Términos y condiciones

In order to provide the services under the conditions set forth in the Agreement located at https://hilos.io/terms-and-conditions (or its successor URL), Hilos may engage the following third parties as sub-processors to carry out data-processing activities that involve the processing of personal data on the customer’s behalf.

‍

Effective: April 15, 2025

This Data Processing Agreement (“DPA”) forms part of, and is incorporated into, the agreement located at https://hilos.io/terms-and-conditions or its successor URL (“Agreement”) entered into between Hilos and the customer (“Customer”) governing the subscription of services (“Services”) from Hilos by Customer. This DPA reflects the Parties’ agreement with regard to the Processing of Personal Data on behalf of Customer by Hilos.

‍

1. DEFINITIONS

‍

“Controller” means the entity which determines the purposes and means of the Processing of Personal Data.

‍

“Data Subject” means the identified or identifiable person to whom Personal Data relates. An identifiable person is a person who may be identified, directly or indirectly, in particular by reference to an online identifier, or to one or more factors specific to the physical, physiological, genetic, psychological, financial, cultural or social identity of such natural person.

‍

“Data Protection Laws” means all laws and regulations, including laws and regulations of Mexico, laws and regulation of the European Union, and any other law or regulation, applicable to the Processing of Personal Data carried out by Hilos within the framework of the performance of the Agreement, in each case as amended, repealed, consolidated, or replaced from time to time. For the avoidance of doubt, Data Protection Laws include the GDPR and the UK GDPR, if and to the extent applicable.

"Europe" means the European Union, the European Economic Area, Switzerland and the United Kingdom.

“GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data.

“Personal Data” (which may also be used interchangeably with “Customer Personal Data”) means any Customer personal data that directly or indirectly identifies a Data Subject.

“Processing” means any operation or set of operations, carried out by a Party (whether or not by automated means), and applied to Personal Data or sets of Personal Data, such as, in particular, collection, recording, storage, organization, structuring, conservation, adaptation, modification, extraction, consultation, use, communication by transmission, dissemination or any other form of provision, reconciliation, interconnection, limitation, erasure or destruction. “Process”, “Processed” and “Processes” shall be interpreted accordingly.

“Processor” means any entity that Processes Personal Data on behalf of the Controller.

“EU Standard Contractual Clauses” or “EU SCCs” means the European Commission standard contractual clauses for the transfer of Personal Data to a Processor established in a third country which does not ensure an adequate level of data protection, as annexed to the European Commission’s Decision (EU) 2021/914 of 4 June 2021 and as may be amended, replaced or repealed from time to time.

“UK GDPR” means the GDPR as incorporated into the United Kingdom law.

All capitalized terms not defined herein shall have the meaning set forth in the Agreement.

‍

2. PURPOSE

In the course of providing the Services to Customer pursuant to the Agreement, Hilos Processes Customer Personal Data on behalf of Customer. The Parties agree to comply with the provisions set out in this DPA with respect to any Customer Personal Data, each acting reasonably and in good faith.

‍

3. PROCESSING OF PERSONAL DATA

‍

3.1. Role of the Parties

‍

Customer appoints Hilos as a Processor to Process the Customer Personal Data on behalf of Customer. As between the Parties, Customer Personal Data is the sole and exclusive property of Customer. Each of Customer and Hilos shall comply with the obligations that apply to it under Data Protection Laws.

‍

3.2. Customer representations and warranties

‍

Customer, acting as the Controller of the Personal Data, shall, in its use of the Services, Process Personal Data in accordance with the requirements of Data Protection Laws, including any applicable obligation to provide notice to or obtain consent from Data Subjects in connection with the use of Hilos as Processor. For the avoidance of doubt, Customer represents and warrants that its Processing instructions comply with the Data Protection Laws. Customer shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Customer collected Personal Data.

Customer must comply with all laws and regulations applicable to its use of the Services, including laws related to confidentiality of communications, privacy, digital marketing, and data protection requirements. Customer is responsible for determining whether the Services are appropriate for storage and Processing of information subject to any specific law or regulation and for using the Services in a manner consistent with Customer’s legal and regulatory obligations.

Customer specifically acknowledges and agrees that its use of the Services will not violate the rights of any Data Subject, to the extent applicable under Data Protection Laws. In particular, Customer represents and warrants that it has provided all notices and obtained all consents and rights necessary under Data Protection Laws for Hilos to Process Personal Data on behalf of Customer for the purposes described in the Agreement (including this DPA). Hilos may take remedial action should Customer materially breach this Section which may include the termination of the Agreement (in whole or in part) and/or the suspension of the Services.

Customer shall not (and shall not permit Data Subject to) disclose to Hilos any of the following categories of data: (i) any “sensitive” or “special categories” of Personal Data (as these terms and their equivalent are defined under Data Protection Laws) and/or (ii) any Personal Data obtained from or relating to a Data Subject that is deemed a child under Data Protection Laws. Customer undertakes to promptly inform Hilos in the event where it becomes aware that personal data of minor and/or sensitive data are processed through the Services.

Further, Customer is solely responsible for determining the suitability of the Services for Customer’s business and complying with any Data Protection Laws to the collection and use of Personal Data and Customer’s use of the Services.

‍

3.3. Hilos’s Processing of Personal Data

‍

Within the framework of the performance of the Agreement, Hilos undertakes to Process Customer’s Personal Data as a Processor (within the meaning of Data Protection Laws) in accordance with the documented and written general or specific instructions provided by Customer.

This DPA and the Agreement into which it is incorporated contain Customer’s complete instructions to Hilos for the Personal Data Processing carried out within the framework of the performance of the Agreement. Hilos shall inform Customer if, in its reasonable opinion, an instruction of Customer constitutes a breach of the GDPR or any applicable Data Protection Laws, or if Hilos is unable to follow Customer’s instructions for the Processing of Personal Data.

Notwithstanding the foregoing, Customer acknowledges and agrees that such notification will not constitute a general obligation on the part of Hilos to monitor or interpret the laws applicable to Customer and such notification will not constitute legal advice to Customer.

Hilos undertakes to Process Customer’s Personal Data in the conditions set forth in this DPA, if and to the extent the undertakings set out herein are required by applicable Data Protection Laws.

Customer agrees that Hilos may collect, use, and disclose data concerning and derived from Customer’s use of the Services, but excluding Personal Data, for industry analysis, benchmarking, analytics, marketing, research and development, improvement of the Services and other business purposes during and after the term of the DPA, provided that any such data collected, used, and disclosed for such purposes will be in aggregate form only and will not identify Customer or Data Subjects and Hilos complies with all applicable laws in collecting, using and disclosing such anonymized data. These anonymized data shall not be considered confidential information of Customer.

‍

3.4. Details of the Processing

‍

Details of the Processing (e.g. duration, purpose, type of Personal Data, categories of Data Subject) carried out under this DPA are further specified in Schedule 2 (Description of Processing) to this DPA.

Customer undertakes to maintain a record of the Processing activities it performs as a Controller, and Hilos undertakes to maintain a record of the Processing activities it performs as a Processor, in accordance with the Data Protection Laws.

‍

4. CONFIDENTIALITY AND SECURITY

‍

Hilos undertakes to implement appropriate technical, contractual and organizational measures to ensure the confidentiality of the Personal Data it Processes in accordance with this Section.

In particular, Hilos must ensure that (i) all employees, agents or contractors who may have access on its behalf to Customer’s Personal Data (and, where applicable, any subsequent Processor) are informed of the confidential nature of the Personal Data and are subject to a non-disclosure obligation, and (ii) access to Customer’s Personal Data is strictly limited to those individuals who need to know or have access to the relevant Personal Data in the performance of the Agreement.

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the Processing as well as the risk of likelihood and severity of infringement of the Data Subjects’ rights and freedoms, Hilos implements, with regard to Customer’s Personal Data it directly Processes, the appropriate technical and organizational measures to ensure a level of security appropriate to such risk and to prevent the occurrence of Data Breaches, including, where applicable, the measures referred to Data Protection Laws, such as article 32 of the GDPR:

(a) the pseudonymization and encryption of the Personal Data;

(b) the ability to ensure the confidentiality, integrity, availability and ongoing resilience of Processing systems and services;

(c) the ability to restore availability and access to the Personal Data in a timely manner in the event of a physical or technical incident;

(d) a process to regularly test, assess and evaluate the effectiveness of the technical and organizational measures to ensure the security of the Processing.

