# Data Processing Agreement

**Version 1.1 · 23 October 2026** · Article 28 of Regulation (EU) 2016/679 (GDPR) and Article 33 of Spanish Organic Law 3/2018 (LOPDGDD).

This Agreement is the "Data Processing Agreement" referred to in clauses 11.2, 16.2 and 19.1 of the [Terms of Service](https://invokeapp.io/terms). It forms an inseparable part of them, is accepted when the service is purchased and prevails over them on data protection matters. If THE CLIENT needs a signed copy, it can request one at privacy@invokeapp.io. In case of discrepancy, the Spanish version prevails.

## 1. Parties and roles

- **INVOKEAPP:** MARTÍNEZ CAMPOY CONSULTING, S.L., Tax ID B88657853, Calle Roma, 15, 30600 Archena (Murcia), Spain, trade name InvokeApp. It acts as **processor** and, when the data belongs to an End Client of THE CLIENT, as **sub-processor**.
- **THE CLIENT:** the business or professional purchasing the service. It acts as **controller** of its own data and as **processor** of its End Clients' data.

Capitalised terms ("End Client", "Workspace", "Agent", "Output") have the meaning given in the Terms of Service.

## 2. Subject matter and duration

INVOKEAPP will process the personal data that THE CLIENT, its users or its End Clients enter, import, connect or generate in the platform, **only to the extent necessary to provide the contracted service**. The processing is described in Annex A.

This Agreement applies for the duration of the contract and, afterwards, during the export and deletion period of clause 13.

## 3. Instructions

1. INVOKEAPP will process the data only on THE CLIENT's documented instructions, including with regard to international transfers. Documented instructions are: the Terms of Service and this Agreement; the configuration THE CLIENT makes in the platform (Agents, connections, campaigns, retention periods); and written requests from its administrator users.
2. If INVOKEAPP considers that an instruction infringes data protection law, it will inform THE CLIENT immediately and may suspend its execution until it is confirmed or withdrawn.
3. If the law required INVOKEAPP to process the data differently, it will inform THE CLIENT beforehand, unless the law prohibits it.

## 4. Limited purpose

1. INVOKEAPP will not process the data for its own purposes or disclose it to third parties, except to the sub-processors of clause 7, to the third parties required by a feature THE CLIENT enables (listed in Annex C), to the recipients of internal technical alerts indicated, with their limitations, in Annex C, where required by law or to produce, under clause 10.3 of the Terms of Service, aggregated and anonymised technical metrics on the use of the service (volumes, response times and errors), without the content of the data and subject to the exclusion in paragraph 3. If it processed the data for any other purpose, it would become controller of that processing (Article 33.2 LOPDGDD).
2. INVOKEAPP will not use the data to train, fine-tune or improve artificial intelligence models, its own or third parties' (clause 10.3 of the Terms of Service).
3. **Data obtained from Google and Meta.** The right to process aggregated and anonymised data in clause 10.3 of the Terms of Service **does not apply** to data obtained through Google APIs (Gmail, Google Calendar and others) or the Meta platform (WhatsApp, Instagram, Facebook, Threads). That data is used only for the features the user sees in the platform, in accordance with the Google API Services User Data Policy (including its Limited Use requirements) and Meta's terms for Tech Providers.

## 5. Confidentiality and personnel

INVOKEAPP ensures, in accordance with Article 28.3.b GDPR, that the persons it authorises to process the personal data will have committed in writing to respect its confidentiality before accessing it, in addition to being bound by the duty of confidentiality in Article 5 LOPDGDD. INVOKEAPP will only give them access when they need it for their work and with least privilege, will inform them of their data protection obligations and will ensure that they process the data only on THE CLIENT's instructions. INVOKEAPP staff will not read the content of connected emails, messages or calendars unless THE CLIENT expressly asks for a specific case, for security purposes or where required by law. This duty of confidentiality survives termination of the contract and the end of each person's engagement with INVOKEAPP.

## 6. Security

INVOKEAPP applies the technical and organisational measures of Annex B (Article 32 GDPR), reviews them at least once a year and will not reduce the level of protection during the contract.

