Data Processing Agreement
Version 1.0 · Last updated
Passages marked [POR DEFINIR] await the company details still to be confirmed.
English translation for convenience — the Spanish version is the governing text.
Application Note (not part of the contractual body)
This Data Processing Agreement (hereinafter, the "Agreement" or the "DPA") is incorporated by reference into the Terms and Conditions of Service for every User who loads to the Platform Personal Data of their own prospects or clients (particularly through the real-estate CRM module or the customer-service Artificial Intelligence Agents), in the terms already anticipated by Chapter 5 of the Full Privacy Notice. For Company or Agency-type Users that so require for their own compliance processes, this Agreement may also be executed as an independent, signed instrument, substituting such incorporation by reference with respect to that specific User.
DATA PROCESSING AGREEMENT (hereinafter, the "Agreement") entered into by, on the one hand, James Marcus Patman, in his capacity as data processor (hereinafter, the "Data Processor" or "Ancuria"), and, on the other hand, the User who accepts the Platform's Terms and Conditions of Service in their capacity as Real-Estate Agent, Real-Estate Developer or Company (hereinafter, the "Data Controller"), pursuant to the following Representations and Clauses.
REPRESENTATIONS
I. The Data Processor declares, through its representative, that
I.1
An individual engaged in business and professional activities, registered with the Federal Taxpayers Registry under RFC PAJA691202942, with domicile at Calle Aldama 470, Sin Número Interior, Colonia El Cerro, Puerto Vallarta, Jalisco, C.P. 48304, Mexico.
I.2
The holder and operator of the Ancuria™ Inteligencia Inmobiliaria technology platform, described in the Terms and Conditions of Service, which offers, among other features, a customer-relationship-management module (real-estate CRM) allowing its Users to manage information about their own prospects and clients.
I.3
Has the technology infrastructure, experience and reasonably necessary security measures to render the Personal Data processing service that is the subject of this Agreement, in its capacity as Data Processor under the Federal Law on the Protection of Personal Data Held by Private Parties (hereinafter, the "Law").
II. The Data Controller declares that
II.1
An individual or legal entity that uses the Platform in their capacity as Real-Estate Agent, Real-Estate Developer or Company, and that, in the course of such use, loads to the Platform Personal Data of their own prospects, clients or professional contacts.
II.2
Is the data controller, under the Law, of the processing of such Personal Data, being responsible for determining the purposes and means of such processing with respect to their own prospects and clients.
II.3
Has the necessary legal basis (including, where applicable, the corresponding consent or privacy notice vis-à-vis their own prospects and clients) to load such Personal Data to the Platform and to instruct the Data Processor to process it under the terms of this Agreement.
III. Both parties declare that
III.1
They mutually acknowledge the legal standing and capacity in which they appear to execute this Agreement.
III.2
It is their will to enter into this Agreement, subjecting themselves to the following:
CLAUSES
Clause 1. Purpose and Definitions
1.1 Purpose
This Agreement is intended to govern the processing of Personal Data that the Data Processor carries out on behalf of and at the instruction of the Data Controller, in connection with the provision of the Service, in compliance with the obligations that the Law and its Regulations impose on the relationship between a data controller and its data processor.
1.2 Definitions
For purposes of this Agreement, the terms "Personal Data", "Data Subject", "processing", "data controller" and "data processor" have the meaning assigned to them by the Law; the terms "Platform", "User", "Real-Estate Agent", "Account" and other capitalized terms not expressly defined in this Agreement have the meaning assigned to them by the Terms and Conditions of Service.
1.3 "Data Controller's Personal Data"
For purposes of this Agreement, these are understood to be the Personal Data of the Data Controller's prospects, clients or professional contacts that the Data Controller loads, captures or generates through the Platform, other than the Data Controller's own Personal Data as a User, which are governed directly by the Full Privacy Notice under the direct Processor-Data Subject relationship described therein.
Clause 2. Instructions of the Data Controller
2.1 Processing pursuant to instructions
The Data Processor will process the Data Controller's Personal Data exclusively pursuant to the latter's documented instructions, which are understood to be given, as a general matter, through the configuration and ordinary use of the Platform's modules (particularly the real-estate CRM and the customer-service Artificial Intelligence Agents) according to their purpose and usage documentation.
2.2 Additional instructions
The Data Controller may issue additional or specific instructions regarding the processing of their Personal Data, through the Platform's support channels, which the Data Processor will attend to to the extent they are technically feasible and compatible with the Platform's architecture.
