Data Processing Agreement

01 Parties, purpose, term and precedence

This Data Processing Agreement (the “Agreement”) is entered into between the Customer, as controller, and Flouvia, as processor, with respect to the personal data Flouvia processes on the Customer’s behalf when providing CORD (the “Customer Data”). “Flouvia”, “Customer”, “CORD” and other defined terms have the meaning given to them in the CORD Terms and Conditions (the “Terms”).

The Agreement forms part of the Terms and the Customer accepts it by accepting them. At the Customer’s request, Flouvia signs a copy. On data processing, the Agreement prevails over the Terms and over any other CORD document; the standard contractual clauses incorporated in section 6 prevail over the Agreement.

The Agreement applies when the Customer or its customers and suppliers are subject to the European Union’s General Data Protection Regulation (GDPR), its United Kingdom equivalent, Brazil’s General Data Protection Law (LGPD), Mexico’s Federal Law on Protection of Personal Data Held by Private Parties or another law that requires a controller–processor contract.

It lasts as long as the Terms and, afterwards, until Flouvia returns or deletes the Customer Data under section 8.

It does not cover the data Flouvia processes as controller under its Privacy Notice: user account data, subscription billing data and data processed for its own purposes, such as fraud prevention, collecting its fees, product statistics or defending claims.

02 Description of the processing

Data subjects: the Customer’s customers and prospects and their contacts, payers, signers, debtors, suppliers whose documents Cord receives for the Customer, representatives and holders of the tax certificates the Customer uploads, and any other person whose data the Customer enters into CORD.

Categories of data:

• identification and contact;
• tax data: identifier, legal name, address and regime;
• commercial data: quotes, invoices, line items, amounts and terms;
• payment data: payment method summary, direct debit mandates, automatic-payment authorizations with their IP address and the status of each payment;
• communications with the Customer’s customers, including collections;
• signature evidence;
• files the Customer uploads;
• what tax authorities return.

The Customer shall not enter special categories of data (health, biometrics, origin, beliefs and the like) or data of minors into CORD without Flouvia’s prior written agreement.

Purpose and nature: providing CORD under the Terms. This includes storing and retrieving the data, generating quotes and invoices, transmitting them to the tax authorities and approved platforms the Customer turns on, sending email on the Customer’s behalf, processing payments through the payment processor, running the integrations and automations the Customer configures and using the artificial intelligence features the Customer invokes.

Frequency: continuous while the Customer uses CORD.

Retention: as set out in the retention table of the Privacy Notice and in section 8.

03 Flouvia’s obligations as processor

Flouvia shall:

1. Process Customer Data only on the Customer’s documented instructions, including with regard to international transfers. Documented instructions are the Terms, this Agreement, the configuration the Customer sets in CORD and the requests it sends through the API. If applicable law requires Flouvia to process the data otherwise, it will inform the Customer beforehand, unless that law prohibits it.
2. Immediately inform the Customer if it considers that an instruction infringes data protection law.
3. Ensure that persons authorized to process Customer Data have committed to confidentiality.
4. Apply the security measures in section 4.
5. Comply with the conditions in section 5 for engaging sub-processors.
6. Assist the Customer, through appropriate technical and organizational measures, in responding to data subject requests. If Flouvia receives a request about Customer Data directly, it will forward it to the Customer within five business days and will not respond on its own unless the Customer authorizes it.
7. Assist the Customer, with the information available, in meeting its obligations on security, breach notification, impact assessments and prior consultation with the authority.
8. Return or delete Customer Data at the end of the service, under section 8.
9. Make available to the Customer the information necessary to demonstrate compliance with this Agreement and allow for audits, including inspections, under section 8.
10. Inform the Customer, unless legally prohibited, of any request from an authority concerning Customer Data.

The Customer shall have a legal basis for each processing it orders, inform data subjects, give lawful instructions and handle its data subjects’ requests in the first place.

04 Security measures

Flouvia maintains at least the following measures and reviews them as risks change:

• Encryption: in transit with TLS and at rest with the database provider’s encryption. Cord also encrypts, per field, payout bank accounts, tax credentials, integration tokens and configured secrets.
• Isolation between organizations: every query runs in the context of the organization it belongs to, and the database enforces row-level security per organization.
• Access: passwords stored with Argon2id, second factor, passkeys, single sign-on with SAML, server-side sessions the user can revoke and role-based permissions within each organization. API keys are stored hashed and can be restricted by resource and by IP address.
• Minimization: identity document images are sent to the payment processor without being stored in Cord and without their location metadata. IP addresses of reading signals are stored hashed.
• Logging and monitoring: an audit log of organization actions, an API log and operational alerts without personal data.
• Availability: continuous backups by the database provider with point-in-time recovery.
• Secure development: automated tests of isolation, of routes that move money and of public routes on every code change.
• Personnel: production access limited to persons authorized by Flouvia and bound by confidentiality.

