1. Purpose and parties
This agreement forms part of the Terms of Service and governs the processing of personal data that [RAZÓN SOCIAL] S.A.S. (“Processor”) performs on behalf of the client organization (“Controller”) when providing the Vox service.
2. Data and purposes
- Controller's users: name, email, job title and role.
- Personal data that may appear in monitored public publications, processed temporarily for analysis: the author of an article and names of people other than the Controller are not kept.
- Data from social media accounts connected by the Controller: own metrics and posts, and public third-party comments processed temporarily: only aggregate data and the link to the original are kept, without author or text.
The sole purpose is to provide the subscribed service: monitoring, analysis, alerts and reports for the Controller.
3. Processor obligations
- Process data only under the Controller's documented instructions and this agreement, and never for its own purposes.
- Ensure staff with access are bound by confidentiality obligations.
- Apply the security measures described in this agreement.
- Assist the Controller with data subject requests, forwarding any received directly within 5 business days.
- Notify the Controller of security incidents affecting its data without undue delay and no later than 72 hours after confirming them.
- Comply with the duties in Article 18 of Law 1581 of 2012.
- On termination, return or delete the data as instructed by the Controller, unless the law requires retention.
- Allow reasonable compliance reviews, with 30 days' notice and at most once a year, at the Controller's expense.
4. Controller obligations
- Have the legal basis or authorizations required for processing.
- Give lawful instructions and configure the service in compliance with the law.
- Inform data subjects about the processing and handle their requests.
- Maintain its own valid data processing policy.
5. Sub-processors
The Controller authorizes the Processor to rely on sub-processors in the following categories, bound by equivalent protection obligations:
- Cloud infrastructure: application hosting, database and authentication.
- Artificial intelligence: automated analysis of monitored content.
- Email: delivery of invitations, password resets and alerts.
The up-to-date list of sub-processors and their locations is available to the Controller on request.
We will give at least 15 days' notice before adding or changing a sub-processor. If the Controller objects on reasonable grounds, it may terminate the service without penalty.
6. International transmission
The Controller authorizes transmission of data to the countries where the sub-processors operate. The Processor ensures those transmissions take place under contractual terms that guarantee an adequate level of protection.
7. Security measures
- Encryption of information in transit and of connected-service credentials.
- Separation of each client organization's information.
- Secure authentication, role-based access control and least privilege.
- Deletion of full article text 7 days after capture.
- Deletion of social media comment text once analyzed or, at the latest, after 72 hours, without keeping its author.
- Platform access logging.
8. Term and termination
This agreement applies while the Processor processes data on behalf of the Controller. When the service ends, data remains available for export for 30 days and is deleted within the following 30 days.
The parties' liability under this agreement is governed by the limitation of liability clause in the Terms of Service, subject to applicable law.