Data processing agreement

01 Parties

CONTROLLER (RESPONSABLE DEL TRATAMIENTO): the business that opens an account in Kommyt and decides which data it collects from the individuals it manages and for what purpose. It is identified by the details provided at registration.

PROCESSOR (ENCARGADO DEL TRATAMIENTO): Luis Coronado, NIF 79273745-J, with address at Castellar del Vallès (Barcelona), España, who develops and provides the Kommyt service under the trade name Ads&Nexus.

Processor’s contact for data protection matters: info@adsandnexus.com.

The Processor is a natural person. It has not appointed a Data Protection Officer because none of the cases in Article 37 of the GDPR applies; if that were to change, the Controller would be informed.

02 Purpose

This contract governs the processing of personal data that the Processor carries out ON BEHALF OF the Controller as a consequence of providing the Kommyt service, in accordance with Article 28(3) of the GDPR.

It does not govern data of which the Processor is controller in its own right (the contact and billing data of the Kommyt customer itself), which are governed by the privacy policy.

It is concluded upon the Controller’s express acceptance in the registration form. That acceptance is recorded with the date, the version of the text and a cryptographic fingerprint (hash) of the exact content accepted, so that both parties can later prove what was signed.

03 Free of charge

This contract applies on the same terms whether the service is provided in exchange for a price or free of charge, in trials, demonstrations or preliminary versions.

The absence of consideration does not reduce any of the Processor’s obligations, because the GDPR does not make them conditional on payment.

04 Nature, purpose and duration of the processing

NATURE: collection, recording, structuring, storage, consultation, modification, extraction, communication by transmission and erasure of personal data, by means of computer systems.

PURPOSE: exclusively to provide the Controller with the CRM functions that it has contracted and configured: management of the people it serves, appointments and bookings, payments and consumption, inventory, staff, documents and the others included in its plan and its sector.

DURATION: for as long as the Controller keeps an active account. Once the service has ended, the obligations under clauses 9 (confidentiality) and 17 (return or deletion) survive.

05 Categories of personal data

The detail is in Annex I. In summary, the Controller may enter identifying data (full name, identity document number, date of birth, postal address, telephone number and email address), images (photograph of the person and copies of the identity document on both sides), economic data (consumption, fees, payments, wallet balances), activity data (entries to the premises, attendance at classes or events, appointments) and employment data about its staff (working hours, clock-in records, contracts, pay).

SPECIAL CATEGORIES (Article 9 of the GDPR): the service ACCEPTS data concerning health where the Controller carries on a healthcare or wellbeing activity. Specifically, the history of services provided to a person may contain clinical or aesthetic notes, including allergies, and billing to mutual insurers or insurance companies. Likewise, the files of a professional practice may reflect data relating to judicial proceedings within the meaning of Article 10 of the GDPR.

The processing of those categories by the Processor is covered by Article 9(3) of the GDPR, in so far as it is carried out under the responsibility of a professional subject to professional secrecy, or of a person bound by an equivalent duty of confidentiality, and it is subject to the reinforced measures of clause 10.

The Processor does not request, does not consult and does not use that data for any purpose of its own.

06 Categories of data subjects

The individuals the Controller manages through the service, under the name they receive in their sector: members, customers, patients, students or users.

The Controller’s staff, whose data it enters into the service to manage shifts, clock-in records, commissions or payroll.

Third parties linked to its activity whose data the Controller decides to record, such as contact persons at suppliers or insurers.

07 Documented instructions

The Processor processes the data solely on the basis of the Controller’s documented instructions, including those relating to international transfers.

The following have the status of documented instructions: (a) this contract; (b) the configuration the Controller makes in the service, including the activation of optional integrations; and (c) orders that the Controller sends in writing to the Processor’s contact email from an account with holder or administrator profile.

The Controller’s silence does not amount to an instruction. Faced with a request outside this contract, the Processor will refrain from acting until it receives written instructions.

If the Processor considers that an instruction infringes the GDPR or Spanish data protection legislation, it will inform the Controller without delay and may suspend its execution until the instruction is confirmed or corrected.

If the Processor had to process the data to comply with a legal obligation, it will inform the Controller beforehand, unless that same law prohibits it for reasons of public interest.

