Data Processing Agreement

1. Parties and Roles

This Data Processing Agreement ("DPA") governs the processing of personal data by Apolaris AI, provided by Apolaris AI S.L., a company established in Spain (APOLARIS AI S.L., Tax ID (NIF) B05659628, C/Ana Maria 33, 33209 Gijon, Asturias, Spain) ("Apolaris AI", "we", "us"), on behalf of the business customer that uses the Apolaris AI platform ("Customer", "you"). It forms part of, and is incorporated into, the agreement under which the Customer subscribes to the Apolaris AI services available at apolaris.net and its subdomains (app.apolaris.net, portal.apolaris.net, docs.apolaris.net and support.apolaris.net) (the "Services").

For personal data that the Customer manages inside the platform — including the Customer's own end-customers, employees and business records — the Customer is the data controller and Apolaris AI acts as the data processor. Apolaris AI processes that data only to provide the Services, on the Customer's behalf and under its instructions.

Apolaris AI acts as an independent data controller in its own right, and not as the Customer's processor, for a limited set of data: the apolaris.net marketing website, sales leads, and the Customer's own account and billing data. The handling of that data is governed by the Apolaris AI Privacy Notice rather than by this DPA.

This DPA is designed to satisfy the EU General Data Protection Regulation (GDPR) and the ePrivacy framework, Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP, 2026 framework) including ARCO rights, and the transparency duties of Article 50 of the EU AI Act. Where the Customer or its data subjects are in the EU/EEA, the GDPR applies and those rights are preserved in full; where they are in Mexico, the LFPDPPP applies. The terms "personal data", "data subject", "processing", "controller", "processor", "sub-processor" and "personal data breach" carry the meaning given to them under the applicable law.

2. Subject-Matter, Duration, Nature and Purpose of Processing

Subject-matter. Apolaris AI processes personal data submitted to, or generated within, the Services by the Customer and its authorised users in order to deliver the platform's functionality.

Nature and purpose. The processing consists of the operations needed to operate a multi-tenant SaaS platform for service and retail businesses, namely: appointment booking and calendar management, with online booking pages; point of sale and payment processing; inventory and supply management; HR and payroll; customer CRM and a loyalty program; an omnichannel WhatsApp contact centre (via the Meta WhatsApp Cloud API or a WAHA gateway) with an AI agent answering customer messages; voice telephony with an AI voice agent, including call recording and transcription; customer-journey marketing automation across email, SMS and WhatsApp, with opt-out (STOP-word) suppression; AI-assisted security cameras and computer vision (event detection, people counting, attendance); an AI copilot; analytics and a data explorer; competitor intelligence (map-based discovery of nearby businesses from public map sources such as OpenStreetMap or, optionally, Google Places, with an AI advisor); a public website builder hosting the Customer's marketing site on platform subdomains or custom domains; an optional Consents & Clinic History module (signed consent documents and clinical/treatment history); multi-site and franchise management; and access to a token-authenticated REST API. Processing also includes AI-assisted automations that, on scheduled rules or real-time business events and subject to manager approval, can trigger outward actions such as emails to the Customer's end-customers, contact-centre messages, webhook POSTs to external systems, and manager tasks. It further includes optional SMS notifications and two-factor-authentication (OTP) delivery through our SMS carrier, OVHcloud, where the Customer enables SMS features. The purpose is strictly to provide, maintain, secure and support these features for the Customer.

Duration. Processing continues for the term of the subscription agreement and for any wind-down, return or deletion period described in Section 11. Apolaris AI will not retain personal data longer than necessary for these purposes or as required by applicable law.

Deployment. The Services are provided as a managed service from infrastructure owned and operated by Apolaris AI in Spain (see the Hosting statement in the Annex). On-premise (self-hosted) deployment is offered only to large enterprise customers and is subject to review and approval by Apolaris AI. Where a customer is approved to self-host, the customer controls the hosting infrastructure and is responsible for its security and availability; Apolaris AI's obligations under this DPA apply to the components and processing it actually performs in that configuration.

3. Categories of Personal Data and Data Subjects

Categories of data subjects may include: the Customer's end-customers and prospects; the Customer's employees, staff and contractors; the Customer's authorised platform users and administrators; and individuals who interact with the Customer through the contact centre or who appear in camera footage.

