This Data Processing Agreement (“DPA”) is part of the terms contracted by the Client (the data controller for its end users' data) with Active Network Global SL (hereinafter, “InBoxIA” or the “Processor”), and governs the processing of personal data carried out by InBoxIA on behalf of the Client while providing the service, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).

1. Parties

Data Controller: the Client who contracts and uses the InBoxIA platform to manage its own business and its own end users.
Data Processor: Active Network Global SL, Tax ID (NIF) B93372217, C/ Decano Manuel Dominguez 12, 29140 Málaga, Spain — operator of inbox-ia.com and app.inbox-ia.com.

2. Subject matter, nature and purpose of processing

The Processor will process the personal data the Client enters or receives through the platform solely to provide the contracted service: managing AI agents, processing conversations through connected channels (WhatsApp, Instagram, Messenger and others), scheduling appointments, managing the knowledge base, Social Hub features, and any other functionality the Client activates. The Processor will not process the data for any purpose of its own or other than the one stated in this DPA and in the Privacy Policy.

3. Types of data processed

Identification and contact details of the Client's end users (name, phone number or messaging platform ID)
Conversation content: text messages and media files (photos, videos, audios, documents)
Appointment and calendar data managed by the AI agent on behalf of the Client
Business data configured by the Client itself (catalog, opening hours, knowledge base)
Technical conversation metadata (dates, statuses, tags)

The Processor does not determine which categories of data it receives from end users: these depend on what the Client and its users communicate through the connected channels.

4. Categories of data subjects

End users of the Client (customers, contacts or patients of the Client's business, depending on its activity)
Client staff authorized to use the platform (agents, account administrators)

5. Processor obligations (Art. 28 GDPR)

The Processor undertakes to:

Process data only on the Client's documented instructions, as reflected in the service configuration and in this DPA
Ensure that staff authorized to process the data are bound by confidentiality obligations
Implement the technical and organizational measures required by Article 32 GDPR (see section 8)
Assist the Client in responding to end users' requests to exercise their rights
Notify the Client without undue delay of any personal data breach it becomes aware of
Make available to the Client the information necessary to demonstrate compliance with these obligations, and allow and contribute to reasonable audits
Delete or return all personal data at the end of the provision of the service, unless required by law to retain it (see section 10)

6. Sub-processors

The Client gives general authorization for the Processor to engage the following sub-processors, necessary to provide the service, all bound by data protection obligations equivalent to those in this DPA:

OpenAI (USA) — natural language processing, image analysis and audio transcription
Groq (USA) — AI processing for the platform's internal support assistant
Stripe (USA) — payment processing and subscription management
Meta Platforms (USA) — integration with WhatsApp, Instagram, Messenger, Facebook Pages and Threads
Google (USA) — integration with Google Calendar, YouTube and Google My Business
TikTok, LinkedIn (Microsoft), X Corp., Pinterest, Reddit and other Social Hub platforms the Client voluntarily activates
PostHog (EU) — product analytics, instance hosted in the European Union
Hetzner Online GmbH (Germany, EU) — server hosting and infrastructure

The Processor will inform the Client of any intended change to this list with reasonable notice, giving the Client the opportunity to object. This list matches the provider list published in the Privacy Policy.

7. International transfers

Where a sub-processor is located outside the European Economic Area, the transfer is carried out under the European Commission's Standard Contractual Clauses and/or the EU-US Data Privacy Framework, as applicable to that provider.

8. Security measures

The Processor applies, among others, the following measures: password encryption (bcrypt), encrypted communications via HTTPS/TLS, JWT token-based authentication, encrypted storage of third-party tokens, and a fraud prevention system. Full detail is available in the Security section of the Privacy Policy.

9. Duration and fate of the data

This DPA remains in effect for as long as the contractual relationship between the Client and the Processor exists. Upon termination, the Processor will delete or return to the Client, at the Client's choice, all personal data processed on its behalf, unless a law requires retention (for example, tax obligations on payment data), in which case the data will be retained only for the applicable legal period and solely to comply with that obligation.

10. Liability

Each party is responsible for complying with its own obligations under the GDPR. The Processor will be liable for damage caused by processing that breaches the obligations of this DPA or the Client's lawful instructions.

11. Contact

For any questions about this Data Processing Agreement, you can write to agent@inbox-ia.com.