Data processing agreement

1. Roles

The customer is the controller (in Brazil, "controlador") of the personal data of its contacts, leads and users. ELOOO is the processor ("operador") and processes that data only to provide the service.

2. Subject, duration and purpose

Hosting, storage and processing of data for CRM, messaging, automations, AI agents, calendars, email, websites, calls and support, for as long as the subscription lasts and until the data is deleted after it ends.

3. Data subjects and types of data

• Data subjects: the customer's contacts, leads, clients and users.
• Data: identification and contact details, messages, call recordings, appointments, notes, order and payment information and usage data.
• Special categories: only if the customer chooses to store them, in which case the customer is responsible for having a valid legal basis.

4. Our commitments as processor

• Process data only on the customer's documented instructions, which are the use of the platform and its settings.
• Ensure that the people with access are bound by confidentiality.
• Apply appropriate technical and organizational security measures (GDPR art. 32; LGPD art. 46).
• Help the customer respond to data subject requests and, where applicable, with impact assessments.
• Notify the customer of a personal data breach without undue delay after becoming aware of it.
• At the end of the service, delete or return the data, unless the law requires it to be kept.
• Make available the information needed to demonstrate compliance and allow audits under reasonable conditions agreed in advance.

5. Subprocessors

The customer authorizes the use of subprocessors, the main one being the technology provider of the CRM platform and its cloud infrastructure in the United States. We impose equivalent data protection obligations on them, inform customers in advance of changes, and customers may object for justified reasons. The list is available on request.

6. International transfers

Transfers outside the European Economic Area or Brazil are protected by the European Commission's Standard Contractual Clauses, by the EU-US Data Privacy Framework when the provider is certified and by the standard contractual clauses approved by the ANPD.

7. Customer obligations

• Have a legal basis for each processing, including consent for marketing messages where the law requires it.
• Inform data subjects about the processing and about the use of AI where applicable.
• Not store data obtained unlawfully and follow the Acceptable use policy.

8. Security measures

Encrypted connections (TLS), role-based access control, two-factor authentication, activity logs, backups and confidentiality obligations for staff.

9. Contact

Data protection questions and requests for the signed agreement: privacidade@elooocrm.com.