Service Legal Agreements

1. Parties 2. Purpose of the Agreement 3. Subject Matter of the Processing 4. Identification of the Information Affected
5. Obligations of the CONTROLLER
6. Obligations of the PROCESSOR
7. Liability of the PROCESSOR
8. Notices
9. International Data Transfers
10. Miscellaneous
11. Data Protection Officer
ANNEX 1 — Authorised Subprocessors

1. Parties

1.1 On the one hand: the contracting entity responsible for providing the Services (hereinafter, “INVOFOX”):

INVOFOX, Inc., a company incorporated under the laws of the United States, registered in the Delaware Commercial Register under number 7218056, with its registered address for these purposes at 251 Little Falls Drive, Wilmington, New Castle County, DE 19808, Delaware (United States), and email address support@invofox.com.
INVOFOX INC SUCURSAL EN ESPAÑA, a branch incorporated under the laws of Spain, with Tax ID W0265699I, with registered address at calle Aranjuez 2, local, 28039 Madrid (Spain), and email address support@invofox.com.

The CLIENT shall contract the Services with the entity designated in the Purchase Order.

1.2 On the other hand: the CLIENT, a legal entity contracting the Services of INVOFOX.

1.3 Hereinafter, INVOFOX and the CLIENT shall be jointly referred to as the “Parties” and individually as a “Party”.

1.4 The Parties mutually acknowledge that they have sufficient legal capacity to contract and to fulfil their respective obligations.

2. Purpose of the Agreement

2.1 The Parties agree to execute this data processing agreement for the purpose of regulating the personal data processing operations carried out by INVOFOX, establishing the procedure that will govern the processing of personal data, as well as the rights, responsibilities, and obligations inherent to its role as data processor (hereinafter, the “Data Processing Agreement”).

2.2 Based on the contractual relationship and the nature of INVOFOX’s services, the CLIENT is the data controller (hereinafter, the “CONTROLLER”), and INVOFOX is the data processor (hereinafter, the “PROCESSOR”).

2.3 The Parties agree that this Data Processing Agreement shall be governed by EU Regulation 2016/679 (General Data Protection Regulation – GDPR) and by Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and Guarantee of Digital Rights (hereinafter, the “LOPDGDD”), as well as any applicable regulations and the terms established herein.

2.4 The CLIENT’s signature of the Purchase Order entails full acceptance of the Data Processing Agreement, unless INVOFOX has expressly agreed in writing to any modification.

3. Subject Matter of the Processing

Through this Data Processing Agreement, the PROCESSOR is authorised to process, on behalf of the CONTROLLER, the personal data necessary for the provision of INVOFOX services. The processing shall mainly consist of:

Digitisation and processing of Documents that the CONTROLLER sends to the PROCESSOR via the channels enabled for this purpose.
Storage of said Documents and of the processed data on servers managed by the PROCESSOR and accessible to both Parties at all times through the INVOFOX Platform.
Provision of maintenance and support services for the INVOFOX Platform.
Generation and use of statistical data to improve the services provided by the PROCESSOR.

4. Identification of the Information Affected

The CONTROLLER provides the PROCESSOR with the information contained in the Documents subject to digitisation and processing services, including but not limited to:

Identification data: names and surnames, national ID numbers, passport numbers, tax ID numbers, social security numbers, insurance numbers, public and private healthcare identification, dates of birth, signatures, email addresses, telephone numbers, bank account numbers, IP addresses, etc.
Professional or employment data: job categories, positions, professional experience, professional certifications, licences, professional association data, salaries, remuneration, withholdings, hiring and termination data, permits, etc.
Academic data: qualifications, academic records, specific training, etc.
Other data: usernames and passwords of Authorised Users, geographical areas, and usage data of the Platform.

Under no circumstances shall the PROCESSOR be responsible for the type of information contained in the Documents sent by the CONTROLLER.