Categories of personal data may include:

• Account and business data, and authorised-user credentials and roles. Where an authorised user enables passkey sign-in, Apolaris AI stores only a public-key credential and technical metadata; the user's biometric is verified on their own device and is never transmitted to or stored by Apolaris AI, which processes no biometric data through this feature;
• End-customer personal data: names, contact details, and booking and purchase history — which may include client records created automatically from inbound contact-centre conversations, and AI-generated memory notes summarising a client's stated preferences to personalise the AI booking agent;
• Employee and HR data, including payroll information;
• Payment metadata. Card data processing is delegated to the payment providers; Apolaris AI does not store full card numbers;
• WhatsApp, SMS and other messaging content exchanged through the contact centre and through journey automations;
• Optional camera footage and derived events (for example people counting and attendance), where the Customer enables the cameras module;
• Call recordings and transcripts from the voice-telephony module, including calls handled by the AI voice agent, where the Customer enables voice features;
• Website-builder content and the enquiries visitors submit through the Customer's public website or online booking pages;
• AI prompts, queries and the content the Customer submits to AI features;
• Optional SMS phone numbers for notification/authentication delivery, where the Customer enables SMS features;
• Health data — a special category of personal data (Article 9 GDPR) — where the Customer enables the Consents & Clinic History module: signed consent documents with signature evidence, clinical and treatment history, allergies, medications, treatment notes, patch-test results and clinical photographs. The Customer, as controller, carries the Article 9 basis for this processing, in particular the data subject's explicit consent (Article 9(2)(a)) and, where applicable, the provision of health or care (Article 9(2)(h)).

Other than through the Consents & Clinic History module, the Services are not designed to process special categories of data or sensitive personal data, and the Customer should not submit such data except where a feature is expressly intended for it and the Customer has a lawful basis to do so. The Customer determines what personal data it places into the platform and is responsible for having a valid legal basis and, where required, for issuing the appropriate aviso de privacidad to its data subjects.

4. Processor Obligations

Processing only on documented instructions. Apolaris AI processes the Customer's personal data only on the Customer's documented instructions, including with regard to international transfers, unless required to act otherwise by a law to which it is subject. The subscription agreement, this DPA, the configuration choices the Customer makes in the platform, and the Customer's use of the Services constitute its documented instructions. If Apolaris AI believes an instruction infringes applicable data protection law, it will inform the Customer.

Confidentiality. Apolaris AI ensures that persons authorised to process the personal data are bound by an appropriate duty of confidentiality and access the data only as needed to perform their duties.

Security (GDPR Article 32). Apolaris AI implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art and the nature of the data. These measures include:

• Strict per-tenant data isolation so that one Customer's data is not accessible to another;
• Encryption of personal data in transit;
• Role-based access control with an activity audit log, and the principle of least privilege for personnel access;
• At-rest encryption of the clinical files of the Consents & Clinic History module with a dedicated key;
• A per-employee privilege model and branch-level (site) access scoping, so that users reach only the records of the locations they are entitled to see;
• Append-only consent records sealed with SHA-256 hash fingerprints and signature-evidence metadata, with access and changes recorded in the audit log;
• Hardened sign-in using an offline arithmetic challenge, a honeypot and failed-attempt throttling, with no third-party CAPTCHA, CDN trackers or external profiling;
• Optional two-factor authentication and passkey (WebAuthn) sign-in available to the Customer's users, with biometrics verified on-device and only public keys stored;
• Measures to support the ongoing confidentiality, integrity, availability and resilience of the Services, and to restore availability after an incident.

The Customer is responsible for the security of the choices within its control, including managing its users and roles, enabling two-factor authentication, safeguarding API tokens, and securing its own infrastructure in a self-hosted deployment.

AI transparency. Where a feature uses AI or automated processing — including the AI chatbot and booking agent, the AI copilot, and any biometric or attention/emotion analysis in the cameras module — Apolaris AI provides the means for these interactions to be disclosed to data subjects in line with Article 50 of the EU AI Act and the LFPDPPP requirement to explain automated decision-making and whether a human is involved. The Customer remains responsible for the lawful, transparent and fair deployment of these features, for informing its data subjects, and for not enabling biometric or emotion-recognition functionality where prohibited or where it lacks a lawful basis.

5. Sub-Processing

The Customer provides a general authorisation for Apolaris AI to engage sub-processors to help deliver the Services. The current sub-processors and the purpose of each are listed in the Annex.

