Data processing

1. Definitions

For the purposes of this Data Processing Agreement (hereinafter, "DPA"), the following definitions shall apply, in line with the General Data Protection Regulation (EU) 2016/679 ("GDPR"):

1.1. Data Controller: VIUZI ESP, SL, which operates the Viuzi platform and determines the purposes and means of processing personal data.

1.2. Data Processor: Any natural or legal person, public authority, agency or other body that processes personal data on behalf of the Data Controller.

1.3. Sub-processor: Any data processor engaged by another data processor to carry out specific processing activities on behalf of the Data Controller.

1.4. Personal data: Any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

1.5. Processing: Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

1.6. Data subject: The natural person whose personal data is subject to processing. In the context of Viuzi, this includes the natural persons acting on behalf of Service Providers, Service Requesters and other platform users.

1.7. Personal data breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

2. Scope and Purpose of Data Processing

2.1. Scope of Application

This DPA applies to all processing of personal data carried out in the context of operating the Viuzi platform, a services marketplace that connects Service Providers with Service Requesters.

2.1bis. Nature of the Document

This document constitutes VIUZI ESP, SL's public transparency policy regarding the processing of personal data by sub-processors. The binding legal instruments are the bilateral DPAs concluded with each sub-processor, available for consultation upon request to privacy@viuzi.com. This document forms an integral part of Viuzi's General Terms of Use and Privacy Policy. Notwithstanding its nature as a public transparency document, this Agreement, as it forms an integral part of the General Terms of Use and Privacy Policy accepted by the User, has binding contractual force in accordance with Art. 28(3) GDPR.

2.2. Categories of Personal Data Processed

• Identification data: full name, email address, telephone number, profile photograph.
• Authentication data: Google OAuth 2.0 authentication tokens, session identifiers.
• Professional data: service descriptions, portfolio, service areas, ratings, reviews.
• Transaction data: job history, invoices, payment amounts, payment methods (processed by Stripe).
• Communication data: messages between users through the platform.
• Technical data: IP addresses, device type, platform usage data, activity logs.
• Geolocation data: GeoJSON coordinates (longitude, latitude), postal addresses, service area locations with coverage radius, facility locations, job site address.

2.3. Categories of Data Subjects

• Service Providers (SERVICE_PROVIDER_ADMIN and members of their organisations).
• Service Requesters (SERVICE_REQUESTER_ADMIN and members of their organisations).
• Platform administrators.

2.4. Processing Purposes

Personal data is processed exclusively for the following purposes:

• User registration and authentication on the platform.
• Management of user and organisation profiles.
• Publication and management of service jobs.
• Facilitation of communication between Providers and Requesters.
• Payment processing and settlement.
• Sending service-related notifications (email and push notifications).
• Content moderation and fraud prevention.
• Generation of aggregated and anonymised statistics for service improvement.
• Compliance with legal and regulatory obligations.

2.5. Purposes and Legal Bases Table

2.6. Viuzi's Dual Role as Controller and Processor

Viuzi may act as (a) Data Controller with respect to the data it manages directly (accounts, transactions), and (b) Data Processor when business users transfer third-party data through the Platform. For scenario (b), business users will be the Data Controllers and must ensure that they have an adequate legal basis.

2.6bis. Viuzi as Data Processor

Where Professional Users act as Data Controllers and Viuzi processes personal data on their behalf (scenario (b) above), the following additional provisions shall apply in accordance with Art. 28 GDPR: (a) Viuzi will process personal data only in accordance with the Controller's documented instructions, including those relating to international transfers; (b) Viuzi will ensure that persons authorised to process personal data have committed themselves to confidentiality; (c) Viuzi will take all security measures required under Art. 32 GDPR as described in Section 6; (d) Viuzi will not engage another processor without the Controller's prior general authorisation, in accordance with the procedure in Section 4.4; (e) Viuzi will assist the Controller in fulfilling data subjects' rights requests; (f) Viuzi will assist the Controller in fulfilling obligations under Articles 32 to 36 GDPR; (g) At the Controller's choice, Viuzi will delete or return all personal data upon completion of the services, in accordance with Section 12; (h) Controller's audit right: Viuzi will make available to the Controller all information necessary to demonstrate compliance with the obligations in Art. 28, and will allow and contribute to audits, including inspections, by the Controller or an auditor mandated by the Controller. Audits will be carried out with a minimum of thirty (30) days' advance notice, during business hours, and without interfering with normal Platform operations. Audit costs shall be borne by the requesting Controller.

