# Data Processing Agreement

**Version 1.0 · 20 October 2026** · Article 28 of Regulation (EU) 2016/679 (GDPR) and Article 33 of Spanish Organic Law 3/2018 (LOPDGDD).

This Agreement is the "Data Processing Agreement" referred to in clauses 11.2, 16.2 and 19.1 of the [Terms of Service](https://invokeapp.io/terms). It forms an inseparable part of them, is accepted when the service is purchased and prevails over them on data protection matters. If THE CLIENT needs a signed copy, it can request one at privacy@invokeapp.io. In case of discrepancy, the Spanish version prevails.

## 1. Parties and roles

- **INVOKEAPP:** MARTÍNEZ CAMPOY CONSULTING, S.L., Tax ID B88657853, Calle Roma, 15, 30600 Archena (Murcia), Spain, trade name InvokeApp. It acts as **processor** and, when the data belongs to an End Client of THE CLIENT, as **sub-processor**.
- **THE CLIENT:** the business or professional purchasing the service. It acts as **controller** of its own data and as **processor** of its End Clients' data.

Capitalised terms ("End Client", "Workspace", "Agent", "Output") have the meaning given in the Terms of Service.

## 2. Subject matter and duration

INVOKEAPP will process the personal data that THE CLIENT, its users or its End Clients enter, import, connect or generate in the platform, **only to the extent necessary to provide the contracted service**. The processing is described in Annex A.

This Agreement applies for the duration of the contract and, afterwards, during the export and deletion period of clause 13.

## 3. Instructions

1. INVOKEAPP will process the data only on THE CLIENT's documented instructions, including with regard to international transfers. Documented instructions are: the Terms of Service and this Agreement; the configuration THE CLIENT makes in the platform (Agents, connections, campaigns, retention periods); and written requests from its administrator users.
2. If INVOKEAPP considers that an instruction infringes data protection law, it will inform THE CLIENT immediately and may suspend its execution until it is confirmed or withdrawn.
3. If the law required INVOKEAPP to process the data differently, it will inform THE CLIENT beforehand, unless the law prohibits it.

## 4. Limited purpose

1. INVOKEAPP will not process the data for its own purposes or disclose it to third parties, except to the sub-processors of clause 7 or where required by law. If it did, it would become controller of that processing (Article 33.2 LOPDGDD).
2. INVOKEAPP will not use the data to train, fine-tune or improve artificial intelligence models, its own or third parties' (clause 10.3 of the Terms of Service).
3. **Data obtained from Google and Meta.** The right to process aggregated and anonymised data in clause 10.3 of the Terms of Service **does not apply** to data obtained through Google APIs (Gmail, Google Calendar and others) or the Meta platform (WhatsApp, Instagram, Facebook, Threads). That data is used only for the features the user sees in the platform, in accordance with the Google API Services User Data Policy (including its Limited Use requirements) and Meta's terms for Tech Providers.

## 5. Confidentiality and personnel

INVOKEAPP ensures that the persons authorised to process the data have committed to confidentiality, access it only when needed for their work and with least privilege, and have received appropriate training. INVOKEAPP staff do not read the content of connected emails, messages or calendars unless THE CLIENT expressly asks for a specific case, for security purposes or where required by law. This duty survives termination of the contract.

## 6. Security

INVOKEAPP applies the technical and organisational measures of Annex B (Article 32 GDPR), reviews them at least once a year and will not reduce the level of protection during the contract.

## 7. Sub-processors

1. THE CLIENT gives INVOKEAPP general authorisation to engage the sub-processors published at [invokeapp.io/subprocessors](https://invokeapp.io/subprocessors) (Annex C).
2. INVOKEAPP will notify any addition or replacement **thirty (30) calendar days in advance**. THE CLIENT may object in writing, on reasoned data protection grounds, within the following fifteen (15) days; if INVOKEAPP maintains the change, THE CLIENT may terminate without penalty (clause 16.3 of the Terms of Service).
3. INVOKEAPP will impose on each sub-processor, by contract, data protection obligations equivalent to those in this Agreement and remains liable to THE CLIENT for their compliance.
4. Where THE CLIENT acts on behalf of an End Client, it will identify INVOKEAPP as an authorised sub-processor in its own agreement with that End Client (clause 7.3 of the Terms of Service).

