1. Roles of the parties
For personal data contained in Customer Data, the Customer is the controller (responsable; “business” under the CCPA) and ARCII México, Inc. is the processor (encargado; “service provider” under the CCPA). Where the Customer is itself a processor for a third party, we act as its sub-processor.
This DPA reflects the requirements of Article 28 of the GDPR and the UK GDPR, the processor obligations of Mexico’s LFPDPPP and its regulations, the service-provider requirements of the CCPA and equivalent provisions of other applicable data-protection laws. Capitalized terms not defined here have the meaning given in the Terms of Service or the applicable law.
2. Processing on documented instructions
We process personal data only to provide BitOne and related support, in accordance with the Customer’s documented instructions. The Terms, this DPA and the Customer’s configuration and use of BitOne constitute those instructions. We will inform the Customer if, in our opinion, an instruction infringes applicable law, and we will not process the data for our own purposes, sell or share it (as defined in the CCPA), or combine it with data from other sources, except as permitted by law.
3. Details of the processing
| Subject matter and duration | Provision of the BitOne platform for the term of the subscription plus the post-termination retention period in Section 10. |
| Nature and purpose | Hosting, storage, organization, retrieval, display, transmission (including e-mail delivery of documents for signature), backup and deletion of data as needed to provide BitOne. |
| Categories of data subjects | The Customer’s Authorized Users, customers, prospects, suppliers, employees and document signers or recipients. |
| Categories of personal data | Identification and contact data; tax identification numbers; commercial and transaction data; employment, attendance and payroll data; signatures and signature audit data (IP address, device, timestamps); any other data the Customer chooses to upload. |
| Sensitive data | Not required by BitOne. If the Customer chooses to process it (for example health information in HR records), the Customer is responsible for having a legal basis and informing us of any special requirement. |
4. Confidentiality of personnel
We ensure that personnel authorized to process personal data are bound by confidentiality obligations, receive appropriate training and access the data only to the extent necessary for their role.
5. Security measures
We implement and maintain appropriate technical and organizational measures, taking into account the state of the art, costs and risks, including:
- encryption of data in transit (HTTPS/TLS) and hashing of passwords;
- logical isolation of each customer company’s data (multi-tenant scoping applied to every query);
- role-based access control inside BitOne and least-privilege access for our personnel;
- password policies, session protection and protection against cross-site request forgery;
- tamper-evident audit trails and SHA-256 document fingerprints in the electronic-signature module;
- regular backups, security updates and monitoring of our infrastructure;
- incident-response procedures.
We may update these measures as long as the overall level of security is not reduced.
6. Sub-processors
The Customer gives general authorization for us to engage sub-processors, including companies of Grupo ARCII, and providers of application hosting, content delivery and network security, and transactional e-mail delivery. We will (a) bind each sub-processor by written contract to data-protection obligations no less protective than this DPA, (b) remain liable for their performance, and (c) provide an up-to-date list on request to [email protected].
We will give at least 15 days’ notice of any new sub-processor. The Customer may object on reasonable data-protection grounds; if we cannot reasonably accommodate the objection, the Customer may terminate the affected Services and receive a prorated refund of prepaid fees for the unused period.
Mercado Pago processes payment data as an independent controller and is not a sub-processor of Customer Data.
7. Assistance to the Customer
Taking into account the nature of the processing, we will assist the Customer through appropriate measures — largely the self-service features of BitOne (viewing, editing, exporting and deleting records) — to respond to data-subject requests (including ARCO rights in Mexico), and with data-protection impact assessments and prior consultations where required. If we receive a request directly from a data subject concerning Customer Data, we will redirect it to the Customer and not respond ourselves unless legally required.
8. Personal data breaches
We will notify the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. We will cooperate so that the Customer can meet its own notification obligations (for example the 72-hour notice to supervisory authorities under the GDPR and the notification to data subjects required by the LFPDPPP).
9. International transfers
Customer Data may be processed in Mexico, the United States and other countries where we or our sub-processors operate. Where the GDPR applies to the transfer, the parties agree to the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module Two, controller-to-processor, or Module Three, processor-to-processor, as applicable), which are incorporated by reference, with Clause 7 (docking clause) included, option 2 of Clause 9 (general authorization), the optional language of Clause 11 excluded, and the law and courts of Ireland chosen for Clauses 17 and 18. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum applies. Annexes I and II of the Clauses are completed by Sections 3 and 5 of this DPA.
10. Return and deletion
During the subscription the Customer can export its data from BitOne. After termination we retain Customer Data for 90 days to allow reactivation or export, and then delete it from active systems; backup copies are overwritten in the ordinary backup cycle. We will not delete data we are legally required to retain, which will remain protected by this DPA. On request, we will confirm deletion in writing.
11. Information and audits
We will make available the information reasonably necessary to demonstrate compliance with this DPA, primarily through written responses to security questionnaires and relevant documentation. Where that is insufficient or a supervisory authority requires it, the Customer may conduct an audit no more than once a year, with at least 30 days’ notice, during business hours, at its own cost, by an independent auditor bound by confidentiality, and without accessing data of other customers.
12. U.S. state law terms
To the extent the CCPA or similar U.S. state laws apply, we will: process personal information only for the business purposes specified in this DPA; not sell or share it; not retain, use or disclose it outside our direct business relationship with the Customer; comply with those laws and provide the same level of privacy protection they require; and notify the Customer if we can no longer meet our obligations. The Customer may take reasonable steps to stop and remediate unauthorized use.
13. Liability and precedence
Each party’s liability under this DPA is subject to the limitations of liability in the Terms of Service, except where applicable law does not permit such limitation. In case of conflict, the Standard Contractual Clauses (where applicable) prevail over this DPA, and this DPA prevails over the Terms of Service with respect to the processing of personal data.
14. Signed copy
This DPA is effective without signature upon acceptance of the Terms of Service. Customers who require a countersigned copy for their records may request one at [email protected].