Data Processing Agreement

This contract governs the processing of personal data that the Provider carries out on behalf of the Firm when providing the ImmigraFlow service. It forms part of the Terms and Conditions (section 11), and capitalised terms (Platform, User, Firm’s Client, Firm Data) have the meaning given to them in the Terms.

1. Parties and form of the contract

• Controller: the Firm that contracts the Platform, identified by its organisation and billing details in its account (hereinafter, the “Firm”).
• Processor: Antonio Samuel Martín Polo, trading under the business name Autonomio and the ImmigraFlow brand. Tax ID (NIF): 50555557Q. Address: Calle de las Laderas 16B, 28490 Becerril de la Sierra, Madrid, España. Email: hello@immigraflow.io (hereinafter, the “Provider”).

The contract is entered into by electronic means: the Firm accepts it by accepting the Terms when registering or contracting, and remains bound by it for as long as the Terms remain in force. This electronic form satisfies the written-form requirement of Article 28(9) of Regulation (EU) 2016/679 (GDPR).

2. Purpose of the processing

The Provider will process, on behalf of the Firm, the personal data that the Firm, its Users or the Firm’s Clients enter into the Platform, solely for the purpose of providing the service described in the Terms. This contract does not cover the data of the Firm’s account and of its Users that the Provider processes as controller (subscription billing, commercial communications, support, analytics), which are governed by the Privacy Policy.

3. Term

This processing agreement lasts as long as the contract under the Terms and, once that ends, for as long as the Provider retains the data under clause 15. The confidentiality and security obligations remain in force for as long as the Provider retains any Firm Data.

4. Nature and purpose of the processing

Purpose: managing the Firm’s immigration case files and its relationship with its clients through the Platform.

Processing operations, depending on the functions the Firm uses:

• Recording, hosting, storage, organisation, retrieval and backup of data and documents.
• Automatic reading of documents with artificial intelligence, case file summaries, regulatory look-ups, draft legal documents and translation of messages.
• Recording of the questions that Users and the Firm’s Clients ask the artificial intelligence assistants (client-portal queries, the Firm’s legal research and support), stored after identifying data is automatically removed (detected names, document numbers, emails, phone numbers and IBANs) for a maximum of 180 days, on the Firm’s behalf and for the purpose of improving the answers. Each Firm can only access its own questions; the Provider may analyse the questions of all firms together, but only on that cleaned text, and only to improve the service. These questions are never used to train third-party models: the artificial intelligence providers are configured with no data retention.
• Communication with the Firm’s Clients through the client portal, by email and, if the Firm enables it, by WhatsApp.
• Generation of forms and documents, electronic signature of documents and filling in of e-government portal forms with the Mercurio extension.
• Issuing invoices, collecting payments and, when the Firm enables it, submitting billing records to the Spanish Tax Agency (VeriFactu).
• Copying documents and sending deadlines to the services the Firm connects (clause 10.3).
• Erasure and blocking of data under this contract.

5. Types of personal data

The Firm decides what data it enters. Given the nature of the Platform, the following may be processed:

• Identification and contact data: full name, foreign identity number (NIE), tax ID (NIF), passport number, date and place of birth, nationality, sex, marital status, parents’ names, address, phone number and email.
• Identity and travel documents: copies of passports, foreign identity cards, visas and other official documents.
• Administrative and immigration status: type of authorisation, entry and residence dates, municipal registration (empadronamiento), case files, requests for further information and decisions of the Administration.
• Family data: data of spouses, children (including minors) and other family members, and documents evidencing the family relationship.
• Employment and academic data: employment contracts and job offers, employment history, data of the employing company and its workers, degrees and enrolment records.
• Financial data: proof of financial means, payslips, bank statements, invoices and payments from the Firm to its clients. Card data is not processed (clause 10).
• Communications and signatures: messages between the Firm and its clients and evidence of the electronic signature of documents.
• Criminal conviction and offence data (Article 10 GDPR): criminal record certificates required by many procedures.
• Special categories of data (Article 9 GDPR): health data from medical certificates and health insurance required by some procedures, and any data appearing in documentation the Firm chooses to upload, for example in international protection case files (political opinions, religious beliefs, ethnic origin, sexual orientation or health).
• Of the Firm’s Users: name, email, role and activity on the Platform, and the electronic certificates the Firm uploads to sign or file documents.

6. Categories of data subjects

• The Firm’s Clients and their representatives.
• Family members of the Firm’s Clients, including minors.
• Corporate clients of the Firm, their contact persons and their workers.
• People who fill in the Firm’s lead-capture forms.
• Signatories of documents and other persons appearing in the documentation (employers, landlords, guarantors).
• The Firm’s Users (partners, lawyers, staff and collaborators).

