Data Processing Agreement (DPA)

The DPA sets out Makatea as Processor of your portfolio data. It is accepted with the Terms, with no separate signature. Makatea reports any incident within 24 hours. It includes the standard contractual clauses for the European Union and the United Kingdom. Sub-processor changes come with 30 days' notice.

SOLUCIONES ORIENTADAS AL BIENESTAR DE LAS PERSONAS SOLU S.A.P.I. de C.V., a Mexican company that operates the "Makatea" platform, with tax ID (RFC) SOB240719U87 and address at Avenida del Valle 162, Colonia Ciudad del Valle, C.P. 63157, Tepic, Nayarit, Mexico (hereinafter "Makatea" or the "Processor"; in Brazil, Operador).

This Data Processing Agreement (the "DPA") is an integral and ancillary part of the Services Agreement or Terms of Service (the "Main Agreement") entered into between:

• You, the Customer, identified in the Main Agreement, acting as data Controller (in Brazil, Controlador; hereinafter the "Controller" or "Customer"); and
• SOLUCIONES ORIENTADAS AL BIENESTAR DE LAS PERSONAS SOLU S.A.P.I. de C.V., acting as data Processor (in Brazil, Operador).

You accept this DPA electronically when you accept the Terms of Service and sign up for or subscribe to the platform (click-wrap acceptance). The DPA is incorporated by reference into the Main Agreement and does not require a handwritten signature or a separate signing step. The current public version of this DPA is available at https://makatea.ai/en/legal/dpa.

If this DPA and the Main Agreement conflict on personal data protection, this DPA prevails.

1. Definitions and legal framework

1.1 Definitions. The terms "personal data", "sensitive data" or "special categories", "processing", "controller", "processor", "sub-processor", "data subject", "transfer" or "transmission" or "cross-border flow", "profiling or automated decision" and "security incident or breach" have the meaning given by the data protection law of the Controller's country.

1.2 Roles. The parties acknowledge that, for the portfolio data the Customer uploads, imports or generates in the Makatea platform, the Customer is the Controller and Makatea is the Processor, processing that data only on behalf of and on the instructions of the Customer. Makatea acts as Controller only for the user-customer's own account data (sign-up, billing and account administration data), which is governed by Makatea's Privacy Policy and is outside the scope of this DPA.

1.3 Applicable law. This DPA is designed to comply, depending on the location of the Controller and the data subjects, with:

• Mexico: Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its supplementary Regulation. Authority: Secretaría Anticorrupción y Buen Gobierno.

• Colombia: Statutory Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Single Decree 1074 of 2015). Authority: Superintendencia de Industria y Comercio (SIC). The applicable figure is the transmission contract of art. 25 of Decree 1377.

  Special regime of financial habeas data (Law 1266 of 2008). When processing includes financial, credit, commercial or service information about debtors in Colombia, the Controller (Customer) may be subject, in addition to the general regime (Law 1581 of 2012 and Decree 1377 of 2013), to the special financial habeas data regime of Law 1266 of 2008, as a possible source and/or operator of information, with the obligations, principles and data subject rights that law imposes. Whether the Customer acts as source and/or operator, and compliance with the related duties (including quality and accuracy of negative data, permanence periods and handling of inquiries and claims under Law 1266), are the sole responsibility of the Controller. Makatea, as Processor, processes that information only on the Controller's documented instructions and does not act as a credit bureau, information operator or financial database on its own account, nor reports information to credit bureaus without the Customer's express and documented instruction.

• Brazil: Law No. 13,709/2018 (LGPD) and CD/ANPD Resolutions No. 18/2024 and No. 19/2024. Authority: ANPD.

• Ecuador: Organic Law on Personal Data Protection (LOPDP), its General Regulation and Resolution SPDP-SPD-2026-0004-R. Authority: Superintendencia de Protección de Datos Personales (SPDP).

• Peru: Law No. 29733 and its Regulation approved by Supreme Decree No. 016-2024-JUS. Authority: National Authority for Personal Data Protection (APDP) of MINJUSDH.

