Aipiter data processing agreement

1. The parties and purpose

1.1. Controller: the business or professional subscribing to Aipiter, identified during registration (the “business”).

1.2. Processor: Adrián Puig de la Morena, a sole trader operating under the trading name Meypi Developers, the owner of Aipiter, Spanish tax ID 49322385N, with the address stated in the legal notice. Contact: hola@aipiter.com (“Aipiter”).

1.3. This agreement forms part of the Aipiter contract and the business accepts it when registering. For data protection matters it prevails over the terms if any provision says otherwise.

1.4. Subject matter: Aipiter processes personal data on behalf of the business solely to provide the service it subscribes to. Annex I sets out the subject matter, nature, purpose, duration, types of data and categories of data subjects (Article 28(3) GDPR).

1.5. This agreement does not cover processing for which Aipiter is the controller: its website, registration and demo requests, accounts of people using the panel, support and Aipiter billing. These are explained in the privacy policy.

2. Instructions (Article 28(3)(a))

2.1. Aipiter processes data only on documented instructions from the business. Instructions consist of:

• this agreement and the terms;
• the settings the business configures in the panel: modules, channels, rules, assistant, calendar, time limits and permissions;
• written requests from a person with administration permissions for the business.

2.2. Aipiter does not use the data for its own purposes, sell or disclose it, or use or allow it to be used to train artificial intelligence models.

2.3. If EU or Spanish law requires Aipiter to process data differently, it will inform the business beforehand, unless that law prohibits such information on important grounds of public interest.

2.4. If Aipiter considers that an instruction infringes data protection law, it will immediately inform the business (final paragraph of Article 28(3) GDPR).

3. Confidentiality (Article 28(3)(b))

3.1. People working for Aipiter with access to data are bound to confidentiality by contract or law, including after the relationship ends (Article 5 of the Spanish LOPDGDD).

3.2. Aipiter accesses a business’s data only in three situations:

• to provide the service;
• to resolve an incident at the business’s request;
• to protect the security of the service.

In each case it accesses only what is necessary.

4. Security (Articles 28(3)(c) and 32)

4.1. Aipiter applies the measures in Annex IV, appropriate to the risk, and reviews them when the service or risks change.

5. Subprocessors (Articles 28(2), 28(3)(d) and 28(4))

5.1. The business gives general authorisation for Aipiter to use the subprocessors in Annex III. The current list is available under subprocessors.

5.2. Before adding or replacing a subprocessor, Aipiter gives at least 10 days’ notice. The notice is emailed to people with administration permissions and published on that page. The business may object within that period on reasonable data protection grounds. If there is no alternative solution, it may terminate the contract without penalty before the change.

5.3. Each subprocessor is contractually bound by the same data protection obligations as this agreement. Aipiter remains liable to the business for each subprocessor’s performance.

5.4. Services that the business connects using its own accounts are not Aipiter’s subprocessors (Annex III, Part B). The business contracts with them directly and accepts their terms; Aipiter sends or receives data on its instructions.

6. Individuals’ rights (Article 28(3)(e))

6.1. The panel allows the business to access, correct, export and delete data about its contacts and conversations.

6.2. If an individual writes to Aipiter to exercise rights over a business’s data, Aipiter does not respond on the business’s behalf. It forwards the request to the business within a maximum of 5 working days and helps it respond.

7. Assistance with security, breaches and assessments (Article 28(3)(f))

7.1. Data breaches: Aipiter informs the business without undue delay and no later than 48 hours after becoming aware. It provides the information required by Article 33(3) GDPR that it has, and supplies further information in phases if necessary. This allows the business to notify the authority within its 72-hour period and, where necessary, affected individuals (Articles 33 and 34).

7.2. Aipiter provides information it holds to help the business carry out its impact assessment and any prior consultation with the authority (Articles 35 and 36).

8. When the service ends (Article 28(3)(g))

8.1. While the service is active, the business can export its data from the panel.

8.2. When the contract ends, through cancellation or non-payment, the account is paused. For 60 days the business can access and download its data.

8.3. After those 60 days, Aipiter closes the business and destroys its data, files, conversations and inbox, and people who used the panel lose access.

8.4. Only data that must be retained by law is kept: invoices issued using Aipiter and their invoicing records. They are blocked and used only to meet that obligation (Royal Decree 1007/2023, Article 30 of the Spanish Commercial Code and Article 66 of the Spanish General Tax Law). Individuals appearing in them no longer have a contact record and are replaced with “Deleted person”, except in the issued document.

8.5. Backups disappear when they expire, within a maximum of 30 days.

8.6. At the business’s request, Aipiter confirms deletion in writing.

9. Information and audits (Article 28(3)(h))

9.1. Aipiter makes available the information needed to demonstrate compliance with this agreement: measures, subprocessors and records of processing activities as a processor (Article 30(2) GDPR).

