement between Agentsapp and the customer using the Services ("Customer"). It governs solely the processing of Personal Data that Agentsapp carries out on behalf of the Customer. In the event of a conflict regarding data protection, this DPA prevails with respect to that subject matter; the financial liability regime remains subject to the main agreement unless otherwise validly and expressly agreed.

1. Purpose and roles

This DPA applies when Agentsapp processes Personal Data on behalf of the Customer. Agentsapp acts as a data processor or processing service provider; if the Customer in turn acts on behalf of a third party, Agentsapp may act as a sub-processor.

The terms Personal Data, processing, data controller and data processor shall be interpreted in accordance with applicable regulations. In Argentina, particular consideration shall be given to Law No. 25,326 and its supplementary regulations.

2. Instructions and purpose

Agentsapp will process Personal Data to provide, maintain, secure and support the Services in accordance with the agreement, the Customer's configuration and its documented instructions. If an instruction is manifestly contrary to applicable regulations, Agentsapp may suspend it while the situation is clarified.

Agentsapp does not use the Customer's private content to train its own general models. The use of AI providers to generate responses or execute functions of the Service is described in the Subprocessor List.

3. Customer responsibilities

The Customer determines the purposes of the processing it configures and is responsible for having the legal bases, notices, authorizations and rights necessary to collect, use, disclose and entrust Agentsapp with the processing of the Personal Data.

• the lawfulness of the databases, contacts, content and instructions it incorporates;

• the rules applicable to campaigns, messages and contacts with end users;

• the configuration of the Service in accordance with its activity and legal restrictions; and

• not instructing Agentsapp to carry out processing contrary to law.

4. Confidentiality and security

Agentsapp limits access to Personal Data to the personnel and providers who need to be involved in providing the Service and maintains confidentiality obligations and technical and organizational measures that are reasonable and proportionate to the risk.

The public description of the architecture and controls currently disclosed by Agentsapp is available in Security & Data Processing. No system can guarantee absolute security.

5. Sub-processors

The Customer grants Agentsapp general authorization to use the sub-processors necessary to provide the Services. The current list of providers acting in that role, together with their function and main location, is published in the Subprocessor List.

Agentsapp may add or replace sub-processors and update that list. If applicable regulations require prior notice, Agentsapp will provide it through a reasonable means. The Customer may raise a reasoned objection on data protection grounds and the parties will seek a reasonable alternative.

Integrations that the Customer connects directly, such as Meta, Google Calendar, Kommo, Tiendanube, WooCommerce, GVAMax or its own APIs, operate under their own terms and are not automatically considered sub-processors engaged by Agentsapp.

6. International transfers

The Services use providers that may process information outside Argentina. When applicable regulations require specific safeguards for an international transfer, Agentsapp will use the appropriate contractual mechanisms or other legally valid safeguards.

7. Data subject rights

If Agentsapp receives a request for access, rectification, updating, deletion or another right with respect to data processed on behalf of the Customer, it may refer the request to the Customer and will provide reasonable assistance so that the Customer can respond to it.

When a request requires technical intervention by Agentsapp, it may be handled through manual or technical processes depending on the system affected. Agentsapp will not respond on behalf of the Customer except upon valid instruction or legal requirement.

8. Security incidents

Agentsapp will notify the Customer without undue delay after becoming aware of a confirmed security incident affecting the Customer's Personal Data and, as a contractual rule, within 72 hours of becoming so aware, unless applicable regulations or a valid specific agreement require a shorter period.

The notification will include the reasonably available information regarding the nature of the incident, the data potentially affected and the measures taken or planned. The notification does not constitute an admission of fault or liability.

9. Retention, return and deletion

While the account is active, Agentsapp retains Personal Data to the extent necessary to operate the Service, maintain the history and contracted features, comply with valid instructions and meet legal, security or dispute resolution obligations.

Cancellation of a subscription does not currently result in the automatic and immediate deletion of all data. Valid requests for return or deletion may require manual processing in databases, files, credentials and integrations, and will be handled within a reasonable period depending on the technical and legal scope of the request.

The daily database backups managed by Supabase may retain a temporary copy during their rotation cycle, currently of up to seven days for the plan used by Agentsapp. Files in Storage and data processed by external providers are additionally governed by the mechanisms and policies of the corresponding system or provider.

When a legal obligation requires certain information to be retained, it may be kept restricted to that purpose. Agentsapp will update this section when it implements different automatic retention or deletion periods.

10. Information and audits

Upon reasonable request, Agentsapp will make available sufficient information about its processing and security practices to respond to due diligence processes. An additional audit will proceed when required by law, when there is a material incident or when the available documentation is reasonably insufficient.

Any audit must be coordinated with reasonable notice, protect the information of other customers, avoid undue interference with operations and be paid for by the Customer unless a material breach by Agentsapp is proven.

11. Liability

Liability arising from this DPA forms part of the total liability under the main agreement and is subject to the same exclusions and financial limits set forth therein.

This DPA does not create unlimited liability or a separate financial cap merely because it governs privacy, confidentiality or security. Any higher special cap must be expressly agreed in writing. Nothing is limited that a mandatory rule of law does not permit to be limited.

12. Term

This DPA will remain in effect for as long as Agentsapp processes Personal Data on behalf of the Customer. Obligations that by their nature must continue —including confidentiality, assistance, security and deletion— will survive for as long as necessary.

The governing law and jurisdiction set forth in the main agreement apply.

Annex A · Processing details

Annex B · Incorporated documents

• Terms of Service / applicable commercial agreement.

• Subprocessor List

• Security & Data Processing