08 Obligations of the Controller

Determining the purpose and means of the processing, and having a valid legal basis for the data it enters.

Informing data subjects in accordance with Articles 13 and 14 of the GDPR, including the existence of this engagement. The Processor has no relationship with those individuals and cannot inform them on the Controller’s behalf.

Carrying out, where appropriate, the impact assessment and prior consultations; the Processor will assist it in accordance with clause 15.

Entering only the data necessary for its activity and keeping it accurate and up to date.

Safeguarding its credentials and those of its staff, and withdrawing access from anyone who no longer needs it.

Deciding whether to activate the optional integrations in Annex II, being aware that some of them involve international transfers.

09 Confidentiality

The Processor will maintain the duty of secrecy in respect of the data to which it has access, which subsists indefinitely after the contract ends.

The Processor guarantees that every person acting under its authority who has access to the data has undertaken in writing to respect confidentiality before obtaining access, and has been informed of their data protection obligations.

The Processor maintains an up-to-date list of the persons with access, which it will make available to the Controller if the Controller so requests.

As at the date of this version, the Processor has no staff in its charge: the only administrative access is that of the owner himself.

10 Security measures and declared limitations

The Processor applies the technical and organisational measures of Article 32 of the GDPR that are detailed in Annex III, including isolation between businesses at database level, encryption in transit, access control by permissions, audit logging of changes and a limit on access attempts.

REINFORCEMENT FOR SPECIAL CATEGORIES: files that may contain health data or copies of identity documents are stored outside the database, in a private repository, and are served only through the application, after verification of session and permission. Public links and signed direct-access addresses are never generated.

KNOWN LIMITATIONS. So that the Controller can assess the risk before accepting, the Processor expressly informs it that, as at the date of this version: (a) the limit on access attempts operates per instance and in memory, so that if the service were to run on several instances the limit would apply to each instance and not globally; and (b) the audit log is isolated between businesses by the database itself, but it is not immutable within it: the fact that only entries are added, and that none is modified or deleted, is upheld by the application, because no path in the program alters them. It is a real and verifiable property, but it belongs to the application and not to the database.

Two limitations that earlier versions of this contract declared no longer exist, and the Processor says so here instead of silently deleting them: application-level encryption at rest is now applied (since 8 September 2026, to identity document numbers, bank details and copies of the document), and the purge of deleted data is no longer carried out on request but automatically and daily (since 18 September 2026).

BACKUPS AND RECOVERY. The Processor makes automatic daily backups of all of the service’s databases. Each backup is ENCRYPTED with AES-256 before leaving the server and is deposited in storage separate from the one that hosts the database, so that the loss of the server or of the hosting provider does not also take the backups with it. Backups from the last 30 days are kept, and older ones are deleted automatically, both on the server and in the external repository. The database hosting provider also maintains recovery to an earlier point in time within its retention window.

VERIFICATION THAT BACKUPS WORK. Once a month a full drill is run (download, decryption and restoration on an isolated system, with a record count), because a backup that is never restored has not been demonstrated. In addition, a daily process verifies that a recent backup of each database exists and raises an alert if one stops being made. The integrated export covers all of the Controller’s data, as it is derived from the schema itself so that no table is left out.

EFFECT OF BACKUPS ON ERASURE. When data is deleted, it immediately ceases to be processed by the service, but it may remain in some backup until that backup expires, at most 30 days later. During that interval the backups are not used for any purpose other than recovering the service.

This declaration is information, not an exemption: the Processor remains bound by Article 32 of the GDPR and is liable for any breach of it.

As to the two limitations that remain, the Processor undertakes the following, and does so with a condition rather than a date because they are of a different nature. Item (a) will be corrected BEFORE the service runs on more than one instance, which is the moment it stops being theoretical; committing to a date for something that currently has no effect would invite leaving it until the day of the change, which is precisely when it must not be left. Item (b) is NOT a pending fix but a design decision taken deliberately: immutability within the database would require giving up the automatic purge that meets the deadlines published in the privacy policy, and between the two protections the one that takes effect every day has been chosen. The Processor will inform the Controller if that decision changes.

Versions 1.1 and 1.2 of this contract promised to correct outstanding items before 31 December 2026. Three of the four limitations were corrected before that deadline, and this version certifies it above. The promise is rewritten in this way because one of the two that remain will not be corrected, and keeping a date that is known not to be met is worse than not giving one.

