1. 1. Subject
Databilidad, S.L. (processor) processes on behalf of the customer (controller) the personal data needed to provide Origen Visible: publishing product pages, managing products, batches and documents, connecting to the customer's business software, sending notices and producing visit statistics.
2. 2. Data and people concerned
Depending on how the customer uses the service:
- The customer's users: name, e-mail, phone, business and access logs.
- Customers, suppliers and business contacts the customer uploads or connects: name, business, e-mail, phone and order or batch data.
- People named in documents or certificates the customer uploads.
- Visitors to public pages: technical visit data and approximate location, without identifying the person.
3. 3. Duration
For as long as the plan is active. When it ends, the customer can download their data. Databilidad deletes it when the customer deletes the account, or within 30 days of a request, except data a law requires to be kept, which is blocked.
4. 4. Databilidad's obligations
Databilidad undertakes to:
- Process the data only on the customer's documented instructions, which are these terms and what the customer configures in the app. It will say so if an instruction seems unlawful.
- Ensure that people authorised to process the data are bound by confidentiality.
- Apply appropriate security measures (GDPR art. 32): encryption in transit, per-person and per-business access control, audit logs, daily backups and automatic security updates.
- Help the customer answer data subjects' rights (access, rectification, erasure, objection, restriction and portability).
- Notify the customer without undue delay, and within 48 hours at the latest, of any security breach affecting their data, with the information available so the customer can report it.
- Help the customer with the impact assessments and prior consultations that fall to them.
- Make available the information needed to demonstrate compliance and allow reasonable audits with prior notice.
5. 5. Sub-processors
The customer authorises Databilidad to use these sub-processors, under contracts imposing the same data protection obligations:
Databilidad will give at least 30 days' notice of any change of sub-processors. The customer may object and, failing agreement, cancel at no cost.
- netcup GmbH (Germany): hosting of the server and backups, in the European Union.
- Cloudflare, Inc.: content delivery and site protection. This may involve transfers to the United States, covered by the EU-US Data Privacy Framework and standard contractual clauses.
- Google Ireland Limited: sending the service's e-mails (notices and reports). This may involve transfers covered by the same Framework and standard contractual clauses.
6. 6. Customer's obligations
The customer warrants that it has a legal basis for the data it uploads or connects, informs the people concerned and does not upload special categories of data.
7. 7. Liability
Each party is liable for the breaches attributable to it under GDPR article 82.