Data Processing Addendum (DPA)

1. Definitions

Controller: a private individual or legal entity that determines the Processing of Personal Data.

Data Subject: the individual to whom the Personal Data relates.

Personal Data: any information relating to an identified or identifiable person. An individual is identifiable when their identity can be determined, directly or indirectly, through any information.

Processing: the collection, use, disclosure, or storage of Personal Data by any means, including automated procedures. Use includes any act of accessing, handling, utilizing, transferring, or disposing of Personal Data.

Processor: an individual or legal entity, whether public or private, outside the Controller’s organization, that, alone or jointly with others, processes Personal Data on behalf of the Controller pursuant to a legal relationship that defines the scope of its activities in providing a service.

Sensitive Personal Data: Personal Data concerning the most private aspects of a Data Subject’s life, or whose misuse may give rise to discrimination or pose a serious risk to the Data Subject. Such data includes, without limitation, data revealing racial or ethnic origin, present or future health status, genetic information, religious, philosophical, or moral beliefs, political opinions, and sexual preference.

Transfer: any communication of Personal Data, within or outside Mexico, to a person other than the Data Subject, the Controller, or the Processor.

Transmission: the communication of Personal Data exclusively between the Controller and the Processor, within or outside Mexico, for the Processor to carry out Processing on behalf of the Controller.

2. Processing of Personal Data on behalf of the Customer

2.1. In the course of the business relationship, the provision of services and use of the Platform may involve the Customer transmitting Personal Data to Random Truffle, granting access to such data, or using it to generate outputs. With respect to Processing performed on its behalf, the Customer will act as Controller and Random Truffle as Processor.

2.2. The Customer undertakes to ensure that the purposes of such processing are covered by the applicable privacy notice and for obtaining Data Subjects’ consent when required under applicable law.

2.3. Random Truffle will act as Processor and will process Personal Data confidentially and solely on behalf of the Customer to provide the services, enable use of the Platform, and implement, maintain, protect, and improve its operation. Processing will be performed in accordance with the Customer’s lawful instructions, this DPA, applicable law, and the relevant data protection and processing standards. Such instructions include the routine operations necessary for these purposes, without the need to repeat them for each operation, and always within the agreed purposes and limits.

2.4. Random Truffle will act as an independent Controller with respect to the Personal Data of the Customer’s representatives and contact persons that it processes to provide access to the Platform, manage the business relationship, or comply with its legal obligations. Such Processing will be governed by applicable law and its Privacy Notice, and will be excluded from the scope of this DPA. The obligations set forth in this DPA will apply exclusively to Processing performed by Random Truffle as Processor on behalf of the Customer.

2.5. For purposes of this DPA, any reference to “Personal Data” will be limited to data that Random Truffle processes as Processor on behalf of the Customer, excluding data it processes as an independent Controller as described in the preceding paragraph.

3. Purpose limitation

3.1. Random Truffle agrees not to:

• i. process Personal Data for purposes other than those set forth in the preceding section;
• ii. sell, rent, market, share, or disclose Personal Data to third parties, except as expressly permitted by this DPA;
• iii. use Personal Data for advertising, profiling, or database enrichment for the benefit of other customers or for its own purposes;
• iv. use Personal Data to train, fine-tune, or evaluate general-purpose artificial intelligence models without the Customer’s prior, written authorization; or
• v. attempt to reidentify Data Subjects from anonymized or de-identified data.

4. Customer obligations

4.1. The Customer undertakes and warrants that it:

• i. has a valid legal basis or, when required, the Data Subject’s consent to collect, use, transmit, and, where applicable, transfer Personal Data to Random Truffle;
• ii. has made available to Data Subjects a privacy notice describing the purposes, categories of data, means of exercising ARCO rights, transfers, and other elements required by applicable law;
• iii. will provide only Personal Data that is necessary and proportionate to the purposes agreed upon by the parties; and
• iv. will not provide the Prohibited Data defined in Annex 1, unless the Parties enter into a prior written agreement updating that Annex and establishing the applicable purposes and protective measures in accordance with applicable law.

4.2. The Customer will be responsible for the quality, lawfulness, and accuracy of the Personal Data it makes available to Random Truffle.

5. Confidentiality and access

5.1. Random Truffle will limit access to Personal Data to its employees and Subprocessors (as defined in Section 9) who need access to such data to provide its services or operate, maintain, and support the Platform. These individuals will be bound by written confidentiality obligations that remain in effect after their relationship with Random Truffle ends.