The Processor will periodically review the effectiveness of these measures and may replace them with other equivalent or superior ones, notifying the Controller thirty days in advance if the replacement reduces the level of protection.

11 Sub-processors

The Controller generally authorises the Processor to engage the sub-processors listed in Annex II.

The Processor will notify the Controller of any addition or replacement of a sub-processor at least fifteen calendar days in advance. Within that period the Controller may object in writing and with reasons; if it does so, the Processor will not engage that sub-processor for the Controller’s data or, if that would prevent the provision of the service, either party may terminate the contract without penalty, with clause 17 applying.

The Processor will impose on each sub-processor, by contract, the same data protection obligations it assumes in this document, and will verify that it offers sufficient guarantees before engaging it.

The Processor is fully liable to the Controller for the non-compliance of its sub-processors.

Several of the integrations in Annex II are DISABLED by default and are only activated if the Controller configures them. While it does not do so, no data is sent to them.

12 International transfers

Some sub-processors in Annex II are located outside the European Economic Area, notably the artificial intelligence providers and the email provider, which are based in the United States.

The Processor will not make transfers outside the EEA without covering each one with a valid mechanism under Chapter V of the GDPR: an adequacy decision, standard contractual clauses or any other appropriate safeguard. The Processor assumes this obligation and does not pass it on to the Controller.

The artificial intelligence assistant operates with the Controller’s own key: the Controller contracts directly with the chosen provider and accepts its terms. The key is stored only in the browser of the person who enters it and is not kept in the Processor’s systems. Even so, the transmission takes place through the service, so the Processor includes it here and applies the safeguard described in the following paragraph.

Before anything is sent to an artificial intelligence provider, the service removes from the text identity document numbers, postal addresses, personal telephone numbers and email addresses, dates of birth and bank details. Only the operational data necessary to answer is transmitted.

For health data the safeguard is different, and the Processor says so clearly because the previous version of this contract promised to delete it, which is not possible: there is no reliable way to recognise automatically an ailment written in free text. What does exist, and what underpins the protection, is that the assistant’s tools do not reach that data: they can only request a person’s name, number and balance, a product’s name and price, a table of business figures and the preparation of a payment, and never the notes fields, which is where that information could be written. In addition, the assistant’s screen warns that health data must not be written in it.

The Controller may choose not to activate this function; if it does not, no international transfer takes place on this basis.

The service data (database and application servers) is hosted entirely within the EEA: Neon, Inc. in Frankfurt (Germany) and Hetzner Online GmbH in Nuremberg (Germany). For those two NO international transfer takes place. Two US providers do, however, take part in ancillary functions: Cloudflare, Inc. and Resend (transactional email delivery). For both, the Standard Contractual Clauses approved by the European Commission apply, incorporated into their data processing terms. The Controller may request a copy by writing to info@adsandnexus.com. As regards Cloudflare, it should be made clear what it does and does not do, because the previous version of this contract described it as a distribution network and traffic protection service, which is not accurate: it provides the file repository in Annex II and hosts the domain name zone, but the service’s traffic does NOT pass through its network, and goes directly to the application server. The files it stores are indeed the Controller’s data, including copies of identity documents, which is why it appears in Annex II with that function and no other.

13 Assistance with data subjects’ rights

It is for the Controller to respond to requests from data subjects for access, rectification, erasure, restriction, portability and objection. The Processor will not respond to those individuals directly.

If a data subject contacts the Processor, the Processor will refer it to the Controller and inform the Controller without delay and in any case within twenty-four hours, with the data necessary to deal with the request.

The Processor will assist the Controller with appropriate technical and organisational measures and will provide what it needs within a maximum of five business days from the written request, so that the Controller can meet the one-month deadline of Article 12(3) of the GDPR.

The service includes functions for consultation, correction, export and deletion that allow the Controller to deal with most requests itself.

14 Personal data breaches

The Processor will notify the Controller of any personal data breach without undue delay and, in any case, within twenty-four hours of becoming aware of it. The period is set at twenty-four hours precisely so that the Controller has margin within the seventy-two hours that Article 33 of the GDPR gives it to notify the supervisory authority.