5. Obligations of the CONTROLLER

The CONTROLLER undertakes to:

a. Apply and comply with the GDPR, the LOPDGDD, and any applicable data protection regulations.

b. Provide data subjects with the information required under the GDPR at the moment their personal data is collected.

c. Where possible, anonymise or pseudonymise data and, in any case, provide the PROCESSOR only with the data referred to in Clause 4.

d. Conduct a data protection impact assessment for the processing operations to be carried out by the PROCESSOR.

e. Perform any necessary prior consultations.

f. Supervise the processing, including conducting audits and inspections of the PROCESSOR.

g. Ensure, prior to and throughout the processing, that the PROCESSOR complies with applicable regulations.

6. Obligations of the PROCESSOR

The PROCESSOR undertakes to:

a. Use personal data only for the purpose described in this Agreement. The PROCESSOR may not use the data for its own purposes except as provided in Clause 10.4 of the General Terms and Conditions.

b. Process the data according to the CONTROLLER’s instructions. If any instruction infringes the GDPR, the LOPDGDD or any applicable regulation, the PROCESSOR shall immediately inform the CONTROLLER.

c. Maintain a written record of all categories of processing activities carried out on behalf of the CONTROLLER, including:

Contact details of the PROCESSOR and CONTROLLER (and representatives, if applicable).
Categories of processing carried out.
International transfers, where applicable.
Description of security measures applied (pseudonymisation, encryption, confidentiality, integrity, availability, resilience, recovery, auditing, etc.).

d. Not disclose data to third parties without express authorisation from the CONTROLLER unless legally required.
e. Subcontract cloud storage services only with the entities listed in Annex 1, or others duly notified in writing to the CONTROLLER, following the applicable authorisation procedure.
f. Maintain confidentiality even after the termination of services.
g. Ensure that authorised personnel commit in writing to confidentiality and to following security measures.
h. Maintain documentation proving compliance with the above obligations.
i. Ensure necessary data protection training for authorised personnel.
j. Assist the CONTROLLER, where possible, in responding to data subject rights requests (access, rectification, erasure, opposition, restriction, portability, and objection to automated decisions).
k. Provide information to data subjects when collecting data.
l. Notify the CONTROLLER of any personal data breach without undue delay and no later than 48 hours.
m. Assist the CONTROLLER in performing data protection impact assessments.
n. Provide all necessary information to demonstrate compliance.
o. Implement mechanisms to ensure:

Confidentiality, integrity, availability, and resilience of systems.
Rapid restoration of data availability after incidents.
Regular verification and evaluation of security measures.

p. After termination of the Contract, retain and allow the CLIENT to download Extracted Data for one (1) year. After that period, the PROCESSOR may delete the data unless the CONTROLLER requests deletion or return in writing, unless retention is required by law.

7. Liability of the PROCESSOR

7.1 The PROCESSOR shall be considered a CONTROLLER if it processes data for a different purpose, communicates it, or uses it contrary to this Agreement. In such cases, the PROCESSOR shall be personally liable for any infringements.

7.2 The PROCESSOR shall compensate the CONTROLLER for any damages arising from the breach of this Agreement.

7.3 INVOFOX holds a valid civil liability insurance policy with a reputable insurer, including coverage for personal data breaches and sanctions arising from such breaches.

8. Notices

Identical wording to the Confidentiality Agreement:

Notices must be in writing via email.
Notices to the CLIENT shall be sent to the email address designated by the CLIENT; notices to INVOFOX shall be sent to support@invofox.com.
The sending timestamp shall be used for all deadline calculations.

9. International Data Transfers

9.1 Personal data may only be transferred outside the EEA where strictly necessary to fulfil this Agreement and to jurisdictions not covered by an adequacy decision.

9.2 Any such transfer shall be governed by the applicable Standard Contractual Clauses (Module 4), which are incorporated by reference and shall prevail in case of conflict.

9.3 Other mechanisms under applicable legislation may also apply.

9.4 The CONTROLLER expressly accepts that personal data may be transferred to or stored by subprocessors outside the EEA, including jurisdictions without adequacy decisions, provided conditions in Clauses 9.2 and 9.3 are met.