5.2. Random Truffle will implement access controls based on the principle of least privilege, review permissions periodically, and revoke access in a timely manner.

6. Security measures

6.1. Random Truffle will implement and maintain reasonable administrative, technical, and physical safeguards proportionate to the risks, taking into account the nature and volume of the Personal Data and the purposes of Processing. At a minimum, these safeguards will include:

• i. encryption of data in transit and, where applicable, at rest;
• ii. identity controls, access logs, and logical separation of each customer’s data;
• iii. vulnerability management, security updates, and reasonable testing;
• iv. backups and recovery procedures;
• v. periodic staff training;
• vi. incident management procedures;
• vii. supplier assessments and contractual commitments to confidentiality, privacy, and security; and
• viii. secure deletion or de-identification of Personal Data once the purposes for which it is processed have been fulfilled.

6.2. At the Customer’s request, Random Truffle will provide an up-to-date description of its relevant controls, available certifications, audit reports, or security questionnaires, subject to confidentiality obligations.

7. Security incidents

7.1. Random Truffle will notify the Customer as soon as possible and, to the extent possible, within 48 (forty-eight) hours after becoming aware of a security incident affecting Personal Data.

7.2. The notification will include, as available:

• i. the nature of the incident;
• ii. the categories and approximate volume of Personal Data and number of Data Subjects involved;
• iii. the likely date or time period of the incident;
• iv. containment, investigation, mitigation, and remediation measures;
• v. and contact information for the person responsible for coordinating the response.

7.3. Random Truffle will reasonably cooperate with the Customer to investigate, contain, and remediate the incident. The Customer, as Controller, will determine whether notification to Data Subjects or the competent authority is required, unless the law requires Random Truffle to take direct action.

7.4. Attribution of the incident to the Customer or its Users will not relieve Random Truffle of its applicable notification obligations or containment and security measures, without prejudice to the applicable allocation of responsibilities and costs.

8. Requests from Data Subjects and authorities

8.1. If Random Truffle receives a request to exercise ARCO rights or withdraw consent, a complaint, or a request from an authority relating to Personal Data, it will notify the Customer as soon as possible, to the extent permitted by law. Random Truffle will respond on the merits only when required by a legal provision or a binding request from a competent authority, and will limit its response to what is strictly required.

8.2. Notwithstanding the foregoing, Random Truffle will provide reasonable assistance to enable the Customer to address Data Subject requests, investigations, audits, or requests relating to its services. At the Customer’s request, Random Truffle will cooperate with the Customer in conducting impact assessments or risk analyses concerning the Processing of Personal Data associated with its services. Such cooperation will be limited to providing relevant information available to Random Truffle that the Customer cannot reasonably obtain by other means.

9. Subprocessors

9.1. Random Truffle may engage third parties necessary to provide the services and the Platform, including providers of technology infrastructure, hosting, storage, analytics, support, or other related services. Such third parties will act as Subprocessors.

9.2. The Customer authorizes Random Truffle to engage the Subprocessors identified in Annex 2 and to add or replace Subprocessors in accordance with the following procedure:

• i. Random Truffle will notify the changes to the Customer’s designated contact, at least 30 (thirty) calendar days before the new Subprocessor accesses Personal Data, specifying its identity, service, and country or region of Processing;
• ii. During that period, the Customer may object in writing on grounds based on applicable data protection law.
• iii. Random Truffle will evaluate the objection and endeavor to resolve it through additional protective measures or a reasonable alternative. Pending resolution, the new Subprocessor will not have access to the Customer’s Personal Data.
• iv. If the Customer does not submit an objection within the specified period, the notified changes will be incorporated into Annex 2, and Random Truffle may use the new Subprocessors as of the date specified in the notification.

9.3. Random Truffle will select Subprocessors that maintain security and data protection measures appropriate to the services they provide. Random Truffle will enter into an agreement with each Subprocessor requiring it to comply with data protection obligations at least equivalent to those under this DPA. In particular, Random Truffle will:

• i. limit the Subprocessor’s access to Personal Data to what is strictly necessary to provide, maintain, or support the services; and
• ii. require the Subprocessor to implement security measures no less protective than those set forth in this DPA, to the extent applicable to the services it provides.

9.4. Random Truffle will be liable to the Customer for its Subprocessors’ breaches in connection with this DPA, unless the Parties expressly agree otherwise in writing.

10. Transmissions, transfers, and international processing

10.1. Making Personal Data available to Random Truffle constitutes a transmission for the purposes set forth in this DPA and does not authorize Random Truffle to use such data for its own purposes.