2.7. Exclusively B2B Platform and Protection of Minors

Viuzi is an exclusively B2B platform for legal entities. Data of persons under 18 years of age is not intentionally collected. If data of minors is detected, it will be immediately deleted in accordance with Article 8 of the GDPR.

3. Obligations of the Data Controller (VIUZI ESP, SL / Viuzi)

3.1. Lawfulness of Processing

VIUZI ESP, SL ensures that the processing of personal data is carried out in accordance with at least one of the legal bases established in Article 6 of the GDPR:

• Consent of the data subject (Art. 6.1.a).
• Performance of a contract to which the data subject is a party (Art. 6.1.b).
• Legitimate interests of the Data Controller (Art. 6.1.f).
• Compliance with a legal obligation (Art. 6.1.c).

3.2. Transparency and Information

VIUZI ESP, SL commits to:

• Providing data subjects with clear and accessible information about the processing of their personal data, in accordance with Articles 13 and 14 of the GDPR.
• Keeping the platform's Privacy Policy up to date.
• Informing data subjects of any substantial changes to data processing practices.

3.3. Data Protection by Design and by Default

VIUZI ESP, SL implements data protection by design and by default measures (Art. 25 GDPR), including:

• Data minimisation: only data strictly necessary for each purpose is collected.
• Storage limitation: data is retained only for as long as necessary.
• Access limitation: only authorised personnel have access to personal data.

3.4. Records of Processing Activities

VIUZI ESP, SL maintains a record of processing activities under its responsibility, in accordance with Article 30 of the GDPR, which includes the description of categories of data subjects, personal data, purposes, recipients and international transfers.

3.5. Impact Assessment

VIUZI ESP, SL will carry out Data Protection Impact Assessments (DPIAs) in accordance with Article 35 of the GDPR where the processing is likely to result in a high risk to the rights and freedoms of natural persons.

3.6. Data Protection Officer

VIUZI ESP, SL has assessed its processing activities in accordance with Article 37 of the GDPR and has determined that, given the current volume of processing, the mandatory appointment of a DPO is not required. In particular, it has been assessed that: (a) Viuzi's main activity is technological intermediation, not large-scale data processing; (b) geolocation data is limited to service areas voluntarily declared; (c) special categories of data are not processed systematically. The designated specialist external contact point for data protection is: privacy@viuzi.com. This assessment is reviewed annually or when significant changes in processing activities occur. VIUZI ESP, SL commits to formally designating a DPO when the volume or nature of processing so requires.

The assessment specifically considers that the processing of geolocation data (GeoJSON coordinates, service areas) is limited to areas declared by the Providers themselves and does not constitute regular and systematic monitoring of persons on a large scale within the meaning of Article 37(1)(b). However, if the volume of users or the precision of geolocation tracking increases significantly, VIUZI ESP, SL will designate a DPO.

It is acknowledged that the use of Amazon Rekognition for image moderation could involve the processing of biometric data (Art. 9 GDPR) if faces are analysed. VIUZI ESP, SL will periodically assess the need to formally designate a DPO, particularly in relation to the scale of use of AI systems for moderation.

Amazon Rekognition Configuration. Amazon Rekognition is used exclusively for the detection of inappropriate content (moderation categories: nudity, violence, suggestive content, drugs, tobacco, alcohol, gambling) and is NOT configured to perform facial recognition, biometric identification or facial feature analysis. No biometric data within the meaning of Art. 9(1) GDPR is processed by this tool. This configuration will be reviewed periodically and any change involving the processing of biometric data will require a prior impact assessment (DPIA) and, where applicable, explicit consent.

4. Sub-Processors

4.1. General Authorisation

The Data Controller authorises the following sub-processors for the processing of personal data in connection with the operation of the Viuzi platform. The Data Controller commits to informing data subjects about any addition or replacement of sub-processors.

4.2. List of Authorised Sub-Processors

4.2.1. Amazon Web Services (AWS)

• Legal entity: Amazon Web Services EMEA SARL
• Address: 38 Avenue John F. Kennedy, L-1855 Luxembourg
• Services provided:
  • Cloud hosting (EC2, ECS, Fargate)
  • Email service (Amazon SES)
  • Object storage (Amazon S3)
  • Cache service (Amazon ElastiCache / Redis)
  • Virtual private network (Amazon VPC)
  • Container management and deployment (AWS CDK, ECR)
• Processing location: EU-West-1 (Ireland), European Union
• Legal basis for transfer: Processing within the EEA; no additional transfer mechanism required.
• Security measures: ISO 27001, SOC 1/2/3 certifications, encryption in transit and at rest, VPC isolation.

