Data Protection Agreement

This Data Processing Agreement (the “DPA”) is entered into between:

(i) the End Customer identified in the applicable Order Form or other ordering document (the “Customer” or “Controller”),

and

(ii) ELEVA AI SOLUTIONS, S.L., Tax ID B22707855 (“ELEVA AI” or the “Processor”), and forms part of the ELEVA Platform Service Terms and the Order Form applicable to the Customer (jointly referred as the “Main Agreement”).

Where the Customer requests separate execution of this DPA, this DPA may be executed directly between the Customer and ELEVA AI without affecting the commercial relationship between the Customer and the relevant ELEVA AI reseller or partner, where applicable.

1. PURPOSE AND SCOPE OF THE PROCESSING ENGAGEMENT

1.1. Under this DPA, the Customer authorises ELEVA AI to process on the Customer’s behalf the personal data necessary to provide the ELEVA Platform and the functionalities enabled for the Customer under the Main Agreement and applicable Order Form, including, as applicable, Eleva Assistant and Eleva Forms. The processing engagement includes, as applicable:

a) receiving, transmitting and processing End Users’ queries and conversational interactions through Eleva Assistant, including, where enabled, transmitting information necessary to initiate or facilitate third-party bookings or transactions on the Customer’s documented instructions;

b) generating contextualised responses and performing natural-language processing, semantic retrieval, embeddings, retrieval-augmented generation (RAG) and other processing necessary to provide the conversational functionality;

c) accessing, receiving, retrieving, transmitting, analysing, cross-referencing and structuring Personal Data originating from Customer Integrated Systems and other data sources or communication channels enabled by the Customer, where necessary to provide the Service, including to generate contextualised responses, analytics, insights and reports for the Customer;

d) collecting data through digital forms configured by the Customer;

e) generating structured lead records from information provided by End Users;

f) hosting and retaining personal data as necessary to provide the Service;

g) technically recording the status of checkboxes, consents or authorisations configured by the Customer; and

h) making data available to the Customer or transmitting them to destination systems or tools designated by the Customer.

1.2. Scope. This DPA applies to any Processing of Personal Data carried out by ELEVA AI on behalf of the Customer in connection with the provision of the Platform, including Personal Data contained in Conversational Data, Form Data, Consent Records, Customer Content and data originating from Customer Integrated Systems, to the extent processed by ELEVA AI for the purposes of providing the Service in accordance with the Customer’s documented instructions. This includes Personal Data accessed, received or generated through the communication channels, integrations and data sources enabled by the Customer and processed by ELEVA AI for conversational assistance, workflow automation, analytics, insights, reporting or other functionalities provided to the Customer through the Service. This DPA does not apply to Processing activities for which ELEVA AI independently determines the purposes and essential means and therefore acts as an independent Controller under applicable Data Protection Laws. Any such processing shall be governed by the Main Agreement and ELEVA AI’s applicable privacy information and shall not include the use of Personal Data processed on behalf of the Customer for training, fine-tuning or improving AI models, except as expressly permitted under Clause 6 below.

1.3. Nature and purpose of the processing: The purpose of the Processing is the provision, operation, maintenance, security and support of the Platform functionalities enabled by the Customer, including Eleva Assistant and Eleva Forms, in accordance with the Main Agreement, the applicable Order Form and the Customer’s documented instructions.

1.4. Processing operations covered: The Processing may include collection, receipt, transmission, recording, organisation, structuring, consultation, contextualisation, retrieval, cross-referencing, analysis, profiling, segmentation, generation of responses, hosting, storage, retention, synchronisation with Customer Integrated Systems, making available, disclosure by transmission to systems or recipients designated by the Customer, anonymisation, restriction, erasure and destruction, together with such automated processing through AI Systems as is necessary to provide the enabled functionalities.

