Data processing agreement

Version 1.2.0, in force since 20 October 2026. This English text is the binding version of this document; the versions in other languages are translations provided for convenience.

1. Parties and purpose

1.1. This agreement is made between the business that buys a NordixAIgency plan (the «Customer» or the «Controller») and the company that provides the service under the NordixAIgency brand («we» or the «Processor»):

• Company: AD Caldas Innotec SA

• NIF: A66316399

• Registered office: Calle Blanco 1011595 Torrecera (Cádiz)Spain

  1.2. It forms part of the NordixAIgency terms of sale (clause 11.2), and the Customer accepts it together with them when it completes the sign-up in the app (app.nordixaigency.com). It need not be signed separately.

  1.3. It governs the processing of personal data that we carry out on the Customer's behalf while providing the service, under Article 28 of Regulation (EU) 2016/679 (the «GDPR») and Spanish Organic Law 3/2018 (the «LOPDGDD»). The Customer is the controller of that data and we are its processor.

  1.4. It does not govern the data we process as controller: that of the Customer and of the people who represent it or use its account (sign-up, access, billing and support), or that of the visitors of nordixaigency.com. That data is governed by the privacy notices of clause 11.1 of the terms: the app's privacy notice and the website's privacy policy.

  1.5. On data protection, this agreement prevails over the terms of sale if the two conflict.

2. Definitions

«Personal data», «processing», «controller», «processor», «data subject», «personal data breach» and «data protection impact assessment» have the meaning given in the GDPR. In addition:

• «Customer Data»: the personal data we process on the Customer's behalf under clause 4.
• «Sub-processor»: a third party we engage to process Customer Data (clause 8 and Annex I).
• «Platform»: NordixBIOS, the AI-agent platform of Nordix Systems on which the assistant runs.
• «App»: the NordixAIgency application in which the Customer sets up and manages its assistant.
• «Connected systems»: the external systems the Customer joins to its assistant: those on our list (for example Google Calendar, Outlook or its booking or management software), with the «Connectors» add-on, and those joined through a custom integration job (clauses 3.5 and 4.4 of the terms).
• «Management line»: the App's phone number (the Customer's «management number») that the Customer calls from its verified mobile, with its PIN, to manage its business by voice.

3. Nature, purpose and duration of the processing

3.1. Nature. The Customer's assistant automatically receives and answers the communications that people address to the business on the plan's channels; consults the information and the agenda the Customer sets up; creates, moves and cancels appointments and waiting-list entries; reads and writes, on the Customer's behalf, in the connected systems (depending on the system, for example bookings, customer records or orders); sends the plan's notices (for example the confirmation of an appointment or the day-before reminder); passes the conversation or the call to a person where so configured; and tells the Customer what it has done. With Bookings switched off in the App, the assistant does not check availability: it takes the person's request for a booking or for a product and the App sends it to the Customer by e-mail, so that the Customer answers the person itself. When the Customer asks to be paid before a booking is kept, the App holds the booked time until a deadline and sends the person a link to the Customer's own payment page (with Bookings switched off, no time is held and the link is sent when the request is taken); it is the Customer who confirms the payment, and if the deadline passes without that confirmation, the held booking is cancelled. When the Customer calls its management number, the management line handles what it asks about its agenda and, depending on its plan, its connected systems (for example reading the day's appointments, cancelling an appointment or blocking a time slot). To do so, the data is collected, recorded, stored, consulted, transmitted and, in the end, erased.

3.2. Purpose. We process Customer Data only to provide the contracted service to the Customer: to serve its customers, to manage its agenda, to work with its connected systems, to handle what it asks on its management number, to inform it, to measure the plan's usage in order to invoice it, to keep the service secure and to answer its support requests. We do not use it for our own purposes, we do not sell or share it, we do not use it to send commercial communications, and it is not used to train artificial-intelligence models: the Platform's model providers are contractually prohibited from doing so.

3.3. Duration. This agreement lasts as long as the service contract and, after it, until we have returned or erased the Customer Data under clause 13.