• European Union and European Economic Area: Regulation (EU) 2016/679 (GDPR), in particular its article 28. This DPA includes the EU and UK Annex.

• United Kingdom: UK GDPR and Data Protection Act 2018. Authority: Information Commissioner's Office (ICO).

• United States: state privacy laws applicable to the Controller. Makatea acts as a service provider or processor and does not sell or share portfolio data.

• India: Digital Personal Data Protection Act, 2023. Makatea acts as the Controller's Data Processor.

• Other countries: the data protection law of the Controller's and data subjects' country. The obligations of this DPA apply to the extent that law allows.

2. Subject matter, nature, purpose and duration of processing

2.1 Subject matter. This DPA governs the processing that Makatea, as Processor, carries out on the Customer's portfolio personal data in providing the Makatea platform services (portfolio management, communication with customers and debtors, payment records, reconciliation, campaigns and reports).

2.2 Nature of processing and operations. Depending on the features the Customer uses and as recorded in the platform, processing includes the following operations that Makatea carries out on behalf of the Customer:

Communications under operation O2 use the operating channels, WhatsApp and email. SMS is not an operating channel. If enabled in the future, it will be documented separately.

Determining the lawful basis of each operation is the sole responsibility of the Controller. The Customer undertakes to document the lawful basis of each operation (in the account configuration or in the lawful basis annex the parties keep) and Makatea undertakes to process data only according to those bases and instructions. In the B2B context, the processor's typical basis is performance of the contract and/or the controller's legitimate interest (art. 7 LGPD, art. 6 GDPR and equivalents in other jurisdictions), not consent.

2.3 Purpose. Makatea processes data only to provide the contracted services to the Customer and on its documented instructions. Makatea does not use the Customer's portfolio data for its own purposes other than providing the service.

2.4 Duration and retention criteria. Processing lasts for the term of the Main Agreement and ends under Clause 12 (Return and deletion). The retention policy by data category is:

When the account is cancelled, data is deleted or anonymized, except where there is a legal retention obligation (for example, tax, accounting or anti-money-laundering), in which case it is kept only for the period and purpose the law requires.

3. Types of personal data and categories of data subjects

3.1 Categories of data subjects. Individuals in the Customer's portfolio, typically customers or debtors of the Customer, and possibly their associated contacts.

3.2 Types of data processed. Makatea may process the following categories of portfolio data, to the extent the Customer uploads them or they arise from use of the service:

3.3 Sensitive data, special categories and financial data. The platform is not designed to process sensitive data (health, biometrics, ethnic origin, beliefs and similar). However, free-text fields (notes), unlimited custom fields and KYC documents could contain, by the Customer's own decision, data that applicable law considers sensitive or financial. Therefore:

(a) The Customer undertakes not to upload unnecessary sensitive data and to apply data minimization.

(b) When the Customer uploads sensitive data, it is solely responsible for obtaining the enhanced or explicit consent required by applicable law (LFPDPPP arts. 7-8 Mexico; Law 1581 art. 9 Colombia; LGPD art. 11 Brazil; enhanced basis LOPDP Ecuador; in writing Law 29733 Peru; art. 9 GDPR in the European Union and the United Kingdom).

(c) When the Customer uploads financial data (balances, CLABE, proofs, KYC documents), it undertakes to prove, on request, the express consent that Mexico requires for financial data (LFPDPPP arts. 7-8) and the equivalent basis in other jurisdictions.

(d) Makatea does not validate or assume the role of Controller regarding the lawful basis of that data. The risk of uploading sensitive or financial data without a valid basis lies with the Customer.

4. Controller's instructions

4.1 Makatea processes data only on the Customer's documented instructions. The initial instruction is the use of the platform under the Main Agreement, this DPA and the configuration the Customer sets in the application. As processor, Makatea follows the controller's instructions (art. 39 LGPD, art. 28 GDPR and equivalents).