Details of such measures are available upon Customer’s request only in order to enable Customer to demonstrate compliance with Data Protection Laws, and on the condition that the Parties have a separate non-disclosure agreement in place which protects such details as Hilos’s confidential information.

Notwithstanding the above, Customer agrees that except as provided by this DPA, Customer is responsible for its secure use of the Services, including (as applicable) (i) securing its account authentication credentials, (ii) protecting the security of Personal Data when in transit to and from the Services, and (iii) taking any appropriate steps to securely encrypt or backup any Personal Data uploaded to the Services.

‍

5. DATA BREACHES

‍

Hilos shall notify Customer without undue delay after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss or alteration, unauthorized disclosure of, or access to, Customer Personal Data Processed by Hilos or its Sub-Processor(s) of which Hilos becomes aware.

Hilos will provide the notice in a report that may also include, within the reasonable control and discretion of Hilos, relevant information about the nature, scope, circumstances, predictable consequences and the measures taken or to be taken, to the extent that such information is available to Hilos.

At Customer’s request, Hilos will reasonably cooperate to enable Customer to comply with Customer’s notification obligation under Data Protection Laws, within the framework of the assistance provided as set out in Section 7 of this DPA.

Hilos will take reasonable steps to mitigate and, where possible, to remedy the effects of, any such security incident. Hilos’s obligations in this Section do not apply to incidents that are caused by Customer or Customer’s staff or users or to unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.

‍

6. SUB-PROCESSORS

‍

Customer agrees that Hilos may use subsequent Processors (“Sub-Processors”) in connection with the Services under the Agreement to Process its Personal Data, provided that such Sub-Processors are contractually bound to Hilos by data protection obligations no less protective than those set forth in this DPA.

Hilos must ensure that any Sub-Processor complies with its obligations, and in such respect conduct any audit of the Sub-Processor it deems necessary to ensure compliance.

The current list of Sub-Processors engaged in Processing Personal Data for the performance of the Services is listed under https://hilos.io/subprocessors and includes a description of the subject-matter and nature of the Processing. Customer agrees that Personal Data may be Processed by these Sub-Processors.

At any time during the performance of the Agreement, Hilos may call upon new Sub-Processors and agrees to inform Customer of any such change.

Customer has the right to object to Hilos’s use of a new Sub-Processor by notifying Hilos in writing within seven (7) calendar days following the receipt of Hilos notice of change. In the event where Customer objects to a new Sub-Processor within the aforementioned period, Hilos will use reasonable efforts to make available to Customer a change of the Services and/or of the conditions under which they are used by Customer in order to avoid the Processing of Personal Data by the Sub-Processor which has been rejected by Customer. Notwithstanding, Hilos may, at its sole discretion, waive its right to work with the relevant Sub-Processor or maintain its decision to work with such Sub-Processor.

In the event where Hilos decides to continue working with the rejected Sub-Processor and is unable to make available to Customer an alternative way to deliver or use the Services, Customer is entitled to cease entrusting Hilos with the Processing of its Personal Data upon written notice of termination (corresponding to only the Services involving the subcontracting of Personal Data) sent under the conditions provided for in the Agreement.

In no event Hilos may be held liable by Customer of the early termination of the Agreement by Customer as a result of change in the Sub-Processor list.

‍

7. ASSISTANCE AND COOPERATION

‍

Each Party undertakes to provide reasonable assistance to the other Party in the performance of the Agreement with regard to Personal Data protection.

Each Party undertakes:

(a) to perform in good faith its obligations under the DPA;

(b) to ensure the availability, cooperation and competence of its staff for the proper performance of the DPA; and

(c) to provide the other Party with the information necessary for the performance of the DPA or which may have an impact on its performance, to the extent that the Party owing such obligation is reasonably able to have or have access to such information.

Each Party undertakes to perform its obligations in a manner and within a timeframe that enables the other Party to perform its own obligations under the DPA. In addition, the Parties agree to cooperate reasonably in the event of an inquiry or investigation by a supervisory authority.

In the event that, in accordance with the Data Protection Laws, Customer is required to carry out an impact assessment on the protection of Personal Data or a prior consultation with a supervisory authority, Hilos undertakes to reasonably assist Customer, upon its written request, by providing it with all the documents and information available to it and reasonably necessary for such purpose, depending on the nature of the Processing.

All additional assistance will be mutually agreed upon by the Parties and will give rise to payment of additional compensation as reasonably determined by the Party providing the assistance requested by the other Party.

‍

8. RIGHTS OF DATA SUBJECTS

‍

Hilos undertakes to notify Customer without undue delay of any request or complaint made by a Data Subject to Hilos regarding the Processing carried out on their Personal Data and, upon Customer’s written request, to reasonably cooperate with Customer to enable it to comply with any request by the Data Subject to exercise their rights in accordance with the Data Protection Laws, depending on the nature of the Processing. Customer will respond to the Data Subject directly and Hilos undertakes not to respond directly to requests from Data Subject except to confirm to the Data Subject that the request relates to Customer.

‍

9. THIRD-PARTY ACCESS REQUEST

‍

To the extent legally permitted, Hilos will notify Customer of any request or order it may receive from third parties, administrative authorities or courts, as well as any actions and/or measures initiated by such third parties, authorities or courts, seeking the disclosure of Customer Personal Data and/or information relating to the Processing carried out by Hilos on behalf of Customer.

Hilos shall, upon Customer’s written request, provide commercially reasonable cooperation to assist Customer to respond to any such data access request. In the event that any such request is made directly to Hilos, Hilos shall not respond to such communication directly without Customer’s prior authorisation, unless legally permitted to do so.

In the event where Hilos receives a legally binding request to access Personal Data from a public authority (i.e. any government or law enforcement authority, including judicial authorities), Hilos shall, unless otherwise legally prohibited, notify Customer without undue delay.

Hilos shall respond to the third parties, administrative authorities or courts as required by applicable laws. Each Party undertakes to cooperate and reasonably assist the other Party to enable it to respond to such requests in accordance with the Data Protection Laws and within the given time limits.

‍

10. AUDIT

‍

To the extent required by Data Protection Laws and upon Customer’s written request no more than once per year, Hilos acting as a Processor agrees to make available to Customer such information, documents and access to its service providers as may be reasonably necessary to enable it to ensure compliance by Customer of its obligations under this DPA.

For the DPA’s entire term, Hilos (acting as a Processor) authorizes Customer to conduct, or have conducted by an independent auditor who is not a competitor of Hilos and bound by an enforceable non-disclosure obligation, with a minimum of eight (8) weeks prior notice and a detailed audit plan describing the proposed scope, duration, and start date of the audit, an audit in order to verify Hilos’ compliance with its obligations under the DPA, no more than once per year, if such an audit is required by Data Protection Laws and Hilos’s compliance cannot be demonstrated by means that are less burdensome on Hilos.

For this purpose, Hilos shall provide Customer (and/or its auditors bound by an enforceable non-disclosure obligation) with all documents and information available to Hilos as reasonably necessary to enable it to verify Hilos’s compliance with its obligations under the DPA.

Hilos undertakes (i) to cooperate in good faith with the auditor, (ii) to provide the auditor with all information, documents available to Hilos and/or explanations which are reasonably necessary to conduct the audit, (iii) to allow the auditor access to the premises, systems, facilities and service providers involved in the performance or documentation of the Processing.

Customer and the appointed auditor undertake to avoid causing (or, if it cannot avoid it, to minimize) any disruption to the Hilos’s business and to prevent any damage to the Hilos’ premises, equipment, staff and business in the course of conducting the audit, and to conduct the audit during Hilos’s regular business hours, subject to Hilos’s policies.

Customer must provide the results of the audit to Hilos as soon as it receives the auditor's report, and will request Hilos to make its comments on the report, which are then recorded in writing as an appendix to the report.