Customer-connected providers. Where the Customer connects its own account with a third-party service to the platform — for example its own SMS or telephony carrier account on the Channels screen, its own Meta WhatsApp Business account, its own email relay, its own Stripe or Mercado Pago account, or a third-party scheduling, marketplace or calendar tool synchronised with the platform — that provider is engaged by the Customer directly under the Customer's own agreement with it. Such a provider acts as the Customer's processor (or as an independent controller), not as a sub-processor of Apolaris AI, and the Customer is responsible for the lawfulness of that arrangement.

When Apolaris AI engages a sub-processor, it imposes data protection obligations on that sub-processor that are no less protective than those in this DPA, in particular regarding security under Article 32. Apolaris AI remains fully liable to the Customer for the performance of its sub-processors' obligations.

Change notification. Apolaris AI will give the Customer prior notice of any intended addition or replacement of a sub-processor, giving the Customer a reasonable opportunity to object on reasonable data protection grounds. If the Customer objects and the parties cannot agree on a resolution, the Customer may, as its remedy, cease using the affected feature or terminate the affected part of the Services.

6. Assisting with Data-Subject Requests

Taking into account the nature of the processing, Apolaris AI assists the Customer by appropriate technical and organisational measures, insofar as possible, to fulfil the Customer's obligation to respond to requests from data subjects exercising their rights. This includes the GDPR rights of access, rectification, erasure, restriction, portability and objection, and the Mexican ARCO rights (Acceso, Rectificación, Cancelación, Oposición), as well as rights relating to automated and AI-assisted decision-making.

The platform's access, search, export and deletion tools allow the Customer to locate, correct, export and delete the personal data it controls. If a data subject contacts Apolaris AI directly about data the Customer controls, Apolaris AI will, where lawful, refer the request to the Customer rather than respond on the Customer's behalf. EU/EEA data subjects retain the right to lodge a complaint with their local supervisory authority or, as Apolaris AI is established in Spain, with the Spanish Agencia Española de Protección de Datos (AEPD), and Mexican data subjects may contact INAI.

7. Personal-Data-Breach Notification

Apolaris AI notifies the Customer without undue delay after becoming aware of a personal data breach affecting personal data processed on the Customer's behalf. The notification will, to the extent known, describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed to address it and mitigate its effects, and a contact point for further information. Apolaris AI will provide further details as they become available and will reasonably cooperate with the Customer's own breach-handling and regulatory-notification obligations. This notification does not in itself constitute an admission of fault or liability.

8. Assistance with DPIAs and Prior Consultation

Taking into account the nature of the processing and the information available to it, Apolaris AI provides the Customer with reasonable assistance in carrying out data protection impact assessments (DPIAs) and, where required, in conducting prior consultation with the competent supervisory authority — for example in connection with the cameras and computer-vision module or AI-assisted decision-making features.

9. International Transfers

Apolaris AI is established in Spain and provides the Services from Spain to the European Union, Mexico and other markets, and its sub-processors and hosting may involve processing in other countries. Apolaris AI transfers personal data internationally only in accordance with the Customer's instructions and applicable law. Where personal data originating in the EU/EEA is transferred to a country without an adequacy decision, the transfer is protected by an appropriate safeguard, such as the European Commission's Standard Contractual Clauses (SCCs), together with any supplementary measures the circumstances require. For data subject to the LFPDPPP, transfers are made consistently with the Mexican framework and the applicable aviso de privacidad. The Annex identifies the sub-processors involved in such processing.

10. Audit and Inspection Rights

Apolaris AI makes available to the Customer the information reasonably necessary to demonstrate compliance with this DPA and the processor obligations under applicable law, and allows for and contributes to audits, including inspections, conducted by the Customer or an independent auditor it mandates.

To protect the security and confidentiality of Apolaris AI's multi-tenant environment and other customers' data, audits are conducted on reasonable prior notice, no more than once per year except where required by a supervisory authority or following a material security incident, during business hours, in a manner that does not unreasonably disrupt operations, and subject to confidentiality obligations. Where available, Apolaris AI may satisfy an audit request by providing relevant documentation and responses to a reasonable security questionnaire.

