Data Processing Addendum (DPA)
Last updated: October 21, 2026
This Data Processing Addendum governs the processing of personal data carried out by AutoLatam on behalf of the Customer, pursuant to Article 28 of the General Data Protection Regulation (GDPR).
1. Parties and purpose
This addendum is entered into between the Customer (data controller) and AutoLatam (data processor), located at Av. Eng. Duarte Pacheco, 1070-103 Lisbon, Portugal. Its purpose is to govern the processing of personal data performed by AutoLatam within the scope of the contracted automation services.
2. Scope and duration
It applies to all services contracted with AutoLatam for the duration of the main agreement. Confidentiality and data protection obligations survive termination until the complete deletion of the processed data.
3. Nature, purpose, and data categories
Processed data includes contact details of the Customer's leads and customers (name, email, phone), conversation content, and documents processed by the automations. The purpose is limited to delivering the contracted services. No special categories of data will be processed unless expressly agreed in writing.
4. Processor obligations
AutoLatam will process data only according to the Customer's documented instructions, ensure personnel confidentiality, apply appropriate technical and organizational measures, assist with data subject rights requests, and notify any security breach within a maximum of 72 hours. Upon termination, data will be deleted or returned at the Customer's choice.
5. Security measures
Encryption in transit (TLS) and at rest, least-privilege access, access logging, and a policy of not storing personal data in application logs. Infrastructure runs on Google Cloud with ISO 27001 and SOC 2 certifications.
6. Subprocessors
The Customer authorizes the use of the following subprocessors: Google Cloud (hosting, European Union), FormSubmit (contact forms), and the AI model providers configured in each solution (Azure OpenAI or Google Vertex AI). AutoLatam will notify any addition or replacement at least 14 days in advance, during which the Customer may raise reasoned objections.
7. International transfers
Data is hosted and processed primarily in the European Union (europe-west1 region). Any transfer outside the European Economic Area will be covered by European Commission standard contractual clauses or another valid transfer mechanism under the GDPR.
8. Data subject rights
AutoLatam will provide reasonable assistance to the Customer in responding to access, rectification, erasure, restriction, portability, and objection requests, within the applicable legal deadlines.
9. Audit and documentation
AutoLatam will provide the information reasonably necessary to demonstrate compliance with this addendum. On-site audits may be conducted with 30 days' notice, at most once per year, except in the case of a justified security incident.
10. Governing law and jurisdiction
This addendum is governed by Portuguese law and the GDPR. Any dispute shall be submitted to the courts of Lisbon, Portugal.
To request a signed copy of this addendum or raise data-processing questions, write to contacto@auto-latam.com