7. Obligations of the Firm

As controller, it is for the Firm to:

• Decide what data is processed and have a legal basis for processing it, including the conditions of Articles 9 and 10 GDPR for health data and criminal record data.
• Inform data subjects (Articles 13 and 14 GDPR), including about the use of the AI functions, the WhatsApp channel and the services it connects.
• Give instructions to the Provider. Its instructions are these Terms, this contract and the configuration the Firm sets up on the Platform (enabled functions, integrations, access granted to its Users and clients). Any other instruction must be given in writing.
• Manage access for its Users and clients and safeguard their credentials.
• Carry out, where applicable, the data protection impact assessment and prior consultation (Articles 35 and 36 GDPR).
• Handle data subjects’ rights, with the Provider’s assistance (clause 12).

8. Obligations of the Provider

The Provider undertakes to:

• Process the data only on the Firm’s documented instructions, including with regard to international transfers, unless required to do otherwise by European Union or Spanish law; in that case it will inform the Firm before processing the data, unless that law prohibits it. If it considers that an instruction infringes data protection law, it will inform the Firm immediately.
• Not process the data for its own purposes, not use it to train artificial intelligence models, and not disclose it to third parties, except to the sub-processors under clause 10 or where required by law.
• Ensure that persons authorised to process the data have committed in writing to respect their confidentiality or are subject to a statutory duty of confidentiality. Access to Firm Data is limited to what is necessary to provide the service, resolve incidents or handle a request from the Firm.
• Apply the security measures set out in clause 9.
• Comply with the conditions of clause 10 for engaging sub-processors.
• Assist the Firm in handling data subjects’ rights (clause 12) and in complying with Articles 32 to 36 GDPR (clauses 9, 13 and 14).
• Erase or return the data when the service ends, under clause 15.
• Make available to the Firm the information necessary to demonstrate compliance with this contract and allow audits (clause 16).
• Keep a record of the categories of processing activities carried out on behalf of the Firm (Article 30(2) GDPR).

9. Security measures

The Provider applies technical and organisational measures appropriate to the risk, taking into account that the Platform processes identity documentation, data of minors, health data and criminal record data. The measures currently in place are:

• Encryption in transit: all communications with the Platform are encrypted with TLS (HTTPS mandatory, with HSTS).
• Encryption at rest: the database and files are encrypted at rest by the hosting provider. In addition, the Platform encrypts with AES-256-GCM the electronic certificates, the passwords of connected email accounts and the keys of the Firm’s payment terminals.
• Isolation between firms: each Firm is a separate organisation, and row-level security policies (RLS) in the database, active on all tables, prevent one firm from accessing another firm’s data.
• Role-based access control: within the Firm, each User accesses data according to their role and, on plans that include it, only the case files assigned to them. Each Firm’s Client only accesses what the Firm shares with them.
• Private documents: files are stored in non-public storage and are only served through short-lived signed links.
• Location: the database and files are hosted in the European Union (Paris). Some services are provided from outside the EU (clauses 10 and 11).
• Backups: daily database backups at the hosting provider, kept for 7 days, plus an additional backup of the database and files on a Provider computer in Spain, where each database backup is kept for 30 days. Files that are no longer in the main storage are removed from that copy after 30 days.
• Error logging without identifying data: technical errors are logged after removing identifying fields beforehand, and session recordings attached to an error mask the text and block the images.
• Erasure log: every erasure of a person’s data is logged so that it can be demonstrated that the request was handled.
• Provider access: administration of the Platform is restricted to the person at the Provider responsible for it.

The Provider reviews these measures and may update them, without lowering the level of protection they provide.

10. Sub-processors

10.1. General authorisation

The Firm gives the Provider general written authorisation to engage the sub-processors listed below. The Provider imposes on each of them, by contract, the same data protection obligations it assumes under this contract, and is liable to the Firm for their compliance.

Before adding or replacing a sub-processor, the Provider will notify the Firm’s administrators by email and update this page at least 30 days in advance. The Firm may object within that period on reasonable data protection grounds. If no solution is found, the Firm may terminate the contract before the change takes effect, and the Provider will refund the portion already paid for the period it will not enjoy.

10.2. List of sub-processors

10.3. Services the Firm connects or contracts directly

These are not sub-processors of the Provider, because the Firm contracts or connects them with its own account and their processing is governed by the Firm’s contract with each of them. The Platform sends or receives data from them only when the Firm enables the integration:

• Google (Google Drive, Google Calendar and sign-in with Google), with the Firm’s Google account.
• Microsoft OneDrive, with the Firm’s Microsoft 365 account, when the Firm chooses to keep its case documents there.
• Dropbox (Dropbox, Inc.), with the Firm’s Dropbox account, when the Firm chooses to keep its case documents there. It receives the copies of the Firm’s documents and the case folder, and the Platform keeps the connection credentials encrypted. It is only active if the Firm connects it.
• Microsoft 365 or another email provider, when the Firm connects its mailbox so that emails from its clients reach the case file.
• WhatsApp (Meta): the channel under section 9 of the Terms uses the Firm’s WhatsApp number and account, and messages travel through WhatsApp’s servers under the terms the Firm has with WhatsApp.
• Stripe Connect and bank payment terminals (Redsys), with the Firm’s collection account.
• The Spanish Tax Agency, which receives the billing records the Firm submits (VeriFactu) under the Firm’s own legal obligation.