4. Data subjects and categories of data

4.1. Data subjects. The Customer's customers and prospective customers and anyone who addresses its assistant (who calls, writes on WhatsApp, uses the chat on its website or sends an e-mail); the people booked in its agenda or on its waiting list; the people whose data is in the connected systems, as far as the assistant or the management line reads or writes it; the members of the Customer's team who appear in the agenda or receive transferred calls.

4.2. Categories of data, by channel. Depending on the channels and add-ons of the Customer's plan:

Channel or function	Data processed
Calls	The calling number; date, time and duration; what the caller says, converted into text, and the assistant's answers (transcript); language; the number the call is transferred to. The audio of the call is not recorded.
WhatsApp	WhatsApp phone number and profile name; the content of the messages and their date and time.
Website chat	The content of the conversation; a visitor identifier, which lets the visitor be recognised on later visits only if it consented on the Customer's website; language.
E-mail	The sender's address and name; subject, content and date of the messages; the attachments, which are stored and read to extract their text, which the assistant uses to answer.
Agenda and waiting list	The person's name, mobile number, e-mail address (only if the person gives it), language and notes; service, date, time, staff member, status of the appointment, channel it was requested on, and waiting-list entries. Also: how the person gets what it books (at the business, picked up, delivered or at the person's home); only for a delivery or a service at the person's home, the person's address (street lines, postcode and locality); the detail of what the person asks for, in its own words; the requests taken while Bookings are switched off; and, when the Customer asks to be paid before a booking is kept, whether the booking is held pending payment, its deadline and the channel (mobile or e-mail) the payment link was sent by (the link can also be given to the person in the conversation itself, or shown on the page of a waiting-list offer the person accepts). The recipient is the Customer, in the App and in the notice and request e-mails. The address is never given back to the assistant after the conversation, never goes in an SMS or WhatsApp message to the person, on the page of a notice's link or to an external calendar, and the technical copies the service makes of it to process each change once last no more than 24 hours.
SMS and e-mail notices	Mobile number, content of the notice and its delivery status; when the notice's link is opened, the IP address, only to limit abuse. When the Customer asks to be paid before a booking is kept, the payment link, and the notice that the payment was confirmed or that the time ran out, can also go by e-mail to the address the person gave.
Connected systems	The data the Customer's assistant reads and writes in the connected systems, depending on the system and on what the Customer sets up: for example bookings, customer records or orders; for the calendars, the busy periods read from them and the appointments written to them.
Assistant memory	What the person said in earlier conversations, so that it is recognised and not asked the same thing again.
Notices to the Customer	The appointment data included in the e-mails and notices the Customer receives (new appointment, cancellation, request to move, daily summary, a request taken while Bookings are switched off, a booking held pending payment or whose payment link could not be sent, and a hold that expired). The e-mails about a new, cancelled or moved booking, a request to move, a booking from the waiting list and a request also carry the address and that detail when there are any, and the notes of any booking; the e-mail about a booking held pending payment, or booked with the payment left to the business, does not.
Management line	What the Customer asks when it calls its management number, converted into text (transcript), and the data of its agenda and of its connected systems that the line reads or changes to handle it. The audio of the call is not recorded.

4.3. Payments. The assistant does not collect card data. In the solutions that send payment links, the payment is made in the Customer's own account with its payment provider (clause 3.4 of the terms).

4.4. Special categories of data. The service is not meant to process special categories of data (Article 9 GDPR) or data relating to criminal convictions and offences. The Customer must not set up its assistant to ask for them. If a person gives them on its own initiative, the assistant processes them only within the conversation and the appointment, and they are erased with them (Annex III and clause 13), or earlier at the Customer's request (clause 10).

4.5. Health businesses: appointment logistics only. A Customer in the health sector (for example a clinic or a practice) may use the service only for the logistics of its appointments: to book, move, confirm and cancel them, to run its waiting list and to send the plan's notices. In particular:

• the Customer undertakes not to set up its assistant — its instructions, the information it gives, the questions it asks — to collect clinical information (symptoms, diagnoses, treatments, medication, test results or medical history), and not to write such information in the notes of the appointments;

• the parties acknowledge that the type of appointment (the service booked, the professional or the speciality) may by itself reveal data concerning health. That data is processed only as far as the appointment needs it, and the reinforced measures of clause 4.6 apply to it;

• as controller, the Customer determines the condition of Article 9(2) GDPR that allows the processing, informs its patients and, where required, carries out the data protection impact assessment, in which we assist it (clause 12.1).

