Data Processing Addendum

1. Roles and Scope

The client is the controller of end-customer personal data processed through AI agents. We process such data only on documented instructions to provide the Services.

2. Processor Obligations

• Process personal data only on the controller's instructions.
• Ensure personnel are bound by confidentiality.
• Implement appropriate technical and organizational measures (see Security Policy).
• Assist with data subject requests and data protection impact assessments.
• Notify the controller of a personal data breach without undue delay and within 72 hours.
• Delete or return personal data at the end of the Services.

3. Sub-processors

We engage sub-processors for cloud hosting, AI model inference, messaging delivery, email delivery and payment processing. We will give 30 days' notice of new sub-processors, during which the controller may object. A current list is available on request from contact@gringoservice.com.

4. International Transfers

Transfers of personal data from the EEA, UK or Switzerland are governed by the EU Standard Contractual Clauses (Module 2 or 3) and the UK International Data Transfer Addendum, incorporated by reference.

5. Audits

We will make available information necessary to demonstrate compliance and allow for reasonable audits, no more than once per year with 30 days' notice.