11. International transfers

The Provider only transfers data outside the European Economic Area to the sub-processors listed in clause 10.2, on the terms indicated there: on the basis of a European Commission adequacy decision, such as the EU-U.S. Data Privacy Framework, or with the safeguards of Article 46 GDPR, such as standard contractual clauses. The Firm authorises these transfers by accepting this contract.

12. Data subjects' rights

• The Firm’s Clients and other data subjects exercise their rights before the Firm. If the Provider receives a request directly, it will forward it to the Firm without delay and will not respond to it on its own, unless instructed by the Firm.
• From the Platform, the Firm can view, correct and download its clients’ data and delete documents, which are permanently erased after 30 days.
• Deleting a client record or a case file from the panel archives it and removes it from view, but does not permanently erase it. To permanently erase a person’s data, the Firm must request it from hello@immigraflow.io, and the Provider will do so within a maximum of 30 days and will keep a record of it.
• The Provider will provide any additional assistance the Firm needs to handle any other right within the applicable time limit.

13. Personal data breaches

The Provider will notify the Firm, without undue delay and in any event within a maximum of 48 hours of becoming aware of it, of any personal data breach affecting Firm Data. The notification will be sent by email to the Firm’s administrators and will include, to the extent known, the information required by Article 33(3) GDPR: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point. If all the information cannot be provided at once, it will be provided in phases.

It is for the Firm to notify the breach to the Spanish Data Protection Agency and, where applicable, to the data subjects. The Provider will provide it with the assistance it needs to do so.

14. Impact assessments and prior consultation

The Provider will give the Firm the information about the Platform and its security measures that it needs to carry out a data protection impact assessment and, where applicable, the prior consultation with the supervisory authority.

15. Fate of the data when the service ends

• Read-only mode: when the subscription ends, the Firm’s account switches to read-only mode. The Firm and its Users can still log in and download the documents in each case file and the invoice export. The Platform keeps the data of a read-only account in that state, with the same security measures, for 12 months from when the subscription ended. If the Firm reactivates it before then, nothing is deleted.
• Return: before erasure, the Firm can download its data from the Platform and, if it requests it, the Provider will also give it a copy of its organisation’s data in a structured, commonly used format.
• Erasure: once those 12 months have passed, the Platform automatically deletes the data of the Firm’s organisation, except for what remains blocked under the next point. Beforehand, the Provider notifies the owner and administrators of the Firm’s account by email at least 30 days in advance, stating the date of the erasure, and does not carry it out without that notice. The Firm may request erasure earlier, at any time, by writing to hello@immigraflow.io. The Provider carries it out within a maximum of 30 days, including the external copy of the files, and confirms it in writing. The hosting provider’s daily backups disappear once their 7-day cycle is complete, and the external database backups once their 30-day cycle is complete.
• What remains blocked: unless the Firm indicates otherwise, the invoices the Firm issued from the Platform and its VeriFactu billing records, which the Firm is required to keep under tax and commercial law, remain blocked for 6 years from their issue and are erased afterwards. While blocked, they are only made available to the Firm, to judges and courts, to the Public Prosecutor’s Office and to the competent Public Administrations (Article 32 LOPDGDD). The same applies to any other data the Provider must retain under its own legal obligation, for the period that obligation sets.

These same rules are set out in section 6 of the Terms.

16. Information and audits

The Provider will make available to the Firm all the information necessary to demonstrate compliance with this contract and with Article 28 GDPR. The Firm, or an independent auditor it appoints and who undertakes to keep confidentiality, may carry out audits and inspections. Unless there has been a security breach or a supervisory authority requires it, audits will be requested at least 30 days in advance, no more than once a year, will preferably be carried out through remote documentary review without affecting the security of other firms’ data, and their cost will be borne by the Firm.

17. Liability

Each party is liable for its own breaches of data protection law under Article 82 GDPR. If the Provider were to process the data for its own purposes or in breach of the Firm’s instructions, it will be regarded as controller of that processing (Article 28(10) GDPR). In the relationship between the parties, the limits set out in section 10 of the Terms apply, to the extent permitted by law.

18. Precedence, governing law and jurisdiction

In data protection matters, this contract prevails over any other provision of the Terms. It is governed by the GDPR, by Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD), and by Spanish law. For any dispute, the parties submit to the Courts of Madrid (Spain).

19. Contact

For any question about this contract, a personal data breach or the exercise of rights: hello@immigraflow.io.