The notification will be sent to the contact email that the Controller provided at registration, and will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed.

If it is not possible to provide all of that information at once, it will be provided in phases without further delay.

The Processor will document every breach and will give the Controller the cooperation it needs to notify it to the supervisory authority and, where appropriate, to the data subjects.

Notification to the Spanish Data Protection Agency and to the data subjects is the responsibility of the Controller, unless it instructs otherwise in writing.

15 Assistance with impact assessments

The Processor will assist the Controller in carrying out data protection impact assessments and in prior consultations with the supervisory authority, where these are required under Articles 35 and 36 of the GDPR.

For that purpose it will provide the information about the processing that it holds, within a maximum of ten business days from the written request.

The Processor warns that large-scale processing of health data and systematic monitoring of physical presence may require an impact assessment: the assessment is for the Controller to make.

16 Audits and information

The Processor will make available to the Controller all the information necessary to demonstrate compliance with the obligations of Article 28 of the GDPR, within a maximum of ten business days from the written request.

The Processor will allow and contribute to audits, including inspections, carried out by the Controller or by an auditor it appoints. They will be coordinated with reasonable notice, during business hours, without compromising the security or confidentiality of other customers, and at most once a year unless there is a security breach or a request from the supervisory authority.

The cost of the audit is borne by the party requesting it, unless it reveals a breach by the Processor, in which case the Processor will bear it.

The Processor will respond without delay to requests from the competent supervisory authority.

17 Return or deletion on termination

Once the service has ended, the Processor will, AT THE CONTROLLER’S CHOICE, return the data or delete it, together with any existing copies, unless Union or Spanish law requires their retention.

The Controller will communicate its choice in writing. If it does not, the Processor will request it again and, absent a reply, will proceed to RETURN the data and not to delete it: destroying data because the other party is silent could cause irreversible harm to the Controller and to the data subjects.

Return will be carried out within a maximum of thirty calendar days from termination, in a structured and commonly used format. It covers all of the Controller’s data, including data that the integrated export functions do not yet cover, which the Processor will extract for that delivery.

Deletion, where chosen, will also cover logically deleted data and the files stored in the object repository, and will be evidenced by written certification.

While the process is under way, the Processor will keep the data blocked, without processing it for any other purpose.

ONLY EXCEPTION TO THE SILENCE RULE: THE FREE TRIAL. The service starts with a free trial period of one month. If the Controller does not convert it into a paid subscription before the trial ends, it instructs from now on, by signing this contract, the ERASURE of the data, and not its return. This advance instruction is the choice that the first paragraph reserves to the Controller, exercised in advance and only for this case; it does not apply to any other form of termination.

Erasure is neither immediate nor silent. Between the end of the trial and erasure there are 15 calendar days, and the Processor notifies the Controller by email, at the account holder’s address, at three points: 7 days before the trial ends; on the day it ends, stating the exact date of erasure; and once it has been carried out, to certify it.

During those 15 days the Controller keeps three exits, and any one of them stops the erasure: converting the account into a paid subscription, exporting its data with the integrated functions, or requesting in writing the return under the third paragraph of this clause. The request for return PREVAILS over erasure: if it is made within the period, nothing is erased until the data has been delivered.

Once the trial has ended, access to the service is suspended while the grace period runs. Suspension is not erasure: the data still exists, blocked and not processed for any other purpose, and becomes available again as soon as the Controller converts the account.

18 Liability

Each party is liable for the damage it causes through breach of its obligations, in accordance with Article 82 of the GDPR.

No clause of this contract limits or excludes the Processor’s liability towards data subjects or supervisory authorities, which is mandatory and cannot be agreed downwards.

The Processor is not liable for damage arising from the Controller’s instructions that infringe the regulations, provided it warned the Controller in accordance with clause 7, nor for the lack of legal basis or of information for data subjects, which are the Controller’s responsibility.

The Processor is liable for damage caused by the processing where it has not complied with the obligations of the GDPR specifically directed at processors, or where it has acted outside the Controller’s lawful instructions.

19 Amendment of the contract

The Processor may amend this contract to adapt it to regulatory changes, to decisions of the supervisory authority or to changes in the service.

Amendments will be notified to the Controller thirty calendar days in advance. If the Controller does not accept them, it may terminate the contract within that period, with clause 17 applying.