  4.6. Reinforced measures for health data. (a) All the measures of clause 7 apply to that data without exception, and call audio is not recorded. (b) The name of the service appears in the SMS notices sent to the person's mobile and in the notices to the Customer, so the Customer names its services in a way that reveals no more than the appointment needs (for example «Consultation» rather than the name of a condition or a treatment). (c) The data is kept no longer than Annex III states and is erased with the account under clause 13. (d) Only the members of our team who need it to answer a request of the Customer (clause 10) or to keep the service running have access to it (clause 6).

5. The Customer's instructions and its obligations as controller

5.1. We process Customer Data only on the Customer's documented instructions, which are: the terms of sale, this agreement, the set-up the Customer makes in the App (channels, opening hours, services, answers, when to pass to a person, who may call, spending cap, connected systems), what it asks by phone on its management number and the instructions it sends us in writing to privacy@nordixaigency.com.

5.2. If we consider that an instruction infringes the GDPR or other data protection rules, we will tell the Customer at once and may refrain from following it until the Customer confirms or changes it.

5.3. If Union or Member State law requires us to process the data otherwise (for example, at the request of an authority), we will tell the Customer beforehand, unless that law prohibits it.

5.4. As controller, the Customer:

• decides the legal basis of the processing and answers for it;
• informs its customers about the processing of their data (for example, in its website's privacy notice and in its communications), including the use of an automated assistant, which introduces itself as such in its first reply;
• obtains on its website, where required, the consent to recognise a chat visitor on later visits;
• gives the assistant only numbers and addresses it is entitled to use (for example, that of the person who receives transferred calls);
• does not use the service to send unsolicited communications; and
• complies with the other obligations of clause 10 of the terms.

6. Confidentiality

6.1. Only the members of our team who need it to operate the service or to assist the Customer have access to Customer Data, and all of them are bound by a contractual or statutory duty of confidentiality that survives the end of their relationship with us.

6.2. That duty of confidentiality is also imposed on the Sub-processors (clause 8.4).

7. Security measures

7.1. We apply technical and organisational measures appropriate to the risk (Article 32 GDPR). Today, in summary:

• Location. The App, its database and its storage are hosted on Amazon Web Services, in the European Union (Frankfurt, Germany). The Platform also runs in Frankfurt.

• Encryption in transit. All communication with the App and the Platform is encrypted (HTTPS/TLS); the storage refuses unencrypted connections and e-mail sending requires TLS 1.2 or higher.

• Encryption at rest. The database and the storage are encrypted. The most sensitive credentials (those of the connected systems, the team's second factors and the sessions with the Platform) are in addition encrypted one by one with AES-256-GCM and a key that can be rotated. The Platform encrypts its data at rest with AES-256 and keeps credentials in a managed key store.

• Credentials of the connected systems. The keys and access the Customer gives to connect a system are the Customer's: the App keeps them encrypted as just described and uses them only, in that Customer's account, for its assistant and, when the Customer calls its management number, for the management line. We never use credentials of NordixAIgency in the Customer's systems. Depending on the system, the App hands the credential to the Platform for each call to the system, or the call goes through the App, which places the credential: in that case the App sees in transit the data that goes back and forth, does not keep it beyond what the call needs and does not record its content in its logs.

• Isolation. Each brand that uses the App has its own installation, with its own database, storage and secrets; one Customer's data is kept apart from the others', and caller recognition never crosses from one Customer to another. On the Platform, each partner's data is isolated by row-level security policies in the database.

• Access control. Our team's access requires a second authentication factor; each function has its own role and least privileges; passwords are stored with a key-derivation algorithm (scrypt) and never in clear; the service's secrets are kept in a secrets manager, not in the code.

• Minimisation. When the assistant looks up an appointment to move or cancel it, it never reveals anybody's name, phone number, e-mail address or notes, and every change it makes is notified to the Customer and, by SMS, to the appointment's mobile number.