4.2 Makatea does not process data for its own purposes or disclose it to third parties except (i) on the Customer's instruction, (ii) to provide the service through the sub-processors of Clause 8, or (iii) when required by a legal obligation, in which case Makatea informs the Customer in advance unless legally prohibited.

4.3 If Makatea considers that an instruction from the Customer infringes applicable data protection law, it notifies the Customer without delay.

4.4 Makatea does not decide on the content, accuracy or lawfulness of the data uploaded by the Customer. Determining the purposes, the lawful basis and obtaining the data subject's consent is solely the Customer's responsibility as Controller.

5. Confidentiality

5.1 Makatea ensures that every person authorized to process the Customer's personal data is bound by a contractual or legal duty of confidentiality that survives the end of the relationship.

5.2 Access to data is limited to staff who need it to provide the service, under the principle of least privilege.

5.3 The duty of confidentiality extends to sub-processors, under Clause 8.

6. Security measures

Makatea applies the following technical and administrative measures to protect the data.

6.1 Encryption in transit (TLS/HTTPS) and at rest. Platform communications and service functions run over HTTPS/TLS, including endpoints to sub-processors. Data at rest is encrypted with AES-256 on the cloud infrastructure that hosts it, and payment data is processed in the payment processors' PCI-DSS environments.

6.2 Isolation by organization. Isolation is enforced at the database level in the main tables. Each query checks membership in the Customer's organization. Makatea keeps this isolation through continuous internal reviews.

6.3 Access control to integration secrets. Integration keys (messaging, payment processors, service and scheduled tasks) are stored encrypted or with restricted reading and are not accessible to the organization's end users.

6.4 Private storage of documents and media. KYC documents, inbound media files, template attachments and reconciliation files are kept in private storage, with access policies restricted to the Customer's organization.

6.5 Audit log. The platform automatically records actions (create, update, delete, sign-in, import, send, payment), the affected resource, before and after snapshots, IP address, user agent and timestamp. The application only appends events to the log and offers no operations to edit or delete them.

6.6 Integrity of critical operations. Payment operations run through atomic functions protected against race conditions. The payment ledger only accepts new entries (reversals are recorded as new entries, never as updates).

6.7 Evidence. The measures in this Clause are evidenced to the Customer through the documentation and assistance of Clause 11. Any third-party certifications Makatea obtains will be communicated to the Customer separately.

7. Assistance to the Controller

7.1 Data subject rights. Makatea reasonably assists the Customer in handling data subjects' requests to exercise their rights under applicable law:

• Mexico (LFPDPPP): ARCO rights, Access (art. 22), Rectification (art. 23), Cancellation with blocking (art. 24) and Objection, including objection to profiling (art. 26); withdrawal of consent (art. 7); periods of 20 business days, extendable by 15 (art. 31); free of charge (art. 34).
• Colombia (Law 1581): know, update and rectify; proof of authorization; information on use; revocation and deletion (art. 8.e); free access. Inquiries, 10 business days (extendable by 5). Claims, 15 business days (extendable by 8), with "claim in progress" marking. So that the Colombian Customer can meet these periods, Makatea responds and provides the information that depends on the platform within 3 business days of the Customer's request.
• Brazil (LGPD, art. 18): confirmation, access, correction, anonymization, blocking or deletion (art. 18-IV/VI), portability (art. 18-V), deletion of data processed on consent, information on sharing, withdrawal of consent and review of automated decisions (art. 20).
• Ecuador (LOPDP): information, access, rectification and updating, deletion (art. 18), objection, portability (art. 20), suspension or restriction and the right not to be subject to automated decisions (art. 22). General response period of 15 days, extendable.
• Peru (Law 29733 and S.D. 016-2024-JUS): information, access, rectification, cancellation or deletion, objection, objective processing (no automated profiling without a valid basis) and portability.
• European Union and United Kingdom (GDPR and UK GDPR, arts. 15 to 22): access, rectification, erasure, restriction, portability, objection and not being subject to solely automated decisions. Response within one month, extendable by two months.