4.2.2. MongoDB Inc.

• Legal entity: MongoDB, Inc.
• Address: 1633 Broadway, 38th Floor, New York, NY 10019, United States
• Services provided:
  • Database hosting (MongoDB Atlas)
  • Full-text search (Atlas Search)
  • Automated backups
• Processing location: EU-West-1 (Ireland), European Union (MongoDB Atlas cluster configured in the EU region)
• Legal basis for transfer: Processing within the EEA via EU-configured cluster. For any support access from outside the EEA: Standard Contractual Clauses (SCC) adopted by the European Commission.
• Security measures: TLS encryption in transit, encryption at rest (AES-256), SCRAM authentication, role-based access, access auditing.

4.2.3. Stripe, Inc.

• Legal entity: Stripe, Inc.
• Address: 354 Oyster Point Blvd, South San Francisco, CA 94080, United States
• Services provided:
  • Payment processing
  • Payment method verification (SetupIntents)
  • Post-job-completion payment settlement
  • Connected account management (Stripe Connect)
  • Subscription and plan management
• Processing location: EU (primary processing) + US (backup infrastructure)
• Legal basis for transfer: EU-US Data Privacy Framework (DPF), supplemented by Standard Contractual Clauses (SCC) adopted by the European Commission pursuant to Implementing Decision (EU) 2021/914.
• Security measures: PCI DSS Level 1 certification, AES-256 encryption, card data tokenisation, real-time fraud monitoring.

4.2.4. Google LLC

• Legal entity: Google LLC
• Address: 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States
• Services provided:
  • User authentication (Google OAuth 2.0 / Google Sign-In)
  • Identity verification via Google ID tokens
• Processing location: EU (primary processing, European data centres) + US
• Legal basis for transfer: EU-US Data Privacy Framework (DPF), supplemented by Standard Contractual Clauses (SCC) adopted by the European Commission.
• Security measures: ISO 27001, SOC 2/3 certifications, encryption in transit and at rest, vulnerability programme (Project Zero).

4.2.5. Google Firebase Cloud Messaging (FCM)

• Legal entity: Google Ireland Limited
• Services provided:
  • Push notification delivery to Android and web devices
• Processing location: Ireland (EU) + US
• Legal basis for transfer: EU-US Data Privacy Framework + Standard Contractual Clauses (SCC).
• Security measures: ISO 27001, SOC 2/3 certifications, encryption in transit and at rest.

4.2.6. Apple Push Notification Service (APNS)

• Legal entity: Apple Distribution International Ltd. (Ireland, EU) and Apple Inc. (Cupertino, California, US)
• Services provided:
  • Push notification delivery to iOS devices
• Processing location: Ireland (EU) + US
• Note: Push notification data may be processed by both Apple Distribution International Ltd. (Ireland, EU) and Apple Inc. (Cupertino, California, US) for notification routing. Apple Inc. is certified under the EU-US Data Privacy Framework (DPF). Additionally, Standard Contractual Clauses (SCC) are applied as a complementary transfer mechanism for any data that reaches Apple's US infrastructure.
• Legal basis for transfer: EU-US Data Privacy Framework (DPF) + Standard Contractual Clauses (SCC).
• Security measures: Encryption in transit, differential privacy policies, SOC 2 certifications.

4.2.7. Amazon Rekognition

• Legal entity: Amazon Web Services EMEA SARL
• Services provided:
  • Automated image moderation
• Processing location: EU-West-1 (Ireland)
• Legal basis for transfer: Processing within the EEA; SCC (Decision 2021/914) as a complementary mechanism.
• Security measures: ISO 27001, SOC 1/2/3 certifications, encryption in transit and at rest, VPC isolation.

4.2.8. Amazon Comprehend

• Legal entity: Amazon Web Services EMEA SARL
• Services provided:
  • Text toxicity analysis
• Processing location: EU-West-1 (Ireland)
• Legal basis for transfer: Processing within the EEA; SCC (Decision 2021/914) as a complementary mechanism.
• Security measures: ISO 27001, SOC 1/2/3 certifications, encryption in transit and at rest, VPC isolation.

