Data processing agreement

1. Scope and parties

This agreement is part of the terms and conditions between SMART SSO, S.A. de C.V. ("SmartAlly") and the business that purchases the service ("you"). It applies to the personal data of your end customers and other people that SmartAlly processes on your behalf when providing the service ("customer data").

For customer data, you are the controller and SmartAlly is the processor, as defined by Mexico's Federal Law on the Protection of Personal Data Held by Private Parties.

2. What data and for what

3. Your responsibilities

• Having your own privacy notice and making it available to your customers.
• Having the legal basis to process the data and to message customers on each channel, including the express consent the law requires for sensitive or financial data.
• Configuring the assistant and giving us instructions that comply with the law.
• Handling your customers' rights requests, with our support.

4. Our obligations as processor

• Processing customer data only on your instructions, which are those you give when configuring and using the service and those in this agreement. If an instruction seems unlawful to us, we tell you.
• Not using customer data for our own purposes, not selling it and not using it to train general-purpose artificial intelligence models.
• Making sure staff with access are bound by confidentiality and access only what is needed, for example to support you when you ask.
• Maintaining administrative, technical and physical security measures appropriate to the risk.
• Helping you, within reason, answer rights requests and requests from authorities. If a request reaches us directly, we pass it to you without answering it ourselves, unless you ask us to.
• Notifying you if an authority requests customer data, unless the law prohibits it.

5. Providers that process the data (subprocessors)

You agree that we use the providers on the providers page to process customer data. We require each of them by contract to meet protection obligations equivalent to this agreement, and we remain responsible for them.

If we add or change a provider, we update the page and email you at least 30 days in advance. If you have a reasonable data protection reason to object, write to us within that period. If we cannot find a solution, you can cancel the affected part of the service without penalty.

6. International transfers

Some providers process data outside Mexico, mainly in the United States. We only use providers that commit by contract to protect it to a standard equivalent to Mexican law.

If your customers are in the European Union, the European Economic Area, the United Kingdom or Switzerland, this agreement also works as the processor contract required by Article 28 of the GDPR. Transfers of that data outside their region are covered by the European Commission's standard contractual clauses, which are deemed incorporated into this agreement.

7. Security breaches

If we confirm a security breach affecting customer data, we notify you without delay and within 72 hours. We tell you what happened, what data was affected, what we did and what we recommend, so you can notify data subjects when the law requires.

8. Return and deletion

When the service ends you have 30 days to export customer data from the platform or ask us for a copy. After that we delete it, along with its copies, within 90 days at most, except what the law requires us to keep, which we block and use only for that purpose.

9. Reviews

If you need it to show your own compliance, we give you reasonable information about our privacy and security measures, up to one request per year unless there is a breach or an authority asks for it. The information we provide is confidential.

10. Precedence and contact

If this agreement and the terms and conditions differ on personal data, this agreement prevails. For anything about this agreement, write to us at connect@smartally.io.