Data processing policy

Last updated: October 9, 2026 · Preliminary version 0.1

Important: this Policy is a preliminary version, subject to legal review, and may change once that review is complete. The version in force is always the one published on this page. In case of any discrepancy, the Spanish version prevails.

1. Purpose and scope

This Data Processing Policy (the "Policy") describes how [PENDING: exact legal name of DM4 Digital Business] ("DM4") processes personal data on the Dairi IA ONE platform (the "Platform") and sets out the rules that apply when DM4 processes, on behalf of its customers (the "Customers"), the personal data of their end customers, leads and contacts (the "End Users").

This Policy forms part of the Terms and Conditions and supplements the Privacy Notice. It is issued under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette (DOF) on March 20, 2025 and in force since March 21, 2025 (the "Law"). With respect to Customer Data, this Policy prevails in case of conflict unless the parties have signed a separate data processing agreement.

2. Roles of the parties

Processing of account data is described in the Privacy Notice. The rest of this Policy mainly concerns Customer Data, for which DM4 acts as a processor and the Customer is the controller.

3. Customer Data processed

Depending on the features the Customer enables, the Platform may process the following End User data:

• Phone number and name.
• WhatsApp and web chat messages, including voice notes and shared files.
• Call recordings and transcripts.
• AI-generated summaries, classifications and data extracted from conversations.
• Contacts imported by the Customer (for example, via CSV files) and the Customer's CRM records.
• Tickets and their service history.
• Results of outbound call and WhatsApp campaigns.
• Information obtained through read-only queries to the Customer's systems (databases, APIs, spreadsheets) and documents uploaded to the knowledge base.

DM4 does not decide what data is collected or from whom; that depends on how the Customer configures the Platform. The Customer should keep its agents from requesting sensitive or financial personal data (for example, health information or full card numbers) unless it has a legal basis and appropriate safeguards to do so [PENDING: confirm with legal counsel whether processing of sensitive data on the Platform should be expressly prohibited].

4. DM4's obligations as processor

With respect to Customer Data, DM4 will:

1. Process it only on the Customer's instructions, which are given through the Platform configuration, the Terms and this Policy.
2. Not use it for any purpose other than providing the service to the Customer, and not sell, rent or disclose it to third parties.
3. Not use it to train general-purpose AI models, whether DM4's own or third parties' [PENDING: confirm under each AI provider's terms that data is not used for training].
4. Implement the security measures described in section 7.
5. Keep it confidential and require the same of its staff and sub-processors, including after the relationship ends.
6. Reasonably assist the Customer in responding to End User rights requests.
7. Notify the Customer of security breaches as set out in section 8.
8. Delete or return Customer Data when the service ends, as set out in section 10.
9. Not disclose it except to its sub-processors or when required by a competent authority, in which case it will inform the Customer where legally permitted.

5. The Customer's obligations as controller

As controller, the Customer will:

• Maintain its own privacy notice that covers the use of technology providers such as DM4 and, where applicable, international transfers, and make it available to End Users.
• Inform End Users that they are being served by an AI-powered virtual assistant and, where applicable, that the call is being recorded, preferably at the start of the interaction.
• Obtain all required consents, especially for marketing calls and messages, and honor opt-out requests.
• Check and honor PROFECO's Do-Not-Call Registry (REPEP) before running promotional campaigns.
• Comply with WhatsApp Business policies (including prior opt-in and message template rules) and telephone carrier policies.
• Ensure that the contacts it imports and the systems it connects were obtained and are used lawfully.
• Handle End Users' ARCO rights requests (access, rectification, cancellation and objection), withdrawals of consent and requests to limit use.
• Configure user permissions and connector credentials on a least-privilege basis.

6. Sub-processors and international transfers

The Customer authorizes DM4 to engage the following sub-processors to provide the service. DM4 will require each of them to meet confidentiality and security obligations at least equivalent to those in this Policy.

Some of these providers are located outside Mexico, so data may be transferred internationally. DM4 will seek to ensure these providers offer an adequate level of protection through contractual clauses or other recognized mechanisms. DM4 will keep this list up to date and give reasonable advance notice of material changes; if the Customer has a well-founded objection to a new sub-processor, it may raise it and, if no solution is found, cancel its subscription.

7. Security measures

DM4 implements administrative, technical and physical safeguards, including:

• HTTPS encryption in transit.
• Hashed password storage; DM4 never sees passwords in plain text.
• AES-256 encryption of connector credentials.
• Read-only connections to the Customer's systems: the Platform queries, but does not modify, data in those systems.
• Role-based access control (owner, administrator, supervisor, agent and read-only), with data segregated between different Customers' accounts.
• Audit trail and access logs (IP address, date and time).
• DM4 staff access limited to what is needed for support, maintenance or security, and subject to confidentiality.
• [PENDING: confirm whether backups exist, their frequency and encryption of data at rest]

8. Security breaches

If DM4 detects a security breach affecting Customer Data, it will notify the Customer without undue delay and in any case within [PENDING: notification deadline, e.g. 72 hours] of confirming it, describing the nature of the incident, the data affected, the measures taken and recommendations for the Customer. As controller, the Customer is responsible for informing affected End Users when the breach significantly affects their rights, and DM4 will provide the information reasonably available to help it do so.

9. End User rights

End Users may exercise their ARCO rights, withdraw consent or limit the use of their data with the Customer, as controller. If DM4 receives such a request directly, it will forward it to the Customer within a reasonable time and will not respond on its own, unless the Customer instructs it to or the law requires it.

The Platform provides tools for the Customer to view, correct, export or delete contacts, conversations and recordings. Where these tools are not enough, the Customer may request assistance at [PENDING: privacy email address].

10. Retention, return and deletion

• While the subscription is active, Customer Data is kept until the Customer deletes it [PENDING: confirm whether automatic retention periods will apply to recordings and transcripts].
• After an account is cancelled or suspended, data is kept for 30 days, during which the Customer may reactivate the account or request an export of its data.
• After that period, DM4 will delete or anonymize Customer Data, except data it must keep by law or at the request of an authority, which will be blocked and kept only for the required period.
• Backup copies will be deleted according to their normal rotation cycles [PENDING: backup rotation period].

11. Use of artificial intelligence

The Platform's agents process conversations using third-party AI models to understand, respond, transcribe, summarize and extract data. These outputs may contain errors. The Customer is responsible for reviewing summaries and extracted data before making significant decisions about End Users, and for not using the Platform to make decisions with legal or similarly significant effects on a person based solely on automated processing, without human involvement, where the law restricts this.

12. Information and cooperation

Upon the Customer's reasonable written request, DM4 will provide information on its security measures and sub-processors so the Customer can demonstrate its own compliance to the competent authority, which under the current Law is the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno). DM4 will reasonably cooperate with the Customer in responding to requests from that authority relating to Customer Data.

13. Data processing agreement

This Policy is the legal instrument governing the processing relationship between the Customer and DM4. Customers who need a signed data processing agreement or specific clauses may request one at [PENDING: privacy email address] [PENDING: decide whether a signed DPA will be offered and for which plans].

14. Changes to this Policy

DM4 may update this Policy. Changes will be posted on this page with their update date and, when material, notified to the Customer's registered email address or through a notice in the portal.

15. Contact

• Privacy email: [PENDING: privacy email address]
• Phone: [PENDING: contact phone number]
• Address: [PENDING: full address]
• Website: dm4digitalbusiness.com