• Logs. Technical logs mask personal data and secrets and are kept for 30 days; changes to the state of the service leave an audit record. The Platform also keeps a record of the assistant's operations.

• Backups and continuity. The database has point-in-time recovery over 35 days and deletion protection; usage limits per person and per IP address protect against abuse.

  7.2. We may update these measures as technology evolves, provided the level of security is not reduced.

8. Sub-processors

8.1. The Customer gives us a general authorisation to engage Sub-processors. The current ones are listed in Annex I.

8.2. We will notify the Customer by e-mail at least 30 days before adding or replacing a Sub-processor. Within that period the Customer may object on reasonable data protection grounds by writing to privacy@nordixaigency.com. If no solution is found, the Customer may close its account with immediate effect.

8.3. If a Sub-processor stops providing its service for an urgent reason of security or continuity, we may replace it without waiting for that period, telling the Customer as soon as possible.

8.4. We impose on each Sub-processor, by contract, data protection obligations equivalent to those of this agreement, and we remain liable to the Customer for their performance (Article 28(4) GDPR).

8.5. Not Sub-processors are the third-party services the Customer connects with its own account and under that third party's terms (clause 3.3 of the terms), the connected systems included, listed in Annex II: they are the Customer's providers, and the data reaches them, and is read from them, by the Customer's decision.

8.6. Nor are the providers we use for our own processing as controller (clause 1.4): for example Stripe to charge the Customer, Cloudflare Turnstile against spam on the website forms and at sign-up, Google for the website's measurement and Microsoft 365 for the mailbox that receives the website's requests.

9. International transfers

9.1. Customer Data is hosted in the European Economic Area. Some Sub-processors of Annex I are or may be outside it (for example, the AI model providers in the United States).

9.2. Transfers outside the European Economic Area take place only with a safeguard of Chapter V of the GDPR: an adequacy decision (including the EU-US Data Privacy Framework where the recipient is certified) or, failing that, the standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914), with any supplementary measures required. Annex I states the safeguard of each Sub-processor.

10. Data subjects' rights

10.1. If a person addresses to us a request to exercise its rights (access, rectification, erasure, objection, restriction or portability) over Customer Data, we will pass it on to the Customer within 5 business days and will not answer it ourselves unless the Customer instructs us to.

10.2. The Customer can handle part of those requests itself in the App: move and cancel appointments, edit or clear their notes and remove waiting-list entries.

10.3. For the rest — for example a copy of a person's data, or the erasure of its conversations, call transcripts, assistant memory or appointments — the Customer sends us the request by e-mail to privacy@nordixaigency.com, naming the person by the phone number, e-mail address or WhatsApp number it used. We handle it for the Customer, through a documented procedure of our team, in the App and on the Platform, without undue delay and in time for the Customer to answer the person within the periods of Article 12(3) GDPR (one month, which may be extended by two further months where necessary): within 10 business days of the Customer's request, unless we tell the Customer within that period why the request needs longer. We tell the Customer in writing what we found and what we did, so that it can answer the person. There is no self-service tool for these actions.

11. Personal data breaches

11.1. We will notify the Customer, without undue delay and in any event within 48 hours of becoming aware of it, of any personal data breach affecting Customer Data, at its account's e-mail address.

11.2. The notice will include, as far as we know it, the information of Article 33(3) GDPR: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed and a contact point. What we do not know at first we will provide in phases.

11.3. We will take reasonable measures to contain the breach and mitigate its effects and will cooperate with the Customer so that it can notify the supervisory authority and, where applicable, the data subjects. We will not notify the authority or the data subjects on the Customer's behalf unless it asks us to. The notice is not an admission of fault or liability.

12. Other assistance to the Customer

12.1. We will assist the Customer, with the information available to us, in its data protection impact assessments and in prior consultations with the supervisory authority (Articles 35 and 36 GDPR).

12.2. We keep the record of the processing activities we carry out on behalf of our customers (Article 30(2) GDPR).

13. End of the contract: return and erasure of the data

13.1. When the account closes, the channels close, the phone number is released, the connected systems are disconnected and their credentials deleted at once (for the calendars, consent is also withdrawn where the provider allows it) and the assistant stops answering. What is already written in the Customer's systems (for example the appointments in its calendars) remains there, because it is the Customer's.

