Data processing agreement

1. Parties and subject matter

The Controller is the holder of the SyntaxFlow account who accepts this agreement; the Processor is Elam Uceda Herrero, trading as SyntaxFlow (annex I). The Processor will process on the Controller's behalf the personal data the Controller keeps in its account, for the sole purpose of storing it and syncing it between its devices, as described in annex II.

The links the Controller sends to its customers or suppliers (estimate, job report, delivery note, purchase order) carry the document inside the link itself, in the part the browser does not send to the server, and the customer's or supplier's replies reach the Controller by WhatsApp or e-mail without passing through the Processor. That part of the service involves no processing by the Processor.

2. Definitions and interpretation

Terms defined in the GDPR have the same meaning in this agreement, which shall be read in accordance with the GDPR and never so as to prejudice the rights of data subjects.

3. Instructions

3.1. The Processor will process the data only on documented instructions from the Controller, unless Union or Member State law requires it to; in that case it will inform the Controller beforehand, unless that law prohibits this on important grounds of public interest.

3.2. Documented instructions are: this agreement and its annexes; the terms of service the Controller has accepted; and what the Controller's users do with the tools (save, edit, delete, export, issue a document or create a link). Any other instruction shall be given in writing to the contact address in annex I.

3.3. The Processor will not process the data for its own purposes: no analysis, advertising, marketing or training of artificial intelligence models.

3.4. The Processor will immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other data protection law.

4. Confidentiality and access

4.1. At the date of this agreement the only person with access to the systems is the Processor himself. Access to the Controller's content will be limited to what is strictly necessary to carry out its instructions, provide support the Controller asks for, resolve an incident or comply with a legal obligation.

4.2. Before giving access to any future collaborator, the Processor will bind them in writing to a duty of confidentiality.

5. Security of processing

The Processor will apply at least the technical and organisational measures in annex III, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks for data subjects (Article 32 GDPR).

6. Sensitive data

Processing of the special categories of data in Article 9 GDPR or of data on criminal convictions and offences is not envisaged. The Controller undertakes not to enter such data. If the Processor finds that any appears incidentally, it will restrict access to it, inform the Controller and follow its instructions.

7. Sub-processors

7.1. The Controller gives the Processor a general authorisation to engage the sub-processors listed in annex IV.

7.2. The Processor will inform the Controller in writing of any addition or replacement of a direct sub-processor at least thirty (30) days in advance, with the information needed to object. If the Controller objects on reasonable data protection grounds and there is no viable alternative, either party may terminate the agreement without penalty, with the export of the data provided for in clause 13.

7.3. When a sub-processor in annex IV announces changes to its own sub-processors, the Processor will pass the notice on to the Controller within three (3) working days at most; the Controller may object within the following five (5) calendar days, with the effect set out in the previous paragraph.

7.4. The Processor will only engage sub-processors that provide sufficient guarantees and whose contract imposes on them, in substance, the same data protection obligations as this agreement imposes on the Processor. At the Controller's request it will provide a copy of that contract or of the data processing addendum containing it, and may omit confidential information.

7.5. The Processor remains fully liable to the Controller for the performance of its sub-processors' obligations (Article 28(4) GDPR) and will notify the Controller of any failure by them.

8. International transfers

8.1. The data is stored in the European Union: the database and the file store have been created with the sub-processor's European Union jurisdiction (annex IV). The service's code, however, runs on that sub-processor's worldwide network, so the data in a request may pass through facilities outside the European Economic Area (EEA). That transit relies on the sub-processor's certification under the EU-U.S. Data Privacy Framework and, in the alternative, on the standard contractual clauses of Commission Implementing Decision (EU) 2021/914 included in its data processing addendum.

8.2. Apart from the above, the Processor will only transfer data to a third country or an international organisation on documented instructions from the Controller or where Union or Member State law requires it, and always in accordance with Chapter V GDPR.

8.3. If the Controller is established outside the EEA, in a country without an adequacy decision of the European Commission, the return of its data to its devices is governed by the standard contractual clauses of Commission Implementing Decision (EU) 2021/914, module four (transfer from processor to controller), which the parties incorporate by reference, with the Processor as data exporter and the Controller as data importer, and with the details in annexes I to III of this agreement.

9. Assistance to the Controller

9.1. The Processor will promptly notify the Controller of any request it receives from data subjects and will not answer it itself unless the Controller authorises it to.

9.2. The Controller can handle access, rectification, erasure and portability itself from its tools. Where that is not enough, the Processor will help it in writing within ten (10) working days at most.