## 8. International transfers

The platform and its data are hosted in the European Union (Madrid). INVOKEAPP will only transfer data outside the European Economic Area through the sub-processors of Annex C or on THE CLIENT's instructions, and always with a Chapter V GDPR safeguard (an adequacy decision, including the EU-U.S. Data Privacy Framework, or standard contractual clauses). If a third-country authority requested access to the data, INVOKEAPP will notify THE CLIENT unless legally prohibited and disclose only the minimum required.

## 9. Data subject rights

1. If a data subject contacts INVOKEAPP, it will forward the request to THE CLIENT within **three (3) business days** at most and will not answer it unless instructed.
2. INVOKEAPP will help THE CLIENT respond to requests for access, rectification, erasure, objection, restriction and portability, through the platform's features or, if they are not enough, by carrying out the requested action itself within **ten (10) business days** of the written instruction.
3. Opt-outs from commercial communications are kept on the suppression list so that the person is not contacted again (Article 21.3 GDPR).

## 10. Personal data breaches

1. INVOKEAPP will notify THE CLIENT, **without undue delay and at the latest within forty-eight (48) hours** of becoming aware of it, of any security breach affecting its personal data, by email to its administrators.
2. The notification will include, to the extent known and supplemented in phases: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point.
3. INVOKEAPP will cooperate so that THE CLIENT can notify the supervisory authority within 72 hours and, where applicable, the data subjects. INVOKEAPP will not notify on its own unless it has its own legal obligation or THE CLIENT so instructs.

## 11. Impact assessments and prior consultation

INVOKEAPP will provide THE CLIENT with the information about the processing, security measures, AI Agents and sub-processors it needs to carry out a data protection impact assessment and, where applicable, the prior consultation with the authority (Articles 35 and 36 GDPR).

## 12. Records of processing

INVOKEAPP keeps the record of the processing activities it carries out as processor (Article 30.2 GDPR).

## 13. End of the service: return and deletion

1. After termination, THE CLIENT has **thirty (30) calendar days** to export its data in a structured, commonly used format (clauses 5.4 and 10.5 of the Terms of Service). During the contract it may export it at any time.
2. After that period, INVOKEAPP will **delete** the data, including third-party connections and their credentials, within thirty (30) days at most. Backups are deleted according to their rotation cycle (Annex B). INVOKEAPP will issue a deletion certificate at THE CLIENT's request.
3. INVOKEAPP may keep, **blocked** and for no other use, the data strictly necessary to prove compliance with this Agreement while liabilities may arise (Article 33.4 LOPDGDD), and any data the law requires it to keep.

## 14. Information and audits

1. INVOKEAPP will make available to THE CLIENT the information necessary to demonstrate compliance with this Agreement and will answer, once a year, a security questionnaire within twenty (20) business days.
2. THE CLIENT, or an auditor bound by confidentiality, may audit compliance once a year (or after a security breach or at the request of an authority), with thirty (30) days' notice, during business hours, without access to other customers' data and at its own cost, unless a material breach by INVOKEAPP is found.
3. Regarding the sub-processors' infrastructure, INVOKEAPP will provide the reports and certifications it has; physical inspection of cloud providers' data centres is not possible.

## 15. Obligations of THE CLIENT

THE CLIENT: (a) has a legal basis for all processing it instructs and has informed data subjects (Articles 13 and 14 GDPR); (b) gives lawful instructions; (c) carries out the impact assessment where required; (d) does not enter into the platform, unless agreed in writing beforehand, special categories of data (Article 9 GDPR), criminal data, data of children under fourteen or full payment card data; (e) sets the retention periods for its data; (f) complies with the rules on commercial communications (Articles 20 to 22 LSSI and 23 LOPDGDD); and (g) passes this Agreement on to its End Clients.