2.3 Instructions exceeding the object of the Agreement
If an instruction from the Data Controller, in the Data Processor's reasonable judgment, would infringe the Law or another applicable provision, the Data Processor will immediately inform the Data Controller, being entitled to suspend execution of that instruction until the Data Controller confirms, modifies or withdraws it.
2.4 Prohibition of processing for own purposes
The Data Processor will not process the Data Controller's Personal Data for its own purposes other than those necessary for the provision of the Service, except to the extent such data undergoes an aggregation and anonymization process preventing individual identification of Data Subjects, pursuant to section 5.4 of the Terms and Conditions of Service, for the generation of Market Indicators.
2.5 Consequences of non-compliance
Processing of the Data Controller's Personal Data outside the documented instructions under this Clause shall constitute a material breach of this Agreement and of the Law, and the Data Processor may be deemed, with respect to such excessive processing, an independent data controller for all legal purposes pursuant to Article 50 of the Regulations of the Law.
Clause 3. Obligations of the Data Processor
3.1 Confidentiality
The Data Processor will process the Data Controller's Personal Data with strict confidentiality, refraining from disclosing it to unauthorized third parties, and imposing equivalent confidentiality obligations on its personnel and collaborators who have access to such data.
3.2 Security measures
The Data Processor will implement the administrative, technical and physical security measures described in the Information Security Policy and in Chapter 25 of the Terms and Conditions of Service, with respect to the Data Controller's Personal Data, with the same level of diligence applicable to the Data Processor's own information of equivalent classification.
3.3 Collaboration in the Data Controller's compliance
The Data Processor will provide the Data Controller with the reasonable assistance the latter requires to fulfill its own obligations toward its Data Subjects, including handling ARCO Rights requests pursuant to Clause 5, and notification of security breaches pursuant to Clause 6.
3.4 No retention of unnecessary data
The Data Processor will not retain the Data Controller's Personal Data for a period longer than necessary for the provision of the Service, pursuant to the periods described in Clause 9.
3.5 Consequences of non-compliance
Non-compliance with the obligations provided in this Clause shall give rise to the Data Processor's liability under Clause 10, without prejudice to the administrative consequences that, where applicable, apply under the Law.
Clause 4. Sub-processors
4.1 General authorization for subcontracting
The Data Controller generally authorizes the Data Processor to subcontract the processing of the Data Controller's Personal Data with the technology providers (sub-processors) described in Annex B of this Agreement, which correspond to the data processors identified in Chapter 10 of the Full Privacy Notice.
4.2 Equivalent obligations for sub-processors
The Data Processor undertakes that every sub-processor it uses for processing the Data Controller's Personal Data assumes, through a contractual instrument, data protection obligations equivalent to those assumed by the Data Processor itself in this Agreement.
4.3 Notification of changes in sub-processors
The Data Processor will notify the Data Controller, through the Annex B update mechanism or a general notice on the Platform, of the incorporation of a new sub-processor that will process the Data Controller's Personal Data in a manner substantially different from those already authorized, giving the Data Controller the opportunity to object to such incorporation pursuant to section 4.4.
4.4 Right to object
If the Data Controller reasonably objects to the incorporation of a new sub-processor, within a period of [POR DEFINIR] calendar days from the corresponding notification, the parties will seek a reasonable solution; if such solution is not reached, the Data Processor may choose not to incorporate that sub-processor with respect to the objecting Data Controller, or to terminate this Agreement with respect to that Data Controller, pursuant to Clause 11.
4.5 Liability for sub-processors
The Data Processor is liable to the Data Controller for its sub-processors' compliance with data protection obligations, to the same extent it would be liable if it carried out such processing directly.
4.6 Consequences of non-compliance
Subcontracting an unauthorized third party under this Clause, or failing to impose equivalent obligations on a sub-processor, shall constitute a breach of this Agreement.
Clause 5. Assistance in the Exercise of ARCO Rights
5.1 Referral of requests
When the Data Processor receives a Data Subject's request to exercise ARCO Rights that concerns the Data Controller's Personal Data, the Data Processor will refer that request to the Data Controller within a reasonable period, refraining from handling it directly, except upon the Data Controller's express instruction to the contrary.
5.2 Technical assistance
The Data Processor will provide the Data Controller with the reasonable technical assistance the latter requires to handle the corresponding request, including, where technically possible, the extraction, rectification or deletion of the Data Controller's Personal Data hosted on the Platform, through the features available for that purpose or by request to the Data Processor's support channels.