4.3. Sub-Processor Obligations

Each sub-processor is contractually obligated to:

• Process personal data only in accordance with the Data Controller's documented instructions.
• Ensure that persons authorised to process personal data have committed themselves to confidentiality. Confidentiality obligations are both contractual (through specific clauses in employment contracts and NDAs) and statutory. Periodic checks are carried out and there is a mandatory annual privacy and data protection training programme for all personnel with access to production data.
• Implement appropriate technical and organisational measures in accordance with Article 32 of the GDPR.
• Not engage another sub-processor without the Data Controller's prior authorisation. The same data protection obligations established in this Agreement shall be contractually imposed on any additional sub-sub-processors, in accordance with Article 28(4) of the GDPR.
• Assist the Data Controller in fulfilling obligations relating to data subjects' rights.
• Delete or return all personal data upon completion of service provision.
• Assist the Data Controller in carrying out Data Protection Impact Assessments (DPIAs) and prior consultations with the supervisory authority in accordance with Articles 35 and 36 of the GDPR.
• In the event of receiving a public authority request that conflicts with the Controller's instructions, the sub-processor must: (a) notify VIUZI ESP, SL before complying, unless expressly prohibited by law, and (b) challenge requests it considers disproportionate or incompatible with the GDPR.

4.4. Notification of Changes to Sub-Processors

VIUZI ESP, SL will notify platform users at least 30 days in advance before incorporating new sub-processors or replacing existing ones, providing information about the identity of the new sub-processor, the services it will provide and the processing location. Users will have the opportunity to object to the change within that period.

If the User objects to a change of sub-processor, they may: (a) request that their personal data not be processed by the new sub-processor, to the extent technically feasible; or (b) terminate their contractual relationship with VIUZI ESP, SL with immediate effect, including the export of their data in accordance with Article 20 of the GDPR, without any penalty. VIUZI ESP, SL will not proceed with the sub-processor change with respect to the objecting User's data until the objection is resolved or the termination is executed.

5. International Data Transfers (Chapter V GDPR)

5.1. General Principle

VIUZI ESP, SL ensures that any transfer of personal data to a third country or to an international organisation is carried out in accordance with the provisions of Chapter V of the GDPR, ensuring that the level of protection of natural persons guaranteed by the GDPR is not undermined.

5.2. Transfer Mechanisms Used

5.2.1. Adequacy Decisions (Art. 45 GDPR)

• United States: The EU-US Data Privacy Framework (DPF), adopted through the European Commission's Adequacy Decision of 10 July 2023, constitutes the primary basis for data transfers to US entities certified under that framework (Stripe, Inc. and Google LLC).

5.2.2. Standard Contractual Clauses (Art. 46.2.c GDPR)

• The Standard Contractual Clauses (SCC) adopted through Commission Implementing Decision (EU) 2021/914 are used as a complementary transfer mechanism when data is transferred to sub-processors outside the EEA.
• The relevant SCC modules are applied:
  • Module 2: Controller to Processor (applicable to Stripe and Google).
  • Module 3: Processor to Sub-Processor (applicable where sub-processors engage their own sub-processors).

The Standard Contractual Clauses are incorporated by reference into this Agreement as Annex II. The full text of the applicable SCCs (Module 2: Controller to Processor; Module 3: Processor to Sub-Processor) is available in Commission Implementing Decision (EU) 2021/914 and in the bilateral agreements with each sub-processor, available upon request.

5.2.3. DPF Contingency Clause

In the event that the EU-US Data Privacy Framework is invalidated by the Court of Justice of the European Union, the Standard Contractual Clauses (SCC) will become the primary transfer mechanism without the need to renegotiate this agreement.

5.2.4. Supplementary Measures

In accordance with the recommendations of the European Data Protection Board (EDPB), VIUZI ESP, SL implements the following supplementary measures:

• Technical measures: Encryption of data in transit (TLS 1.2+) and at rest (AES-256), pseudonymisation where possible, and strict access controls.
• Organisational measures: Periodic assessments of the legislation of the destination country, contractual clauses preventing mass access to data, and policies for notifying government data requests.
• Contractual measures: Commitment by sub-processors to challenge disproportionate government access requests and to notify the Data Controller of such requests.

