Data processing agreement (Article 28 GDPR): Contigo services

Parties

The Customer (controller): Company name: ______________________________ · Tax ID: ______________ · Registered office: ______________________________ · Represented by: ______________________________, as ______________________.

The Processor: Cloud Cost Control SL, tax ID (NIF) B19340702, registered in the Barcelona Commercial Registry, volume/IRUS 1000426702250, folio 1, sheet B-620287, entry 1, registered office Passeig d'Àngel Guimerà 67, 08230 Matadepera (Barcelona), Spain, email damian@contigobot.com, represented by Damian Munafo, director (administrador). It provides its services under the Contigo brand.

This agreement forms part of the Contigo service agreement between the parties (the "Main Agreement") and governs the processing of personal data the Processor carries out on the Customer's behalf, under Article 28 of Regulation (EU) 2016/679 (GDPR) and Article 33 of Spanish Organic Law 3/2018 (LOPDGDD). On data protection matters this agreement prevails over the Main Agreement.

1. Subject matter, duration, nature and purpose

1.1. The Processor processes personal data only to provide the Contigo services the Customer has contracted and enabled (Annex I): Contigo Clínica (appointments, reminders, client portal, veterinary records, lab results, invoicing, staff time records and, if enabled, the voice assistant) or Contigo Club (member and player records, teams, call-ups, fees and payments, shop and communications), and WhatsApp messaging with automated replies.

1.2. Nature of the operations: collection through the application, WhatsApp, Telegram (Club) and the voice assistant (Clínica); recording, organisation, storage, consultation, alteration, sending messages and emails on the Customer's behalf, payment collection, generating invoicing records, export and erasure.

1.3. Duration: that of the Main Agreement. On termination clause 11 applies.

2. Data and data subjects

2.1. The categories of data subjects and data are those in Annex I, depending on the modules the Customer enables.

2.2. Special categories. The application does not ask for special-category data (Art. 9 GDPR) except in fields the Customer decides to use (for example player health fields in Contigo Club). Free text that data subjects write or say on WhatsApp, Telegram or the phone may contain such data. The Customer determines the legal basis and the applicable Art. 9(2) condition and informs data subjects. Animal health data are not special-category data.

2.3. Minors. Where the Customer processes data of minors (for example club players), it is responsible for obtaining the consent of the holder of parental responsibility where required (Art. 7 LOPDGDD) and for configuring the application accordingly. The Contigo Club Telegram bot is offered to adults only.

3. Customer instructions

3.1. The Processor processes the data only on documented instructions from the Customer. Documented instructions are this agreement, the Main Agreement, the Customer's configuration of the application and written instructions sent to damian@contigobot.com (Art. 28(3)(a) GDPR).

3.2. This includes the international transfers in clause 7, which the Customer authorises. The Processor will make no other transfer unless required by Union or Member State law; in that case it will inform the Customer beforehand unless that law prohibits it.

3.3. If the Processor considers that an instruction infringes the GDPR or other data protection law, it will immediately inform the Customer (Art. 28(3), second subparagraph, GDPR).

3.4. The Processor does not use the data for its own purposes, does not sell it and does not use it to train artificial intelligence models.

4. Confidentiality

The Processor ensures that persons authorised to process the data have committed themselves in writing to confidentiality or are under a statutory obligation of confidentiality (Art. 28(3)(b) GDPR and Art. 5 LOPDGDD). Access by the Processor's staff to a Customer's data requires a time-limited, reasoned and logged grant.

5. Security

5.1. The Processor applies the technical and organisational measures in Annex II, appropriate to the risk (Art. 32 GDPR; Art. 28(3)(c)).

5.2. The Processor may update those measures provided the level of protection is not reduced.

6. Sub-processors and other recipients

6.1. The Customer gives general authorisation to engage the sub-processors in Annex III (Art. 28(2) GDPR). Module-dependent sub-processors only take part if the Customer enables that module.

6.2. The Processor will inform the Customer in writing at least 30 days in advance of any addition or replacement of sub-processors. The Customer may object on reasonable data protection grounds within that period. If no solution is found, the Customer may terminate the Main Agreement for the affected service without penalty.