1.5. Collection channels and scope. Personal Data may be processed through:

a) conversational interactions between End Users and Eleva Assistant, including through web, in-venue interfaces, WhatsApp Business or other channels enabled by the Customer in the Main Agreement;

b) digital forms made available through Eleva Forms;

c) Customer Integrated Systems connected to the Platform, including where applicable CRM, social-media, messaging, email, review, loyalty, marketing and other systems or channels enabled by the Customer;

d) information supplied by the Customer or its authorised users; and

e) structured records generated from information provided by End Users during their interactions with the Platform.

Personal Data contained in conversational interactions shall remain subject to this DPA for so long as ELEVA AI processes such data on behalf of the Customer, irrespective of whether the same information is subsequently incorporated into a structured lead record.

1.6. Hosting and retention. Personal Data processed under this DPA may be hosted in databases operated by ELEVA AI during the term of the Main Agreement. Unless the Customer provides documented instructions establishing a shorter period, ELEVA AI shall retain such data for as long as necessary to provide the Service and shall return or erase them in accordance with Clause 4.r) of this DPA. The Parties acknowledge that the Services may involve continuous assistance, personalisation across successive visits, CRM integration, customer engagement, operational analytics and longitudinal performance reporting. Unless the Customer provides documented instructions establishing shorter periods, the following maximum retention periods shall apply:

a) Conversational Data, identifiable session records, user identifiers and preferences: up to twenty-four (24) months from the End User's last interaction, subject to appropriate data minimisation and filtering measures.

b) Identifiable analytics, interaction events, profiles and segmentation data: up to twenty-four (24) months, where necessary for longitudinal analysis, reporting and Service improvement.

c) Incident and customer satisfaction records: up to twenty-four (24) months following closure or collection, as applicable.

d) Temporary integration caches: up to thirty (30) days, unless earlier deletion is appropriate or continued retention is necessary for another authorised purpose.

e) Identifiable marketing and CRM data stored by ELEVA AI: up to twenty-four (24) months from the last relevant interaction or activity, subject to the applicable consent and the Customer's documented instructions.

f) Administrative, technical and security logs: up to twenty-four (24) months, with earlier deletion where continued retention is unnecessary.

g) Consent Records: for the period necessary to demonstrate compliance with applicable legal obligations and establish, exercise or defend legal claims, in accordance with the Customer's instructions.

h) Personal Data held directly within the Customer's own CRM or other systems: subject to the Customer's applicable retention policies.

i) Location data: only for as long as necessary to provide the relevant functionality. Precise geolocation data or detailed movement histories shall not be retained unless specifically authorised by the Customer for a documented purpose.

These periods constitute maximum retention limits. Personal Data shall be erased earlier where no longer necessary for the relevant purposes, subject to applicable legal retention obligations. Upon termination, the return and erasure provisions of this DPA shall apply.

2. IDENTIFICATION OF THE INFORMATION CONCERNED

2.1. Categories of data subjects: (i) End Users interacting with Eleva Assistant or Eleva Forms, including visitors to the Customer’s premises or digital environments, prospective clients and other individuals interacting with the Service; (ii) Customer personnel and authorised users; and (iii) any other individuals whose Personal Data is made available through Customer Integrated Systems or Customer Content.

2.2. Categories of personal data processed:

a) identification and contact data, including name, email address, telephone number and other information voluntarily provided by the End User or configured by the Customer;

b) Conversational Data, including queries, conversational content, responses, metadata, interests expressed, actions, events and contextual information generated during interaction with Eleva Assistant;

c) structured information extracted or generated from conversational interactions;

d) preferences, interests, usage patterns, user profiles and segments generated or inferred from End Users' interactions with the Platform, including age ranges voluntarily provided by End Users or estimated through artificial intelligence;

e) Form Data and Consent Records;

f) Personal Data obtained from or made available through Customer Integrated Systems and enabled channels, including customer, user, interaction, communication, transactional, CRM, review, engagement and related metadata, depending on the integrations enabled by the Customer;

g) Personal Data contained in Customer Content or made available through Customer Integrated Systems;

h) technical and usage data necessary to provide and secure the Service, including identifiers, timestamps, logs and interaction metadata; and

i) any other Personal Data processed on the Customer’s documented instructions through the functionalities enabled under the applicable Order Form.

