Data processing agreement
Last updated: 20 October 2026
This English version is a courtesy translation. In case of discrepancy, the Spanish version prevails.
Template pending legal review. This is the agreement we offer organisations and public bodies subscribing to TARJE2ME, under Article 28 GDPR and Article 33 of the Spanish Data Protection Act (LOPDGDD). Before signing, it is completed with each client’s details and may be adapted to their tender specifications. Request an editable copy at oscar@indole.es.
1. Parties
Controller: the client organisation or public body (the Controller).
Processor: INDOLE DATA TECHNOLOGY S.L.L., NIF B39887120, Paseo del Niño 3, 39300 Torrelavega (Cantabria), Spain (the Processor).
2. Subject matter, duration and nature
The Processor processes personal data on behalf of the Controller to provide the TARJE2ME service: creating, hosting and displaying digital business cards for its staff, managing the contacts captured by its staff and, once available and enabled by the Controller, its events and integrations. Operations: collection, recording, structuring, storage, consultation, disclosure by transmission to the systems indicated by the Controller, erasure and destruction.
The duration matches that of the service contract. When it ends, clause 8 applies.
3. Types of data and categories of data subjects
- Controller’s staff: full name, job title, department, entity, professional contact details, photograph, professional social profiles and usage statistics for their card.
- Contacts captured by staff or at events: name, company, job title, contact details, notes, tags, event and proof of consent.
- Participants in events organised by the Controller, once events mode is available: badge data, interests and sector.
No special categories of data are processed. The Controller undertakes not to enter any.
4. Processor’s obligations
- Process the data only on the Controller’s documented instructions, including those given when configuring the service, and notify it if it believes an instruction infringes the law.
- Ensure that persons authorised to process the data have committed to confidentiality.
- Apply the security measures in clause 6.
- Not engage another processor without complying with clause 5.
- Assist the Controller in responding to data subjects’ rights, providing tools for access, export, rectification and erasure, and forwarding without delay any request received directly.
- Assist the Controller in meeting its obligations on security, breach notification, impact assessments and prior consultation.
- Notify the Controller, without undue delay and within 48 hours of becoming aware, of any personal data breach, with the information needed to document and report it.
- Keep a record of processing activities as a processor.
- Not process the data outside the European Economic Area without the Controller’s prior written authorisation and the safeguards of Chapter V GDPR.
5. Sub-processors
The Controller gives the Processor general authorisation to engage sub-processors. The Processor will inform it of any addition or change at least 30 days in advance, and the Controller may object on reasonable grounds. Each sub-processor is bound by the same obligations as this agreement.
Current sub-processors:
| Service | Location | Status |
|---|---|---|
| Platform hosting and backups | European Union; server managed by Índole | Active |
| Optional automatic AI reading: Anthropic | United States | Only if the Controller enables it; processes what is sent in order to read it, without storing it or using it for training |
| Transactional email, payment gateway | — | Will be added to this list before going live |
6. Security measures
- Encryption of communications (TLS).
- Role-based access control (super admin, entity admin, editor and employee) and passwordless sign-in with a one-time code sent to the user’s email.
- Logical separation of each organisation’s data.
- Regular backups.
- Audit log of changes made in the dashboard.
- Data minimisation: card analytics store nothing that identifies the person opening a card; consent is evidenced without storing the IP address.
- Roadmap towards the Spanish National Security Framework (ENS). TARJE2ME is not currently certified under the ENS or ISO 27001.
7. Controller’s obligations
The Controller warrants that it has a legal basis for the data it provides or causes to be captured, informs data subjects, configures the service according to its instructions and oversees the processing, including the audits in clause 9.
8. Return and deletion
When the service ends, the Processor will make the data available to the Controller in standard formats (CSV and VCF) for 30 days and will then delete it, including copies, except data it must keep blocked under a legal obligation while liabilities may arise. Backups are erased in their ordinary renewal cycle. The Processor will certify deletion on request.
9. Information and audits
The Processor will make available to the Controller the information needed to demonstrate compliance with this agreement, and will allow and contribute to audits and inspections conducted by the Controller or another auditor it mandates, with reasonable notice and without affecting the security or data of other clients.
10. Governing law
This agreement is governed by the GDPR, the LOPDGDD and other applicable Spanish law. In case of conflict with the service contract on data protection matters, this agreement prevails.