In the event an audit reveals a breach by Hilos to comply with its obligations under the DPA, Hilos undertakes to take the necessary steps to correct such breach and mitigate its effects, where applicable.

Customer will bear the cost of the audit. All information disclosed by Hilos pursuant to this Section will be deemed Hilo’s confidential information and shall be protected by Customer (and/or its auditors) in accordance with the applicable confidentiality provisions.

‍

11. RETURN AND DELETION

Upon expiry or termination of this DPA for any reason whatsoever, Hilos undertakes to return Customer Personal Data to Customer and to allow Customer to back-up the Customer Personal Data prior to deleting Customer Personal Data, to the extent legally required. Until Customer Data is deleted or returned, Hilos shall continue to Process Personal Data in accordance with this DPA, to the extent required by Data Protection Laws.

Hilos will not retain any copies of the Personal Data, except for that relating to technical back-up procedures or data retention processes or to the extent legally required.

‍

12. LIABILITY

Each party’s liability, taken together in the aggregate, arising out of or in connection with this DPA, whether in contract or tort, shall be subject to the liability limitations set forth in the Agreement and any reference to a party’s liability in the Agreement shall be deemed to be a reference to the aggregate liability of such party.

‍

13. JURISDICTION SPECIFIC PROVISIONS

‍

The following jurisdiction specific provisions apply to the extent that Hilos Processes Personal Data originating from or protected by Data Protection Laws in a jurisdiction identified in this Section.

‍

13.1 Europe Specific Provisions

‍

Hilos will Process Personal Data in accordance with the GDPR and UK GDPR requirements directly applicable to Hilos’s provision of its Services.

In the event where, within the framework of the performance or use of the Services, Personal Data of European Data Subjects are transferred to a country outside Europe that is not subject to an adequacy decision in accordance with the GDPR or the UK GDPR, the Module 2 of the EU Standard Contractual Clauses of the European Commission attached in Schedule 1 and 2 to this DPA shall apply (in the case of transfers subject to the GDPR) and the UK IDTA shall apply (in the case of transfers subject to the UK GDPR).

The ”UK IDTA” (as used in this Section) means the International Data Transfer Addendum issued by the UK Information Commissioner, which is incorporated (and deemed executed) by reference into this DPA and amends Module 2 of the EU Standard Contractual Clauses of the European Commission attached in Schedule 1 and 2 to this DPA.

Neither Party can terminate the UK IDTA pursuant to Table 4 and Section 19 thereof without the written consent of the other.

The EU SCCs and the UK IDTA do not apply to any transfer of Personal Data to an entity certified under the EU-US Data Privacy Framework and its extensions.

As of the date of this DPA, Hilos has no reason to believe that the laws and practices in a country outside Europe (which applies to its Processing of Personal Data) prevents Hilos from fulfilling its obligations under the DPA.

In the event where Hilos reasonably believes that any law and practice in a country outside Europe applicable to its Processing of Personal Data prevent it from fulfilling its obligations under this DPA, it shall promptly notify Customer.

Hilos shall use reasonable efforts to make available to Customer a change in the Services or recommend a commercially reasonable change to Customer’s configuration or use of the Services to facilitate compliance with applicable Data Protection Laws.

In the event Hilos is not in a position to propose such change, Customer may terminate the Agreement in respect only to those Services which cannot be provided by Hilos in accordance with Data Protection Laws by providing written notice in accordance with the Agreement.

‍

13.2 Brazil Specific Provisions

‍

In circumstances where: (i) the Processing of Personal Data involves Data Subjects located in Brazil; (ii) the Personal Data subject to Processing has been collected in Brazil; or (iii) the Processing operations are carried out in Brazil, such Processing activities shall be subject to the provisions of the Brazilian General Data Protection Law (Federal Law No. 13.709/2018) (the “LGPD”).

In such cases, the Customer, in its capacity as the Controller, shall be responsible for ensuring compliance with the LGPD. This includes, but is not limited to: (a) identifying and establishing the appropriate legal basis for each Processing activity involving Personal Data made available through Hilos’s Services; (b) fulfilling the duty of transparency toward data subjects; (c) responding to data subject requests in accordance with the rights guaranteed under the LGPD; and (d) performing notifications to the competent supervisory authority or affected data subjects, where required by applicable law.

Hilos, acting in its capacity as a Processor of Customer’s Personal Data, undertakes to provide reasonable assistance and make available relevant information, to the extent of its responsibilities and subject to applicable confidentiality obligations, for the purpose of supporting Customer’s compliance with the LGPD. Such assistance shall be rendered solely upon Customer’s express and documented request.

The Parties acknowledge that the Processing of Personal Data by Hilos, in connection with the provision of its Services, may occur outside the territory of the Federative Republic of Brazil. In this context, Customer, in its role as the Controller, shall remain fully responsible for complying with all applicable legal and regulatory requirements governing international data transfers under Brazilian law, including, but not limited to, fulfilling all transparency obligations toward data subjects.

For the purpose of such international transfers in accordance with the LGPD and Resolution CD/ANPD No. 19/2024, the Parties agree to adopt the standard contractual clauses issued by the Brazilian Data Protection Authority (ANPD), as included in Schedule 3 to this DPA (“Brazilian Standard Contractual Clauses”). Customer acknowledges and accepts the use of the Brazilian Standard Contractual Clauses as the applicable instrument governing the international transfer of Personal Data through Hilos’s Services.

‍

13.3 Mexico Specific Provisions

‍

Hilos will Process Personal Data in accordance with the Mexican Data Protection Law on the Protection of Personal Data Held by Private Parties and its Regulations (the “Mexican Data Protection Law”), to the extent directly applicable to Hilos’s provision of its Services.

Further, to the extent Hilos provides cloud services, Hilos undertakes to (i) apply personal data protection policies in line with the applicable principles and duties set forth by the Mexican Data Protection Law; (ii) transparent subcontracting involving the information in which the cloud services are provided; (iii) refrain from including conditions, in the rendering of the cloud services, that authorize or allow Hilos to assume ownership or property of the information in which the cloud services are rendered; (iv) maintain confidentiality with respect to the Personal Data Processed by the cloud services; (v) notify changes of the privacy policy or its terms of service; (vi) allow the Controller to limit the type of processing regarding the cloud services; (vii) establish and maintain adequate security measures; (viii) delete Personal Data under applicable data retention standards; and (ix) prevent unauthorized access.

Upon expiry or termination of this DPA for any reason whatsoever, prior to the deletion of Customer Personal Data by Hilos, Hilos undertakes to allow Customer to back-up the Customer Personal Data.

In the event of international data transfers, Hilos may use contractual clauses or a data transfer agreement providing at least the same obligations to which the Controller is subject, as well as the conditions under which the Data Subject consented to the Processing of their Personal Data. The Parties acknowledge and agree that the EU Standard Contractual Clauses may be used for such international data transfers.

‍

13.4 United States Specific Provisions

‍

Hilos will Process Personal Data subject to the United States Data Protection Law requirements as a “service provider” (as that term or its equivalent is defined under United States Data Protection Law), in accordance with the United States Data Protection Law requirements directly applicable to Hilos’s provision of its Services, and the Parties acknowledge and agree that Hilos does not receive any Personal Data as consideration for the Services.

Hilos will not: (i) retain, use, or disclose Personal Data outside of its direct business relationship with Customer, or for any purpose (including a commercial purpose) other than as necessary for the specific purpose of performing the Services in accordance with the Agreement or as permitted by Data Protection Law; and (ii) sell or share the Personal Data.

Hilos will also not combine the Personal Data that it receives on behalf of Customer, with Personal Data that it receives on behalf of another person, except as permitted by Data Protection Law.

‍

14. MISCELLANEOUS

‍

Except as specifically set forth in this DPA, all terms of the Agreement remain in full force and effect. In the event of any conflict or inconsistency between this DPA and the Agreement, this DPA shall prevail.

‍

SCHEDULE 1 – EU STANDARD CONTRACTUAL CLAUSES (MODULE 2 – CONTROLLER TO PROCESSOR)

‍

For the purposes of EU SCC Module 2, Customer is the data exporter and Hilos is the data importer and the Parties agree to the following.