7.2 Mechanisms to assist these rights. Through the single contact channel, Makatea offers on request:

• Access and export: in addition to the CSV export functions (UTF-8) for portfolio, reports and reconciliation at the organization level available in the interface, Makatea offers, on request, export of a data subject's data in a structured, machine-readable format (access and portability).
• Rectification and updating: editing member records and custom fields from the platform.
• Objection and opt-out of communications: recording of opted-out channels and opt-out classification when the data subject asks not to receive more communications.
• Cancellation, erasure and deletion: on request, Makatea carries out effective deletion or anonymization of a data subject's personal data, including retained records where applicable, unless there is a legal retention obligation. In the interface, members can be marked as churned and orders as cancelled. Effective deletion or anonymization is handled through the single channel.

Effective deletion or anonymization and export per data subject are provided on request through the single channel of Clause 13, not as self-service in the platform.

7.3 Cancellation with blocking and effective erasure. Cancellation with blocking is required in Mexico (art. 24 LFPDPPP) and erasure is required in Colombia (art. 8.e Law 1581), Brazil (art. 18-VI LGPD), Ecuador (art. 18 LOPDP), Peru (art. 20 Law 29733), the European Union and the United Kingdom (art. 17 GDPR). At the request of the data subject or the Controller through the single channel, Makatea applies (i) blocking of the data after cancellation (stopping processing while keeping the data to establish liability during the legal period) and (ii) final deletion or anonymization of personal data, including, where applicable, append-only records (audit log and interactions), backups and propagation to sub-processors, unless there is a legal retention obligation.

7.4 Security, impact assessments and consultation with the authority. Makatea reasonably assists the Customer in meeting its security and incident notification obligations. In particular, for the Data Protection Impact Report (RIPD) of art. 38 LGPD, the DPIA of art. 35 GDPR and equivalent figures in other jurisdictions, Makatea provides the Customer, based on the information available to it: (i) a description of data flows within the platform; (ii) categories of data processed (Clause 3); (iii) identity and function of sub-processors (Clause 8); (iv) a description of technical and administrative measures and their scope (Clause 6); and (v) a high-level description of automated processing and profiling (Clause 7.5). It also assists with prior consultation with the authority where applicable.

7.5 Automated processing and profiling. The parties expressly state that the platform performs automated processing with profiling: it classifies interactions using machine learning (ML) models, learns the data subject's channel and time preferences and derives a member status (for example, active, at risk, overdue, inactive). At a high level, the logic categorizes messages and payment or response behavior signals to prioritize portfolio management and communication. These derivations may be profiling and, depending on their use, decisions that affect the data subject. Therefore:

(a) Makatea assists the Customer in handling the data subject's right not to be subject to automated decisions and to have them reviewed (LGPD art. 20; LOPDP art. 22; objection to profiling art. 26 LFPDPPP Mexico; objective processing Law 29733 Peru; art. 22 GDPR).

(b) The Customer is responsible for disclosing the profiling to data subjects in its privacy notice and explaining its logic and consequences, and for obtaining the corresponding basis.

(c) Makatea makes available to the Customer the high-level description of the logic needed for that disclosure.

8. Sub-processors and their authorization

8.1 General authorization and content of the engagement. The Customer authorizes Makatea to use the sub-processors needed to provide the service. Each sub-processor processes data under its own terms and data processing agreements or standard clauses, which apply when using its service and are incorporated by reference into this DPA. Makatea is responsible to the Customer for providing the service through those sub-processors. The analytics sub-processor receives only aggregated metrics and the organization name and, by contractual obligation under its commercial terms, does not train models on the data it receives. The Customer accepts those terms when using the service, without an additional signature.

Specifically for Colombian Controllers, and to comply with the transmission contract of art. 25 of Decree 1377/2013, Makatea: (i) applies the Customer's Processing Policy; (ii) follows the principles of Law 1581; (iii) keeps the information confidential and secure; and (iv) handles data subjects' inquiries and claims on behalf of the Controller, within the firm assistance period of Clause 7.1.