## 7. Sub-processors

1. THE CLIENT gives INVOKEAPP general authorisation to engage the sub-processors published at [invokeapp.io/subprocessors](https://invokeapp.io/subprocessors) (Annex C).
2. INVOKEAPP will notify any addition or replacement **thirty (30) calendar days in advance**. THE CLIENT may object in writing, on reasoned data protection grounds, within the following fifteen (15) days; if INVOKEAPP maintains the change, THE CLIENT may terminate without penalty (clause 16.3 of the Terms of Service).
3. INVOKEAPP will impose on each sub-processor, by contract, data protection obligations equivalent to those in this Agreement and remains liable to THE CLIENT for their compliance.
4. Where THE CLIENT acts on behalf of an End Client, it will identify INVOKEAPP as an authorised sub-processor in its own agreement with that End Client (clause 7.3 of the Terms of Service).

## 8. International transfers

The platform and its database are hosted in the European Union (Madrid). AI models run in the European Union (Belgium and, as a fallback for image generation, the Netherlands), except video generation (Veo, United States), which is only used if THE CLIENT enables it. Backups are stored in the European Union multi-region, and technical logs and platform secrets in Google Cloud's global location. Details are given in Annex C. INVOKEAPP will only transfer data outside the European Economic Area through the sub-processors and other recipients of Annex C or on THE CLIENT's instructions, and always with a Chapter V GDPR safeguard (an adequacy decision, including the EU-U.S. Data Privacy Framework, or standard contractual clauses), save for the exceptions indicated in Annex C, which do not yet have a safeguard in place. If a third-country authority requested access to the data, INVOKEAPP will notify THE CLIENT unless legally prohibited and disclose only the minimum required.

## 9. Data subject rights

1. If a data subject contacts INVOKEAPP, it will forward the request to THE CLIENT within **three (3) business days** at most and will not answer it unless instructed or in the case of paragraph 4.
2. INVOKEAPP will help THE CLIENT respond to requests for access, rectification, erasure, objection, restriction and portability, through the platform's features or, if they are not enough, by carrying out the requested action itself within **ten (10) business days** of the written instruction.
3. Opt-outs from commercial communications are kept on the suppression list so that the person is not contacted again (Article 21.3 GDPR).
4. Where the owner of a connected account (for example, an End Client that owns its WhatsApp Business or Google account) disconnects the account or asks for the data obtained from it to be deleted, THE CLIENT hereby authorises INVOKEAPP to carry this out as a documented instruction. INVOKEAPP will forward the request to THE CLIENT without delay.

## 10. Personal data breaches

1. INVOKEAPP will notify THE CLIENT, **without undue delay and at the latest within forty-eight (48) hours** of becoming aware of it, of any security breach affecting its personal data, by email to its administrators.
2. The notification will include, to the extent known and supplemented in phases: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point.
3. INVOKEAPP will cooperate so that THE CLIENT can notify the supervisory authority within 72 hours and, where applicable, the data subjects. INVOKEAPP will not notify on its own unless it has its own legal or contractual obligation or THE CLIENT so instructs.
4. Where an incident affects data obtained through Google APIs or the Meta platform, INVOKEAPP may notify Google or Meta in the manner and within the time limits their terms require, and will inform THE CLIENT accordingly.

## 11. Impact assessments and prior consultation

INVOKEAPP will provide THE CLIENT with the information about the processing, security measures, AI Agents and sub-processors it needs to carry out a data protection impact assessment and, where applicable, the prior consultation with the authority (Articles 35 and 36 GDPR).

## 12. Records of processing

INVOKEAPP keeps in writing the record of the processing activities it carries out as processor (Article 30.2 GDPR) and will make it available to the supervisory authority on request.

