Legal
Data Processing Agreement
The article 28 GDPR contract: Booklift processes the end customers’ data on behalf of the business.
1. Purpose
This agreement governs the processing of personal data that MFDT S.L. («the processor») carries out on behalf of the customer that purchases Booklift («the controller»), in compliance with article 28 of Regulation (EU) 2016/679 and Spanish Organic Act 3/2018.
It forms an inseparable part of the service contract and is accepted on purchase. In the event of conflict with other documents, this agreement prevails as regards data protection.
2. Scope of the processing
| Item | Detail |
|---|---|
| Subject matter | Automated handling of conversations and appointment management on behalf of the controller |
| Duration | That of the service contract, plus the subsequent retention period set out in clause 9 |
| Nature and purpose | Receiving messages and calls, generating replies, checking availability, creating and modifying appointments, and recording the conversations |
| Type of data | Name, telephone number, social network account identifier, email address where provided, conversation content, call recording and transcript, and appointment details |
| Categories of data subjects | End customers, prospects and contacts of the controller |
| Special categories | Not envisaged. If the controller’s activity involves health data or other categories under art. 9 GDPR, it must inform Booklift before activating the service |
3. Obligations of the processor
Booklift undertakes to:
- process the data only on documented instructions from the controller, including as regards international transfers;
- not use the data for any purpose other than providing the service, and in particular not to use it to train its own models or those of third parties;
- ensure that persons authorised to process the data have undertaken to respect confidentiality, a duty that survives the end of the relationship;
- apply the technical and organisational measures of article 32 GDPR described in clause 6;
- assist the controller in responding to requests from data subjects exercising their rights;
- assist the controller in carrying out data protection impact assessments and prior consultations where required;
- make available to the controller the information needed to demonstrate compliance and allow audits in accordance with clause 8;
- inform the controller if, in its opinion, an instruction infringes data protection law.
4. Obligations of the controller
The controller undertakes to:
- have a valid legal basis for the processing and for disclosing the data to the processor;
- inform its end customers of the processing, including the involvement of an automated handling system, and link to Booklift’s Privacy Policy where appropriate (arts. 13 and 14 GDPR);
- not remove, conceal or alter the notice identifying the agent as artificial intelligence that Booklift issues in every conversation and every call (art. 50 of Regulation (EU) 2024/1689);
- not enter into the platform special categories of data under art. 9 GDPR without a valid legal basis and without having informed Booklift in writing beforehand;
- give lawful instructions and report any relevant change;
- handle its data subjects’ rights requests, with the processor’s assistance;
- supervise the processing and the agent’s configuration.
As processor, Booklift issues in every text conversation and at the start of every voice call the notice that the interaction is handled by an artificial intelligence system, in accordance with article 50 of Regulation (EU) 2024/1689. The notice is issued by the platform, is enabled by default and cannot be disabled from the business’s settings. Booklift keeps a record of its issuance and makes it available to the controller on request.
5. Sub-processors
The controller gives the processor general authorisation to engage the sub-processors listed in the Privacy Policy, with which Booklift has signed a contract imposing the same data protection obligations as those set out in this agreement.
Booklift will give at least thirty days’ notice of the addition or removal of any sub-processor. The controller may object on reasonable and substantiated grounds; if the objection makes it impossible to provide the service, either party may terminate the contract without penalty.
6. Security measures
Having regard to the state of the art and the risk of the processing, at least the following measures are applied:
- encryption of communications in transit using TLS 1.2 or higher;
- password hashing using resistant key derivation functions;
- role-based access control and the principle of least privilege;
- logging of access and of operations on personal data;
- regular backups with restore verification;
- separation of development and production environments;
- a documented procedure for handling security breaches;
- periodic review of the effectiveness of the measures and of providers.
7. Personal data breaches
The processor will notify the controller, without undue delay and within a maximum of 48 hours of becoming aware, of any personal data breach, providing the information available on its nature, the categories and approximate number of data subjects affected, the likely consequences and the measures taken.
It is for the controller to notify the breach to the supervisory authority and, where applicable, to the data subjects.
8. Audit
The controller may verify compliance with this agreement by requesting documentation evidencing the measures applied and, on thirty days’ notice and at most once a year, carrying out an audit at its own cost through an independent third party bound by confidentiality, without access to other customers’ data or to information that would compromise the security of the platform.
9. Return and deletion
Once the service ends, the processor will keep the data for thirty calendar days to allow the controller to export it. After that period it will delete or anonymise it, including existing copies, except for data whose retention is required by law, which will be blocked for the corresponding statutory period.
At the controller’s request, the processor will issue a certificate of deletion.
10. International transfers
Transfers outside the European Economic Area are made on the basis of adequacy decisions, the EU-US Data Privacy Framework or standard contractual clauses, with any necessary supplementary measures, as detailed in the Privacy Policy.
11. Liability
Each party is liable for the damage it causes by breaching the obligations that this agreement and the GDPR specifically impose on it, under the terms of article 82 of the Regulation.
Last updated: 23 de septiembre de 2026.
This is a translation provided for convenience. The Spanish version of this document is the binding one; in the event of any discrepancy, the Spanish text prevails.