Data Processing Agreement

The terms "personal data", "data subject", "processing", "controller", "processor", "transfer" and "personal data breach" shall have the meaning given to them by the LFPDPPP and, where applicable, the GDPR.

• Controller: the Customer, who determines the purposes and means of the processing.
• Processor: GRM, who processes personal data solely on behalf of the Controller.
• Sub-processor: a third party engaged by GRM to perform part of the services involving the processing of data.

GRM shall process personal data solely to provide the contracted services (operation of the P-ERM 4.0 platform, hosting, technical support, maintenance and associated risk-management features). The details of the processing —categories of data, of data subjects, purpose and duration— are set out in Annex I.

GRM shall not process personal data for its own purposes or for purposes other than those instructed by the Controller.

This DPA shall remain in force for as long as GRM processes personal data on behalf of the Controller and, in any event, for the duration of the main agreement. Confidentiality and data return or deletion obligations shall survive its termination.

GRM, as Processor, undertakes to:

• Process personal data only on the documented instructions of the Controller, including with regard to international transfers.
• Ensure that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Not transfer or disclose the data to third parties except on the Controller's instructions or by legal obligation; in the latter case, GRM shall inform the Controller before processing, unless legally prohibited.
• Assist the Controller, through appropriate technical and organisational measures, in complying with its obligations to respond to data subjects and to ensure the security of processing.
• Make available to the Controller the information necessary to demonstrate compliance with the obligations set out herein.

GRM shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Annex II. Such measures shall be reviewed and updated periodically.

The Controller grants GRM general authorisation to engage the sub-processors listed in Annex III. GRM shall impose on each sub-processor, by contract, data protection obligations equivalent to those in this DPA.

GRM shall inform the Controller of any addition or replacement of sub-processors with reasonable prior notice, giving it the opportunity to object on justified data-protection grounds. GRM shall remain liable to the Controller for its sub-processors' compliance.

Where providing the service involves processing data outside the country of origin of the Controller or the data subject, GRM shall ensure that such transfers are carried out with adequate safeguards.

For data subject to the GDPR, transfers outside the European Economic Area shall rely on the Standard Contractual Clauses (SCC) approved by the European Commission or another valid transfer mechanism, incorporated by reference into this DPA.

Taking into account the nature of the processing, GRM shall assist the Controller, insofar as possible, in responding to requests to exercise rights of Access, Rectification, Cancellation and Objection (ARCO under Mexican law) —or access, rectification, erasure, restriction, portability and objection under the GDPR—.

If GRM receives a request directly from a data subject, it shall forward it to the Controller without responding on its own account, unless expressly authorised.

GRM shall notify the Controller without undue delay, and no later than 72 hours after becoming aware, of any personal data breach affecting the data processed on behalf of the Controller.

The notification shall include, to the extent available, the nature of the breach, the categories and approximate number of affected data subjects, the likely consequences, and the measures taken or proposed to mitigate it.

GRM shall make available to the Controller the information necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, by the Controller or an auditor mandated by it, with reasonable prior notice and subject to confidentiality obligations.

Upon termination of the services, and at the Controller's choice, GRM shall return or delete all personal data processed on its behalf, as well as existing copies, unless retention is required by an applicable legal obligation.

Each Party shall be liable for the damage it causes by breaching its obligations, on the terms and within the liability limits set out in the main agreement. This DPA is governed by the laws of the United Mexican States, and the Parties submit to the competent courts of Cuernavaca, Morelos, México, unless a mandatory data-protection rule provides otherwise.