6.3. The Processor imposes on each sub-processor, by contract, data protection obligations offering sufficient guarantees equivalent to those in this agreement (Art. 28(4) GDPR) and remains liable to the Customer for the sub-processor's performance.

6.4. xAI. The Processor uses the xAI API only with zero data retention (ZDR) active for its team, so xAI keeps neither inputs nor outputs.

6.5. Meta. Meta may process certain WhatsApp platform data as an independent controller for safety and integrity purposes, under its own terms.

6.6. Voice assistant (Vapi). The Processor enables the voice assistant only for a Customer that requests it in writing, and only with Vapi's zero data retention (ZDR) active, so Vapi keeps no recordings, transcripts, messages or logs of a call once it ends. Any language-model, transcription or voice providers used through Vapi will be added to Annex III, with the notice in clause 6.2, before it is enabled. The Clinic will tell callers at the start of the call that an automated assistant is answering.

6.7. Stripe. Stripe processes payment data as a processor to process payments, and as an independent controller to prevent fraud, comply with anti-money-laundering and know-your-customer rules, meet requests from authorities and financial institutions and improve its services, under its data processing agreement. Card details are entered directly on Stripe's pages and the Processor does not receive them.

6.8. Telegram (Contigo Club). If the Club enables the Telegram bot, only an adult who starts the bot of their own choice receives messages through that channel. Telegram is not a sub-processor: it processes its platform data as an independent controller under its own terms and offers no data processing agreement. The transfer to Telegram relies on its being necessary to deliver the communication the person has asked for through that channel (Art. 49(1)(b) GDPR). The Processor limits what is sent through Telegram to club activity notices, with no health data, minors' data or payment data, and the Club always offers WhatsApp or email as an alternative.

7. International transfers

7.1. The service database and files are stored in the European Union (Cloudflare D1 and R2 with EU jurisdiction). Some sub-processors may process data outside the European Economic Area, as stated in Annex III.

7.2. Those transfers rely on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the EU-US Data Privacy Framework for certified importers and, failing that, on the standard contractual clauses in Implementing Decision (EU) 2021/914 incorporated into the contract with each sub-processor (Arts. 45 and 46(2)(c) GDPR). Telegram is governed by clause 6.8.

7.3. The Processor will inform the Customer if an importer loses its certification or the applicable safeguard changes.

8. Data subject rights

8.1. The Processor assists the Customer, through the application's functions and other reasonable means, in responding to requests for access, rectification, erasure, objection, restriction, portability and the right not to be subject to automated decisions (Art. 28(3)(e) GDPR).

8.2. If a data subject contacts the Processor, it will forward the request to the Customer within 5 business days at the latest and will not respond itself unless the Customer instructs it to.

9. Assistance with security, breaches and impact assessments

9.1. The Processor assists the Customer in meeting Arts. 32 to 36 GDPR, taking into account the nature of the processing and the information available to it (Art. 28(3)(f)).

9.2. Breaches. The Processor will notify the Customer of any personal data breach without undue delay and in any event within 48 hours of becoming aware of it, at the contact address the Customer designates (Art. 33(2) GDPR). The notice will include, as far as known: the nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, measures taken or proposed and a contact point. Missing information will be provided in phases. Notifying the AEPD and data subjects is for the Customer.

9.3. The Processor will provide the information the Customer needs for a data protection impact assessment or prior consultation.

10. Records of processing

The Processor keeps a record of the processing activities it carries out on the Customer's behalf (Art. 30(2) GDPR).

11. Retention, export and erasure

11.1. During the agreement data is kept according to the Customer's configuration. The Processor does not erase data on its own initiative, except for the automatic erasures in Annex I.

11.2. Export. The Customer may at any time request a full export of its data in a structured, commonly used and machine-readable format (CSV or JSON), split by table. The Processor will deliver it within 30 days at the latest.

11.3. Erasure only on written instruction. The Processor erases a Customer's data set, or a table in it, only on a written instruction from the Customer's representative, after delivering the export and a prior list of what will be erased. The erasure is logged with the date, table, number of records and instruction reference, without copying the content of the erased records.