The provisions contained in the EU Standard Contractual Clauses (Module 2) are incorporated by reference into and are an integral part of this DPA. The information required for the purposes of the Appendix to the EU Standard Contractual Clauses are set out in Schedule 2 to the DPA.

The parties agree to amend the EU SCCs as follows:

Clause 7 (“Docking Clause”): The option under Clause 7 shall not apply.

Clause 8.1. (“Instructions”): For the purpose of Clause 8.1., the instruction of Customer to Hilos are set out in Section 3.3 of the DPA.

Clause 8.5 (“Duration of processing and erasure or return of data”) and 16(d) (“Non Compliance with the Clauses and termination”): The parties agree that the certification of deletion of Personal Data that is described in Clause 8.5 and 16(d) of the EU Standard Contractual Clauses shall be provided by Hilos to Customer upon Customer's written request.

Clause 8.9 (“Documentation and compliance”): Any audit arising out of Clause 8.9 of the EU SCCs shall be carried out in the conditions set forth in Section 10 of the DPA.

Clause 9 (“Use of sub-processors – General written authorization”): The option 2 (General written, authorization) provided in Clause 9 of the EU SCCs shall apply. Customer grants Hilos a general authorization to engage sub-processors in accordance with Section 5 of this DPA. Customer acknowledges and agrees that Hilos may engage new sub-processors as described in the DPA.

Clause 10 (“Data Subject Rights”): For the purpose of Clause 10, the assistance provided by Hilos to Customer are set out in Sections 7 and 8 of the DPA.

Clause 11 (“Redress”): The option set out in Clause 11 shall not apply.

Clause 13 (“Supervision”):

Where Customer is established in the European Union, the supervisory authority with responsibility for ensuring compliance by Customer with the GDPR as regards the data transfer shall act as the competent supervisory authority.

Where Customer is not established in the European Union, but falls within the territorial scope of application of the GDPR in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of the GDPR, the supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of the GDPR is established shall act as the competent supervisory authority.

Where Customer is not established in the European Union, but falls within the territorial scope of application of the GDPR in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of the GDPR, the supervisory authority of one of the Member States in which the Data Subject whose Personal Data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, shall act as the competent supervisory authority.

Clause 15 (“Obligations of the data importer in case of access by public authorities”): For the purposes of Clause 15(1)(a), Hilos shall notify Customer only (and not the Data Subjects) in the event of access request by public authorities. Customer shall be solely responsible for promptly notifying the Data Subject as necessary.

Clause 17 (“Governing Law”): These Clauses shall be governed by the law that is designated in the Governing Law section of the Agreement. If the Agreement is not governed by an European Union member state law, the EU Standard Contractual Clauses will be governed by the laws of Ireland.

Clause 18 (“Jurisdiction”): The competent courts shall be those designated in the Agreement. If the Agreement does not designate an European Union member state court as having exclusive jurisdiction to resolve any dispute or lawsuit arising out of or in connection with the Agreement, the parties agree that the courts of Ireland. Notwithstanding the foregoing, data subjects may also bring legal proceedings against Customer or Hilos before the courts of the European Union member state in which he/she has his/her habitual residence. The parties agree to submit themselves to the jurisdiction of such courts.

Contractual Documentation: In the event of any conflict or inconsistency between the DPA and the Standard Contractual Clauses, the EU Standard Contractual Clauses shall prevail.

‍

SCHEDULE 2 – DESCRIPTION OF THE PROCESSING

‍

A. List of Parties

Data exporter:

Name: Customer, as identified in the Agreement.

Address: Customer address provided in the Agreement.

Contact person’s name, position and contact details: representative identified in the Agreement.

Activities relevant to the data transferred under these clauses: performance of the Services pursuant to the Agreement.

Role: Customer is a Controller.

Data exporter:

Name: Hilos, as identified in the Agreement.

Address: San Antonio No. 95, Nápoles, Benito Juárez, Ciudad de México, México C.P. 03840

Contact person’s name, position and contact details: as identified in the Agreement.

Activities relevant to the data transferred under these clauses: performance of the Services pursuant to the Agreement.

Role: Hilos is a Processor.

B. Description of Transfer

Categories of data subjects whose personal data is processed/transferred:

Customer Personal Data include Personal Data of:

• Data Subjects with whom Customer interacts: Customer may elect to Process Personal Data of its clients, prospects or message recipients through the Services.

Categories of personal data processed/transferred:

• Any information provided by Customer to Hilos regarding the Data Subjects.

• Any information disclosed by the Data Subject through Hilos.

Such information may include first name and last name, title, position, company/employer, personal and/or professional contact information (email, phone, address), ID data, professional life data, personal life data, commercial information, content of the messages sent through Hilos.

Sensitive data transferred (if applicable):

Not applicable (per the conditions set forth in Section 3.2 of the DPA)

Frequency of the transfer:

Continuous basis depending on the use of the Services by Customer.

Nature of the processing:

Performance of the Services pursuant to the Agreement.

Purpose of the data transfer and further processing:

Hilos Processes Personal Data as necessary to perform the Services pursuant to the Agreement, and as further instructed by Customer in the DPA.

Duration of processing:

Hilos will Process Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.

Sub-processor:

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing:

Personal Data may be transferred to Sub-Processors in the conditions set forth in Section 6 of the DPA.

Competent supervisory authority:

Competent supervisory authority is appointed in the conditions set forth in Schedule 1 (Clause 13) to the DPA.

‍

SCHEDULE 3 – Brazilian Standard Contractual Clauses

‍

SECTION I - GENERAL INFORMATION

CLAUSE 1. Identification of the Parties

1.1. By this agreement, the Exporter and the Importer (hereinafter, “Parties”), identified below, have agreed to these standard contractual clauses (hereinafter, “Clauses”) approved by the National Data Protection Authority (ANPD), to govern the International Data Transfer described in CLAUSE 2.

Customer is the Exporter and Hilos is the Importer.

Details of the Parties: as set forth in Schedule 2 to this DPA.

CLAUSE 2. Object

2.1 This Clauses shall apply to International Transfers of Personal Data between Data Exporters and Data Importers, as described below.

Description of the international data transfer: as set forth in Schedule 2 to this DPA.

CLAUSE 3. Onward Transfers

3.1. The Importer may carry out an Onward Transfer of Personal Data subject to the International Data Transfer governed by these Clauses, in the cases and according to the conditions described below and the provisions of CLAUSE 18.

Details of Onward Transfers: as set forth in Schedule 2 to this DPA.

CLAUSE 4. Responsibilities of the Parties

4.1 Without prejudice to the duty of mutual assistance and the general obligations of the Parties, the Designated Party below, as Controller, shall be responsible for complying with the following obligations set out in these Clauses:

a) Responsible for publishing the document provided in CLAUSE 14;

(x) Exporter

b) Responsible for responding to requests from Data Subjects dealt with in CLAUSE 15:

(x) Exporter

c) Responsible for notifying the security incident provided in CLAUSE 16:

(x) Exporter

4.2. For the purposes of these Clauses, if the Designated Party pursuant to item 4.1 is the Processor, the Controller remains responsible for:

a) compliance with the obligations provided in CLAUSES 14, 15 and 16 and other provisions established in the National Legislation, especially in case of omission or non-compliance with the obligations by the Designated Party;

b) compliance with ANPD’s determinations; and

c) guaranteeing the Data Subjects' rights and repairing damages caused, subject to the provisions of Clause 17.

‍

SECTION II – MANDATORY CLAUSES

‍

CLAUSE 5 Purpose

5.1 These Clauses are presented as a mechanism to enable the secure international flow of personal data, establish minimum guarantees and valid conditions for carrying out the International Data Transfer and aim to guarantee the adoption of adequate safeguards for compliance with the principles, the rights of the Data Subject and the data protection regime provided for in National Legislation.