## 13. End of the service: return and deletion

1. After termination, THE CLIENT's data remains available for export for **thirty (30) calendar days** (clause 5.4 of the Terms of Service): THE CLIENT may request the export at privacy@invokeapp.io and INVOKEAPP will deliver it in a structured, commonly used format (CSV or JSON) within **ten (10) business days** at most. During the contract it may export from the platform the data the platform allows it to export and request the rest through the same channel (clause 10.5 of the Terms of Service).
2. After that period, INVOKEAPP will **delete** the data, including third-party connections and their credentials, within thirty (30) days at most. At the request of THE CLIENT or of the owner of the connected account, data obtained through Google APIs and the Meta platform is deleted within thirty (30) days of the request at most, without waiting for the export period. Backups are deleted according to their rotation cycle (Annex B). INVOKEAPP will issue a deletion certificate at THE CLIENT's request.
3. INVOKEAPP may keep, **blocked** and for no other use, the data strictly necessary to prove compliance with this Agreement while liabilities may arise (Article 33.4 LOPDGDD), and any data the law requires it to keep.

## 14. Information and audits

1. INVOKEAPP will make available to THE CLIENT the information necessary to demonstrate compliance with this Agreement and will answer, once a year, a security questionnaire within twenty (20) business days.
2. THE CLIENT, or an auditor bound by confidentiality, may audit compliance once a year (or after a security breach or at the request of an authority), with thirty (30) days' notice, during business hours, without access to other customers' data and at its own cost, unless a material breach by INVOKEAPP is found.
3. Regarding the sub-processors' infrastructure, INVOKEAPP will provide the reports and certifications it has; physical inspection of cloud providers' data centres is not possible.

## 15. Obligations of THE CLIENT

THE CLIENT: (a) has a legal basis for all processing it instructs and has informed data subjects (Articles 13 and 14 GDPR); (b) gives lawful instructions; (c) carries out the impact assessment where required; (d) does not enter into the platform, unless agreed in writing beforehand, special categories of data (Article 9 GDPR), criminal data, data of children under fourteen or full payment card data; (e) sets the retention periods for its data; (f) complies with the rules on commercial communications (Articles 20 to 22 LSSI and 23 LOPDGDD); and (g) passes this Agreement on to its End Clients.

## 16. Third-party channels (Google, Meta and others)

1. **Ownership.** The accounts THE CLIENT or its End Clients connect (WhatsApp Business, social pages and profiles, Google accounts) belong to the business that connects them. INVOKEAPP acquires no rights over them, and the business may disconnect them at any time.
2. **Platform rules.** THE CLIENT undertakes, and will require each End Client, to comply with the terms and policies of each channel provider, in particular the Meta Platform Terms, the Meta Terms for WhatsApp Business Platform, the WhatsApp Business Messaging Policy and the Google API Services User Data Policy, and not to process data obtained through those channels in breach of them.
3. **Recipients' consent.** WhatsApp messages will only be sent to people who have provided their number and agreed to receive them, and commercial emails only to contacts with a legal basis under Article 21 LSSI. THE CLIENT is responsible for proving it.
4. **Channel costs.** WhatsApp messages are billed by Meta directly to the business that owns the account. Neither INVOKEAPP nor THE CLIENT resells the WhatsApp platform or charges the cost of messages as its own.
5. **Restricted content.** WhatsApp will not be used to send or request health information, card data, bank account or identity document numbers, or for products and services restricted by Meta.
6. **Suspension.** INVOKEAPP will suspend access to a channel when its provider requires it or when there are reasonable signs of a breach of its policies, informing without delay.
7. **Provider communications.** INVOKEAPP will forward without delay to the business concerned any communication from the channel provider about data subjects' requests regarding their data.

## 17. Liability

Each party is liable to data subjects and authorities under Article 82 GDPR. Between the parties, clause 13 of the Terms of Service applies: INVOKEAPP is liable for damage caused by breaching the obligations the GDPR or this Agreement impose on it as processor or by acting outside THE CLIENT's lawful instructions; THE CLIENT, for damage resulting from its instructions, the lack of a legal basis or the unlawfulness of the data.

## 18. Contact

Data protection: privacy@invokeapp.io · Security and vulnerabilities: security@invokeapp.io.