13.2. Export. Within 30 days after the closure, the Customer may ask us at privacy@nordixaigency.com for a copy of its appointments, its waiting list, its conversations and the call transcripts that still exist, in a structured, commonly used format. Our team prepares it by hand and sends it through a secure channel within 30 days of the request and, in any case, before the erasure of clause 13.3.

13.3. Erasure. No later than 90 days after the closure, we erase the Customer Data in the App and on the Platform, except the data a law requires us to keep, which remains blocked for as long as that obligation lasts. Erased data that is still in a backup disappears at the end of its cycle (35 days for the App's database) and is never restored into the service; the App's technical logs expire after 30 days. If the Customer asks, we confirm the erasure in writing.

13.4. The export and the erasure are carried out by our team through a documented procedure: the closure of the account does not start them by itself.

13.5. The data of the Customer itself as our customer (its account, invoices and payments) is not Customer Data: it is kept under the privacy notice (clause 1.4) for as long as tax and commercial law requires.

13.6. While the contract is in force, Customer Data is kept as set out in Annex III.

14. Information and audits

14.1. We will make available to the Customer the information needed to demonstrate compliance with this agreement and with Article 28 GDPR.

14.2. The Customer may audit that compliance, itself or through an independent auditor bound by confidentiality, at most once a year (except after a personal data breach or at the request of an authority), with 30 days' notice and at its own cost. We will first try to satisfy it with documentation, including the certifications and audit reports of our Sub-processors; an audit may not give access to other customers' data or compromise the security of the service.

15. Liability

Each party is liable for its own obligations under Article 82 GDPR. Liability arising from this agreement is subject to the limits and exclusions of clause 13 of the terms of sale, except to the extent that data protection law does not allow it to be limited.

16. Changes

We may change this agreement by the same procedure as clause 15 of the terms (notice by e-mail at least 30 days in advance). Changes of Sub-processors follow clause 8; those required by law apply from when they become mandatory.

17. Contact

Notices about this agreement go to privacy@nordixaigency.com; ours go to the e-mail address of the Customer's account. We have not designated a data protection officer.

18. Language, governing law and jurisdiction

18.1. This agreement is governed by Spanish law.

18.2. For any dispute, the parties submit to the courts of the registered office of AD Caldas Innotec SA.

18.3. This agreement is drawn up in English and in Spanish. The English version prevails; the Spanish one is a courtesy translation.

Annex I — Sub-processors

Sub-processor	What it does	Where	Transfer safeguard
Nordix Systems	NordixBIOS Platform: runs the assistant on every channel and the management line, reads and writes in the connected systems on the Customer's behalf, keeps the conversations and the assistant's memory, hosts the assistant's mailbox and measures usage	Data in the EU (Frankfurt, Germany)	No transfer
Amazon Web Services	Hosting of the App (database, storage, compute, secrets and delivery network) and sending of the e-mails to the Customer and to the Customer's customers (the payment link of a held booking); it also hosts the Platform	EU (Frankfurt, Germany)	No transfer of the hosted data
Telnyx LLC (United States); its terms name no EU contracting entity	Phone numbers and call transport; speech recognition and synthesis during calls; SMS notices to the Customer's customers. Engaged by the Platform (voice) and by us (SMS), under one data processing addendum that covers both	Main processing facilities in the United States; Telnyx offers an EU data-locality option (Germany) chosen per account	EU-US Data Privacy Framework (Telnyx LLC certified, active) and the standard contractual clauses (Decision (EU) 2021/914) incorporated in its addendum
Anthropic Ireland, Limited (Ireland; the contracting entity for customers in the EEA), engaged by the Platform	AI model that interprets the messages and generates the assistant's answers. It may not train models on this content and deletes inputs and outputs within 30 days, save for its usage-policy enforcement and legal obligations	Stored in the United States; processing may run in any geography where Anthropic operates	Standard contractual clauses (Decision (EU) 2021/914, modules two and three) incorporated in its addendum; Anthropic is not certified under the Data Privacy Framework
OpenAI Ireland Ltd (Ireland; the contracting entity for customers in the EEA), engaged by the Platform	Turning text into vectors to search the information the Customer sets up. It does not use this content to train its models; abuse-monitoring logs are kept up to 30 days	It may process data outside the European Economic Area; OpenAI offers an EU data-residency option, chosen per project	Standard contractual clauses incorporated in its addendum, for its transfers to OpenAI affiliates and third parties outside the EEA; OpenAI is not certified under the Data Privacy Framework
Microsoft (Microsoft 365)	Support mailbox (support@nordixaigency.com), if the Customer sends Customer Data to it	EU Data Boundary: for organisations signed up in the EU, Customer Data is stored and processed in the EU/EFTA, with the limited exceptions Microsoft documents	Data Privacy Framework (Microsoft Corporation certified, active) and standard contractual clauses between Microsoft Ireland Operations Limited and Microsoft Corporation