CLAUSE 6. Definitions

6.1 For the purposes of these Clauses, the definitions in art. 5 of LGPD, and art. 3 of the Regulation on the International Transfer of Personal Data shall be considered, without prejudice to other normative acts issued by ANPD. The Parties also agree to consider the terms and their respective meanings as set out below:

a) Processing agents: the controller and the processor;

b) ANPD: National Data Protection Authority;

c) Clauses: the standard contractual clauses approved by ANPD, which are part of SECTIONS I, II and III;

d) Related Contract: contractual instrument signed between the Parties or, at least, between one of them and a third-party, including a Third-Party Controller, which has a common purpose, link or dependency relationship with the contract that governs the International Data Transfer;

e) Controller: Party or third-party (“Third Controller”) responsible for decisions regarding the processing of Personal Data;

f) Personal Data: information related to an identified or identifiable natural person;

g) Sensitive Personal Data: personal data on racial or ethnic origin, religious belief, political opinion, affiliation to trade unions or to a religious, philosophical or political organization, data regarding health or sexual life, genetic or biometric data, whenever related to a natural person;

h) Erasure: exclusion of data or dataset from a database, regardless of the procedure used;

i) Exporter: processing agent, located in the national territory or in a foreign country, who transfers personal data to the Importer;

j) Importer: processing agent, located in a foreign country, who receives personal data from the Exporter;

k) National Legislation: set of Brazilian constitutional, legal and regulatory provisions regarding the protection of Personal Data, including the LGPD, the International Data Transfer Regulation and other normative acts issued by ANPD;

l) Arbitration Law: Law No. 9,307, of September 23, 1996;

m) Security Measures: technical and administrative measures able to protect Personal Data from unauthorized access and from accidental or unlawful events of destruction, loss, alteration, communication or dissemination;

n) Research Body: body or entity of the government bodies or associated entities or a non-profit private legal entity legally established under Brazilian laws, having their headquarter and jurisdiction in the Brazilian territory, which includes basic or applied research of historical, scientific, technological or statistical nature in its institutional mission or in its corporate or statutory purposes;

o) Processor: Party or third-party, including a Sub-processor, which processes Personal Data on behalf of the Controller;

p) Designated Party: Party or a Third-Party Controller, under the terms of CLAUSE 4, designated to fulfill specific obligations regarding transparency, Data Subjects’ rights and notifying security incidents;

q) Parties: Exporter and Importer;

r) Access Request: request for mandatory compliance, by force of law, regulation or determination of public authority, to grant access to the Personal Data subject to the International Data Transfer governed by these Clauses;

s) Sub-processor: processing agent hired by the Importer, with no link with the Exporter, to process Personal Data after an International Data Transfer;

t) Third-Party Controller: Personal Data Controller who authorizes and provides written instructions for the carrying out of the International Data Transfer between Processors governed by these Clauses, on his behalf, pursuant to Clause 4 (“Option B”);

u) Data Subject: natural person to whom the Personal Data which are subject to the International Data Transfer governed by these Clauses relate;

v) Transfer: processing modality through which a processing agent transmits, shares or provides access to Personal Data to another processing agent;

w) International Data Transfer: transfer of Personal Data to a foreign country or to an international organization which Brazil is a member of;

and

x) Onward Transfer: transfer of Personal Data, within the same country or to another country, by an Importer to a third-party, including a Sub-processor, provided that it does not constitute an Access Request.

CLAUSE 7. Applicable legislation and ANPD supervision

7.1. The International Data Transfer subject to these Clauses shall subject to the National Legislation and to the supervision of ANPD, including the power to apply preventive measures and administrative sanctions to both Parties, as appropriate, as well as the power to limit, suspend or prohibit the international transfers arising from this agreement or a Related Contract.

CLAUSE 8. Interpretation

8.1. Any application of these Clauses shall occur in accordance with the following terms:

a) these Clauses shall always be interpreted more favorably to the Data Subject and in accordance with the provisions of the National Legislation;

b) in case of doubt about the meaning of any term in these Clauses, the meaning which is most in line with the National Legislation shall apply;

c) no item in these Clauses, including a Related Agreement and the provisions set forth in SECTION IV, shall be interpreted as limiting or excluding the liability of any of the Parties in relation to obligations set forth in the National Legislation; and

d) provisions of SECTIONS I and II shall prevail in case of conflict of interpretation with additional clauses and other provisions set forth in SECTIONS III and IV of this agreement or in Related Agreements.

CLAUSE 9. Docking Clause

9.1. By mutual agreement between the Parties, it shall be possible for a processing agent to adhere to these Clauses, either as a Data Exporter or as a Data Importer, by completing and signing a written document, which shall form part of this contract.

9.2. The acceding party shall have the same rights and obligations as the originating parties, according to the position assumed of Exporter or Importer and according to the corresponding category of treatment agent.

CLAUSE 10. General obligations of the Parties

10.1. The Parties undertake to adopt and, when necessary, demonstrate the implementation of effective measures capable of demonstrating observance of and compliance with the provisions of these Clauses and the National Legislation, as well as with the effectiveness of such measures and, in particular:

a) use the Personal Data only for the specific purposes described in CLAUSE 2, with no possibility of subsequent processing incompatible with such purposes, subject to the limitations, guarantees and safeguards provided for in these Clauses;

b) guarantee the compatibility of the processing with the purposes informed to the Data Subject, according to the processing activity context;

c) limit the processing activity to the minimum required for the accomplishment of its purposes, encompassing pertinent, proportional and non-excessive data in relation to the Personal Data processing purposes;

d) guarantee to the Data Subjects, subject to the provisions of Clause 4: (d.1.) clear, accurate and easily accessible information on the processing activities and the respective processing agents, with due regard for trade and industrial secrecy; (d.2.) facilitated and free of charge consultation on the form and duration of the processing, as well as on the integrity of their Personal Data; and (d.3.) accuracy, clarity, relevance and updating of the Personal Data, according to the necessity and for compliance with the purpose of their processing;

e) adopt the appropriate security measures compatible with the risks involved in the International Data Transfer governed by these Clauses;

f) not to process Personal Data for abusive or unlawful discriminatory purposes;

g) ensure that any person acting under their authority, including sub-processors or any agent who collaborates with them, whether for reward or free of charge, only processes data in compliance with their instructions and with the provisions of these Clauses;

h) keep a record of the Personal Data processing operations of the International Data Transfer governed by these Clauses, and submit the relevant documentation to ANPD, when requested.

CLAUSE 11. Sensitive personal data

11.1. If the International Data Transfer involves Sensitive Personal Data, the Parties shall apply additional safeguards, including specific Security Measures which are proportional to the risks of the processing activity, to the specific nature of the data and to the interests, rights and guarantees to be protected, as described in SECTION III.

CLAUSE 12. Personal data of children and adolescents

12.1. In case the International Data Transfer governed by these Clauses involves Personal Data concerning children and adolescents, the Parties shall implement measures to ensure that the processing is carried out in their best interest, under the terms of the National Legislation and relevant instruments of international law.

CLAUSE 13. Legal use of data

13.1. The Exporter guarantees that Personal Data has been collected, processed and transferred to the Importer in accordance with the National Legislation.

CLAUSE 14. Transparency

14.1. The Designated Party shall publish, on its website, a document containing easily accessible information written in simple, clear and accurate language on the conduction of the International Data Transfer, including at least information on:

a) the form, duration and specific purpose of the international transfer;

b) the destination country of the transferred data;

c) the Designated Party's identification and contact details;

d) the shared use of data by the Parties and its purpose;

e) the responsibilities of the agents who shall conduct the processing;

f) the Data Subject's rights and the means for exercising them, including an easily accessible channel made available to respond to their requests, and the right to file a petition against the Exporter and the Importer before ANPD; and

g) Onward Transfers, including those relating to recipients and to the purpose of such transfer.

14.2. The document referred to in item 14.1. shall be made available on a specific website page or integrated, in a prominent and easily accessible format, to the Privacy Policy or equivalent document.

14.3. Upon request, the Parties shall make a copy of these Clauses available to the Data Subject free of charge, complying with trade and industrial secrecy.