05 Sub-processors

The Customer gives Flouvia general authorization to engage the sub-processors listed on the public Sub-processors page. Flouvia imposes on each, by contract, data protection obligations equivalent to those of this Agreement and remains liable to the Customer for their performance.

Flouvia will give at least 30 days’ notice before adding or replacing a sub-processor to anyone subscribed to notices on that page. The Customer may object to the change in writing, on reasonable data protection grounds, before it takes effect. If the parties do not resolve the objection in good faith, the Customer may terminate the affected services and Flouvia will refund the unused prepaid portion.

When a change is necessary to address an urgent security risk or a provider failure, Flouvia may make it immediately and will give notice as soon as possible, with the same right to object from the notice.

Stripe, Mercado Pago, Google and Apple act with their own obligations and are not sub-processors. Tax authorities and approved platforms receive documents under the Customer’s legal obligation. Integrations the Customer connects, such as HubSpot, Shopify, its accounting software, its messaging channels, its email, platforms using the API or webhooks, receive data on the Customer’s instruction and under its relationship with those third parties.

06 International transfers

Flouvia operates from Mexico and its main sub-processors process data in the United States.

• European Economic Area: when the Customer transfers Customer Data subject to the GDPR to Flouvia, the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, module 2 (controller to processor), apply and are incorporated by reference into this Agreement with these options:

  • clause 7 (docking clause) is included;
  • in clause 9, option 2 (general authorization with the notice in section 5);
  • the option in clause 11 is not included;
  • in clause 17, the law of the Member State where the Customer is established or, if it is not established in one, the law of Ireland;
  • in clause 18, the courts of that same Member State.

  Section 2 is its Annex I.B, section 4 its Annex II and the sub-processor page its Annex III. The competent supervisory authority is the one determined under clause 13.

• United Kingdom: the same clauses with the International Data Transfer Addendum issued by the Information Commissioner’s Office.

• Brazil: the standard contractual clauses of ANPD Resolution CD/ANPD No. 19/2024.

• To sub-processors: when a sub-processor processes Customer Data outside the country of origin, Flouvia relies on its certification under the EU–U.S. Data Privacy Framework and its UK Extension, where it holds one, or on the Standard Contractual Clauses (module 3, processor to processor). Facturapi is governed by the next item.

• Facturapi: it only stamps CFDI for Customers established in Mexico, and a Mexican Customer generally does not become subject to the GDPR by invoicing a customer in the European Economic Area. If a Customer is subject to the GDPR, the safeguard for the transfer to Facturapi is the Standard Contractual Clauses, module 3 (processor to processor), annexed to the processor agreement between Flouvia and Facturapi as its sub-processor. Until Facturapi has signed them, that Customer must not use CORD’s CFDI stamping to invoice persons located in the European Economic Area.

07 Security incidents

If Flouvia becomes aware of a security breach affecting Customer Data, it will notify the Customer without undue delay and in any event within 48 hours. The notice will include, to the extent known:

• the nature of the breach;
• the categories and approximate number of data subjects and records affected;
• the likely consequences;
• the measures taken or proposed to mitigate them;
• a contact point.

What is not known immediately will be provided in phases. Flouvia will cooperate with the Customer so that it can meet its own obligations to notify the authority and the affected persons. Notifying a breach is not an acknowledgment of fault by Flouvia.

08 Audit, return, deletion and final provisions

Audit. Flouvia makes available to the Customer the documentation that demonstrates compliance with this Agreement. If that documentation is not sufficient, the Customer may carry out an inspection, itself or through an independent auditor bound by confidentiality, with 30 days’ notice, once a year, during business hours and at its own cost, without access to other customers’ data or to information that would compromise security. That annual limit does not apply when a supervisory authority requires an inspection or after a security breach affecting Customer Data.

Return and deletion. While the service is in force, the Customer may export all Customer Data from Settings at any time, including its tax documents with their XML and acknowledgments. When the Customer requests deletion of its organization, the deletion is scheduled with a 30-day grace period during which the Customer can export its data or cancel the deletion. After that, Flouvia deletes Customer Data from its database. Backups are overwritten when their recovery window ends. Flouvia keeps only what the law requires it to keep and a record of the deletion. At the Customer’s request, Flouvia certifies the deletion in writing.

Liability. Each party’s liability is governed by section 12 of the Terms, without limiting the rights that the standard contractual clauses in section 6 grant to data subjects.

Governing law and jurisdiction. Except as the standard contractual clauses provide, this Agreement is governed by the law and jurisdiction in section 16 of the Terms.

Amendments. Amendments to this Agreement follow section 17 of the Terms. A sub-processor change follows section 5 of this Agreement.