11.4. Backups. Data erased from the database may remain recoverable in the continuous backups (Cloudflare D1 Time Travel) for up to 30 days after erasure. After that it is gone for good. During those 30 days the Processor does not restore erased data except on the Customer's written instruction or to recover the service after an incident; in the latter case it erases again any restored data that had already been erased. Files (Cloudflare R2) are erased immediately.

11.5. Legal periods the Customer instructs to be kept. So that the Customer can meet its legal obligations, the Customer instructs the Processor, even after an erasure instruction or the end of the agreement, to keep the following data blocked (no access except for the Customer or an authority) and to erase or anonymise it when the period ends:

• Invoices, Veri*Factu invoicing records and event log: until 31 December of the sixth year after issue. Basis: Art. 30 Spanish Commercial Code (6 years); Arts. 29(2)(d), 66 and 70 of Law 58/2003 General Tax Act and Art. 19 Royal Decree 1619/2012 (4-year tax limitation); Royal Decree 1007/2023 and Order HAC/1177/2024 for invoicing records.
• Veterinary prescriptions and the clinical sheets that replace them: 5 years from issue. Basis: Arts. 32(5) and 36(2) Royal Decree 666/2023.
• Staff time records: 4 years. Basis: Art. 34(9) Workers' Statute.

The Customer may instruct in writing that, instead of the Processor keeping them, they be handed over and erased, if the Customer takes over their retention.

11.6. On termination, the Processor will give the Customer the export in clause 11.2 and, after the Customer's written confirmation, erase the data and its copies within 90 days at the latest, except the data in clause 11.5 and data it must keep under its own legal obligation (Art. 28(3)(g) GDPR). Clause 11.4 applies to that erasure.

11.7. Invoices the Processor issues to the Customer for the service are not data processed on the Customer's behalf: the Processor keeps them as controller for the legal periods.

12. Information and audits

The Processor makes available to the Customer all information necessary to demonstrate compliance with this agreement and Art. 28 GDPR, and allows for and contributes to audits and inspections by the Customer or an auditor it appoints who is bound by confidentiality (Art. 28(3)(h)). Audits require 30 days' notice, except after a breach, give no access to other customers' data and are limited to one per year, unless an authority requires otherwise. Each party bears its own costs.

13. Customer obligations

The Customer: a) has a legal basis for the processing and for disclosing the data to the Processor; b) informs data subjects (Arts. 13 and 14 GDPR), including the use of WhatsApp, Telegram, the voice assistant and automated replies; c) identifies itself as the sender of its communications; d) gives its instructions in writing and supervises the processing.

14. Liability, law and jurisdiction

14.1. Each party is liable for its breaches under Art. 82 GDPR and the Main Agreement. A Processor that processes data for its own purposes or against instructions is deemed a controller for that processing (Art. 28(10) GDPR and Art. 33(3) LOPDGDD).

14.2. This agreement is governed by Spanish law. The parties submit to the courts of Barcelona, unless the law sets another forum on a mandatory basis.

Place and date: ______________________________

Annex I. Description of the processing

Annex II. Technical and organisational measures

• Encryption in transit (HTTPS/TLS) for all communications.
• Separation of each Customer's data, with automated cross-customer isolation tests.
• Role-based access; Processor staff access only with a time-limited, reasoned and logged grant.
• Passwords stored hashed; failed-attempt limits; two-factor authentication available.
• Session cookies limited to the host, Secure, HttpOnly and SameSite=Lax.
• Signature verification of WhatsApp webhooks.
• Secrets and credentials encrypted in the hosting platform; never in code.
• Logging of access and erasures.
• Continuous database backups with Cloudflare D1 Time Travel, allowing restore to any minute in the last 30 days. Older backups expire automatically.
• Zero data retention active at xAI and, before the voice assistant is used, at Vapi.
• Breach-handling procedure with 48-hour notification.

Annex III. Authorised sub-processors

The list published on www.contigobot.com (version of 21 October 2026) forms part of this agreement and matches this one:

Stripe also acts as an independent controller for the purposes in clause 6.7. Telegram is not a sub-processor (clause 6.8).