9.3. Taking into account the nature of the processing and the information available to it, the Processor will also help the Controller comply with its obligations on security (Article 32), notification of personal data breaches (Articles 33 and 34), data protection impact assessment and prior consultation (Articles 35 and 36), and will inform it without delay if it finds that the data it processes is inaccurate or outdated.

10. Personal data breaches

10.1. The Processor will notify the Controller of any personal data breach affecting the data under this agreement without undue delay after becoming aware of it and, in any case, within forty-eight (48) hours at most. That maximum does not allow a notification that could be made sooner to be delayed.

10.2. The notification will be sent to the account's e-mail address, if any, and as a prominent notice in the account, and will include at least: the nature of the breach (with the categories and approximate number of data subjects and records concerned, where possible); a contact point; its likely consequences; the measures taken or proposed to address it and mitigate its effects; and the chronology of events and the systems affected. Where not all the information can be given at once, it will be given in phases without undue delay.

10.3. The Processor will cooperate with the Controller so that it can notify the supervisory authority and communicate the breach to data subjects where required (Articles 33 and 34 GDPR).

11. Documentation and audits

11.1. The parties must be able to demonstrate compliance with this agreement. The Processor will deal promptly with the Controller's enquiries and make available to it the information necessary to demonstrate compliance with Article 28 GDPR; it will answer reasonable questionnaires within thirty (30) calendar days at most, at no charge for that ordinary information.

11.2. The Processor will allow for and contribute to audits and inspections by the Controller or an independent auditor it appoints, at reasonable intervals or where there are indications of non-compliance, with reasonable notice which, as a rule, will be thirty (30) calendar days, save justified urgency or a request by a supervisory authority. An audit will not give access to other customers' data or to trade secrets. The auditor's fees are borne by the Controller; extraordinary assistance by the Processor will be agreed beforehand at a reasonable, non-deterrent amount, and borne by the Processor if the audit establishes a material breach on its part.

11.3. As regards the sub-processor's infrastructure, the Processor will provide the independent audit reports and current certifications the sub-processor makes available to its customers and, if they are justifiably insufficient, will exercise against it the information and audit rights its data processing addendum gives it.

11.4. The parties will make this information and the results of audits available to supervisory authorities on request.

12. Non-compliance and termination

12.1. Without prejudice to the GDPR, if the Processor breaches this agreement, the Controller may instruct it to suspend the processing until it complies again, or terminate the agreement. The Processor will promptly inform the Controller if it is unable to comply for whatever reason.

12.2. The Controller may terminate the agreement if suspended processing is not brought back into compliance within a reasonable time and, in any event, within one month; if the Processor is in substantial or persistent breach; or if it fails to comply with a binding decision of a court or supervisory authority on these obligations.

12.3. The Processor may terminate the agreement if, after warning the Controller that an instruction infringes the law (clause 3.4), the Controller insists on it being followed.

13. Duration, return and deletion

13.1. This agreement lasts as long as the account exists and has syncing switched on or the Plan Taller.

13.2. End of the Plan Taller: if syncing stays on, the processing continues for the documents. The Plan Taller's photos and files are kept for thirty (30) days after the plan ends, on the Controller's instruction, so that it can resume the plan or download them without renewing it; after that period, unless resumed, they are deleted from the live systems. The Controller may ask at any time for earlier deletion.

13.3. End of the processing: on deleting the account or switching syncing off, the Controller chooses between exporting its data (in a structured, commonly used format, with its original files) or having it deleted straight away. Once the choice is made, the data is deleted from the live systems without undue delay, unless Union or Member State law requires it to be kept. Until deletion, the Processor keeps complying with this agreement.

13.4. Restore points: to ensure the availability of the service (Article 32(1)(c) GDPR), the database keeps restore points for thirty (30) days at most. Deleted data remains in them, inactive and not in ordinary use, until that period runs out. If a copy has to be restored to repair a fault, the Processor will re-apply later deletions before bringing the service back.

13.5. At the Controller's request, the Processor will confirm in writing the deletion from the live systems and state the date on which the restore points will be gone.

13.6. Continuity: the Controller can export its data at any time from its account. If the Processor decides to discontinue the service, it will give at least thirty (30) days' notice, keep the export available during that period and delete the data afterwards.

14. Liability

Towards data subjects, each party is liable under Article 82 GDPR. Between the parties, each is liable for the damage caused by its own breaches, and the Processor is fully liable to the Controller for its sub-processors' breaches (Article 28(4) GDPR).