5.3 Time periods
The assistance described in this Clause will be provided within reasonable periods allowing the Data Controller to meet the legal deadlines applicable to handling ARCO Rights vis-à-vis its own Data Subjects.
5.4 Consequences of non-compliance
Failure to provide reasonable assistance under this Clause may expose the Data Processor to liability to the Data Controller for the damages the latter suffers from missing its own legal deadlines toward its Data Subjects, when such non-compliance is directly attributable to the Data Processor's lack of assistance.
Clause 6. Notification of Security Breaches
6.1 Obligation to notify the Data Controller
The Data Processor will notify the Data Controller, without unjustified delay and in any case within a reasonable period not exceeding [POR DEFINIR] hours from becoming aware of it, of any security breach affecting the Data Controller's Personal Data processed under this Agreement.
6.2 Content of the notification
The notification will include, to the extent of the information available at the time of issuance: the nature of the breach; the categories and approximate volume of Data Controller's Personal Data affected; the containment measures adopted; and contact details for further information.
6.3 Collaboration in the investigation
The Data Processor will collaborate with the Data Controller in investigating the breach and in fulfilling the notification obligations the latter has toward its own Data Subjects or before competent authorities.
6.4 Consequences of non-compliance
Failure to notify in a timely manner under this Clause shall constitute a material breach of this Agreement.
Clause 7. International Transfers
7.1 Reference to the Full Privacy Notice
The international-transfer regime applicable to the Data Controller's Personal Data processed under this Agreement is that described in Chapter 12 of the Full Privacy Notice, which is incorporated by reference into this Agreement.
7.2 Contractual guarantees
The Data Processor guarantees that every sub-processor located outside the United Mexican States that processes the Data Controller's Personal Data assumes, through a contractual instrument, protection obligations comparable to the standards required by the Law.
Clause 8. Audits
8.1 Data Controller's audit right
When the Data Controller is a Company that has executed this Agreement as an independent instrument pursuant to the Application Note, that Data Controller may request from the Data Processor, with reasonable notice of not less than [POR DEFINIR] calendar days, a reasonable audit of compliance with this Agreement, which will be conducted during business hours, without disproportionately interfering with the Data Processor's operations, and subject to the corresponding confidentiality agreements.
8.2 Audits through documentation
The Data Processor may satisfy the audit request by making reasonable documentation available (such as its sub-processors' certifications, summaries of its security policies, or compliance reports), in substitution of an on-site audit, when such documentation is sufficient for the purposes of the request.
8.3 Costs of the audit
Unless otherwise agreed, the costs of an audit requested under this Clause shall be covered by the requesting Data Controller, unless the audit reveals a significant non-compliance by the Data Processor, in which case the latter shall cover the reasonable costs of the audit.
8.4 Non-Company Users
With respect to Users who have not executed this Agreement as an independent instrument, the audit right is replaced by the right to request the general compliance documentation the Data Processor makes available pursuant to section 17.3 of the Information Security Policy.
Clause 9. Return or Deletion of Data upon Termination of the Agreement
9.1 Options upon termination
Upon termination of the contractual relationship between the Data Controller and the Data Processor, pursuant to the Terms and Conditions of Service, the Data Processor, at the Data Controller's election expressed within the [POR DEFINIR] calendar days following such termination: (i) will return to the Data Controller the latter's Personal Data in a structured, commonly used format, to the extent technically available; or (ii) will delete such Personal Data from its active systems.
9.2 Absence of election
If the Data Controller does not express their election within the indicated period, the Data Processor will proceed under the post-cancellation retention period described in section 35.3 of the Terms and Conditions of Service, after which it will delete such data.
9.3 Exception for legal obligation
The provisions of this Clause are understood without prejudice to the Data Processor's authority to retain the Data Controller's Personal Data, or copies thereof, to the extent necessary for compliance with a legal obligation applicable to the Data Processor itself.
9.4 Consequences of non-compliance
Unjustified retention of the Data Controller's Personal Data beyond what is provided in this Clause shall constitute a breach of this Agreement.
Clause 10. Liability and Indemnification
10.1 Liability of the Data Processor
The Data Processor shall be liable to the Data Controller for damages directly caused by non-compliance with the obligations specifically assumed in this Agreement, subject to the liability limits provided in Title IX of the Terms and Conditions of Service, which are incorporated by reference into this Agreement.