10. Miscellaneous

The Data Processing Agreement forms an integral part of the Contract.
In case of conflict, this Agreement prevails over the General Terms and Conditions regarding data protection matters.
Assignments require prior written consent, except those made by INVOFOX to group entities.
Changes of address must be notified immediately.
Invalid clauses do not affect the remaining Agreement.
INVOFOX may update the Agreement to reflect legal or platform changes, notifying the CLIENT in advance.

11. Data Protection Officer

The Data Protection Officer appointed is:

Equal Consulting, S.L.P.

Tax ID: B86823267

Address: calle Santa Engracia 17, 6th floor, 28010 Madrid (Spain)

Email: equaldpo@equalprotecciondedatos.com

Telephone: +34 914 456 569

‍

Last revision date: October 2025

ANNEX 1 — Authorised Subprocessors

List of entities authorised by the CONTROLLER to subcontract the services related to the cloud storage of the content accessible from the INVOFOX Platform:

Subprocessor

Use

Location

Guarantees

Amazon AWS

Cloud hosting service

European Union

Region selected by the client

Microsoft Azure

Cloud hosting service

European Union

Region selected by the client

MongoDB Atlas

Data hosting

European Union

1. Parties 2. Purpose of the Agreement 3. Confidential Information 4. Nature of the Confidential Information
5. Custody and Non-Disclosure
6. Exclusions from this Non-Disclosure Agreement
7. Breach
8. Entry into Force and Duration
9. Notices
10. Miscellaneous
11. Governing Law and Jurisdiction

1. Parties

1.1 On the one hand: the contracting entity responsible for providing the Services (hereinafter, “INVOFOX”):

INVOFOX, Inc., a company incorporated under the laws of the United States, registered in the Delaware Commercial Register under number 7218056, with its registered address for these purposes at 251 Little Falls Drive, Wilmington, New Castle County, DE 19808, Delaware (United States), and email address support@invofox.com.
INVOFOX INC SUCURSAL EN ESPAÑA, a branch incorporated under the laws of Spain, with Tax ID W0265699I, registered address at calle Aranjuez 2, local, 28039 Madrid (Spain), and email address support@invofox.com.

The CLIENT shall contract the Services with the entity designated in the Purchase Order.

1.2 On the other hand: the CLIENT, a legal entity contracting the Services of INVOFOX.

1.3 Hereinafter, INVOFOX and the CLIENT shall be jointly referred to as the “Parties” and individually as a “Party”.

1.4 The Parties mutually acknowledge that they have sufficient legal capacity to contract and to fulfil their respective obligations.

2. Purpose of the Agreement

2.1 The Parties agree to execute this non-disclosure agreement for the purpose of ensuring the confidentiality of the information and data accessed by the Parties, establishing the procedure governing the custody and non-transmission to third parties of such information, as well as the rights, responsibilities, and obligations inherent in their capacity as sender, owner, and recipient of such information (hereinafter, the “Non-Disclosure Agreement”).

2.2 The CLIENT’s signature of the Purchase Order entails full acceptance of the Non-Disclosure Agreement, unless INVOFOX has expressly agreed in writing to any modification of it.

3. Confidential Information

3.1 The Parties agree that any information relating to their commercial, financial, technical and/or industrial aspects supplied to the other Party shall be considered confidential information and shall be treated in accordance with this Non-Disclosure Agreement (hereinafter, “Confidential Information”). By way of example and without limitation, this includes billing data, addresses, customer databases, emails, concepts, knowledge, techniques, procedures, know-how, business plans, designs, drawings, trademarks, or logos.

Likewise, all information marked as confidential at the time it is delivered to the other Party shall be considered Confidential Information.

3.2 The information provided, including any copies and/or reproductions, shall be considered Confidential Information for the purposes of this Non-Disclosure Agreement, regardless of whether such transmission is made orally, in writing, in magnetic format, or through any other computer, graphic, or similar medium.

3.3 Neither Party shall disclose the content of or make announcements related to this Non-Disclosure Agreement without the other Party’s prior written consent, except where required by law or by a competent authority.

4. Nature of the Confidential Information

4.1 Confidential Information shall at all times remain the property of the Party providing it. INVOFOX undertakes to use the Confidential Information provided by the CLIENT solely within the scope of its business activities.