9.2. The business may audit compliance on these conditions:

• the audit is carried out by the business or an independent auditor bound to confidentiality;
• it gives 30 days’ notice;
• once a year, unless there is a breach or an authority requests it;
• documents are reviewed first, with an inspection only if they are insufficient.

The business pays the cost, unless the audit finds a serious breach by Aipiter.

10. Data outside the EU

10.1. Data is hosted in the European Union. Where a subprocessor processes or accesses it from outside the EU, Aipiter does so only under the safeguards in Chapter V GDPR, specified in Annex III: an adequacy decision, including the EU–US Data Privacy Framework for certified entities, or the standard contractual clauses in Decision (EU) 2021/914.

11. The business’s responsibilities

11.1. The business decides the purposes for which data is used. It is responsible for:

• having a legal basis for each processing activity;
• informing individuals (Articles 13 and 14 GDPR);
• providing no more data than necessary;
• having the permissions required by each channel (for example, from individuals it messages on WhatsApp outside the 24-hour window);
• complying with the terms of the services it connects.

11.2. Special categories of data: the service does not require health data or other special categories (Article 9 GDPR). If the business processes them, for example a clinic organising appointments, it is responsible for having the applicable exception under Article 9(2). Aipiter processes them with the same measures and only to provide the service.

12. Duration, changes and law

12.1. This agreement lasts for the duration of the contract and afterwards as necessary to comply with section 8. The duty of confidentiality does not end.

12.2. Aipiter publishes each new version with its number and date, and gives 30 days’ notice of material changes. The version each business accepted and when it accepted it are recorded.

12.3. Spanish law applies. Any dispute is subject to the courts specified in the terms. Each party is liable as provided in Article 82 GDPR.

13. Annex I · Processing details

Operations

Hosting, organising, accessing and retaining data. Receiving and sending messages through channels connected by the business. Applying its rules and automations. Responding using the assistant it configures. Managing calendars and bookings, contacts, sales and, where subscribed to, invoicing and shops. Exporting and deleting data.

Purpose

Providing the service subscribed to by the business.

Duration

The duration of the contract, plus the 60-day exit period in section 8.

Data subjects

The business’s customers and prospective customers. People who contact it through WhatsApp, Instagram, website chat or email. People who book appointments. Contacts at its customers and suppliers. People appearing in its quotes and invoices. The business’s team using the panel.

Data types

Names and contact details. WhatsApp telephone numbers, Instagram usernames and email addresses. Conversation content, comments and attachments. Appointments and bookings. Opportunities, quotes, shop orders and invoices. Notes and tags. Communication permissions and opt-outs. Technical data: IP addresses and browser signals during anti-bot checks, and technical logs. With the Voice module, which cannot currently be subscribed to: call audio and transcripts.

Special categories

Not required. They may appear if the business includes them or an individual provides them on their own initiative (section 11.2).

Frequency

Continuously while the service is active.

Retention

As determined by the business. In addition, Aipiter deletes what is no longer needed, for example: unfinished imports after 7 days; temporary data of people commenting on Instagram after 24 hours; team notifications after 90 days; WhatsApp history not held in any contact record after 180 days.

14. Annex II · Data locations

• Database: Paris (France).
• Servers, conversation inbox and queues: France and Belgium.
• Artificial intelligence: Gemini in Vertex AI, using its European endpoint.
• Only the cases in Annex III involve data leaving the EU, each with its stated safeguard.

15. Annex III · Subprocessors and the business’s services

Part A · Aipiter’s subprocessors

Part B · Services connected by the business (not Aipiter’s subprocessors)

The business contracts with them directly and accepts their terms; Aipiter only sends or receives data on its instructions:

• Meta (WhatsApp Business and Instagram);
• Microsoft 365 and Gmail;
• its own email provider (IMAP and SMTP);
• Shopify and WooCommerce;
• Holded;
• its Stripe account;
• Redsys and its bank.

With the invoicing module, Aipiter submits invoicing records to the Spanish Tax Agency on behalf of the business, as required by Royal Decree 1007/2023.

16. Annex IV · Security measures (Article 32)

• 1. Each business sees only its own data: the database applies row-level security to tables holding businesses’ data.
• 2. Login using an emailed code and a second factor; permissions per person and role; activity logging.
• 3. Encryption in transit (HTTPS and TLS) and at rest. Channel and connection credentials stored by Aipiter are encrypted with AES-256-GCM, and service keys are held in a secrets manager.
• 4. Hosting in the European Union (Annex II).
• 5. Anti-bot checks and usage limits on forms and public links.
• 6. Database backups expire within a maximum of 30 days.
• 7. Availability and error alerts.
• 8. Automated tests and independent review before each change is published.
• 9. Confidentiality duties for people with access, and access limited to what is necessary.
• 10. Breach procedure: detect, contain, inform the business within a maximum of 48 hours and document.