2.3. Special categories of data. The Customer shall not intentionally configure or use the Service to collect or otherwise process special categories of Personal Data within the meaning of Article 9 GDPR, unless expressly agreed in writing with ELEVA AI and subject to the Customer having identified an applicable condition under Article 9(2) GDPR and any additional safeguards required by applicable law. ELEVA AI does not intentionally solicit special-category data through Eleva Assistant. Where an End User spontaneously discloses such information during a conversational interaction, ELEVA AI shall process such information solely as necessary to provide the Service on behalf of the Customer and in accordance with the Customer’s documented instructions, unless otherwise required by applicable law.

3. TERM

3.1. This DPA shall remain in force for the same term as the Main Agreement and shall terminate automatically when the Main Agreement terminates for any reason.

3.2. The confidentiality and duty-of-secrecy obligations, together with the obligations concerning the disposition of data set out in Clause 4.r), shall survive termination.

4. PROCESSOR OBLIGATIONS

ELEVA AI and all of its personnel shall:

a) Use the Personal Data processed under this DPA, or collected for inclusion, solely for the purpose of this processing engagement. Under no circumstances may ELEVA AI use them for its own purposes other than those provided for in this DPA.

b) Process the Personal Data in accordance with the Customer’s documented instructions. If ELEVA AI considers that an instruction infringes the GDPR, the LOPDGDD or any other Union or Member State data-protection provision, ELEVA AI shall immediately inform the Customer.

c) Maintain in writing a record of the categories of processing activities carried out on behalf of the Customer, containing the information required by Article 30(2) GDPR, and make it available to the Customer upon request.

d) Not disclose the Personal Data processed under this DPA to third parties unless expressly authorised by the Customer where legally permitted, or unless such disclosure is required by Union or Member State law applicable to ELEVA AI, in which case ELEVA AI shall inform the Customer of that legal requirement in advance unless the law prohibits such information on important grounds of public interest. Transmission of data to destination systems or tools designated by the Customer itself, which forms part of the processing engagement, shall not be deemed disclosure to a third party.

e) Sub-processors. The Customer grants ELEVA AI general authorisation to engage the sub-processors listed in Schedule II to this DPA for provision of the Service. ELEVA AI shall inform the Customer of any addition or replacement of sub-processors at least thirty (30) calendar days in advance, stating the identity and location of the sub-processor, the purpose of the processing entrusted to it and the applicable safeguards. The Customer may object within that period on reasonable and justified data-protection grounds. If the Customer objects, the Parties shall negotiate an alternative solution in good faith; if no solution is reached, either Party may terminate the affected functionality without penalty. ELEVA AI shall contractually impose on each sub-processor the same data-protection obligations as those set out in this DPA and shall remain fully liable to the Customer for the sub-processor’s compliance with those obligations.

f) Maintain confidentiality in respect of the Personal Data processed under this DPA to which it has had access by virtue of this processing engagement, including after the engagement has ended.

g) Ensure that persons authorised to process Personal Data expressly undertake in writing to preserve confidentiality and comply with the applicable security measures, of which they shall be duly informed.

h) Keep documentation evidencing compliance with the obligation in the preceding paragraph available to the Customer.

i) Ensure that persons authorised to process Personal Data receive the necessary personal-data protection training.

j) Assistance with the exercise of rights. Taking into account the nature of the processing and by appropriate technical and organisational measures, assist the Customer in responding to the exercise of rights of access, rectification, erasure and objection, restriction of processing, data portability and the right not to be subject to automated individual decision-making, including profiling. Where a data subject exercises any such right with ELEVA AI, ELEVA AI shall notify the Customer immediately at the usual contact address and, in any event, no later than the business day following receipt of the request, together with any other information relevant to resolving it.