Each version keeps its number and its cryptographic fingerprint, so that it can always be determined which text was in force and which one was accepted at each moment.

20 Applicable law and jurisdiction

This contract is governed by Regulation (EU) 2016/679, by Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights, and by the remaining applicable Spanish legislation.

For any dispute, the parties submit to the courts and tribunals of Barcelona. If the Controller has the status of consumer, the jurisdiction that legally corresponds to it will apply.

21 Annex I. Data and data subjects

IDENTIFIERS: full name, customer or member number, identity document number, date of birth, postal address, telephone number and email address.

IMAGES: photograph of the person and copies of the identity document, front and back.

ECONOMIC: consumption, fees, payments, refunds, wallet balances and quotes.

ACTIVITY: entries to and exits from the premises, capacity, attendance at classes, events and tournaments, appointments and bookings.

EMPLOYMENT, of the Controller’s staff: contract, working hours, shifts, clock-in records, commissions and payroll items.

SPECIAL CATEGORY, where the Controller’s activity entails it: notes in the service history that may reflect health status or allergies, and billing data for mutual insurers or insurance companies.

RELATING TO OFFENCES OR PROCEEDINGS, where the Controller is a professional practice: subject matter of the file, judicial body and case number.

TECHNICAL AND TRACEABILITY: IP address, browser identifier, date and time of each access, and audit log of changes.

DATA SUBJECTS: the individuals managed by the Controller (members, customers, patients, students or users), its staff, and the contact persons of its suppliers and insurers.

22 Annex II. Sub-processors

DATABASE HOSTING: PostgreSQL managed by Neon, Inc. It stores all of the service’s data. Location: AWS Europe Central 1 region (Frankfurt, Germany), within the European Economic Area. Status: always active.

APPLICATION SERVER: Hetzner Online GmbH. It runs the program and processes requests; the data remains in the database and in the file repository. Location: Nuremberg (Germany), within the EEA. Status: always active.

FILE REPOSITORY: S3-compatible object storage, on Cloudflare R2. It stores photographs and documents, including copies of identity documents, and also the encrypted database backups. Location: European region. Status: ACTIVE. Earlier versions of this contract declared it planned and disabled by default, which stopped being true when it was configured; it is corrected here because where the copies of identity documents live is a large part of what the Controller has to assess.

EMAIL: Resend, United States. It sends communications to the individuals managed: recipient, subject and content of the message. Status: DISABLED by default; it is activated only if the service key is configured.

ARTIFICIAL INTELLIGENCE: Anthropic, OpenAI, Google and Groq, United States. They receive the assistant’s queries and the operational data necessary to answer them, after the prior removal described in clause 12. They operate with the Controller’s own key, which is kept only in its browser. Status: DISABLED by default; it is activated only if the Controller enters a key.

The identification and session system runs within the service’s own infrastructure and does not send data to any third party. No third-party analytics, advertising or telemetry tools are used.

23 Annex III. Security measures

ISOLATION BETWEEN BUSINESSES: row-level security in the database, so that every query is confined to the business of the session. No customer can read or modify another customer’s data.

ACCESS CONTROL: identification with username and password, and authorisation by roles and permissions per module. Passwords are stored using a salted key-derivation function (scrypt), never in plain text.

SESSIONS: cookies that are inaccessible from the browser, expiring after seven days. The session is extended when it is used, at most once every fifteen minutes. Revocation may take up to five minutes to propagate, owing to session caching.

ENCRYPTION IN TRANSIT: HTTPS mandatory, with a strict transport security policy of two years including subdomains.

SECURITY HEADERS: restrictive content security policy, prohibition of embedding in frames, blocking of content-type sniffing and a restricted permissions policy.

PROTECTION AGAINST BRUTE FORCE: twelve access attempts every five minutes per address, and additional limits on the remaining authentication routes.

TRACEABILITY: audit log recording the author, the action, the entity affected, the date, the IP address and the previous and new values.

FILES: private repository, without public links or signed addresses; the bytes are always served through the application, after verification of session and permission.

SECRETS: service credentials are read from environment variables and do not appear in the code.

The known shortcomings of this annex are declared in clause 10 and must not be understood as remedied by the list above.