5.3. Processing within the EEA

The majority of personal data processing is carried out within the European Economic Area (EEA):

• Application servers (AWS), the database (MongoDB Atlas) and cache (ElastiCache/Redis) are located in the EU-West-1 region (Ireland).
• VIUZI ESP, SL prioritises the selection of sub-processors that offer EEA-based processing options.

5.4. Transfer Impact Assessments

VIUZI ESP, SL carries out Transfer Impact Assessments (TIAs) for each data transfer to a third country, documenting:

• The nature of the data transferred.
• The applicable legislation in the destination country.
• The safeguards provided by the transfer mechanism.
• The supplementary measures implemented.

6. Technical and Organisational Security Measures (Art. 32 GDPR)

VIUZI ESP, SL implements the following technical and organisational measures to ensure an appropriate level of security relative to the risk of processing:

6.1. Encryption

• Encryption in transit: All communications between clients (mobile and web applications) and platform servers are made using TLS 1.2 or higher. Unencrypted connections are automatically rejected.
• Encryption at rest: Data stored in MongoDB Atlas is encrypted using AES-256. Objects stored in Amazon S3 are encrypted using server-side encryption (SSE-S3 or SSE-KMS). Data in Amazon ElastiCache (Redis) is encrypted at rest and in transit.

6.2. Authentication and Access Control

• Password hashing: User passwords are stored using robust hashing algorithms with salting in accordance with current industry standards, ensuring that original passwords cannot be recovered.
• JWT token-based authentication:
  • Access tokens have a validity of 30 minutes.
  • Refresh tokens have a validity of 7 days.
  • Tokens are invalidated following password changes through timestamp comparison.
• Google OAuth 2.0 authentication: Users authenticate via server-verified Google ID tokens.
• Role-Based Access Control (RBAC): The platform implements differentiated roles (SERVICE_PROVIDER_ADMIN, SERVICE_REQUESTER_ADMIN, PLATFORM_ADMIN) with specific permissions for each role. The role is assigned once and is immutable.
• Multi-factor authentication (MFA): All administrative access to production systems (AWS console, MongoDB Atlas panel, Stripe dashboard, code repositories) requires multi-factor authentication (MFA) using TOTP (Time-based One-Time Password). Access without MFA to production environments is prohibited.

6.3. Rate Limiting and Access Control

• Rate Limiting: The API implements a limit of 30 requests per 5-minute window per user to prevent abuse and brute-force attacks.
• Distributed Locking: Redis is used to implement distributed locks that prevent race conditions in critical operations (payments, job assignment).

6.4. Infrastructure Security

• Network isolation (AWS VPC): Platform services run within an AWS Virtual Private Cloud (VPC), with private subnets for database and cache services, and public access limited to load balancers.
• MongoDB TLS Encryption: All connections to MongoDB Atlas are made using TLS, ensuring that data in transit between the application and the database is encrypted.
• Environment separation: Development and production environments are completely separated, with isolated Redis keys and configurations for each environment.

6.5. Security Reviews

• Periodic security reviews: VIUZI ESP, SL conducts periodic reviews of infrastructure security configurations, including review of firewall rules, access permissions and encryption configurations, including vulnerability analysis, penetration testing and formal security audits at least annually, in accordance with Article 32(1)(d) of the GDPR.
• Dependency updates: Software dependencies are regularly updated to apply security patches.
• Log monitoring: Access and activity logs are maintained that enable the detection of anomalous activities.

6.6. Personnel Access Management

• Access to production systems is restricted to strictly necessary personnel.
• The principle of least privilege is applied to all access.
• All personnel with access to personal data are subject to confidentiality obligations.

6.7. Resilience and Continuity

VIUZI ESP, SL implements measures to ensure the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident (Art. 32(1)(c) GDPR), including: automated encrypted backups (maximum retention 90 days), disaster recovery (DR) procedures, and internally defined Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO). Pseudonymisation is applied to analytical and aggregated usage data in accordance with Art. 32(1)(a).

7. Personal Data Breach Notification (Arts. 33 and 34 GDPR)

7.1. Notification to the Supervisory Authority

In the event of a personal data breach, VIUZI ESP, SL will notify the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) without undue delay and, at the latest, within 72 hours of becoming aware of the breach, in accordance with Article 33 of the GDPR.

The notification will include, at a minimum:

• The nature of the breach, including the categories and approximate number of data subjects and records affected.
• The name and contact details of the Data Protection Officer or privacy contact point.
• The likely consequences of the breach.
• The measures taken or proposed to address the breach and mitigate its effects.

