Data Processing Agreement (DPA)

Last updated: 30 October 2026

This Agreement applies when a Business Customer ("Controller") uses Spen and Mazinger Ventures, S.L. ("Processor") processes personal data on its behalf. It forms part of the Terms of Service and complies with Article 28 GDPR. If the Customer has signed a specific DPA, that DPA prevails.

1. Subject matter, duration and nature

• Subject matter: provision of the Spen service described in the Terms.
• Duration: the term of the service contract, plus the time needed to return or delete the data.
• Nature and purpose: accessing, storing, analysing, summarising, classifying, drafting and updating information in Integrations, on Users' instructions.
• Categories of data subjects: the Customer's Users; contacts, clients, suppliers, candidates and other individuals appearing in Customer Content.
• Categories of data: identification and contact data, professional data, communication content (emails, messages, voice notes), calendar, documents, CRM and invoicing data, and any other data the Customer includes in its Content. The Customer must not use Spen to process special categories of data without prior agreement and additional safeguards.

2. Processor obligations

The Processor shall:

1. Process the data only on the Controller's documented instructions (these Terms, Spen's configuration and Users' instructions), unless required by law, and inform the Controller if it considers an instruction infringes data protection law.
2. Not use the data for its own purposes or to train AI models.
3. Ensure that persons authorized to process the data are bound by confidentiality.
4. Implement the security measures in Annex II, appropriate to the risk (Art. 32 GDPR).
5. Assist the Controller in responding to data subject requests.
6. Assist the Controller in meeting its obligations on security, breach notification, impact assessments and prior consultation (Arts. 32 to 36 GDPR).
7. Notify the Controller without undue delay, and within 48 hours of becoming aware, of any personal data breach affecting its data, with the information available.
8. On termination, return or delete the data at the Controller's choice within 30 days, unless retention is legally required.
9. Make available to the Controller the information needed to demonstrate compliance and allow audits, with reasonable notice of 30 days, no more than once a year except following a breach or a regulator's request, and through third-party reports or certifications where sufficient.

3. Sub-processors

• The Controller grants the Processor general authorization to engage the sub-processors listed in Annex III.
• The Processor will give at least 15 days' notice of any new or replacement sub-processor, by email or by updating this page with notice. The Controller may object on reasonable data protection grounds; if no solution is found, it may terminate the contract without penalty and with a pro-rata refund.
• The Processor will impose on each sub-processor obligations equivalent to this Agreement and remains liable for their performance.

4. International transfers

Where a sub-processor processes data outside the EEA, the Processor will ensure a valid basis under Chapter V GDPR (adequacy decision or Standard Contractual Clauses) and supplementary measures where appropriate. At the Controller's request, the Processor will restrict processing of its Content to EU-hosted models, subject to availability and plan terms.

5. Liability

The parties' liability under this Agreement is governed by the Terms of Service, without prejudice to the GDPR's provisions towards data subjects.

Annex I. Parties

• Controller: the Business Customer identified in its account or Specific Agreement.
• Processor: Mazinger Ventures, S.L., Tax ID B55061451, Avinguda de Perpinyà, 31, 17600 Figueres (Girona), Spain. Contact: privacy@spen.ai.

Annex II. Security measures

• Encryption of data in transit (TLS) and at rest.
• Logical isolation of each customer's data.
• Least-privilege access control, multi-factor authentication for staff and periodic access reviews.
• Access and action logs, with security alerts.
• Integration access tokens encrypted and revocable by the User.
• Encrypted backups and business continuity plan.
• Vulnerability management and regular security testing.
• Staff training and confidentiality undertakings.
• Breach management and notification procedure.

Annex III. Sub-processors

Voice notes are transcribed on Mazinger's own infrastructure, without a sub-processor.

Channels (WhatsApp, Slack, Teams, Telegram, SMS) and the Integrations a User connects are services chosen by the Controller and do not act as Mazinger's sub-processors.