## 16. Third-party channels (Google, Meta and others)

1. **Ownership.** The accounts THE CLIENT or its End Clients connect (WhatsApp Business, social pages and profiles, Google accounts) belong to the business that connects them. INVOKEAPP acquires no rights over them, and the business may disconnect them at any time.
2. **Platform rules.** THE CLIENT undertakes, and will require each End Client, to comply with the terms and policies of each channel provider, in particular the Meta Platform Terms, the Meta Terms for WhatsApp Business Platform, the WhatsApp Business Messaging Policy and the Google API Services User Data Policy, and not to process data obtained through those channels in breach of them.
3. **Recipients' consent.** WhatsApp messages will only be sent to people who have provided their number and agreed to receive them, and commercial emails only to contacts with a legal basis under Article 21 LSSI. THE CLIENT is responsible for proving it.
4. **Channel costs.** WhatsApp messages are billed by Meta directly to the business that owns the account. Neither INVOKEAPP nor THE CLIENT resells the WhatsApp platform or charges the cost of messages as its own.
5. **Restricted content.** WhatsApp will not be used to send or request health information, card data, bank account or identity document numbers, or for products and services restricted by Meta.
6. **Suspension.** INVOKEAPP will suspend access to a channel when its provider requires it or when there are reasonable signs of a breach of its policies, informing without delay.
7. **Provider communications.** INVOKEAPP will forward without delay to the business concerned any communication from the channel provider about data subjects' requests regarding their data.

## 17. Liability

Each party is liable to data subjects and authorities under Article 82 GDPR. Between the parties, clause 13 of the Terms of Service applies: INVOKEAPP is liable for damage caused by breaching the obligations the GDPR or this Agreement impose on it as processor or by acting outside THE CLIENT's lawful instructions; THE CLIENT, for damage resulting from its instructions, the lack of a legal basis or the unlawfulness of the data.

## 18. Contact

Data protection: privacy@invokeapp.io · Security and vulnerabilities: security@invokeapp.io.

---

## Annex A. Description of the processing

| Element | Description |
|---|---|
| Nature | Hosting, recording, organisation, consultation, import and export; sending and receiving messages and emails through the accounts THE CLIENT connects; scheduling and publishing content; appointment management; rule-based segmentation and scoring; AI-generated drafts, summaries and classifications; support; deletion |
| Purpose | Providing THE CLIENT with the InvokeApp platform service (CRM, AI Agents, integrations and business intelligence) under the Terms of Service |
| Data subjects | THE CLIENT's users; its customers, contacts and leads; its End Clients' customers, contacts and leads; people who write to its channels (WhatsApp, website chat, email) |
| Categories of data | Identification and contact data; professional data; commercial data (products, purchases, opportunities, notes); content of messages, emails and conversations; appointment data; legal basis, consents and opt-outs; derived data (segments, scores, AI Outputs); identifiers and encrypted credentials of connected accounts; user activity |
| Excluded data | Those in clause 15(d), unless agreed in writing beforehand |
| Frequency | Continuous during the contract |
| Location | European Union (Madrid). See Annex C |

## Annex B. Technical and organisational measures

| Area | Measure |
|---|---|
| Hosting | Google Cloud, Madrid region (`europe-southwest1`), European Union |
| Encryption | TLS/HTTPS connections; encryption at rest of databases and storage; third-party credentials (OAuth tokens, API keys) additionally encrypted at application level, with key rotation; secrets in a secrets manager, never in code |
| Isolation | Each company's and each Workspace's data logically separated, with controls on every query and automated isolation tests |
| Access | Individual users; roles; only administrators connect or disconnect third-party accounts; hashed passwords; expiring sessions; rate limiting |
| INVOKEAPP personnel | Production access only for authorised staff, with named accounts and on a need-to-know basis; confidentiality commitment |
| Logging | Activity and access logs; infrastructure logs kept for up to 400 days |
| Backups | Daily encrypted automated database backups in the same region; the last seven are kept (plus seven days of transaction logs) and deleted by rotation |
| AI | Google models (Vertex AI) in the European region; no training with customer data; only the text each feature needs is sent to the model; AI disclosure in conversations with people; human review of Outputs |
| Commercial communications | Suppression list, mandatory unsubscribe link in every email, exclusion of contacts without a legal basis, human approval of campaigns |
| Incident management | Response and notification procedure (clause 10); channel to report vulnerabilities: security@invokeapp.io |
| Review | Annual review of these measures |

## Annex C. Sub-processors

The current list, with service, location and safeguard, is published at [invokeapp.io/subprocessors](https://invokeapp.io/subprocessors) and is updated in accordance with clause 7.