Data Processing Agreement
Klienz Platform · SekinSoft · Version 1 · Supplementary to the Service Agreement
This translation is provided for convenience. The Spanish version is the legally binding one.
1. Parties and Roles
This Data Processing Agreement ("DPA") is entered into by and between the Customer ("the Controller") and SekinSoft, owner of the Klienz platform ("the Processor"). It supplements the Service Agreement and prevails in matters of data protection.
2. Purpose
The Processor processes personal data on behalf of the Controller for the sole purpose of providing the Klienz service (a CRM with WhatsApp, Telegram and Instagram/Messenger messaging). The Processor acquires no rights whatsoever in such data and does not process it for its own purposes.
3. Controller's Instructions
The Processor processes personal data solely in accordance with the Controller's documented instructions, which are given through the use of the platform's features. If an instruction infringes applicable regulations, the Processor will inform the Controller.
4. Nature, Purpose and Duration
Nature: storage, organization, retrieval and sending/receiving of messages. Purpose: the Controller's sales and customer service management. Duration: for as long as the service remains in effect, plus any legal retention periods.
5. Categories of Data and Data Subjects
Data processed: contact and identification data (name, phone number, email, messaging identifiers) and the content of conversations. Data subjects: the Controller's contacts, prospects and customers uploaded to the platform.
6. Processor's Obligations
The Processor shall: (a) process the data only to the extent necessary; (b) ensure that authorized persons have committed to confidentiality; (c) provide reasonable assistance to the Controller; and (d) not disclose the data to third parties except where required by law or instructed by the Controller.
7. Security Measures
The Processor implements reasonable technical and organizational measures: encryption in transit, role-based access control, isolation of data by customer (each tenant in its own database), periodic backups and event logging, appropriate to the state of the art and to the risk.
8. Sub-processors
The Controller authorizes the Processor to engage sub-processors to provide the service, including: infrastructure/hosting providers, messaging platforms (Meta/WhatsApp, Telegram) and artificial intelligence model providers. The Processor remains liable to the Controller and will give notice of relevant changes in sub-processors.
9. Assistance to the Controller
To the extent permitted by the platform's features, the Processor will assist the Controller in responding to requests from data subjects exercising their rights (access, rectification, erasure, objection) and in fulfilling its security and impact assessment obligations.
10. Breach Notification
The Processor will notify the Controller without undue delay after becoming aware of a security breach affecting personal data processed on its behalf, providing the information reasonably available so that the Controller can fulfill its notification duties.
11. Return and Deletion
Upon termination of the service, the Processor will delete or return the personal data in accordance with the procedure published at https://klienz.sekinsoft.com/eliminar-datos.html, unless it is legally required to retain it. The Controller may request deletion at any time through the same procedure.
12. Information and Audits
The Processor will make available to the Controller the reasonable information necessary to demonstrate compliance with this DPA. The Processor's general processing of data is described in the Privacy Policy, available at https://klienz.sekinsoft.com/privacidad.html.
13. International Transfers
Where the processing involves international data transfers (for example, due to the location of sub-processors), the Processor will adopt the appropriate safeguards required by applicable regulations.
14. Liability and Governing Law
The liability of the parties and the governing law are governed by the Service Agreement, of which this DPA forms an integral part. In the event of a conflict regarding data protection, this DPA prevails.