Data Processing Agreement

This Data Processing Agreement ("DPA") supplements the service agreement between FFID and the Customer, governing the processing of personal data in accordance with the General Data Protection Law (Law 13.709/2018 — LGPD, Brazil's data protection law).

Controller: The Customer, which determines the purposes and means of processing the personal data of its customers and leads.

Processor: FFID, which processes personal data on behalf of and according to the instructions of the Controller.

Personal Data Processed: Name, phone number (WhatsApp), email, data on interactions with AI Agents, conversation history, credit data (where applicable to Auria Cred) and other data collected during the customer service journey.

Data Subjects: The Customer's clients, leads and prospects who interact via WhatsApp or other channels integrated into the FFID platform.

The Controller (Customer) is responsible for:

Obtaining valid consent from data subjects for data processing and for sending messages via WhatsApp;

Defining the purposes of the processing of personal data;

Ensuring the lawfulness of the collection and sharing of data with FFID;

Responding to data subjects' requests regarding their rights under the LGPD;

Keeping consent (opt-in) records up to date and auditable.

The Processor (FFID) is responsible for:

Processing personal data exclusively according to the Controller's documented instructions;

Implementing appropriate technical and organizational measures to protect the data;

Notifying the Controller of security incidents within 48 hours;

Assisting the Controller in responding to data subject requests;

Not sharing personal data with third parties without the Controller's prior authorization.

FFID implements the following technical and organizational measures to protect data:

Encryption: Data in transit protected by TLS 1.2+ and data at rest encrypted with AES-256;

Access control: Multi-factor authentication (MFA), principle of least privilege and periodic access reviews;

Infrastructure: Servers with enterprise providers (AWS/GCP) holding SOC 2 and ISO 27001 certifications;

Monitoring: Access and audit logs, intrusion detection and real-time alerts;

Backup: Encrypted backups with a defined retention policy and periodic restore tests;

Training: Staff trained in data protection and information security.

FFID uses the following subprocessors to provide the services:

Meta Platforms, Inc. (USA) — WhatsApp Business API for sending and receiving messages;

Amazon Web Services / Google Cloud Platform — Hosting and processing infrastructure;

OpenAI / Anthropic — Natural language processing for the AI Agents;

The Customer is informed of and agrees to the use of these subprocessors. Any change to the list of subprocessors will be communicated 30 days in advance, allowing the Customer to object on reasonable grounds.

All subprocessors are bound by data protection contractual clauses equivalent to those of this DPA.

Due to the nature of the services (WhatsApp Business API, cloud infrastructure), some personal data may be transferred outside Brazil.

These transfers are carried out on the basis of Art. 33 of the LGPD, using:

Standard contractual clauses approved by the ANPD (Brazil's National Data Protection Authority);

Transfer to countries with an adequate level of data protection;

Specific consent of the data subject where applicable.

FFID keeps records of international transfers and ensures that recipients provide a level of protection equivalent to that of the LGPD.

During the agreement: Data is kept for the period necessary to provide the services and according to the Controller's instructions.

After termination: FFID will keep the data for 90 days for export by the Customer. After this period, the data will be securely and irreversibly deleted.

Retention exceptions: Data may be kept for longer periods when required by a legal or regulatory obligation (e.g., tax records, obligations under the Marco Civil da Internet).

The Controller may request early deletion of data at any time, subject to applicable legal obligations.

In the event of a security incident involving personal data processed under this DPA, FFID undertakes to:

Notify the Controller within 48 hours after confirmation of the incident, stating: the nature of the incident, the categories of data affected, the approximate number of data subjects impacted, the measures taken and recommendations;

Cooperate fully with the Controller in the investigation, mitigation and reporting of the incident to the ANPD and to data subjects, as required by the LGPD;

Document the incident in its own record, keeping records for at least 5 years.

FFID assists the Controller in responding to data subject requests provided for in Art. 18 of the LGPD:

Confirmation of the existence of processing;

Access to personal data;

Correction of incomplete, inaccurate or outdated data;

Anonymization, blocking or deletion of unnecessary data;

Data portability;

Deletion of data processed on the basis of consent;

Information about sharing with third parties;

Withdrawal of consent.

Requests must be directed to the Controller, who may call on FFID for technical support in handling them.