Data Processing Agreement

Change log

1. Parties and roles

1.1. Data controller (owner of the personal data bank): the Customer, who decides the purpose and content of the data it uploads to XEN.

1.2. Data processor: Xeneural Technologies E.I.R.L., RUC 20606521261.

1.3. Xeneural acquires no ownership of the data, does not use it for its own purposes and does not use it to train artificial intelligence models, its own or third parties'.

2. Subject matter, nature and duration

2.1. Xeneural processes the personal data exclusively to provide the XEN Service in accordance with the contract, with the configuration the Customer makes on the platform and with its written instructions.

2.2. Categories of data subjects: employees, customers, suppliers, contacts and signatories designated by the Customer.

2.3. Categories of data: identification, contact, employment, attendance, economic and tax data, documents and signatures, and any other data the Customer decides to incorporate. If the Customer incorporates sensitive data, it warrants that it has the written consent or the legal basis required by law.

2.4. Duration: that of the main contract. The obligations of confidentiality, return and deletion survive its termination.

3. Instructions

3.1. Xeneural processes the data only according to the Customer's documented instructions: the contract, this Agreement, the XEN configuration and the written requests of its designated contact. It does not process the data for any other purpose and does not transfer it beyond what is provided for here.

3.2. If Xeneural considers that an instruction infringes data protection rules, it informs the Customer immediately and may suspend its execution until the matter is clarified.

3.3. When a law requires Xeneural to process the data otherwise, it informs the Customer before doing so, unless that law prohibits it.

4. Xeneural's obligations

4.1. Staff confidentiality. Every person with access to the data is bound by a written confidentiality obligation before accessing it, receives data protection training on joining and every year, and accesses only what is necessary for their role. Xeneural keeps the record of that training and of those undertakings.

4.2. Technical and organisational measures. Xeneural applies the measures of the Security Annex (section 9), maintains them under a management system compliant with ISO/IEC 27001:2022 and reviews them at least once a year. Xeneural may update them provided that it does not materially reduce the level of security of the Service, and informs the Customer of relevant changes at its request.

4.3. Assistance to the Customer. Xeneural assists the Customer in handling data subjects' rights (forwarding every request received within a maximum of two (2) business days), in impact assessments, in consultations with the authority and in incident notification. XEN lets the Customer access, rectify, export and delete data on its own.

4.4. Records. Xeneural keeps a record of the processing activities it carries out on behalf of the Customer and of every support access to its data, available on request.

4.5. Demonstrating compliance. Xeneural makes available to the Customer the information needed to demonstrate compliance with this Agreement and with the applicable rules.

5. Security incidents

5.1. "Security Incident" is any breach of the security of Xeneural or of its subprocessors that leads, accidentally or unlawfully, to the destruction, loss, alteration, unauthorised disclosure of or access to the personal data processed on behalf of the Customer; unsuccessful attempts that do not compromise its confidentiality, integrity or availability are not Security Incidents. Xeneural notifies the Customer of every Security Incident without undue delay and at the latest within twenty-four (24) hours of the moment it has reasonable certainty that it has occurred, by email to the designated contact, with the information available: nature of the incident, categories and approximate number of data subjects and records affected, measures taken and recommended, and point of contact.

5.2. Xeneural completes the information in phases, as it obtains it, and delivers a report with root cause, impact and corrective measures within a maximum of ten (10) business days. Notification of or response to a Security Incident does not constitute an acknowledgement of fault or liability.

5.3. That notification allows the Customer to meet its own deadlines before the National Personal Data Protection Authority of Peru (48 hours) or before the supervisory authority that applies to it (72 hours under the GDPR). Xeneural does not communicate the incident to third parties or to the public on the Customer's behalf without its written authorisation, except under its own legal obligation.

6. Subprocessors

6.1. The Customer generally authorises the subprocessors listed on the public list at xeneural.com/legal/subencargados, incorporated into this Agreement, each bound by a written contract with obligations equivalent to those of this Agreement.

6.2. Xeneural publishes any addition or replacement of a subprocessor, with its name, its purpose and the country of processing, and communicates it by email to the subscribers of the notice, at least thirty (30) days before it accesses the data. Within that period, the Customer may object in writing stating reasonable grounds related to data protection. Xeneural answers within a maximum of ten (10) business days with one of these options: (i) not using that subprocessor for the Customer's data; (ii) proposing a configuration that avoids it; or (iii) if neither is feasible, granting the Customer the right to terminate the affected service without penalty and with a refund of any amount paid in advance. If the Customer does not object within the period, it is deemed to accept the subprocessor.

6.3. Xeneural is liable to the Customer for the acts and omissions of its subprocessors as if they were its own.

7. International transfers

7.1. The data is processed in these locations, according to the purpose: hosting of the application, the database and the documents in the United States of America; delivery and protection of traffic on the global network of the edge provider, with temporary cached copies; and XENI answers on the global infrastructure of Google. Each subprocessor appears on the list with its location. For customers in Peru, Xeneural reports the cross-border flow to the National Registry of Personal Data Protection and gives the Customer the form it needs to register or update its own data bank.

7.2. For customers in the European Economic Area, the United Kingdom or Switzerland, the Parties incorporate without modification the standard contractual clauses of the European Commission (Decision 2021/914, module two, controller to processor) and, where applicable, the United Kingdom addendum, with the annexes completed with the information of this Agreement and of the subprocessor list.

7.3. Xeneural does not move the hosting of the data outside the locations indicated without the Customer's prior written consent and without the safeguards required by law.

8. Audit rights

8.1. The Customer, itself or through an independent auditor bound by confidentiality, may audit compliance with this Agreement once a year and, in addition, when an incident affects its data or an authority makes a demand, with thirty (30) days' notice, during business hours, covering documentation, configuration and controls, without access to other customers' data.

8.2. Certification reports (ISO/IEC 27001) and executive summaries of penetration tests and internal audits satisfy the audit unless there is reasonable indication of non-compliance. While certification is in progress, Xeneural provides the documented status of its management system and its plan with dates.

8.3. This right survives termination for as long as Xeneural keeps the Customer's data.

9. Security Annex: technical and organisational measures

10. Return and deletion

10.1. After termination, the Customer has thirty (30) days to export its data in open formats with a data dictionary. At its choice, Xeneural delivers a complete export within a maximum of ten (10) business days of the request.

10.2. Xeneural deletes the data from active systems within a maximum of thirty (30) days after that period and from backups within a maximum of ninety (90) days, and certifies it in writing at the Customer's request.

10.3. Records subject to a legal retention obligation (payment vouchers, accounting entries, payrolls: five years in Peru) are kept in an archive with restricted access and integrity verification, and are deleted when the legal period expires.

11. Liability

Each Party is liable for the damage it causes by breaching this Agreement or data protection rules, and Xeneural is liable for its subprocessors. Liability arising from this Agreement is subject to the enhanced limit of the Terms of Service: two (2) times the amount paid by the Customer during the twelve (12) months preceding the first event giving rise to the claim. That limit does not apply to wilful misconduct or gross negligence (article 1328 of the Civil Code).

12. Appointments and contact

On 21 September 2026 Xeneural appointed its Managing Owner as Personal Data Officer. Contact: privacy@xeneural.com. Security and incident contact: security@xeneural.com.

13. Term

From the acceptance of the Terms of Service or the signing of this document, and for as long as the main contract lasts. Sections 4.1, 5, 8, 10 and 11 survive termination.

Signatures, when formalised as a separate document: for the Customer, its authorised representative, with name, position and date; for Xeneural Technologies E.I.R.L., its Managing Owner.