Data Processing Agreement

This Data Processing Agreement (the "Agreement") forms part of the Twinyx Terms and Conditions and governs the processing of personal data that Twinyx carries out on behalf of the user, in accordance with Article 28 of Regulation (EU) 2016/679 ("GDPR") and Article 33 of the Spanish data protection act, Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales ("LOPDGDD"). It is concluded electronically when the Terms are accepted (Article 28.9 of the GDPR).

1. Parties and roles

• Controller: the user who holds the Twinyx account (hereinafter, the "Creator"), for the data of the people they talk to on the Telegram accounts they connect to the service.
• Processor: BAIXOSAMA INVERSIONES, SL, NIF B27854181, with its registered office at Rua Condesa Casa Barcenas, 11, 36204 Vigo, Pontevedra (hereinafter, "Twinyx"), contact: admin@twinyx.app.
• The Creator decides to use Twinyx to manage their conversations, and for what purpose. Twinyx processes that data only to provide the service to them.
• This Agreement does not cover the processing for which Twinyx is the controller: the Creator's account, billing, the security of the service, commercial communications and keeping proof of the artificial intelligence notice, which is a legal obligation of Twinyx's own (Article 50 of Regulation (EU) 2024/1689). That processing is governed by the Privacy Policy.

2. Subject matter, nature and purpose

Twinyx processes the data of the Creator's contacts to provide the contracted service: receiving the messages of their Telegram conversations, generating replies with artificial intelligence on the Creator's behalf and in the Creator's style, classifying the conversations, handing them over to the Creator when appropriate, managing promotion swaps (SFS), filtering spam and showing all of this in their dashboard. The details of the data subjects, the data and the operations are set out in Annex I.

3. Duration

This Agreement lasts as long as the Creator's account. The provisions on the end of the processing (clause 13) and on blocked retention continue to apply afterwards.

4. Documented instructions

• This Agreement and the configuration the Creator sets in their dashboard are the documented instructions for the processing.
• Twinyx will not process the data for its own purposes: it will not use it for advertising, to train or improve artificial intelligence models or to build profiles, and it will not disclose it to third parties, except to the sub-processors in Annex II or when the law requires it. If it did so, it would become the controller of that processing (Article 33.2 of the LOPDGDD).
• International transfers will only be made to the sub-processors in Annex II and with the safeguards indicated there.
• If Twinyx considers that an instruction infringes data protection law, it will inform the Creator immediately.

5. Agreed measures towards contacts

The Creator instructs Twinyx to apply on their behalf, in all their conversations, the following measures, which are part of the service and which the Creator cannot switch off:

• Artificial intelligence notice before the first automatic message, with a text the Creator can reword but not remove.
• Request for explicit consent (Articles 6.1.a and 9.2.a of the GDPR) before any processing of each contact's messages with artificial intelligence, including the declaration that the contact is of legal age, a statement that the contact can withdraw it at any time and the link to the information for contacts, which explains how to do so (by writing STOP in the chat). Without a YES, typed or given with the request's "Yes, I agree" button, the messages are not processed with artificial intelligence. Twinyx keeps proof of each step on behalf of the Creator.
• Stop for possible minors: if a contact indicates that they are a minor, the artificial intelligence stops replying to them and the Creator is alerted.
• Contacts with whom the Creator has already agreed a promotion swap (SFS) or who are on the Creator's trusted partners list (whitelist), and other creators who use Twinyx, do not receive the consent request: their processing is based on the Creator's legitimate interest in managing that commercial arrangement, and they receive the artificial intelligence notice with the link to the information. Anyone proposing a swap for the first time receives the request like any other contact.

6. Confidentiality

Twinyx ensures that the persons authorized to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality (Article 5 of the LOPDGDD), including after their relationship with Twinyx ends. Access by Twinyx staff to conversations is limited to what is necessary for support and security, and it is logged.

7. Security

Twinyx applies the technical and organizational measures in Annex III, appropriate to the risk of the processing (Article 32 of the GDPR), taking into account that the conversations may contain special categories of data. Twinyx may update them as long as it does not lower the level of protection.

8. Sub-processors

• The Creator gives Twinyx general authorization to engage the sub-processors in Annex II.
• Twinyx will inform the Creator, by email or through a notice in the dashboard, of any addition or replacement of a sub-processor at least 30 days in advance. The Creator may object on reasonable data protection grounds; if no solution is found, the Creator may terminate the contract without penalty before the change takes effect.
• Twinyx will impose on each sub-processor, by contract, the same data protection obligations as in this Agreement (Article 28.4 of the GDPR) and will remain liable to the Creator for each sub-processor's compliance with those obligations.

9. Data subjects' rights

• Twinyx provides the Creator and their contacts with the tools to exercise rights: withdrawal of consent with STOP, data export and deletion from the dashboard, and handling of requests by email.
• General instruction: the Creator instructs Twinyx to handle directly, on their behalf, the requests for access, rectification, erasure, objection, restriction and portability that their contacts send, verifying the contact's identity proportionately and replying within the legal period of one month. Twinyx will inform the Creator of each request handled and, before replying, will refer to the Creator any request that requires their decision.
• If the Creator receives directly a request that requires action on the data processed by Twinyx, the Creator will forward it to admin@twinyx.app.