Nordix Systems may engage further providers of its own for the Platform; their list is available to the Customer on request at privacy@nordixaigency.com.

Under its data processing addendum, Telnyx acts as an independent controller of the call and message records (who called or wrote to whom, when and for how long) and may use de-identified content to improve its services.

Annex II — Third-party services the Customer connects (not Sub-processors)

Service	What for
Meta (WhatsApp; Instagram and Messenger when available)	The Customer's WhatsApp number is connected with its own Meta account, under Meta's terms.
Google Calendar, Microsoft Outlook and the other systems on our list	The systems the Customer connects, if it does, with its own account and under its provider's terms, so that the assistant reads and writes in them what the Customer sets up (for example the busy periods and the appointments of its calendars).
The systems joined through a custom integration	The Customer's system that needs development (for example its ERP or its CRM), which we join to its assistant through a custom job, under its provider's terms.
The Customer's payment provider (for example its Stripe account)	Payment links, in the solutions that send them.
The Customer's telephone carrier	Forwarding its calls to the plan's number and receiving transferred calls.

These services and systems are the Customer's providers, not Sub-processors: the Customer decides to connect them, and the data reaches them, and is read from them, under its relationship with each provider.

Annex III — Retention while the contract is in force

Data	Retention
Call transcripts, those of the management line included	180 days, then erased automatically by the Platform
Call audio	Not recorded: recording is off by default and the App does not switch it on
The assistant's memory of each person	Erased after 180 days without contact
WhatsApp, website chat and e-mail conversations	12 months. Our team erases them in a monthly procedure, so no conversation is kept more than 13 months
Appointments	For as long as the account exists; erased with it (clause 13.3)
Booking requests taken while Bookings are switched off	Like an appointment, the person's name and mobile number included: for as long as the account exists; erased with it (clause 13.3), except what the next row erases sooner
The person's address, and the detail in the person's own words of a booking or request for a product or of a request that names no item	Erased 30 days after the booking ends (requests: 30 days after the requested day or, when the request names no day, after the request). The notes of a booking or a request for a service are kept like the appointment. Copies already delivered in the notice e-mails sit in the Customer's own mailbox, under the Customer's control, and are not erased by us. An address the person says in a conversation stays in that conversation and follows its retention (above)
Waiting-list entries	Until the day after the end of the requested window
Links in SMS notices	Expire 24 hours after the start of the appointment
Payment links of a held booking (sent by SMS or e-mail, given in the conversation or shown on the page of a waiting-list offer)	Stop leading to the Customer's payment page at the hold's deadline; for a request taken while Bookings are switched off, 24 hours after the request
Notices to the Customer in the App's notification panel	90 days
The App's technical logs	30 days
Credentials of the connected systems	While the system is connected. If the Customer disconnects it (except Google Calendar and Outlook), no longer has the «Connectors» add-on (for the systems on our list, except those two) or if the system stops being available to the Customer (because we withdraw it from our list or, for a system joined through a custom integration, it is no longer assigned to the Customer), they are kept encrypted and unusable for up to 30 days, so that it can connect it again without giving them anew (in the last case, if the system becomes available to it again); then they are erased automatically. Those of Google Calendar and Outlook, which are connected from the agenda, are erased at once when they are disconnected and, without the add-on, are disconnected and erased after 7 days. When the account closes they are erased at once (clause 13.1)
Backups of the App's database	35 days