Data Processing Agreement

1. Parties and roles

1.1 The customer organisation (the “Controller”) decides what data is processed, for what purpose and on what basis.

1.2 Eskadia (the “Processor”) processes that data exclusively on the Controller's behalf.

1.3 With respect to data about the Customer's and its Users' accounts, Eskadia is the controller and the Privacy Policy applies.

2. Subject matter, duration and nature

Providing the Platform described in the Terms of Service, for the duration of the contractual relationship and the deletion period in §11. Operations: collection, recording, structuring, storage, consultation, modification, disclosure to the recipients the Controller determines, processing with AI features where the Controller enables them, restriction and erasure.

3. Data and data subjects

3.1 Data: identification and contact; professional; economic and billing; communications (including the content of emails and messages from connected channels); and, if the corresponding modules are enabled, employment data, working-time data, geolocation at the moment of clock-in or of trip events, academic data, and the health data strictly contained in absence certificates.

3.2 Data subjects: employees, candidates, clients, contacts, suppliers, subcontractors, students and visitors to the Controller's portals, forms and chat.

3.3 Profiling. Opportunity scoring is profiling carried out on the Controller's behalf; the Controller shall inform its data subjects of it and shall not use it as the sole basis for decisions with legal or similarly significant effects.

3.4 Special categories. Medical absence certificates may contain health data; the Controller shall upload them only where necessary to evidence the absence and on the basis of art. 9.2.b GDPR or another applicable basis, and shall restrict access to the roles that need them.

4. Instructions

4.1 Eskadia processes the data only according to the Controller's documented instructions: the Platform configuration, these clauses and those communicated in writing.

4.2 If an instruction infringes the applicable rules, Eskadia shall say so.

4.3 Eskadia does not use the data for its own purposes or to train AI models, nor does it allow its sub-processors to do so.

4.4 If Eskadia establishes that the Controller is processing data without a legal basis, it shall notify it in writing, give it fifteen (15) days to remedy this and, failing that, may suspend the affected feature and terminate the contract under Terms §12.2, keeping a record of each step.

5. Confidentiality

The people authorised by Eskadia are bound by confidentiality, which survives termination. Access by Eskadia staff to the Controller's data is minimal, only for support or security, and is logged.

6. Security

The measures in Annex II, reviewable in line with the state of the art without reducing the level of protection.

7. Sub-processors

7.1 The Controller gives general authorisation to those in Annex I.

7.2 Eskadia shall give thirty (30) days' notice of any addition or replacement; the Controller may object on justified data protection grounds and, if this prevents the service from being provided, terminate without penalty and export its data.

7.3 Eskadia imposes the same obligations on its sub-processors and is answerable for them.

7.4 Providers configured by the Controller itself —its AI provider, its mailboxes and connected channels— are sub-processors or services of the Controller, not of Eskadia.

8. Assistance

Eskadia shall assist the Controller in handling data subject rights (the Platform allows export, rectification, opt-out and erasure), in impact assessments and prior consultations, and in security. If it receives a request directly from one of the Controller's data subjects, it shall pass it on without acting on it.

9. Personal data breaches

Eskadia shall notify the Controller without undue delay and in any event within forty-eight (48) hours of becoming aware, with the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken or proposed, in phases if it cannot all be given at once. This does not displace the periods under US state laws nor the Controller's duty towards the SIC in Colombia.

10. Audit

Eskadia shall make available the information needed to demonstrate compliance and shall allow one audit per year, at the Controller's expense unless it reveals a breach attributable to Eskadia, with reasonable notice, during business hours and without compromising the security of other customers. It may be replaced by sufficient third-party reports or certifications.

11. Return and deletion

11.1 Once the provision has ended, the Controller may export its data for thirty (30) calendar days.

11.2 Thereafter, Eskadia deletes it, except data it must keep by law or for claims (blocked until the limitation period expires) and the suppression lists. Backups are overwritten within seven (7) days.

12. International transfers

Those set out in Privacy Policy §10. In particular, this agreement incorporates by reference the standard contractual clauses of Decision (EU) 2021/914, module 2 (controller to processor) where the Controller is in the EEA and Eskadia transfers, and module 3 (processor to sub-processor) with respect to sub-processors outside the EEA. For Colombia, these clauses constitute the transmission contract under art. 2.2.2.25.5.2 of Decree 1074 of 2015.

13. United States

13.1 With respect to data subject to the CCPA/CPRA or equivalent state laws, the Controller is the business and Eskadia the service provider or processor.

13.2 Eskadia: (a) does not sell or share that data; (b) does not retain, use or disclose it for any purpose other than providing the services, nor outside the direct relationship with the Controller; (c) does not combine it with data from other sources except as permitted; (d) complies with those laws and provides the same level of protection; (e) shall give notice without delay if it cannot comply.

13.3 The Controller may take reasonable steps to verify this and to stop and remediate unauthorised use.

13.4 Eskadia certifies that it understands and will comply with these restrictions.

13.5 The same obligations are imposed on sub-processors.

13.6 With respect to account data, Eskadia acts as a business in its own right, in accordance with the Privacy Policy.

14. Mexico

Eskadia acts as processor and processes the data according to the Controller's instructions, with the obligations the LFPDPPP imposes on processors, and communications to its sub-processors are remittances.

Annex I — Sub-processors

The following are not sub-processors of Eskadia: Google, Microsoft and Meta when the User connects their accounts (they are the source of the data, under the User's own relationship with them), nor the AI provider configured by the Controller. Google Cloud Vision is one, for the function described in the table: there Google is not the source of the data but processes it on behalf of Eskadia.

Annex II — Security measures

1. Isolation between organisations using row level security policies in the database.
2. Role-based access control (five levels) and server-side route protection.
3. Two-factor authentication available and enforceable per organisation.
4. Encryption in transit (TLS) and at rest.
5. Audit logging of sensitive operations (actor, date, metadata).
6. Consent evidence (geolocation, legal documents) written only by the server, with date, IP and user agent.
7. Suppression lists that fail closed.
8. Daily automated checks of critical controls.
9. Automatic blocking of terminated employees and closure of their sessions on all devices.
10. Integration credentials encrypted and never returned to the browser.
11. Daily backups with seven (7) days' retention, in the hosting region.
12. In the applications: session in the system's encrypted store, no third-party tracking or analytics, and permissions requested only at the moment of use.