k) Information duties. The Customer is responsible for providing the information required under Articles 13 and 14 GDPR in relation to the Processing carried out on its behalf and, where applicable, for defining the legal notices, consent mechanisms and other information displayed or implemented through the functionalities and channels configured by the Customer.

l) Notification of personal-data breaches. ELEVA AI shall notify the Customer, without undue delay and in any event within forty-eight (48) hours after becoming aware of them, of personal-data breaches affecting data under ELEVA AI’s responsibility, using the usual contact email address, together with all information relevant to documenting and reporting the incident. The notification shall include, to the extent available, the information required by Article 33(3) GDPR. Where it is not possible to provide the information at the same time, it shall be supplied in phases without undue further delay. The Customer, in its capacity as Controller, is responsible for notifying the breach to the competent supervisory authority and, where applicable, to the data subjects.

m) Support the Customer in carrying out data protection impact assessments where required.

n) Support the Customer in carrying out prior consultations with the supervisory authority where required.

o) Make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and allow for and contribute to audits and inspections by the Customer or another auditor authorised by it. Such audits shall be conducted on reasonable prior notice, during business hours, no more than once per year except following a security incident or a requirement of a competent authority, and without compromising the confidentiality of information relating to other ELEVA AI customers. The costs of such audits shall be borne by the Customer, unless the audit reveals a material breach of this DPA by ELEVA AI, in which case the reasonable costs of the audit shall be borne by ELEVA AI.

p) Implement the technical and organisational security measures described in Schedule I to this DPA, appropriate to ensure a level of security commensurate with the risk in accordance with Article 32 GDPR.

q) Appoint a data protection officer and notify the Customer of the officer’s identity and contact details where such appointment is mandatory.

r) Disposition of data. Upon termination of this DPA, ELEVA AI shall, at the Customer’s option, return the personal data processed on the Customer’s behalf or erase them, and shall also erase any existing copies in its systems. Any request for return must be made within the thirty (30) calendar-day period specified in Clause 8.3 of the Main Agreement; if no express request is made within that period, ELEVA AI shall proceed with erasure. ELEVA AI may retain a duly blocked copy of the data for as long as liabilities may arise from its relationship with the Customer, and shall permanently erase that copy once the applicable limitation periods have expired.

5. CONTROLLER OBLIGATIONS

The Customer shall:

a) Make available to ELEVA AI the Personal Data referred to in Clause 2 of this DPA.

b) Determine the purposes and legal bases applicable to the processing, determine the Personal Data and data sources made available to ELEVA AI, configure the functionalities, integrations and channels enabled for the Service, define any required legal notices and consent or authorisation mechanisms, and determine the recipients or destination systems of Personal Data, and the legal notices, privacy and cookie policies and consent mechanisms applicable to End Users, including the information required under Articles 13 and 14 GDPR

c) Where required, carry out the data protection impact assessment for the processing operations to be performed by ELEVA AI.

d) Carry out any required prior consultations.

e) Ensure, before and throughout the processing, ELEVA AI’s compliance with the GDPR.

f) Supervise the processing, including through inspections and audits on the terms set out in Clause 4.o).

g) Handle the exercise of data-subject rights in respect of processing carried out under the Customer’s responsibility.

6. PROCESSING USING ARTIFICIAL INTELLIGENCE SYSTEMS

6.1. Exclusive purpose. Personal Data processed on behalf of the Customer through artificial-intelligence systems, tools or models (“AI Systems”), including Personal Data contained in Conversational Data and Form Data, shall be processed solely for the purposes of providing the Service in accordance with this DPA, the Main Agreement and the Customer’s documented instructions.