8.2 Current sub-processors. The sub-processors and providers involved in processing are:

The list by function and country is published at https://makatea.ai/en/legal/subprocessors. The identity of each sub-processor, its location and the transfer mechanism are made available to the Customer on request. Makatea informs the Customer reasonably in advance of any new or replaced sub-processor, so that it can exercise the right to object provided in this Clause.

The WhatsApp messaging infrastructure, hosted in the United States, is Makatea's own for sending and receiving messages and media, not an independent third-party sub-processor. The related international transfers are governed by Clause 9.

Each sub-processor applies its own terms and data processing agreements or standard clauses, which are incorporated by reference under Clause 8.1.

8.3 Prior notice of changes and objection. Makatea informs the Customer of the addition or replacement of sub-processors reasonably and in advance, giving it the opportunity to object on reasonable data protection grounds before the new sub-processor starts processing data. Notice is given by email to the Customer's contact and by publication at https://makatea.ai/en/legal/subprocessors, with at least 30 calendar days' notice.

8.4 Return or deletion by sub-processors. Makatea instructs its sub-processors to return or delete data on terms equivalent to those of Clause 12, to the extent technically possible, including backups.

9. Transfers and cross-border flows

9.1 Providing the service involves transfers, communications or cross-border flows of data to the sub-processors of Clause 8 in the United States and to Makatea's own infrastructure, also in the United States. Processing of cash or transfer payment methods in Mexico takes place within the country, without an international transfer for Mexican Controllers.

9.2 These transfers to the United States are made under the standard contractual clauses incorporated in each provider's terms, which apply when using its service, and are disclosed to the data subject through the information Makatea makes available to the Customer for its privacy notice. By jurisdiction:

• Mexico: the relationship with the Processor is not a "transfer" (transfers are between controllers). Communications to sub-processors are made as referrals to processors. Any transfer to third-party controllers requires a basis under arts. 35-36 LFPDPPP.
• Colombia: it is an international transmission (Decree 1377, art. 25), covered by the transmission contract whose required content is set out in Clause 8.1 (applying the Controller's Policy, principles of Law 1581, security, confidentiality and handling of inquiries and claims), without the need for an SIC declaration of conformity.
• Brazil: the international transfer is based on a mechanism of art. 33 LGPD and CD/ANPD Resolution No. 19/2024, through the ANPD standard contractual clauses incorporated in the terms of the providers in the United States and/or the data subject's consent where applicable.
• Ecuador: international flow under the LOPDP, its Regulation and Resolution SPDP-SPD-2026-0004-R, covered by standard clauses incorporated in the providers' terms, keeping the transfer register available to the SPDP.
• Peru: cross-border flow under Law 29733 and S.D. 016-2024-JUS, covered by model clauses or appropriate safeguards incorporated in the providers' terms. Makatea provides the Controller with the supporting documentation available.
• European Union, European Economic Area and United Kingdom: transfers to the United States are covered by the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914, modules 2 and 3) and the UK addendum, under the EU and UK Annex of this DPA.

9.3 Makatea makes available to the Customer the information reasonably needed for it to disclose the transfers in its privacy notice and, where applicable, obtain the data subject's consent.

10. Security incident notification

10.1 Makatea notifies the Customer after becoming aware of a security incident or breach affecting the personal data processed on behalf of the Customer, within the firm period of Clause 10.4, so that the Customer can meet its notification obligations toward the authority and data subjects within the legal periods.

10.2 The notice includes, to the extent available: nature of the incident, categories and approximate number of data subjects and records affected, data compromised, likely consequences and measures taken or proposed.

