…
This document is a DRAFT data processing agreement, written as a reasonable starting point under Article 28 of the General Data Protection Regulation. It has NOT been reviewed by a lawyer, does NOT constitute a closed contractual offer, and must NOT be signed or accepted as a final version. The final version will be subject to legal review before binding use.
Last updated: 17 August 2026
This data processing agreement (the “Agreement”) is entered into between the Customer that subscribes to the Aymar Agents platform (the “Controller”), identified by its account and billing details on the platform, and the entity providing the service (the “Processor”):
The Processor provides the Aymar Agents service to the Controller under the SaaS service agreement entered into between the parties (the “Terms and Conditions”, available at aymaragents.com/legal/terminos), of which this Agreement forms an integral part as required by Article 28.3 of the General Data Protection Regulation.
The subject matter of this Agreement is to regulate the processing, by the Processor on behalf of the Controller, of the personal data of the Controller's end customers (the people who interact with the Controller's artificial intelligence conversational agents through the Aymar Agents platform), as required by Article 28 of the General Data Protection Regulation.
This Agreement takes effect on the date the Controller accepts the Terms and Conditions and remains in force for as long as the Aymar Agents service is provided. The obligations relating to data deletion or return (clause 12) and confidentiality (clause 7) survive termination of the Agreement.
The Processor processes the personal data covered by this Agreement in order to operate, on behalf of the Controller, the artificial intelligence conversational agents it has subscribed to: receiving and responding to messages from its end customers through the enabled channels (WhatsApp, Telegram, Messenger, Instagram Direct and the web chat widget), capturing and managing leads and appointments, generating documents from the information provided, and delivering the platform's other functionality as configured by the Controller.
The processing covers, among others, the following types of data:
The Processor does not actively request special categories of data (Article 9 GDPR); if an end customer voluntarily provides such data in their messages, it is the Controller's responsibility to ensure there is a valid legal basis for that processing.
The Controller's end customers: the individuals who contact, or are contacted by, the Controller's conversational agents through the platform, regardless of the channel used.
The Processor only processes personal data on the Controller's documented instructions, as set out in this Agreement, in the Terms and Conditions, and in the configuration the Controller itself sets up on the platform (for example, the content and scope of its agents' instructions). If the Processor considers that an instruction infringes the General Data Protection Regulation or other data protection provisions, it will immediately inform the Controller.
The Processor will not process the data for its own purposes or for purposes other than those agreed, except where required by law, in which case it will inform the Controller beforehand, unless that law prohibits such information on important grounds of public interest.
The Processor guarantees that personnel authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that such personnel receive the necessary data protection training (including on the transparency requirements of Regulation (EU) 2024/1689 when using artificial intelligence systems).
Among others, the Processor applies the following technical and organisational measures:
Further detail on these measures can be provided on the Controller's reasonable request.
The Controller gives the Processor general authorisation to sub-contract the processing described in this Agreement to other processors (sub-processors), subject to the same data protection obligations set out in this Agreement, through the corresponding contract.
The up-to-date list of nominated sub-processors, with the service they provide, their location and the safeguard applicable to international transfers, is published in section 6 of our Privacy Policy.
The Processor will inform the Controller of any planned change to that list (addition or replacement of sub-processors), giving the Controller the opportunity to object to such changes on reasonable data-protection grounds.
The Processor assists the Controller, through appropriate technical and organisational measures, in fulfilling its obligation to respond to requests to exercise data subjects' rights (access, rectification, erasure, restriction, objection and portability). In particular, the platform includes a feature to delete an end customer's data on request, which the Controller can trigger directly from its dashboard.
The Processor also assists the Controller in fulfilling its obligations relating to the security of processing, notification of security breaches and, where applicable, data protection impact assessments, taking into account the nature of the processing and the information available to the Processor.
The Processor will notify the Controller without undue delay, and in any case within a reasonable period after becoming aware of it, of any breach of the security of the personal data processed on the Controller's behalf, providing the information the Controller needs to comply, where applicable, with its own obligation to notify the competent supervisory authority and, where required, the affected data subjects.
At the end of the service, the Processor will, at the Controller's choice, return or delete the personal data processed, together with any copies of it, unless retention is required by law applicable to the Processor.
In practice, when the Controller closes its account, its data and that of its end customers is kept for a 30-day grace period (in case the closure was accidental) and, once that period has elapsed without the account being reactivated, it is effectively purged from the Processor's databases, file storage and other systems, as described in section 5 of our Privacy Policy.
The Processor will make available to the Controller the information necessary to demonstrate compliance with the obligations set out in this Agreement, and will allow for and contribute to audits, including inspections, conducted by the Controller or an auditor authorised by the Controller, subject to reasonable notice and without prejudice to the confidentiality owed to the Processor's other customers.
Each party will be liable to data subjects and supervisory authorities for damage caused by processing that infringes the General Data Protection Regulation, under the terms of Article 82 and the applicable Spanish data protection legislation.
This Agreement is governed by Spanish and European data protection law. Any dispute concerning its interpretation or performance will be subject to the courts and tribunals with jurisdiction under the service's Terms and Conditions.