7.2. Communication to Data Subjects

Where the data breach is likely to result in a high risk to the rights and freedoms of natural persons, VIUZI ESP, SL will communicate the breach to the data subject without undue delay, in accordance with Article 34 of the GDPR, providing:

• A clear and comprehensible description of the nature of the breach.
• Recommendations on the measures that the data subject can take to protect themselves.
• The measures taken by VIUZI ESP, SL to mitigate the effects of the breach.

7.3. Sub-Processor Obligations

Sub-processors are contractually obligated to notify VIUZI ESP, SL of any data breach without undue delay and, in any case, within 24 hours of detection, providing all information necessary for VIUZI ESP, SL to fulfil its notification obligations.

7.4. Breach Register

VIUZI ESP, SL maintains a register of all personal data breaches, including the facts relating to the breach, its effects and the corrective measures taken, regardless of whether the breach required notification to the supervisory authority.

8. Assistance with Data Subjects' Rights

8.1. Rights Recognised

VIUZI ESP, SL assists data subjects in exercising the following rights under the GDPR:

• Right of access (Art. 15): Obtain confirmation of whether personal data is being processed and, where applicable, access to that data.
• Right to rectification (Art. 16): Request the correction of inaccurate personal data.
• Right to erasure (Art. 17): Request the deletion of personal data ("right to be forgotten").
• Right to restriction of processing (Art. 18): Request the restriction of processing in certain circumstances.
• Right to data portability (Art. 20): Receive personal data in a structured, commonly used and machine-readable format. The exercise of the right to portability during the contract period will be in JSON or CSV format, with a maximum delivery period of 30 days from the request.
• Right to object (Art. 21): Object to processing based on legitimate interests.

8.2. Exercise Procedure

Data subjects may exercise their rights via:

• Email to: privacy@viuzi.com
• Through the account settings on the Viuzi platform.

VIUZI ESP, SL will respond to requests without undue delay and, in any case, within one month of receipt of the request, in accordance with Article 12.3 of the GDPR. This period may be extended by two additional months for complex or numerous requests, with the data subject being informed.

8.3. Sub-Processor Assistance Obligation

Sub-processors are contractually obligated to assist VIUZI ESP, SL in responding to data subjects' rights requests, providing the necessary information and technical capabilities.

8.4. Automated Decisions and Data Subjects' Rights

Automated moderation systems (Amazon Rekognition, Amazon Comprehend) may produce decisions that affect the user's access to the Platform. In accordance with Article 22 of the GDPR, users have the right to: (a) human intervention, (b) express their point of view, and (c) contest the decision. Additionally, VIUZI ESP, SL complies with the obligations of Regulation (EU) 2024/1689 (AI Act) as a deployer of AI systems.

9. Data Retention and Erasure

9.1. Retention Periods

VIUZI ESP, SL applies the following personal data retention periods:

9.2. Data Erasure

Upon expiry of the retention period, or following a valid erasure request from the data subject, VIUZI ESP, SL will proceed to:

• Securely delete personal data from production systems.
• Request sub-processors to delete personal data from their systems.
• Anonymise data that must be retained by legal obligation, so that it does not allow identification of the data subject.

9.3. Backups

Data will be deleted from active systems within 30 days of the request. Data in backups will be deleted in the next rotation cycle (maximum 90 additional days). During this period, data in backups is technically segregated, is not accessible for active operations, and will not be restored. VIUZI ESP, SL ensures that backups are encrypted and that deleted data is not restored from backups after deletion from the production system.

10. Audit Rights

10.1. Audit by the Data Controller

VIUZI ESP, SL has the right to conduct audits, including inspections, of sub-processors to verify compliance with the obligations established in this DPA and in the GDPR.

10.2. Sub-Processor Cooperation

Sub-processors are obligated to:

• Make available to VIUZI ESP, SL all information necessary to demonstrate compliance with the obligations established in Article 28 of the GDPR.
• Allow and contribute to the conduct of audits, including inspections, by VIUZI ESP, SL or an authorised auditor.
• Immediately inform VIUZI ESP, SL if, in their opinion, a processing instruction infringes the GDPR or other data protection provisions.

10.3. Third-Party Certifications and Audits

VIUZI ESP, SL accepts audit reports and certifications from recognised third parties (ISO 27001, SOC 2, PCI DSS) submitted by sub-processors as evidence of compliance with technical and organisational measures, without prejudice to its right to conduct additional audits where it considers this necessary.

