Legal Center

Courtesy translation. In case of any discrepancy, the Spanish version prevails.

This Data Processing Agreement ("DPA") supplements the services contract entered into between Hurus AI Systems, S.L. and the Client, and governs the processing of personal data that Hurus carries out on behalf of the Client in its capacity as data processor, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR) and Ley Orgánica 3/2018 (Organic Law 3/2018) (LOPDGDD).

For the purposes of this DPA, the definitions of the GDPR shall apply. In particular:

Within the framework of the service, Hurus may process personal data of professional business contacts —prospects, leads and business counterparts— provided by the Client or identified during prospecting campaigns, for the sole purpose of carrying out the agreed B2B outreach activities.

The data usually processed is limited to: first name and surname, professional job title, company, corporate email address and professional social network profile. No special categories of data under art. 9 GDPR and no data of persons under 18 years of age are processed.

The duration of the processing coincides with the term of the services contract, unless applicable law requires subsequent retention.

Hurus will process personal data exclusively in accordance with the Client's documented instructions, which are set out in the services contract and in the written communications exchanged during performance. Hurus will not process the data for its own purposes nor use it beyond what is strictly necessary for the provision of the service.

If Hurus considers that an instruction from the Client infringes the GDPR or other applicable data protection regulations, it will inform the Client without delay and in writing, and may suspend the execution of that instruction until it receives confirmation or correction from the Client.

The Client declares and warrants that:

Warning: The Client's breach of the above warranties —especially the lack of a legal basis for the processing— shall release Hurus from all liability arising from such processing and shall transfer such liability entirely to the Client as data controller.

To provide the service, Hurus uses specialized external providers acting as sub-processors in the functional categories described in the Privacy Policy (section 5). By accepting these Terms or signing the contract, the Client expressly authorizes the use of such sub-processors.

Hurus warrants that all sub-processors are bound by data processing agreements with data protection obligations equivalent to or stricter than those of this DPA. Hurus will notify the Client with reasonable advance notice of any change in sub-processors that could affect the level of data protection. The Client may object, on reasoned grounds, to such changes within 15 days of the notification.

The up-to-date list of specific sub-processors may be requested at info@hurus.io.

If Hurus directly receives a request to exercise rights (access, rectification, erasure, objection, portability or restriction) from a data subject whose data it processes on behalf of the Client, it will forward it to the Client without delay so that the Client, as data controller, may resolve it.

Hurus will provide reasonable assistance to the Client in responding to requests to exercise rights, providing the information or technical documentation in its possession that is necessary to handle them.

Hurus will apply the technical and organizational security measures described in its Security Policy, ensuring a level of protection appropriate to the risk of the processing in accordance with art. 32 GDPR.

All Hurus personnel with access to data processed on behalf of the Client are subject to contractual confidentiality obligations. Access to such data is strictly limited to the personnel necessary for the performance of the service.

In the event of a security breach affecting personal data processed on behalf of the Client, Hurus will notify the Client as soon as possible —and in any case within a period that allows the Client to comply with the obligation to notify the Spanish Data Protection Agency (AEPD) within 72 hours— including, to the extent available: the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences and the measures adopted or proposed.

Where the processing involves the transfer of personal data outside the European Economic Area, Hurus will ensure that appropriate mechanisms are in place in accordance with Chapter V of the GDPR: Standard Contractual Clauses approved by the European Commission, adequacy decisions or any other equivalent mechanism recognized by the competent authorities.

Hurus will assist the Client, to the extent reasonably possible and with the means at its disposal, in complying with the following obligations of the data controller:

Upon termination of the services contract, Hurus will, at the Client's choice, return all personal data processed on its behalf or securely and irreversibly erase it, within a maximum of 30 days from the Client's request. Hurus will issue a certificate of erasure if the Client so requests.

Hurus may retain the data in blocked form for the time strictly necessary to address possible legal liabilities arising from the contract, with access restricted solely for defensive purposes.

Hurus will make available to the Client all information reasonably necessary to demonstrate compliance with the obligations of this DPA, and will facilitate audits or inspections —by the Client itself or by an authorized external auditor— under reasonable conditions, with a minimum notice of 15 business days and without interfering with Hurus's normal operations or compromising the confidentiality of other clients' data.

The costs arising from audits shall be borne by the Client, unless the audit reveals a material breach attributable to Hurus.

Hurus shall be liable to the Client only for damages caused directly by a breach, attributable to Hurus, of the obligations of this DPA. Hurus's liability under the DPA is subject to the same limits set out in the Terms of Service.

The Client shall indemnify and hold Hurus harmless from any claim, penalty or liability arising from the Client's breach of its obligations as data controller, including the lack of a legal basis for the processing or the breach of its obligations to inform data subjects.