10.2 Liability of the Data Controller
The Data Controller is solely responsible for: (i) having the necessary legal basis to load their prospects' and clients' Personal Data to the Platform; (ii) the accuracy and lawfulness of such Personal Data; and (iii) compliance with their own obligations as data controller toward their Data Subjects, including making their own privacy notice available.
10.3 Indemnification
The Data Controller undertakes to hold the Data Processor harmless against any claim deriving from non-compliance with the obligations indicated in section 10.2, pursuant to the general indemnification regime provided in Chapter 42 of the Terms and Conditions of Service.
Clause 11. Validity and Termination
11.1 Entry into force
This Agreement shall enter into force on the date the Data Controller accepts the Terms and Conditions of Service or, in the case of an independently executed instrument, on the date of its signature, and shall remain in force for as long as the processing relationship over the Data Controller's Personal Data described in this Agreement subsists.
11.2 Termination
This Agreement shall terminate automatically upon termination of the contractual relationship between the Data Controller and the Data Processor pursuant to the Terms and Conditions of Service, without prejudice to the survival of the confidentiality, data return or deletion, and liability obligations, pursuant to Clause 12.
Clause 12. General Provisions
12.1 Survival
The confidentiality obligations (Clause 3.1), data return or deletion (Clause 9), and liability (Clause 10) obligations shall survive termination of this Agreement.
12.2 Relationship with the Terms and Conditions of Service
This Agreement is interpreted jointly with the Terms and Conditions of Service and the Full Privacy Notice; in case of discrepancy regarding the specific subject of processing of the Data Controller's Personal Data on the latter's behalf, the provisions of this Agreement shall prevail.
12.3 Modifications
The Data Processor may modify this Agreement pursuant to the same notification mechanism provided in Chapter 4 of the Terms and Conditions of Service, unless the Data Controller has executed it as an independent instrument, in which case its modification shall require the consent of both parties.
12.4 Applicable legislation and jurisdiction
This Agreement is governed by the federal laws of the United Mexican States; for its interpretation and performance, the parties submit to the jurisdiction indicated in section 46.2 of the Terms and Conditions of Service.
12.5 Severability
Should any provision of this Agreement be declared null, illegal or unenforceable, such declaration shall not affect the validity of the remaining provisions.
ANNEX A. DESCRIPTION OF THE PROCESSING
| Element | Description |
|---|---|
| Object of the processing | Personal Data of the Data Controller's prospects, clients and professional contacts, loaded into the real-estate CRM module and the Artificial Intelligence Agent service module |
| Nature of the processing | Storage, organization, retrieval, processing through Artificial Intelligence, and generation of automated communications |
| Purpose | Provision of the Platform's customer-relationship-management and sales-automation Service |
| Categories of Data Subjects | The Data Controller's prospects and clients |
| Categories of data | Name, contact data, real-estate preferences, interaction history with the Data Controller |
| Duration of the processing | Duration of the contractual relationship between the Data Controller and the Data Processor, plus the post-termination retention period described in Clause 9 |
ANNEX B. AUTHORIZED SUB-PROCESSORS
| Sub-processor | Service provided | Location |
|---|---|---|
| Railway | Cloud computing infrastructure (hosting of the application and the PostgreSQL database) | [POR DEFINIR] |
| OpenRouter (and underlying model providers: Anthropic, Google, OpenAI, DeepSeek) | Artificial Intelligence infrastructure: routing of requests to language-model providers, depending on the function | [POR DEFINIR] |
| Conekta | Payment processing | Mexico |
| Migadu | Messaging and communications: transactional email (SMTP) | [POR DEFINIR] |
| Cloudflare R2 | File storage (listing photographs and invoicing files) | [POR DEFINIR] |
| Facturapi | Invoicing: stamping of Digital Tax Receipts over the Internet (CFDI) 4.0 | Mexico |
| Mapbox | Interactive maps and geocoding of listing addresses | [POR DEFINIR] |
| Sentry | Technical error monitoring (no information identifying the User) | [POR DEFINIR] |
| Google Fonts | Typefaces (receives no Personal Data) | [POR DEFINIR] |
ANNEX C. SECURITY MEASURES
The security measures applicable to the processing described in this Agreement are those established in the Data Processor's Information Security Policy, which is incorporated by reference into this Annex and can be consulted at www.ancuria.com.