Data Processing Addendum

Last updated: October 23, 2026

This Data Processing Addendum (the "Addendum") forms part of the Dobletilde Terms of Service and the applicable Commercial Proposal between CODE54 S.A. ("Code54", "we", "us") and the Customer. It applies where Code54 processes Customer Data that is personal data on the Customer's behalf.

If this Addendum conflicts with the Terms on processing Customer Data, this Addendum prevails. It does not amend payment obligations, liability limitations, or other commercial terms in the Terms unless the parties expressly agree in writing.

1. Roles and definitions

The Customer is the controller of Customer Data. Code54 is the processor and processes that data solely on the Customer's behalf. Each party retains its own role for data it processes for its independent and legitimate purposes; for example, Code54 is controller for operator-account and billing data.

"Customer Data" means messages, orders, catalogues, attachments, metadata, and other information that the Customer uploads, receives, or makes available through Dobletilde. "Applicable Law" means data-protection law applicable to the processing, including Argentine Law No. 25,326 and, where applicable, the GDPR.

2. Instructions, subject matter, and duration

Code54 will process Customer Data only under the Customer's documented instructions, including the Terms, Commercial Proposal, service configuration, and instructions from authorized contacts. Instructions must be lawful. If Code54 considers an instruction to breach Applicable Law, it will notify the Customer unless law prohibits it.

The subject matter, duration, nature, purposes, categories of data, and data subjects are described in Annex I. Processing lasts while the service is provided and for the limited export, deletion, and backup periods in the Privacy Policy, unless law requires longer retention.

3. Code54's obligations

Code54 will:

• process Customer Data only to provide, maintain, and secure Dobletilde, and not sell it or use it for advertising, its own commercial profiling, or training its own models;
• ensure that people authorized to process Customer Data are bound by confidentiality obligations;
• implement technical and organizational measures appropriate to risk, including the measures described in Annex II;
• not disclose Customer Data to third parties except as permitted by the Customer's instructions, this Addendum, or a legal obligation. Where a legal obligation requires disclosure, Code54 will notify the Customer before doing so unless law prohibits it;
• maintain reasonable records of processing it performs for the Customer where Applicable Law requires; and
• notify the Customer if it receives a request from an authority or data subject relating to Customer Data, unless law prohibits it, and not respond on the Customer's behalf unless instructed in writing or required by law.

4. Security and incidents

Code54 will implement appropriate technical and organizational measures to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Measures may evolve with technological development, provided that the overall level of protection is not materially reduced during the service term.

If Code54 becomes aware of a Customer Data breach, it will notify the Customer without undue delay and, where feasible, within 48 hours. The notice will include available information about the nature of the incident, data and data subjects potentially affected, likely consequences, and measures taken or planned. Code54 will reasonably cooperate with the Customer to investigate, mitigate, and meet notification obligations. The Customer decides whether it must notify an authority or data subjects unless law directly requires Code54 to do so.

5. Subprocessors

The Customer generally authorizes Code54 to engage the subprocessors listed in Annex III to deliver the service. Code54 will bind each subprocessor by contract to data-protection obligations substantially equivalent to this Addendum and remains responsible to the Customer for those subprocessors' performance to the extent required by Applicable Law.

Before adding or replacing a subprocessor that is a material change, Code54 will give the Customer at least 30 days' prior notice by email or through the subprocessor page, unless an urgent security need or legal obligation requires less notice. The Customer may object in writing during that period on reasonable, substantiated data-protection grounds. The parties will work in good faith to find a solution. If they cannot, the Customer may stop using the affected part of the service or terminate it without penalty; prepaid fees for that part will be refunded on a pro-rata basis where appropriate.

6. Assistance to the Customer

Taking account of the nature of the processing and the information available, Code54 will reasonably assist the Customer to:

• respond to requests for access, correction, deletion, objection, portability, restriction, or other data-subject rights;
• carry out impact assessments, prior consultations, or equivalent obligations where necessary; and
• demonstrate compliance with security obligations and manage incidents.

Assistance that reasonably exceeds the service's ordinary functions may be subject to a fee agreed in good faith, unless Applicable Law requires otherwise.

7. International transfers

The Customer acknowledges that use of Dobletilde may require Code54 or its subprocessors to process Customer Data outside Argentina, including in the United States or European Union. Code54 will apply the contractual, organizational, and technical safeguards required by Applicable Law.

Where the GDPR applies and a transfer requires additional mechanisms, the parties will incorporate the European Commission's current standard contractual clauses and the applicable module, together with necessary supplementary measures. If the Customer needs a UK or other country-specific addendum, the parties will agree it in good faith where applicable.

8. Audits and compliance information

Once per year, or more often where there is a reasonable incident- or authority-related basis, the Customer may request reasonable information to verify compliance with this Addendum. Code54 may meet the request with questionnaires, certifications, independent audit summaries, or equivalent documentation.

If that information is not reasonably sufficient, the Customer may conduct a remote or on-site audit on at least 30 days' notice, during business hours, without undue interference with the service, and subject to confidentiality obligations. The parties will agree the scope in good faith, and the Customer will bear its own costs. Code54 may limit an audit to protect other customers' data, trade secrets, and systems security.

9. Return and deletion

During the service and within 30 days after termination, the Customer may request an export of Customer Data available in Dobletilde. Code54 will then delete or anonymize Customer Data from active systems within the following 30 days. Backups will be deleted or overwritten in the ordinary backup cycle, which does not exceed 90 days after deletion from active systems.

Code54 may retain data where necessary to meet a legal obligation, handle a documented dispute, or protect service security and integrity. In that case, it will keep the data protected and process it only for that purpose.

10. Customer responsibilities

The Customer represents that it has a valid legal basis for processing Customer Data, that its instructions are lawful, and that it has provided required notices and obtained required consents. The Customer will not instruct Code54 to process sensitive data or children's data unless it is strictly necessary, permitted by Applicable Law, and protected by appropriate heightened measures.

The Customer is responsible for managing access by its Operators, securely configuring its integrations and destinations, and responding to data subjects regarding Customer Data.

11. Term and contact

This Addendum takes effect when the Customer accepts the Terms or uses Dobletilde and remains in effect while Code54 processes Customer Data. Questions about this Addendum may be sent to contact@dobletilde.com.

Annex I — Processing details

Annex II — Security measures

As appropriate to the service and the risk, Code54 maintains measures such as:

• encryption in transit using HTTPS and encryption at rest for sensitive credentials, including WhatsApp access tokens;
• per-operator access controls, authentication through sign-in providers, and permission review;
• logical separation of data between Customers through tenancy controls and row-level security;
• activity and error logging, reasonable monitoring, and incident-management procedures;
• development, change-management, and backup practices designed to preserve service availability and integrity; and
• confidentiality obligations for authorized people and reasonable subprocessor assessment.

Annex III — Authorized subprocessors