11. Return and Deletion of Data on Termination

On termination or expiry of the Services, and at the Customer's choice, Apolaris AI returns the Customer's personal data to the Customer and/or deletes it, and deletes existing copies, unless retention is required by applicable law. The platform's export tools allow the Customer to retrieve its data before deletion. Statutory clinical-record retention (in Spain, Law 41/2002 — at least five years; in Mexico, NOM-004-SSA3-2012 — five years) overrides deletion instructions to the extent required by law (Article 17(3)(b) GDPR); records so retained remain protected under this DPA until the statutory period expires. On termination, the clinical archives of the Consents & Clinic History module are returned to the Customer or made available for export and are then deleted, subject to those statutory retention floors. Following the agreed wind-down period, Apolaris AI deletes or anonymises the personal data within its control, including from its sub-processors as applicable, except for data it must retain to comply with legal obligations, which remains subject to the confidentiality and security terms of this DPA for as long as it is held. In a self-hosted deployment, return and deletion of data residing on the Customer's own infrastructure are the Customer's responsibility.

12. Liability

Each party is responsible for its own compliance with applicable data protection law in respect of the role it performs under this DPA. The liability of each party arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the subscription agreement between the parties, and this DPA does not increase those limits beyond what that agreement provides. Nothing in this DPA limits any liability that cannot be limited or excluded under applicable law, including the rights of data subjects.

13. Governing Law and Contact

This DPA is governed by the laws of Spain, without regard to conflict-of-laws rules and without prejudice to mandatory data protection rights under the GDPR and the LFPDPPP. The Services are provided from Spain to customers in the European Union, Mexico and other markets. EU/EEA data subjects keep their GDPR rights and may complain to their local supervisory authority or the Spanish Agencia Española de Protección de Datos (AEPD); Mexican data subjects keep their rights under the LFPDPPP, including the ARCO rights, and may contact INAI. Questions about this DPA or about data processing can be sent to [email protected].

Annex — List of Sub-Processors

The following sub-processors support the delivery of the Services. The set actually engaged depends on the features the Customer enables and on whether the Customer self-hosts the platform or AI models.

Sub-processor	Purpose of processing
Stripe; PayPal	Payment processing and related transaction handling. Card data is processed by these providers; Apolaris AI does not store full card numbers.
Mercado Pago	Payment processing for the launch market and related transaction handling, on the same card-data basis as above.
Telnyx	Voice telephony carrier: telephone numbers, inbound and outbound calls and SIP trunking for the voice module, including the AI voice agent, call recording and transcription, where the Customer enables voice features. Where a Customer connects its own Telnyx messaging profile, Telnyx may also carry that Customer's SMS.
Meta Platforms / WhatsApp (via the WhatsApp Cloud API or a WAHA gateway)	Delivering and receiving messages in the omnichannel WhatsApp contact centre, including the AI agent.
AI infrastructure (self-hosted language, vision, speech-to-text and text-to-speech models on GPU infrastructure operated by or for Apolaris AI, currently located in Spain)	Powering AI features — the AI copilot, the AI agents for messaging and voice calls, analytics assistance and related processing of prompts and queries. Customer personal data is not sent to third-party AI cloud services; approved enterprise Customers may instead self-host the models on their own infrastructure.
OpenStreetMap (Nominatim and Overpass); Google Places API (optional)	Geocoding the Customer's site addresses and discovering nearby businesses for the competitor-intelligence feature. Only site locations and search parameters are sent; no end-customer, employee or messaging data is shared. Google Places is used only where the platform operator enables it.
Cloudflare	DNS, network, CDN, WAF and DDoS protection, and the secure tunnel through which the Services are published from our infrastructure to the internet, supporting availability, performance and protection of the Services.
OVHcloud (OVH SAS, France)	SMS carrier for notifications, reminders, journey messages and two-factor authentication (OTP) codes; email hosting and SMTP relay for transactional, notification and support email; domain-name registration for the Customer's websites and custom domains; and an EU (France) edge server that relays encrypted traffic to our infrastructure during network failover.
Tailscale	Private encrypted network (WireGuard) between Apolaris AI's own servers, its EU edge server and its backup destinations. Tailscale's coordination service exchanges device keys and connection metadata only; the traffic itself is end-to-end encrypted and is not readable by Tailscale.
Browser push services (Google, Apple or Mozilla, depending on the user's browser)	Delivering the push notifications that a Customer's staff opt into on their devices. Payloads are encrypted end-to-end (RFC 8291); the push service handles only an opaque subscription endpoint and encrypted bytes.

Hosting. The platform, its databases, uploaded files, AI models and backups run on servers owned and operated by Apolaris AI in Spain (European Union). No public-cloud hosting provider processes Customer personal data; encrypted backups are replicated only to other Apolaris AI-operated servers over the private network described above. In a self-hosted deployment, hosting is the Customer's own.