10.3 Relevant legal periods the Customer must be able to meet and for which Makatea provides timely assistance:

• Peru: notification to the APDP of MINJUSDH within 48 hours of detection (S.D. 016-2024-JUS), and to data subjects when their rights are compromised.
• Colombia: notice of incidents to the SIC (Law 1581, art. 17 lit. n).
• Brazil: communication to the ANPD and data subjects within a reasonable period (art. 48 LGPD).
• Mexico: communication to the data subject of breaches that significantly affect their rights (art. 19 LFPDPPP).
• Ecuador: notification of incidents under the LOPDP and its Regulation.
• European Union and United Kingdom: notification to the supervisory authority within 72 hours where required (art. 33 GDPR) and to data subjects when the risk is high (art. 34 GDPR).

10.4 Makatea's firm notification period to the Customer. Makatea notifies the Customer within twenty-four (24) hours of detecting the incident, through the single contact channel. This period is designed to give the Customer real room to meet the 48-hour duty to notify the APDP of MINJUSDH (Peru), the 72-hour period of art. 33 GDPR and the other periods of Clause 10.3.

10.5 For Colombian Controllers, Makatea provides the information within the firm period of 3 business days set in Clause 7.1, so that the Customer can meet the periods for inquiries (10 business days, extendable by 5) and claims (15 business days, extendable by 8), and supports the mechanism by which the Customer must be able to mark the "claim in progress" while it is resolved.

11. Audit and inspection

11.1 Makatea makes available to the Customer the information reasonably needed to demonstrate compliance with the obligations of this DPA and allows and contributes to audits and inspections, including by the Customer or an independent auditor it appoints (subject to confidentiality).

11.2 Audits are carried out with reasonable prior notice, during business hours, without unduly affecting Makatea's operations and without compromising the security or confidentiality of other customers' data. Operating conditions: at least 30 calendar days' notice, at most one audit per year (except at an authority's request or after a proven incident), and reasonable costs of additional on-site audits borne by the Customer; coordination through the single contact channel.

11.3 As operating support, the Customer has in the platform the append-only audit log at the application level (Clause 6.5) and the reconciliation function with a record of actions, acting user and affected customer, which is an operating record.

12. Return and deletion at termination

12.1 When the Main Agreement ends, and at your choice as Customer, Makatea returns or deletes the personal data processed on behalf of the Customer, unless applicable law requires it to be kept.

12.2 Return. You can export your data through the CSV export functions available in the platform. In addition, on request through the single channel, Makatea exports the data in a structured, machine-readable format within 30 days of the account closing.

12.3 Deletion. On request through the single channel, Makatea carries out effective deletion or anonymization of personal data when the relationship ends, under the retention policy and periods of Clause 2.4, including, where applicable, append-only records (audit log and interactions), backups and propagation to sub-processors, unless there is a legal retention obligation. This satisfies the right of erasure (Colombia art. 8.e; Brazil art. 18-IV/VI; Ecuador art. 18; Peru art. 20; European Union and United Kingdom art. 17 GDPR) and cancellation with blocking (Mexico art. 24).

12.4 Makatea instructs its sub-processors to return or delete data on equivalent terms, to the extent technically possible, including backups.

13. Records of processing, identification and registration duties

13.1 Processor's record of processing activities (RoPA). Makatea, as processor, keeps its own record of processing operations and makes it available to the Controller and the authority on request, under art. 37 LGPD in Brazil, arts. 38 and following of the LOPDP and its Regulation in Ecuador, the processor's internal documentation under S.D. 016-2024-JUS in Peru, art. 30.2 GDPR in the European Union and the United Kingdom, and equivalent figures in other jurisdictions. This record is in addition to the database registry that belongs to the Controller.

13.2 Controller's registration duties. The Controller is responsible for registering databases and other registration duties where applicable: RNBD in Colombia when it exceeds the threshold of Decree 090 of 2018 (assets above 100,000 UVT) and appointing an area for rights requests; RNPDP in Peru and assessing the appointment of a Personal Data Officer according to sales scale and type of processing (S.D. 016-2024-JUS); and other local registries. Makatea provides the processing information it needs for this.

13.3 Controller's privacy notice. The Customer, as Controller, must have a privacy notice (short and full) under arts. 15-16 LFPDPPP (Mexico) and equivalent figures, and make it available to the data subject before or at collection. Makatea provides the processing information needed to prepare it (data, purposes, transfers and sub-processors, profiling of Clause 7.5).

