Data Processing Agreement

1. Subject matter and scope

It applies to the personal data in Customer Data that we process on the Customer’s behalf to provide the Service. It does not apply to data we process as controller (accounts, billing, security), which is governed by the Privacy Notice.

2. Customer instructions

• We will process the data only on the Customer’s documented instructions: these documents, the workspace configuration and the actions its users take in the Service.
• We will not use it for our own purposes other than providing, protecting and supporting the Service, except for aggregated, de-identified statistics that identify no one.
• If we believe an instruction breaks the law, we will tell the Customer and may decline to follow it.
• The Customer warrants that it has the legal basis, privacy notices and, where needed, consents for us to process that data.

3. Confidentiality

People on our side access the data only when needed to provide or support the Service and are bound by confidentiality, including after their relationship with us ends.

4. Security measures

We maintain at least the following measures, which we may improve without lowering the level of protection:

• encryption in transit (HTTPS) and at rest in our providers’ infrastructure;
• logical separation of each workspace and server-enforced role-based access control;
• strong verification (passkeys) and time-limited access for platform staff;
• audit records of relevant changes and platform access;
• backups with 7-day point-in-time recovery and copies kept up to 35 days;
• usage limits, abuse protection and error monitoring with personal data removed;
• pseudonymization of cuppers in SCA uploads and expiry of shared links.

5. Subprocessors

• The Customer authorizes us to engage the subprocessors listed at Subprocessors and data location.
• We impose data protection obligations on them by contract equivalent to those in this agreement and remain responsible for their compliance.
• We will give at least 15 calendar days’ notice of any new or replacement subprocessor by publishing it on that page and emailing owners of workspaces on a paid Plan. The Customer may object on reasonable data protection grounds; if we cannot find an alternative, it may cancel the affected Service with a proportional refund of the unused paid period.
• In a security or continuity emergency we may make a change and notify immediately afterwards.

6. Assistance to the Customer

• The Service lets the Customer handle data subject requests itself: view, correct, export and delete information, remove members and delete the workspace.
• If we receive a data subject request about Customer data directly, we will forward it to the Customer without answering it on the merits, unless the law requires us to.
• We will give the Customer reasonable assistance with its security obligations, impact assessments and consultations with authorities, using the information available to us.

7. Security breaches

If we confirm a security breach affecting Customer data, we will notify the Customer without undue delay and, where possible, within 72 hours, with the information available: the nature of the incident, the data and data subjects affected, the measures taken and recommendations. We will update the information as the investigation progresses. As controller, the Customer is responsible for informing data subjects when the law requires it, and we will help.

8. Return and deletion of data

• While the Service is in effect, the Customer can export its data with the available tools.
• When the owner requests deletion of the workspace, it is scheduled for 30 days (during which the request can be cancelled) and then permanently deleted. Deleted data leaves backups within 35 days at most.
• We will keep only what the law requires us to retain, blocked and with restricted access, and erase it when that period ends.

9. Audits

We demonstrate compliance with this agreement through documentation: this agreement, the description of security measures, the subprocessor list and answers to a reasonable security questionnaire once a year, which the Customer can request at contacto@cafedelossentidos.com. On-site audits take place only when required by law or an authority, with at least 30 days’ notice, during business hours, at the Customer’s cost and without access to other customers’ information.

10. International transfers

Data is hosted and processed in the United States, as detailed at Subprocessors and data location, and the Customer authorizes this. Where applicable law requires it (for example, for data subject to the GDPR), transfers will rely on standard contractual clauses or the appropriate transfer mechanism.

11. Liability, term and assignment

• Each party’s liability is subject to the limits in the Terms, unless the law provides otherwise.
• This agreement remains in force while we process Customer data and will be assigned together with the Terms to the company that succeeds us in operating Koffe, which will assume the same obligations.
• It is governed by the federal laws of Mexico and subject to the courts of Mexico City, like the Terms.