10. Assistance to the controller

Taking into account the nature of the processing and the information available to it, Twinyx will help the Creator comply with their obligations regarding security, notification of breaches, impact assessments and prior consultation (Articles 32 to 36 of the GDPR). In particular, on request, it will make available to the Creator a summary of the impact assessment of the service carried out by Twinyx.

11. Personal data breaches

Twinyx will notify the Creator of any security breach affecting their contacts' data without undue delay and, in any case, within 48 hours at most of becoming aware of it, with the information under Article 33.3 of the GDPR available at that time, which it will complete later. Twinyx will document the breach, take measures to mitigate it and cooperate with the Creator in notifying it to the supervisory authority and, where applicable, to the data subjects.

12. Information and audits

Twinyx will make available to the Creator the information needed to demonstrate compliance with this Agreement (including this Agreement, the description of the security measures and the summary of the impact assessment) and will allow for and contribute to audits, including inspections, conducted by the Creator or by another auditor mandated by the Creator. Audits will be announced 30 days in advance, limited to one per year unless there are signs of non-compliance or an authority requires it, carried out during business hours, without access to other customers' data, under a confidentiality commitment and at the Creator's expense, unless they reveal a breach by Twinyx.

13. End of the processing

• Before deleting their account, the Creator can export the data from their dashboard; this export is the return of the data provided for in Article 28.3.g of the GDPR.
• By deleting the account, the Creator decides that the data is to be destroyed (Article 33.3 of the LOPDGDD). If the Creator deletes it from Settings, Twinyx erases the data from its systems immediately; if the Creator requests the deletion by email, Twinyx carries it out within the period in section 10 of the Privacy Policy (one month, which may be extended by two further months in complex cases).
• After the erasure, backups are overwritten within 24 hours, queued or failed technical tasks are deleted within 7 days, and technical and observability logs within 30 days. Google keeps the data it has already received (Gemini API, Annex II) for up to 55 days, only to detect abuse, and then erases it.
• When the account is deleted, or when the Creator removes a connected Telegram account, Twinyx may keep, duly blocked, the proof of the artificial intelligence notice, the proof of the contacts' consent and the flags of possible minors (in the second case, those of that Telegram account) for as long as liabilities may arise from its relationship with the Creator, and for 3 years at most (Article 33.4 of the LOPDGDD). Blocked data will only be made available to judges and courts, the Public Prosecutor's Office or the competent authorities, and will be destroyed when that period ends.

14. Obligations of the Creator

The Creator, as controller, undertakes to:

• Use the service only with people who write to them; Twinyx does not start conversations.
• Not attempt to circumvent, hide or distort the artificial intelligence notice or the consent request, nor give instructions contrary to the law.
• Not use the service with minors, and verify the age of those who buy adult content when the law requires it. The automatic stop for possible minors is a supporting measure and does not replace this obligation.
• Upload for style analysis only screenshots of their own conversations and, where possible, hide their contacts' names in them.
• Comply with their other obligations as controller (including the record of processing activities under Article 30 of the GDPR, where it applies to them) and cooperate with Twinyx in handling their contacts' rights.

15. Liability

Each party is liable for the damage it causes by breaching this Agreement or data protection law, in accordance with Article 82 of the GDPR. In all other respects, the limitations of liability in the Terms apply, except where the law does not allow liability to be limited.

16. Precedence and applicable law

In matters of data protection, this Agreement prevails over any other provision of the Terms. It is governed by Spanish law and by the GDPR; disputes are submitted to the courts that have jurisdiction under the Terms.

Annex I. Description of the processing

Annex II. Authorized sub-processors

The following are not sub-processors: Telegram, the messaging platform chosen by the Creator, which processes the messages as an independent controller, and the artificial intelligence observability tool, which Twinyx hosts on its own OVHcloud infrastructure.

Annex III. Technical and organizational measures

• Encryption of communications (TLS/HTTPS) between users, Telegram, providers and Twinyx.
• Passwords stored only as bcrypt hashes, checked against leaked passwords.
• Two-factor authentication mandatory for staff with administrative access; two-factor secrets encrypted (AES-256-GCM).
• Data isolation per account and per connected Telegram account; parameterized queries.
• Logging of administrative access to conversation data and of relevant security actions.
• Rate limits and measures against abuse and spam.
• Minimization: images processed in memory without being stored; limited history; technical and observability logs kept for 30 days; job queues kept for 1 to 7 days; no contact data in traces beyond what is needed to debug the service.
• Prior consent of contacts before any processing with artificial intelligence, and a stop for possible minors.
• Daily database backup, overwritten every 24 hours.
• Providers bound by a data processing agreement, with safeguards for international transfers.
• Documented procedures for handling security breaches and rights requests; regular security reviews; confidentiality commitment of staff.