6.2. Model training. ELEVA AI shall not use Personal Data processed on behalf of the Customer under this DPA, including Conversational Data, Form Data, Consent Records, Customer Content or data originating from Customer Integrated Systems, in identifiable or pseudonymised form, for the training, fine-tuning, validation, evaluation or improvement of artificial-intelligence models, whether proprietary or third-party. Notwithstanding the foregoing, the Customer expressly authorises and instructs ELEVA AI to process such Personal Data for the purpose of generating effectively and irreversibly anonymised information, applying appropriate technical and organisational safeguards to prevent the identification or re-identification of individuals. Once effectively anonymised, so that no individual is identified or reasonably identifiable, such information shall no longer constitute Personal Data and ELEVA AI may use it for analytics, aggregated reporting, Service improvement and the development, training, validation, fine-tuning or optimisation of its own artificial intelligence systems and models. ELEVA AI shall not attempt to identify or re-identify any individual from such anonymised information

6.3. Model providers. Where AI System providers participate in the processing, ELEVA AI shall procure their services on terms excluding use of Personal Data processed under this DPA to train or improve the providers’ own models and shall provide evidence of those terms at the Customer’s request. Any providers involved are identified in Schedule II.

6.4. Separation between customers. ELEVA AI implements logical-separation measures preventing data processed on behalf of the Customer from being accessible from another ELEVA AI customer environment, using customer identifiers, access controls and segregation at application and database level. ELEVA AI shall not cross-reference or combine the Personal Data processed on behalf of the Customer under this DPA with Personal Data of other customers.

6.5. Information about systems used. The AI Systems and providers involved in the processing are identified in Schedule II. Any material modification shall be notified to the Customer at least thirty (30) calendar days in advance, on the terms set out in Clause 4.e).

7. INTERNATIONAL DATA TRANSFERS

7.1. Where, for the provision of the services covered by this DPA, ELEVA AI uses technology infrastructure, cloud services or third-party tools involving the processing of personal data outside the European Economic Area (“EEA”), the following conditions shall apply.

7.2. Prior notice. Before commencing any international transfer, ELEVA AI shall inform the Customer of the destination country, recipient entity and legal basis supporting the transfer under Chapter V GDPR. Transfers in place on the date of signature are identified in Schedule II.

7.3. Appropriate safeguards. Every international transfer shall be covered by one of the safeguards provided for in the GDPR, including an adequacy decision of the European Commission, Standard Contractual Clauses, Binding Corporate Rules or another mechanism recognised by the competent supervisory authority. ELEVA AI shall provide documentary evidence of such safeguards at the Customer’s request and, where required, shall carry out the corresponding transfer impact assessment.

7.4. Liability for sub-processors. Where an international transfer takes place through a sub-processor, ELEVA AI shall remain fully liable to the Customer for compliance with the obligations set out in this Clause, in accordance with Clause 4.e).

7.5. Documentary record. ELEVA AI shall keep an up-to-date record of international transfers made, stating the destination countries, recipient entities and safeguards applied, and shall make it available to the Customer upon request, on the terms set out in Clause 4.o).

8. GOVERNING LAW AND JURISDICTION

This DPA is governed by Spanish law. The Parties, expressly waiving any other jurisdiction to which they may be entitled, submit to the Courts of the city of Barcelona for the resolution of any dispute arising from this DPA, consistently with Clause 16.1 of the Main Agreement.

Schedule I - Technical and Organisational Security Measures

• Role-based access control (least privilege); MFA for administrative access to production; secrets management with no credentials in code; revocation upon staff departures.

• Encryption in transit (TLS 1.2+), at rest and for backups.

• Logical data separation by customer; separation of development and production environments; secure retention and deletion in accordance with the Agreement and End Customer instructions.

• Regular automated backups; high-availability and redundant cloud infrastructure.

• Event and access logging; availability monitoring and alerts.

• Version control and code review; vulnerability management; controlled deployments with rollback.

• Written confidentiality commitments for personnel with access to personal data.

Schedule II - Sub-processors and International Transfers

The processing of personal data carried out via WhatsApp Business and other channels integrated with the Platform shall be covered by this Agreement where ELEVA AI acts on behalf of the Client. The legal status of the providers of such channels shall be determined in accordance with the applicable contractual relationship and the functions actually performed by each of them.