10.2. Random Truffle will not disclose Personal Data to third parties other than its authorized Subprocessors, unless requested by the Customer or required by a legal provision or a binding request from a competent authority. When Processing involves access from or storage in another country, Random Truffle will ensure that the provider and applicable agreements provide adequate privacy, confidentiality, and security measures. Annex 2 will identify the principal countries or regions of processing and storage.

11. Retention, return, and deletion

11.1. Unless the Parties agree to a different period, Random Truffle will retain Personal Data only for as long as necessary to provide the services and/or access to the Platform, or for any additional period required by a legal obligation.

11.2. Once the purposes of Processing have been fulfilled, Random Truffle will return or delete Personal Data within the period agreed upon by the Parties or, absent an agreement, without undue delay, unless retention is required by a legal obligation. At the Customer’s request, Random Truffle will confirm in writing that the return or deletion has been completed.

12. Miscellaneous

12.1. Term. This DPA will take effect when the Customer accepts the terms and conditions or the agreement incorporating it by reference, or when the Parties accept it directly, and will remain in effect for as long as Random Truffle processes Personal Data on behalf of the Customer within its scope. The person accepting it on behalf of the Customer must have sufficient authority to bind the Customer.

12.2. Survival of obligations. The obligations concerning confidentiality, security, return/deletion, and cooperation regarding incidents will survive for as long as Random Truffle or its Subprocessors retain Personal Data.

12.3. Order of precedence. This DPA will prevail over the License, T&Cs, and any other agreement incorporating it by reference, exclusively with respect to the Processing of Personal Data by Random Truffle as Processor on behalf of the Customer. Any specific data processing agreement entered into in writing by duly authorized representatives of both Parties will prevail over this DPA only with respect to the Processing identified in that agreement and the matters it expressly governs. This DPA will continue to apply to matters not addressed in that specific agreement.

12.4. Amendments. Any amendments to this DPA must be in writing and accepted by both parties.

12.5. Communications. Communications relating to this DPA will be made through the established channels and contacts designated by the Parties for these purposes.

12.6. Applicable Law. The Federal Law on Protection of Personal Data Held by Private Parties, its implementing regulations and guidelines to the extent applicable, and any other personal data protection provisions applicable in Mexico, including those contained in international treaties to which Mexico is a party.

DETAILS OF PROCESSING

This Annex describes the Processing activities associated with the Random Truffle Platform, which will be performed only to the extent necessary for the contracted scope, in accordance with the Customer’s instructions, which include the routine Processing operations necessary to operate the Platform, and within the purposes and limits agreed upon in the DPA. Their inclusion does not mean that all such activities will be performed under every engagement.

When other services involve Processing not covered by this Annex, the Parties must document its scope in advance in an additional annex subject to this DPA.

Subject matter and purposes

Processing of Personal Data on behalf of the Customer to enable access to, use of, and operation of the Platform and to perform the functionalities used by the Customer in accordance with the contracted scope and its instructions. Random Truffle may access such data to the extent necessary to operate the Platform, perform technical monitoring, support, and maintenance, and protect its security, integrity, and availability, as well as those of the Personal Data processed through it.

Duration

For the duration of access to the Platform and in accordance with the DPA.

Nature of operations

Receipt, access, consultation, recording, structuring, storage, analysis, integration through APIs, generation of reports and outputs, campaign activation, return, and deletion of Personal Data, as applicable to the contracted scope and within the purposes and limits set forth in the DPA and this Annex.

Categories of Data Subjects

The Customer’s customers, prospective customers, website or application users, subscribers, and business contacts whose Personal Data is processed by Random Truffle on the Customer’s behalf.

Categories of data

Online identifiers, browsing or usage events, campaign data, pseudonymized identifiers, email addresses, contact information, transaction and purchase data, and authorized segments or audiences.

Prohibited data

The Customer must not provide, transmit, or make available to Random Truffle sensitive personal data, personal data of minors, biometric data, health data, bank account or payment card numbers, card security codes, banking access credentials, passwords, images of identity documents, or precise geolocation data (the “Prohibited Data”).

If Random Truffle detects Prohibited Data, it will notify the Customer without undue delay and may restrict access to the affected data to the extent necessary to protect it. The Customer must remove such data or provide instructions for its return or deletion in accordance with this DPA. Accidental receipt of such data will not expand the scope of authorized Processing or relieve Random Truffle of its security and confidentiality obligations.

AUTHORIZED SUBPROCESSORS