---

## Annex A. Description of the processing

| Element | Description |
|---|---|
| Nature | Hosting, recording, organisation, consultation, import and export; sending and receiving messages and emails through the accounts THE CLIENT connects; scheduling and publishing content; appointment management; segmentation; lead scoring, rule-based or AI-assisted depending on the feature; AI-generated drafts, summaries and classifications; collection of data from public sources (websites, Google Maps Platform and Google's search engine) when THE CLIENT enables lead prospecting or enrichment; support; deletion |
| Purpose | Providing THE CLIENT with the InvokeApp platform service (CRM, AI Agents, integrations and business intelligence) under the Terms of Service |
| Data subjects | THE CLIENT's users; its customers, contacts and leads; its End Clients' customers, contacts and leads; people who write to its channels (WhatsApp, website chat, email) |
| Categories of data | Identification and contact data; professional data; commercial data (products, purchases, opportunities, notes); content of messages, emails and conversations; appointment data; legal basis, consents and opt-outs; derived data (segments, scores, AI Outputs); identifiers and encrypted credentials of connected accounts; user activity |
| Excluded data | Those in clause 15(d), unless agreed in writing beforehand |
| Frequency | Continuous during the contract |
| Location | European Union (Madrid; AI models in Belgium and, as a fallback for image generation, in the Netherlands); United States only for video generation, if enabled; technical logs and platform secrets in Google Cloud's global location. See clause 8 and Annex C |

## Annex B. Technical and organisational measures

| Area | Measure |
|---|---|
| Hosting | Google Cloud: compute, database and files in the Madrid region (`europe-southwest1`), European Union; task queues and scheduled tasks in Belgium (`europe-west1`); backups in the European Union multi-region; technical logs and secrets in Google Cloud's global location; the public website on Firebase's global content delivery network. Details in Annex C |
| Encryption | Connections to the platform and to providers encrypted with TLS/HTTPS; internal traffic over Google Cloud's private network; encryption at rest of databases and storage; third-party credentials (OAuth tokens, API keys) additionally encrypted at application level, with the keys in a secrets manager and a system that allows them to be rotated; platform secrets in a secrets manager |
| Content for publication | Images and videos generated for publication and profile photos are stored in storage that can be accessed through their link and whose contents cannot be listed |
| Isolation | Each company's and each Workspace's data logically separated, with controls on every query and automated isolation tests |
| Access | Individual users; roles; the agency's and projects' mailbox can only be connected or disconnected by a company administrator; other connections are authorised by a company user or, through a signed, expiring link, by the account owner (End Client); hashed passwords; expiring sessions; general request rate limiting |
| INVOKEAPP personnel | Only persons authorised by INVOKEAPP will access production data, when they need it and after committing in writing to respect its confidentiality (clause 5); access to the Google Cloud console is through named accounts |
| Logging | Activity and access logs; infrastructure logs kept for up to 400 days |
| Backups | Daily encrypted automated database backups, stored in Google Cloud's European Union multi-region; the last seven are kept and deleted by rotation, so deleted data disappears from the backups within ten days at most |
| AI | Google models (Vertex AI) in the European Union (Belgium and, as a fallback for image generation, the Netherlands), except video generation (Veo, United States, only if enabled); pseudonymisation of detectable direct identifiers and CRM names before sending them, with the limitations described in the Privacy Policy (section 4); no training with customer data; only the content each feature needs is sent to the model: text and, in voice or image features, the dictated audio (not stored) or the images provided; AI disclosure in conversations with people; human review of Outputs sent to third parties, except in the autonomous modes THE CLIENT enables |
| Commercial communications | Suppression list; mandatory unsubscribe link in every email; CRM customer records without a recorded legal basis are excluded from campaigns; human approval of each send by default, which falls to THE CLIENT (clause 17.3 of the Terms of Service); autonomous mode only if THE CLIENT enables it: in that case, THE CLIENT accepts that those sends go out without prior review, under its responsibility |
| Incident management | Written procedure for managing and notifying security breaches (clause 10), with a record of each incident and notices to THE CLIENT and, where their terms require it, to Google and Meta; channel to report vulnerabilities: security@invokeapp.io |
| Review | Annual review of these measures |

## Annex C. Sub-processors

The current list, with service, location and safeguard, is published at [invokeapp.io/subprocessors](https://invokeapp.io/subprocessors) and is updated in accordance with clause 7. The same page lists the third parties that receive data only when THE CLIENT enables a feature and that do not act as sub-processors, and the recipients that act as independent controllers, with the transfers that do not yet have a safeguard in place.