14.4. All information made available to Data Subjects, under the terms of these Clauses, shall be written in Portuguese.

CLAUSE 15. Rights of the data subject

15.1. The Data subject shall have the right to obtain from the Designated Party, as regards the Personal Data subject to the International Data Transfer governed by these Clauses, at any time, and upon request, under the terms of the National Legislation:

a) confirmation of the existence of processing;

b) access to data;

c) correction of incomplete, inaccurate or outdated data;

d) anonymization, blocking or erasure of unnecessary or excessive data or data processed in non-compliance with these Clauses and the provisions of National Legislation;

e) portability of data to another service or product provider, upon express request, in accordance with ANPD regulations, complying with trade and industrial secrecy;

f) erasure of Personal Data processed under the Data Subject’s consent, except for the events provided in CLAUSE 20;

g) information on public and private entities with which the Parties have shared data;

h) information on the possibility of denying consent and on the consequences of the denial;

i) withdrawal of consent through a free of charge and facilitated procedure, remaining ratified the processing activities carried out before the request for elimination;

j) review of decisions taken solely on the basis of automated processing of personal data affecting their interests, including decisions aimed at defining their personal, professional, consumer and credit profile or aspects of their personality; and

k) information on the criteria and procedures adopted for the automated decision.

15.2. Data subject may oppose to the processing based on one of the events of waiver of consent, in case of non-compliance with the provisions of these Clauses or National Legislation.

15.3. The deadline for responding to the requests provided for in this Clause and in item 14.3 is 15 (fifteen) days from the date of the data subject's request, except in the event of a different deadline established in specific ANPD regulations.

15.4. In case the Data Subject's request is directed to the Party not designated as responsible for the obligations set forth in this Clause or in item 14.3., the referred Party shall:

a) inform the Data Subject of the service channel made available by the Designated Party; or

b) forward the request to the Designated Party as early as possible, to enable the response within the period provided in item 15.2.

15.5. The Parties shall immediately inform the Data Processing Agents with whom they have shared data with the correction, deletion, anonymization or blocking of the data, for them to follow the same procedure, except in cases where this communication is demonstrably impossible or involves a disproportionate effort.

15.6. The Parties shall promote mutual assistance to respond to the Data Subjects’ requests.

CLAUSE 16. Security Incident Reporting

16.1. The Designated Party shall notify ANPD and the Data Subject, within 3 (three) working days of the occurrence of a security incident that may entail a relevant risk or damage to the Data Subjects, according to the provisions of National Legislation.

16.2. The Importer must keep a record of security incidents in accordance with National Legislation.

CLAUSE 17. Liability and compensation for damages

17.1. The Party which, when performing Personal Data processing activities, causes patrimonial, moral, individual or collective damage, for violating the provisions of these Clauses and of the National Legislation, shall compensate for it.

17.2. Data Subject may claim compensation for damage caused by any of the Parties as a result of a breach of these Clauses.

17.3. The defense of Data Subjects' interests and rights may be claimed in court, individually or collectively, in accordance with the provisions in relevant legislation regarding the instruments of individual and collective protection.

17.4. The Party acting as Processor shall be jointly and severally liable for damages caused by the processing activities when it fails to comply with these Clauses or when it has not followed the lawful instructions of the Controller, except for the provisions of item 17.6.

17.5. The Controllers directly involved in the processing activities which resulted in damage to the Data Subject shall be jointly and severally liable for these damages, except for the provisions of item 17.6.

17.6. Parties shall not be held liable if they have proven that:

a) they have not carried out the processing of Personal Data attributed to them;

b) although they did carry out the processing of Personal Data attributed to them, there was no violation of these Clauses or National Legislation; or

c) the damage results from the sole fault of the Data Subject or of a third-party which is not a recipient of the Onward Transfer or not subcontracted by the Parties.

17.7. Under the terms of the National Legislation, the judge may reverse the burden of proof in favor of the Data Subject whenever, in his judgement, the allegation is credible, there is a lack of sufficient evidence or when the Data Subject would be excessively burdened by the production of evidence.

17.8. Judicial proceedings for compensation for collective damages which intend to establish liability under the terms of this Clause may be collectively conducted in court, with due regard for the provisions in relevant legislation.

17.9. The Party which compensates the damage to the Data Subject shall have a right of recourse against the other responsible parties, to the extent of their participation in the damaging event.

CLAUSE 18. Safeguards for Onward Transfers

18.1. The Importer shall only carry out Onward Transfers of Personal Data subject to the International Data Transfer governed by these Clauses if expressly authorized, in accordance with the terms and conditions described in CLAUSE 3.

18.2. In any case, the Importer:

a) shall ensure that the purpose of the Onward Transfer is compatible with the specific purposes described in CLAUSE 2;

b) shall guarantee, by means of a written contractual instrument, that the safeguards provided in these Clauses shall be ensured by the third-party recipient of the Onward Transfer; and

c) for the purposes of these Clauses, and regarding the Personal Data transferred, shall be considered responsible for any eventual irregularities committed by the third-party recipient of the Onward Transfer.

18.3. The Onward Transfer shall also be carried out based on another valid modality of International Data Transfer provided in National Legislation, regardless of the authorization referred to in CLAUSE 3.

CLAUSE 19. Access Request Notification

19.1 The Importer shall notify the Exporter and the Data Subject of any Access Request related to the Personal Data subject to the International Data Transfer governed by these Clauses, except in the event that notification is prohibited by the law of the country in which the data is processed.

19.2. The Importer shall implement the appropriate legal measures, including legal actions, to protect the rights of the Data Subjects whenever there is adequate legal basis to question the legality of the Access Request and, if applicable, the prohibition of issuing the notification referred to in item 19.1.

19.3. To comply with both the ANPD’s and the Exporter’s requests, the Importer shall keep a record of Access Requests, including date, requester, purpose of the request, type of data requested, number of requests received, and legal measures implemented.

CLAUSE 20. Termination of processing and erasure of data

20.1. Parties shall erase the personal data subject to the International Data Transfer governed by these Clauses after the ending of their processing, being their storage authorized only for the following purposes:

a) compliance with a legal or regulatory obligation by the Controller;

b) study by a Research Body, guaranteeing, whenever possible, the anonymization of personal data;

c) transfer to a third-party, upon compliance with requirements set forth in these Clauses and in the National Legislation; and

d) exclusive use of the Controller, being the access by a third-party prohibited, and provided data have been anonymized.

20.2. For the purposes of this Clause, processing of personal data shall cease when:

a) the purpose set forth in these Clauses has been achieved;

b) Personal Data are no longer necessary or pertinent to attain the intended specific purpose set forth in these Clauses;

c) at the termination of the treatment period;

d) Data Subject's request is met; and

e) at the order of ANPD, upon violation of the provisions of these Clauses or National Legislation.

CLAUSE 21. Data processing security

21.1. Parties shall implement Security Measures which guarantee sufficient protection of the Personal Data subject to the International Data Transfer governed by these Clauses, even after its termination.

21.2. Parties shall inform, in SECTION III, the Security Measures implemented, considering the nature of the processed information, the specific characteristics and the purpose of the processing, the technology current state and the probability and severity of the risks to the Data Subjects’ rights, especially in the case of sensitive personal data and that of children and adolescents.

21.3. The Parties shall make the necessary efforts to implement periodic evaluation and review measures to maintain the appropriate level of data security.

CLAUSE 22. Legislation of country of destination

22.1. The Importer declares that it has not identified any laws or administrative practices of the country receiving the Personal Data that prevent it from fulfilling the obligations assumed in these Clauses.

22.2. In the event of a regulatory change which alters this situation, the Importer shall immediately notify the Exporter to assess the continuity of the contract.

CLAUSE 23. Non-compliance with the Clauses by the Importer

23.1. In the event of a breach in the safeguards and guarantees provided in these Clauses or being the Importer unable to comply with any of them, the Exporter shall be immediately notified, subject to the provisions in item 19.1.

23.2. Upon receiving the communication referred to in item 23.1 or upon verification of non-compliance with these Clauses by the Importer, the Exporter shall implement the relevant measures to ensure the protection of the Data Subjects' rights and the compliance of the International Data Transfer with the National Legislation and these Clauses, and may, as appropriate:

a) suspend the International Data Transfer;

b) request the return of the Personal Data, its transfer to a third-party, or its erasure; and

c) terminate the contract.

CLAUSE 24. Choice of forum and jurisdiction

24.1. Brazilian legislation applies to these Clauses and any controversy between the Parties arising from these Clauses shall be resolved before the competent courts in Brazil, observing, if applicable, the forum chosen by the Parties in Section IV.

