What is this document?
This Data Processing Agreement governs how Suplifai processes third-party personal data on behalf of the Client — that is, the data of the Client's end customers who interact with the Digital Collaborators. It forms an integral part of the Terms & Conditions and responds to Mexico's Federal Law on the Protection of Personal Data Held by Private Parties in force and, where applicable, to the General Data Protection Regulation of the European Union (Article 28).
1. Definitions
- Controller: The Client — the company that contracts Suplifai and determines the purposes and means of processing its end customers' data.
- Processor: Suplifai — processes personal data solely under the Controller's instructions.
- Personal Data: Any information that allows a natural person to be identified (names, phone numbers, emails, messaging conversations).
- Processing: Any operation on personal data: collection, storage, consultation, use, transmission, or deletion.
- Sub-Processor: A third party engaged by Suplifai that participates in the processing under the conditions of this Data Processing Agreement.
2. Subject Matter and Scope of Processing
Suplifai will process personal data on behalf of the Client for the sole purpose of operating the contracted Digital Collaborators. The data may include:
- Name, phone number, and conversations of end customers on WhatsApp, Instagram, or the web.
- Order, quote, and purchase-preference information.
- Inventory and pricing data provided by the Client's system.
Processing takes place mainly on servers in Germany and in the United States, in accordance with Clause 8.
3. Controller's Instructions
Suplifai will process personal data solely following the Client's documented instructions, as set out in the Terms & Conditions and in the platform configuration. If Suplifai considers that an instruction infringes applicable law, it will notify the Client.
4. Suplifai's Obligations as Processor
- Process the data solely for the purposes specified in this Data Processing Agreement.
- Ensure that personnel authorized to access the data are bound by confidentiality obligations.
- Implement the security measures described in Clause 6.
- Assist the Client in handling its end customers' requests, including those relating to the rights of access, rectification, cancellation, and objection, and to objection to automated decisions (Clause 9).
Notifications and transfers
- Notify the Client of any request from a data subject within 5 business days.
- Notify the Client of any security breach affecting its data within 24 hours of detecting it.
- Not transfer data to unauthorized third parties without the Client's prior instruction.
5. Client's Obligations as Controller
- Have a legal basis for processing its end customers' data (consent, contract, or legitimate interest).
- Inform its end customers about the use of artificial intelligence tools in customer service, in accordance with applicable law.
- Not instruct Suplifai to carry out processing that violates the law.
- Handle, as Controller, the exercise of its end customers' rights.
6. Security Measures
Suplifai implements the following technical and organizational measures:
Technical
- • Encryption in transit (transport layer security, version 1.2 or higher)
- • Encryption at rest (256-bit encryption)
- • Multi-factor authentication
- • Role-based access control
- • Access audit log
Organizational
- • Least-privilege policy
- • Confidentiality agreements with employees
- • Periodic security reviews
- • Incident response plan
- • Data-protection training
7. Sub-Processors
The Client authorizes Suplifai to engage Sub-Processors for the provision of the service. Suplifai ensures that each Sub-Processor is bound by data-protection obligations equivalent to those of this Data Processing Agreement. We work with the following categories of Sub-Processors:
| Category | Purpose | Location |
|---|---|---|
| Messaging (Meta Platforms, Inc.) | WhatsApp Business / Instagram application programming interface | United States |
| Email and files (Google LLC) | Receipt of deliveries and notices | United States and others, depending on the provider |
| Cloud infrastructure | Storage and infrastructure (netcup GmbH) | Germany |
| Language and artificial intelligence processing | Generation of responses and cataloging of the Client's catalog, using services whose terms exclude using the content to train their models | United States and others, depending on the provider |
This table is the current list of Sub-Processors, the same for all clients. Suplifai keeps it up to date on this page.
8. International Data Transfers
Some Sub-Processors are located outside Mexico (mainly in Germany and in the United States). Such transfers are made because they are necessary for the provision of the service contracted by the Client and for the performance of the relationship between the Client and Suplifai, in accordance with the grounds provided for in Mexico's Federal Law on the Protection of Personal Data Held by Private Parties in force. In all cases, Suplifai contractually binds each Sub-Processor to maintain data-protection measures equivalent to those of this Data Processing Agreement.
9. Automated Processing and Artificial Intelligence
The service generates responses and quotes through Artificial Intelligence on an automated basis, on behalf of the Client. Suplifai:
- Assists the Client in handling a data subject's objection to decisions based solely on automated processing and their requests for human intervention.
- Designs its flows to escalate to a human agent when the artificial intelligence cannot resolve with certainty.
- Does not use the personal data of the Client or its end customers to train its own models outside of service delivery.
10. Data Retention and Deletion
Upon termination of the contract, Suplifai will delete or anonymize all personal data of the Client and its end customers within 90 calendar days after termination, unless the law requires a longer retention period. The platform records the deletion.
11. Compliance Information
Suplifai publishes the compliance information for this document on this page, the same for all clients. No audits are carried out and no certificates are issued for individual clients.
12. Term
This Data Processing Agreement has the same term as the Terms & Conditions executed between the parties and is updated in parallel with them. The version in force will always be published at this URL.
13. Contact
For inquiries related to this Data Processing Agreement:
📧 legal@suplifai.com
Subject: "Data Processing Agreement, [Your company name]" · Response time: maximum 5 business days.