13.4 Appointment of contact or Data Protection Officer. Each party appoints a contact for data protection matters. The parties acknowledge the appointment duties by the Controller's jurisdiction: personal data officer or department (Mexico, art. 29 LFPDPPP); publicly disclosed Encarregado or DPO (Brazil, art. 41 LGPD); Data Protection Delegate where required (Ecuador, art. 47 LOPDP; Peru, S.D. 016-2024-JUS); person or area responsible for rights requests (Colombia, Decree 1377); and DPO where required (arts. 37 to 39 GDPR).

13.5 Makatea's data contact or DPO. The single contact channel for all jurisdictions, and for any data subject or Controller to exercise their rights, is:

José Rodrigo Barrios Villa, rodrigo@makatea.ai

This single channel covers, among others, the functions of: Privacy Department (Mexico, art. 29 LFPDPPP); PQR channel (Colombia, Dec. 1377 art. 13); Encarregado or DPO (Brazil, art. 41 LGPD) held by José Rodrigo Barrios Villa; DPO (Ecuador, art. 47 LOPDP); and Personal Data Officer (Peru), as applicable.

Local appointments and registrations. Makatea is incorporated only in Mexico. Where the law of another country applies because the service is offered to people in its territory, Makatea handles rights through the single channel and meets the corresponding obligations. Local registrations or appointments (for example, RNBD in Colombia, RNPDP in Peru or DPO registration with the SPDP in Ecuador) are assessed and completed as Makatea has effective operations in each country. When operations in the European Union or the United Kingdom require it, Makatea appoints the representative of article 27 of the GDPR or its UK equivalent.

14. EU and UK Annex

This annex applies when the Controller or the data subjects are in the European Union, the European Economic Area or the United Kingdom.

14.1 Article 28 GDPR. Clauses 4 to 12 of this DPA cover the obligations of article 28.3 GDPR: documented instructions, confidentiality, security, sub-processors, assistance with rights and security, return or deletion and audits.

14.2 Standard contractual clauses. For transfers to the United States, the parties incorporate by reference the standard contractual clauses of Implementing Decision (EU) 2021/914. Module 2 applies when the Customer is Controller and module 3 when the Customer is processor for a third party. The appendices are completed with the information in Clauses 2, 3, 6 and 8 of this DPA.

14.3 United Kingdom. For transfers from the United Kingdom, the International Data Transfer Addendum issued by the ICO is incorporated.

14.4 Law and venue of the clauses. The standard contractual clauses are governed by the law of the Member State stated in them. In all other matters, Clause 15 applies.

15. Final provisions

15.1 Governing law and venue. This DPA is governed by the laws of the United Mexican States, and the parties submit to the jurisdiction of the competent courts of Tepic, Nayarit, Mexico, without prejudice to the mandatory data protection rules of the Controller's and data subjects' country.

15.2 The invalidity of one clause does not affect the validity of the others.

15.3 Any change to this DPA is published at https://makatea.ai/en/legal/dpa and communicated under the Main Agreement.

15.4 Acceptance. You accept this DPA electronically when you accept the Terms of Service and sign up for or subscribe to the platform. It is incorporated by reference into the Main Agreement, without the need for a handwritten signature or a separate signing step.

Processor: SOLUCIONES ORIENTADAS AL BIENESTAR DE LAS PERSONAS SOLU S.A.P.I. de C.V. (RFC SOB240719U87), Avenida del Valle 162, Col. Ciudad del Valle, C.P. 63157, Tepic, Nayarit, Mexico.

Single privacy contact, DPO and Encarregado (BR): José Rodrigo Barrios Villa, rodrigo@makatea.ai.

Public version: https://makatea.ai/en/legal/dpa · Last updated: October 14, 2026.

Language: this DPA is published in Spanish, English and Portuguese. If versions differ, the Spanish version prevails.