15. Notices and changes

15.1. The Processor's notices are sent to the account's e-mail address, if any, and as a notice in the account; the Controller's, to the contact address in annex I. To protect its customers, the Controller should not send documents with third parties' personal data to support unless essential to resolve an incident.

15.2. The Processor may update its contact details and improve the security measures without lowering the level of protection. Changes of sub-processors follow clause 7.

15.3. Any other substantial change requires the documented agreement of the parties. Changes required by law will be notified as soon as possible and, where possible, thirty (30) days in advance. If a change harms the Controller and it does not accept it, it may terminate the agreement without penalty and export its data.

16. Controllers in Brazil

If the Controller is established in Brazil or Law 13.709/2018 (LGPD) applies to it, this agreement also serves as the controller's instructions to the operator (Article 39 LGPD), without prejudice to the safeguards of the GDPR. The transfer of data from Brazil to the EEA relies on the mutual adequacy between Brazil and the European Union (Commission Implementing Decision (EU) 2026/179 and Resolution CD/ANPD No 32/2026), which does not by itself cover the transit described in clause 8.1, covered by the instruments cited there.

17. Governing law and jurisdiction

This agreement is governed by the GDPR, Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights and, otherwise, by Spanish law. Disputes between the parties will go to the courts that have jurisdiction under the statutory rules, with no choice-of-court clause. Nothing in this clause limits the right of data subjects to complain to the supervisory authority or to go to the competent courts.

Annex I. Parties

Controller: the holder of the SyntaxFlow account who accepts this agreement on switching syncing on or buying the Plan Taller, identified by its account details and, if it has bought, by those on its invoice (name or company name and, if given, its tax number). The person accepting declares that they have authority to bind it. Date of accession: the date of acceptance.

Processor: Elam Uceda Herrero, sole trader trading as SyntaxFlow, Spanish tax number (NIF) 48228797M, Calle Fresnedillas 25, 28035 Madrid (Spain). Contact: [email protected]. No data protection officer has been appointed, as none is required (Article 37 GDPR and Article 34 of Organic Law 3/2018).

Annex II. Description of the processing

Data subjects: the Controller's customers and contacts; the Controller's suppliers and their contact persons; the Controller's staff who appear in its documents; people who appear in the photographs the Controller uploads.

Data: identification and contact data (name, site or delivery address, telephone, e-mail); the content of the Controller's documents (estimates, survey sheets, job reports, delivery notes, purchase orders and checklists: references, sizes, quantities, amounts and notes); names, roles and hours of staff in job reports; photographs and files the Controller uploads; and, if the Controller records them, the details of the acceptance or sign-off it has received from its customers.

Sensitive data: not envisaged (clause 6).

Nature: storage on a server, syncing between the Controller's devices, restore copies and deletion.

Purpose: giving the Controller its documents, photos and files on all its devices.

Duration: as in clause 13.

Outside this agreement: the data of the Controller's own account (username, optional e-mail, purchases and security log) is processed by the Processor as controller, under its privacy policy. That is why the providers involved only in it (Stripe for the service's payments, Resend for the account recovery e-mail and Google for signing in with Google) are not sub-processors under this agreement.

Annex III. Technical and organisational measures

Encryption: connections encrypted in transit (TLS/HTTPS). Passwords and recovery codes stored only as hashes; the optional e-mail address encrypted at rest. Syncing is not end-to-end encryption: the server can read what it stores in order to return it to the Controller's devices.

Identification and authorisation: access with username and password, or signing in with Google where offered; a session cookie that page scripts cannot read, that travels only over HTTPS and ends after 30 days without use or after 90 days; protection against cross-site request forgery; limited sign-in attempts.

Separation: each account can reach only its own data. Plan Taller limits: 250 MiB and 2,000 files per account, 25 MiB per file.

Storage and location: the sub-processor's database and file store created with its European Union jurisdiction (clause 8.1).

Availability: database restore points for up to 30 days; the Controller's devices also keep their local copy.

Logging: a security log records what happened (sign-ins, sign-outs, sessions closed, exports and deletions) and when, with the account's internal number, never the content, password or e-mail; it is kept for 12 months and used only for security.

Minimisation and retention: the service asks for no more data than the Controller decides to keep; deletion as in clause 13.

Portability and deletion: export of the account's data and deletion of documents, files or the whole account from within the service.

Governance: administrative access limited to the Processor; review of these measures at least once a year and whenever the infrastructure changes; automated tests of the service before every release.

Annex IV. Authorised sub-processors