24.2. Data Subjects may file lawsuits against the Exporter or the Importer, as they choose, before the competent courts in Brazil, including those in their place of residence.

24.3. By mutual agreement, Parties may use arbitration to resolve conflicts arising from these Clauses, provided that the procedure is carried out in Brazil and in accordance with the provisions of the Arbitration Law.

SECTION III - Security Measures

The Parties acknowledge that the security measures applicable to the Processing activities under this Schedule are established in Section 4 of this DPA, which forms an integral part hereof.

‍

Effective: April 15, 2025

11 Tecnologias, S de R.L. de C.V. (collectively, "Hilos" or "we" or "us") is provider of software-as-as-service platform (https://app.hilos.io/) enabling companies to automate and scale their conversations through Whatsapp.

‍

Within the framework of its business activities, Hilos carries out processing of personal data, acting as a data controller. Identification and contact details for Hilos are set out in the "Contact Us" section of this Privacy Policy. The purpose of this Privacy Policy is to inform you on the manner in which the data are processed by Hilos acting as a data controller when you use our site, application or subscribe to Hilos's services (collectively, the "Services"), or where you otherwise interact with Hilos, as required by the data protection laws.

‍

This Privacy Policy describes the conditions under which Hilos carries out, as data controller, the personal data processing described hereinafter and pertaining to the personal data of any of its customer, prospect, user of its website ("you" or "data subject").

‍

For the purposes of this Privacy Policy, the term "Data Protection Laws" collectively refers to the laws and regulations applicable to personal data protection, including the Mexican Data Protection Law on the Protection of Personal Data held by Private Parties and its Implementing Regulations ("Mexican Data Protection Law"), Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ("GDPR") or any other data protection law or regulation, to the extent applicable.

‍

In accordance with the Data Protection Laws, the term "personal data" in this Privacy Policy refers to any information about you that allows you to be identified directly or indirectly as a natural person.

‍

1. PERSONAL DATA PROCESSED

‍

The categories or personal data we collect about you depend on your activity and interactions with Hilos. The following categories of data may be collected by Hilos:

• Identification data (including title, name, first name, nationality);
• Contact information (including postal address, country, email address, and telephone number, communication language, Whatsapp account details);
• Account credentials (including user name, hashed password and other similar information used to verify the identity of our customers);
• Commercial and financial or economic information (including information about the Services you subscribe to and payment information you provide in connection with these transactions, including billing address and payment card data);
• Professional information (including current or former employer and job title);
• Logs data (including information we may obtain through cookies, as IP address, browser type and version, operating system, interface, the pages you view on our site or application, the pages you view immediately before and after you access the sites, and the search terms you enter on our site or application, your geographical location (in order to ensure the content displayed is relevant for where you are), the name of your access provider and inferences drawn from these information.
• Support data (including support tickets);
• Preferences (including how you prefer to communicate with us, newsletter subscription preferences, answers provided in the feedback survey you completed, the Services that you are interested in, any preference you communicated to us);
• Marketing and engagement data (including newsletter subscription, emails opened, clicks, ads interactions, tracking data);
• Other information you provide when you interact with us (including messages sent to the chatbot, information provided in emails, or other communications that you send to us or otherwise contribute, including any related metadata).

‍

These personal data are collected either directly from you (e.g. when you uses the Services or interact with us), or from you passively (e.g. through cookies), or from third parties (e.g. publicly available databases or social media platforms).

‍

Information collected indirectly (right to opt-out for Mexican residents only)

‍

In the event that we obtain your personal data indirectly, you have a period of 5 (five) business days, from the time we make the first contact with you, so you can express your refusal for the processing of your personal data for secondary purposes, through the email hey@hilos.io.

‍

2. CHARACTERISTICS OF THE PROCESSING

‍

‍

If we need to process your personal data for purposes other than those listed in the table above, you may be informed and we will take all additional steps that may be necessary to ensure compliance with Data Protection Laws of any further processing.

‍

Necessary and secondary purposes (for Mexican residents only)

‍

The purposes of the data processing described in this Privacy Policy are necessary to comply with legal or contractual obligations. Therefore, your consent would not be required, except for the secondary purposes which are for audience measurement and marketing purposes.

‍

Unless you indicate otherwise, we can collect and process your personal data for the secondary purposes listed above. You may, at any time, request your consent withdrawal for secondary purposes, according to Section 6 ("Your Rights Regarding Your Personal Data") described below.

‍

3. COOKIES

‍

‍

We may collect technical information automatically from your computer or mobile device across different sites through the use of cookies or similar tracking technologies.

‍

A cookie is a small data file that can be placed on your computer or mobile device when you visit a website. Cookies help analyze web traffic and let us know when and how you visit a particular site.

‍

For more information about how we use cookies, the types of cookies we use, and how to manage your cookie preferences, please refer to our Cookies Policy.

‍

4. DISCLOSURE OF YOUR PERSONAL DATA

‍

4.1. Recipients of your personal data

‍

The personal data we collect may be disclosed to the following categories of recipients for achieving the purposes of the processing described in this Privacy Policy:

‍

i. our parent and affiliated companies;ii. our service providers involved in all or part of the processing identified and acting on our behalf (in particular, IT service providers, hosting provider, payment provider, digital service tool provider, among other contractors);iii. our partners who operate services available on our site/application;iv. our partners involved in the process of delivering personalized ads (including social networks), in particular to enable us to obtain relevant information about your interests, to better understand your profile and to send you personalized ads and offers corresponding to your choices and interests;v. audit, law firms, judicial and ministerial officials, administrative or judicial authorities before whom a dispute is brought, within the framework of compliance with our legal and regulatory obligations and to enable us to defend our rights and interests; andvi. entities in charge of our external control, such as statutory and other auditors, and entities in charge of internal auditing;

‍

Some of our partners may further process your personal data for their own purposes as separate data controller. For instance, when you interact with links or ads on our site or application that redirect to other sites or applications, the third parties operating these sites, services or ads may process your personal data under their own responsibility as separate data controllers. We invite you to read their personal data protection policies to know the terms and conditions applicable to the processing of your personal data that these actors carry out.

‍

In addition, some of our partners may be joint controllers of the processing. In such case we enter into a joint controller agreement in order to determine the respective responsibilities of each party for compliance with the obligations under Data Protection Laws.

‍

Necessary and secondary purposes for the data transfers (for Mexican residents only)

‍

All transfers are necessary to comply with legal or contractual obligations, except for personalized ads which is a secondary purpose. Unless you object to such processing by notifying us through our email, we may transfer your personal data to business partners for personalized ads purposes.

‍

4.2 Transfers of personal data

‍

Hilos is established in Mexico and may process your personal data for the purposes described above in Mexico or other countries, which may include the United States and countries located outside the European Union (i.e. EEA, Switzerland and United Kingdom).

‍

When your personal data is transferred to countries other than your home country, you may not have the same rights and protections as you do under local law. Any international transfers of such personal data will be done in accordance with Data Protection Laws. This may include implementing adequate protection for the transfer of your personal data to recipients in those countries by entering into international data transfer agreement drawn up in accordance with Data Protection Laws, such as the European Commission's Standard Contractual Clauses, or any other valid mechanisms that may be available, or ensuring additional measures to guarantee a level of protection for your personal data that is materially equivalent to the one provided in the European Union.

‍

5. RETENTION PERIOD

‍

We may retain your personal data for a period of time consistent with the original purpose of collection or as long as required to fulfill our legal obligations.

‍

After expiry of the applicable retention periods, your personal data will be deleted. If there is any data that we are unable, for technical reasons, to delete entirely from our systems, we will implement appropriate measures to prevent any further use of such data.

‍

In some circumstances, we may anonymize personal data so that it may no longer be associated with a data subject, and in such cases we may use that anonymized information without further notice to you and outside of this Privacy Policy (because, once anonymized, it ceases to constitute a personal data within the meaning of Data Protection laws).

‍

Further information regarding retention is available upon request. Please see the "Contact Us" section of this Privacy Policy.

‍

6. YOUR RIGHTS REGARDING YOUR PERSONAL DATA

‍

You may have certain rights relating to your personal data, subject to the local data protection laws as applicable. Please note that you can only exercise these rights with respect to personal data that Hilos processes about you as a data controller.