Certification mechanisms approved pursuant to Article 42 of the GDPR or adherence to codes of conduct approved pursuant to Article 40 of the GDPR will also be accepted as evidence of compliance.

11. Liability and Indemnification

11.1. Data Controller Liability

VIUZI ESP, SL is responsible for ensuring that the processing of personal data is carried out in accordance with the GDPR and this DPA. VIUZI ESP, SL will be liable for damages caused by processing that infringes the GDPR, in accordance with Article 82 of the GDPR.

11.2. Sub-Processor Liability

Each sub-processor will be liable for damages caused by processing only if it has not complied with GDPR obligations directed specifically at processors, or if it has acted outside or contrary to the Data Controller's lawful instructions.

11.3. Indemnification

• Each party shall indemnify the other for any damage, cost, claim or penalty arising from the breaching party's failure to comply with the obligations established in this DPA.
• Indemnification claims shall be made proportionally to each party's responsibility for the breach.

11.4. Limitation of Liability

The total accumulated liability of each party under this DPA shall not exceed the total amount paid or payable for the services during the 12 months preceding the event giving rise to the claim, except in the following circumstances:

• Cases of wilful misconduct or gross negligence.
• Indemnification claims brought by data subjects pursuant to Article 82 of the GDPR, in respect of which liability is governed exclusively by the provisions of that article without contractual quantitative limitation.
• Fines or penalties imposed by supervisory authorities pursuant to Article 83 of the GDPR.
• Where applicable law prohibits such limitation.

12. Term and Termination

12.1. Entry into Force

This DPA enters into force on the date indicated at the beginning of the document and will remain in force while VIUZI ESP, SL processes personal data in the context of operating the Viuzi platform.

12.2. Termination

This DPA will automatically terminate when:

• VIUZI ESP, SL ceases to process personal data.
• The contractual relationship with all sub-processors is terminated.

12.3. Post-Termination Obligations

Following termination of this DPA, VIUZI ESP, SL and sub-processors will:

• Cease all processing of personal data, unless applicable law requires its retention.
• Data will be deleted from active systems within 30 days of the request. Data in backups will be deleted in the next rotation cycle (maximum 90 additional days). During this period, data in backups is technically segregated, is not accessible for active operations, and will not be restored.
• Certify in writing the deletion of personal data.

Data will be returned in a structured and machine-readable format (JSON or CSV, at the User's choice). Data deletion will be carried out in accordance with recognised standards (NIST SP 800-88 for physical media, cryptographic key destruction for encrypted data). Written certification of deletion will be provided within thirty (30) days of the request.

12.4. Survival

Confidentiality, liability and indemnification obligations, as well as those relating to data retention and erasure, shall survive the termination of this DPA.

13. Applicable Law

13.1. Regulatory Framework

This DPA is governed by:

• General Data Protection Regulation (EU) 2016/679 (GDPR): As the primary data protection regulation applicable throughout the European Union and the European Economic Area.
• Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD): As the national implementing legislation for the GDPR in Spain, the country of registration of VIUZI ESP, SL.
• Digital Services Act (EU) 2022/2065 (DSA): With regard to transparency and content moderation obligations.
• Artificial Intelligence Regulation (EU) 2024/1689 (AI Act): With regard to the use of AI systems for automated content moderation.

13.2. Competent Supervisory Authority

The competent supervisory authority for supervising VIUZI ESP, SL's compliance with data protection obligations is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), located at C/ Jorge Juan 6, 28001 Madrid, Spain.

13.3. Jurisdiction

Any dispute arising from this DPA that cannot be resolved amicably shall be submitted to the jurisdiction of the courts of Málaga (Spain).

13.4. Form of the Agreement

This Agreement is formalised in writing, including electronic format, in accordance with Article 28(9) of the GDPR.

14. Contact Details

For any matter relating to this Data Processing Agreement, data subjects may contact:

VIUZI ESP, SL Calle Alejandro Dumas 17 - Oficinas, 29004 Málaga, Spain Email: privacy@viuzi.com Tax ID (NIF): B05735576 VAT number: ESB05735576

15. Annex I — Documented Processing Instructions

This Annex details the documented instructions that VIUZI ESP, SL issues to each sub-processor in accordance with Article 28(3)(a) of the GDPR. Sub-processors may only process personal data within the limits and for the purposes described herein.