4.2 The CLIENT represents and warrants that it is duly authorised to provide the documentation and information submitted, and shall hold INVOFOX harmless from any third-party claims arising from access to such documentation or information.

5. Custody and Non-Disclosure

5.1 INVOFOX undertakes to strictly safeguard and protect the Confidential Information that the CLIENT may provide. INVOFOX shall limit access to Confidential Information to its personnel whose involvement is necessary for the provision of the services, and shall, in all cases, ensure that the obligations and responsibilities contained in this Non-Disclosure Agreement are communicated to such personnel.

5.2 The Parties agree that INVOFOX shall not disclose the Confidential Information, either wholly or partially, to any third party without the CLIENT’s prior, express, written consent. Such consent shall not be required where disclosure of the Confidential Information is mandated by applicable law or by a final administrative or judicial decision.

6. Exclusions from this Non-Disclosure Agreement

Information shall not be considered Confidential Information, nor shall it receive such treatment, where:

I – It is publicly known at the time it is disclosed to the recipient, or becomes public after disclosure without the recipient being the cause of such disclosure.

II – The recipient can prove that it was legitimately in possession of the information prior to this Non-Disclosure Agreement.

III – It has been publicly disclosed without restriction by its legitimate creator.

IV – It must be disclosed due to a legal obligation, applicable regulation, or a final administrative or judicial decision; in such case, the recipient undertakes to notify the sender immediately of the existence, circumstances, and terms of such request.

7. Breach

7.1 Total or partial breach of the confidentiality obligations set out in this Non-Disclosure Agreement may result in the termination of the contractual relationship. Furthermore, the non-breaching Party shall have the right to claim compensation for any damages arising from such breach.

7.2 In this regard, INVOFOX shall be liable only up to the limit established in the service contract executed between the Parties.

8. Entry into Force and Duration

This Non-Disclosure Agreement and the obligations contained herein shall enter into force on the date of signature and shall remain in effect even after the negotiations or contractual relationship have ended.

9. Notices

9.1 Any notices between the Parties relating to this Non-Disclosure Agreement shall be made in writing via email.

9.2 Notices addressed to the CLIENT shall be sent to the email address designated by the CLIENT in its identification details; notices addressed to INVOFOX shall be sent to support@invofox.com.

9.3 For all notices exchanged between the Parties, the date indicated by the sending system shall be considered valid for the purpose of calculating time periods, irrespective of the date on which the recipient accesses the notice.

10. Miscellaneous

10.1 The Non-Disclosure Agreement forms an integral part of the Contract for all purposes.

This Non-Disclosure Agreement constitutes the final agreement between the Parties concerning the Confidential Information and replaces any previous oral or written understandings between the Parties.

10.2 The Parties may not assign all or part of their rights or obligations under this Non-Disclosure Agreement to any third party without the prior written consent of the other Party.

However, as the sole exception, no prior written consent shall be required if INVOFOX assigns all or part of its rights or obligations to companies, subsidiaries, or branches over which it exercises control or which belong to its same corporate group.

10.3 If any clause or provision of this Non-Disclosure Agreement is declared null or void, such declaration shall not affect the remaining clauses. Any invalid clause shall be replaced or supplemented with another that, while compliant with the law, reflects the spirit and purpose of the replaced clause.

10.4 Any delay or failure by INVOFOX to exercise any right under this Non-Disclosure Agreement shall not constitute a waiver of such right, nor shall it be interpreted as a waiver of its exercise in relation to subsequent acts.

10.5 INVOFOX shall not be liable for the breach of any of its obligations under this Non-Disclosure Agreement if such breach results from a force majeure event. While the force majeure event persists, contractual obligations shall be deemed suspended.

11. Governing Law and Jurisdiction

11.1 This Non-Disclosure Agreement shall be governed by and interpreted in accordance with Spanish law.

11.2 The Parties agree to submit any dispute arising from this Non-Disclosure Agreement to the courts and tribunals of Madrid (Spain), expressly waiving any other jurisdiction.