‍

Depending on the applicable Data Protection Law and, in particular, if you are located in Mexico, the European Union, or the United States, these rights may include:

‍

For Mexican residents

‍

As regards your personal data, you have the following rights:

‍

• Right to access your personal data as well as information regarding the conditions and general aspects of the processing.
• Right to rectify/correct your personal data where inaccurate or incomplete;
• Right to limit the use/divulgation of your personal data;
• Right to cancellation and erasure of personal data: you have the right to request the cancellation of your personal data at any time if you believe it is not being processed in accordance with the principles and obligations established by the Mexican Data Protection Law. The cancellation may apply to all of your personal data contained in a database or only a part of it, as requested.
• Right to object to the processing of personal data or request its cessation at any time when:i. there is a legitimate reason and your specific situation requires it, justifying that even if the processing is lawful, it must cease to prevent harm to you, orii. you wish to express your objection to the processing of your personal data to prevent its use for specific purposes.

‍

This right of objection does not apply when the processing is necessary to fulfill a legal obligation imposed on the data controller.

‍

• Right to withdraw consent, at any time, without retroactive effect.

‍

Should you have any doubts or complaints regarding the processing of your personal data, or to know more about the applicable requirements and procedure to exercise your rights, you may contact us using the details provided in the "Contact Us" section below.

‍

For European Union residents

‍

As regards your personal data, you have the right to access, rectify, erase, object to, limit the processing of your personal data and the right to portability of your personal data, to the extent permitted by the Data Protection Laws.

‍

You may also withdraw your consent at any time, in cases where it has been requested.

‍

• Right of access: You may request access to your personal data that we collect and process. If you make an access request, we will provide you with a copy of your personal data in our possession and all other information legally required.
• Right to object: You may object, at any time, for reasons relating to your specific situation, to the processing of your personal data where this is based on our legitimate interest, unless our legitimate interest overrides your own interests, rights and freedoms, or the processing is necessary for determining, exercising or defending rights in a court of law. You may also, at any time, object to our processing of your personal data when such processing is carried out for the purpose of commercial prospecting by electronic means or by mail, including when the relevant processing constitutes profiling.
• Right of rectification: At any time, you can request that we rectify any personal data about you that is inaccurate or incomplete.
• Right to erasure: You may request the erasure of your personal data on the terms provided for by the Data Protection Laws, except where such data must be stored to enable us to comply with legal obligations, or to enable us to exercise or defend our rights or where it is necessary to perform the contract between us.
• Right to limit processing: You may request to limit processing of your personal data on the terms provided for by the Data Protection Laws.
• Right to portability: You have the right to portability of personal data you have provided to us and that we process by automated means, where the processing we carry out is based on your consent or on the performance of a contract or pre-contractual measures, provided that exercising such right does not infringe third parties' rights and freedoms.
• Right to lodge a complaint: After having contacted us in this respect, if you believe that your rights relating to your personal data have not been respected, you may submit a claim to your local data protection authority. Contact details for data protection authorities in the European Union is available here.

‍

In addition, if you are a French resident, you have the right to give general or specific instructions pertaining to the manner in which you wish to exercise the rights, after your death. The general instructions pertain to all personal data about you, and you can revoke them at any time. They may be registered with a trusted digital third party certified by the French Data Protection Authority. The special instructions pertain to the processing referred to in these instructions and are registered with us: they are subject to your specific consent and you may revoke them at any time.

‍

For United States residents

‍

As regards your personal data and in particular if you are located in the State of California, you may have the right to request that we disclose certain information to you about our collection and use of your personal data over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

‍

• The categories of personal data we collected about you and the categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting that personal data.
• The categories of third parties with whom we share that personal data.
• The specific pieces of personal data we collected about you (also called a data portability request).

‍

You may also have the right to request that we delete any of your personal data we collected from you and retained, subject to certain exceptions provided by law. Once we receive and confirm your request, we will delete your personal data from our records, unless an exception applies.

‍

For Brazilian residents

‍

In accordance with the Brazilian General Data Protection Law ("LGPD"), you have the following rights:

‍

• Confirm whether we process your personal data and receive confirmation of such processing.
• Access your personal data that we hold.
• Request the correction of any personal data that is incomplete, inaccurate, or outdated.
• Request the anonymization, blocking, or deletion of data that is unnecessary, excessive, or processed in violation of the LGPD.
• Request the portability of your personal data to another service or product provider, in accordance with Brazilian Data Protection Authority regulations and subject to commercial and industrial confidentiality.
• Request the deletion of personal data processed based on your consent.
• Request information about public and private entities with which we have shared your personal data.
• Be informed about the possibility of refusing to provide consent and the consequences of such refusal.
• Withdraw your consent at any time.
• Object to the processing of your personal data when it is based on a legal ground other than consent, in case of non-compliance with the LGPD.
• Request a review of decisions made solely through automated processing, including those that affect your personal, professional, consumer, or credit profile, or other aspects of your personality. You can also request clear and adequate information about the criteria and procedures used in such decisions, subject to commercial and industrial secrecy.
• File a complaint with the Brazilian Data Protection Authority regarding the processing of your personal data.

‍

Exercising your rights

‍

In order to exercise your rights, you can send us an email or letter to the addresses below, specifying the right you wish to exercise, the personal data involved in your request and indicating your first and last names as well as the email address associated with your customer or loyalty account (if applicable):

‍

• Email: hey@hilos.io.
• Letter: Av Paseo de la Reforma 404, Piso 1, 06600, Cuauhtémoc, Ciudad de México, México.

‍

In the event that you request access to your personal data to a person who is presumed to be the data controller and this person turns out not to be the data controller, it shall be sufficient to indicate this fact to you by any of the means referred to in this section, in order for the request to be considered fulfilled.

‍

Please note that Hilos may (in whole or in part) deny access to the personal data, or to rectify or cancel it, or grant opposition to its processing, in accordance with Data Protection Law, which may include the following cases:

‍

i. When the applicant is not the owner of the personal data, or the legal representative is not duly accredited to do so;ii. When the applicant's personal data are not found in our database;iii. When the rights of a third party are infringed;iv. When there is a legal impediment, or the resolution of a competent authority, which restricts access to the personal data, or does not allow the rectification, cancellation or opposition thereof; andv. When the rectification, erasure or objection has been previously made.

‍

For Mexican residents only:

If you are a Mexican resident, your request must include at least the following information:

‍

(i) Your full name and address, or any another suitable means to receive a response to your request;(ii) Documents proving your identity or, if applicable, that of your legal representative;(iii) The clear and precise description of the personal data with respect to which you seek to exercise any of your rights (except in the case of the right of access) and/or revoke consent to its processing.

‍

In the case of request for rectification of personal data, you shall indicate the modifications to be made and provide the documentation supporting this request.

‍

(iv) The description of the right sought to be exercised, or what you are requesting (revocation of consent to the processing, for example); and(v) Any other element or document that facilitates the location of the personal data, if applicable.

‍

The obligation of access to the information shall be deemed fulfilled when the personal data is made available to you; or by means of electronic documents.

‍

7. CHANGES TO THIS PRIVACY POLICY

‍

We may change this Privacy Policy at any time depending on the applicable legal and regulatory framework or changes in our business, and, in particular, the Services we offer you.

‍

We will notify you of the changes provided to this Privacy Policy by posting a new privacy policy on this page. If we make any changes that materially change the ways we process or protect your information, we may provide additional notification of the changes.

‍

8. CONTACT US

‍

If you have any questions or comments about this Privacy Policy or wish to exercise your rights under Data Protection Laws, please do not hesitate to contact us at: hey@hilos.io

‍

The Data Controller is 11 Tecnologias, S de R.L. de C.V., with domicile for legal service located at: Av Paseo de la Reforma 404, Piso 1, 06600, Cuauhtémoc, Ciudad de México, México.

‍

9. TERMS AND TRANSLATIONS

‍

Terms not expressly defined herein will have the same definition set forth by Data Protection Laws.

If you are a Mexican resident, note that the Spanish version of this Privacy Policy is available on this page.

‍