Personal Data Processing Agreement

Platform: Nimboo SalesKit · Version 1.0 · Effective as of October 14, 2026

1. Parties and nature of the Agreement

1.1 This Personal Data Processing Agreement (the «Agreement») is entered into between NIMBOO VISUAL INTERNATIONAL S.A.S. DE C.V., with Federal Taxpayer Registry (RFC) number NVI231205TN1, domiciled in Benito Juárez, Quintana Roo, Mexico, operator of the Nimboo SalesKit platform («Nimboo» or the «Processor»), and the individual or legal entity that contracts the Platform («the Client» or the «Controller»).

1.2 The Agreement is a single, standard instrument for all clients. It forms an integral part of the Terms and Conditions of Use of the Platform (the «Terms») and is accepted together with them upon registering for, contracting or using the Platform, without the need for a separate signature. A Client that requires it may request from legal@nimboo.com.mx a signed copy, whose content will be identical to the published one.

1.3 The Agreement is the legal instrument that formalizes the relationship between the Controller and the Processor under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Federal Law on the Protection of Personal Data Held by Private Parties, LFPDPPP), published in the Diario Oficial de la Federación (Official Gazette of the Federation) on March 20, 2025 (the «Law»), and, where applicable, its Regulations published in the Diario Oficial de la Federación on December 21, 2011 (the «Regulations»).

2. Definitions

2.1 The terms «personal data», «data subject» (titular), «processing», «controller» (persona responsable), «processor» (persona encargada), «transfer» and «ARCO rights» (access, rectification, cancellation and objection) have the meaning assigned to them by article 2 of the Law.

2.2 «Client Data»: the personal data that the Client, its users or its prospects incorporate into the Platform, or that the Platform generates on behalf of the Client in the provision of the service, including that of prospects, buyers, advisors and other persons with whom the Client deals.

2.3 «Sub-processor»: the provider to which Nimboo entrusts part of the processing of Client Data in order to provide the service.

2.4 «Security breach»: the loss, destruction, theft, misplacement or unauthorized copying of Client Data; its unauthorized use, access or processing; or its unauthorized damage, alteration or modification.

3. Role of the parties

3.1 With respect to Client Data, the Client is the controller and Nimboo is the processor under article 2, section XII, of the Law: it processes the data on behalf of the Client.

3.2 The Client is responsible for having a privacy notice for the data subjects, for obtaining any applicable consents, for the lawfulness of the data it incorporates into the Platform and for the instructions it gives through the configuration of its account.

3.3 With respect to the data of its own clients, users and representatives that it collects to manage the commercial relationship, invoicing and collection, Nimboo acts as controller in accordance with its Privacy Notice, and this Agreement does not apply to it.

4. Purpose and purpose limitation

4.1 Nimboo processes Client Data exclusively to provide the contracted service in accordance with the Terms, with the features the Client activates on the Platform and with the documented instructions the Client gives it in writing.

4.2 Nimboo does not process Client Data for its own purposes or for purposes other than those instructed; it does not sell, rent or trade it; it does not use it for advertising or to build profiles unrelated to the service; and it does not use it to train artificial intelligence models, whether its own or third parties'.

4.3 If Nimboo considers that an instruction from the Client contravenes the Law, it will inform the Client without delay.

5. Confidentiality

5.1 Nimboo keeps Client Data confidential. This obligation survives the termination of the relationship.

5.2 Nimboo limits access to Client Data to the staff and collaborators who require it to provide the service, give technical support requested by the Client, maintain the security of the Platform or comply with a legal obligation, and only to the extent necessary. All such persons are subject to confidentiality obligations.

6. Security measures

6.1 Nimboo establishes and maintains administrative, technical and physical security measures to protect Client Data against damage, loss, alteration, destruction or unauthorized use, access or processing, pursuant to article 18 of the Law.

6.2 The measures in force are described in the document «Nimboo SalesKit Architecture and Security», available to the Client upon request, and include: isolation between organizations in database rules and in server-side validation; role-based access control; encryption in transit and at rest; password management by Google Identity Platform; backups and recovery; and periodic security reviews.

6.3 Nimboo may update those measures provided that it does not reduce the overall level of protection.

7. Sub-processors

7.1 The Client authorizes Nimboo to entrust the processing of Client Data to the following Sub-processors, to the extent necessary for the function each one performs:

7.2 Nimboo imposes on each Sub-processor, by contract or through the acceptance of its data processing terms, confidentiality and security obligations no less protective than those of this Agreement, and is liable to the Client for the compliance of its Sub-processors under the terms of clause 13.

7.3 Nimboo will notify the Client, at least 30 calendar days in advance, of the addition or replacement of a Sub-processor, by updating this Agreement and sending notice to the account's registered email address. If the Client objects on reasonable grounds related to data protection, the parties will seek an alternative in good faith; if there is none, the Client may terminate the affected service without penalty.

7.4 Integrations with third-party systems that the Client configures in its account (for example, other CRMs or webhooks) are instructions from the Client: the receiving third party is not a Sub-processor of Nimboo.

8. International communications of data

8.1 Part of the processing takes place outside Mexico, mainly in the United States, as set out in the table in clause 7.1. In particular, files uploaded to the Platform are stored in the United States.

8.2 The communications of Client Data that Nimboo makes to its Sub-processors are communications between processors on behalf of the Controller and do not constitute transfers under article 2, section XX, of the Law. Nimboo makes them solely to provide the service and under obligations equivalent to those of this Agreement.

8.3 Nimboo does not transfer Client Data to third parties other than the Sub-processors, except on the Client's instruction or upon a reasoned and legally grounded request from a competent authority. In the latter case, and whenever the law allows, Nimboo will inform the Client before complying.

9. Security breaches

9.1 Nimboo will notify the Client of any Security breach affecting Client Data without undue delay and, in any event, within 72 hours after confirming it.

9.2 The notification will be sent to the registered email address of the account holder and will contain, to the extent known: the nature of the breach; the data and categories of data subjects compromised; the immediate measures taken; recommendations for data subjects to protect their interests; and a means of contact. Information not known at the time will be provided as it is obtained.

9.3 It is the Client's responsibility, as controller, to inform data subjects of breaches that significantly affect their property or moral rights, pursuant to article 19 of the Law. Nimboo will provide it with reasonable information and assistance to do so.

9.4 Nimboo will take the corrective and preventive actions necessary to contain the breach and prevent it from recurring, and will document what occurred.

10. Handling of ARCO rights

10.1 Requests for access, rectification, cancellation or objection from the data subjects of Client Data are the responsibility of the Client as controller, under articles 21 to 34 of the Law.

10.2 The Platform allows the Client to view, correct, export and delete Client Data. When the Client so requires, Nimboo will provide reasonable assistance to handle a request within the legal deadlines.

10.3 If a data subject addresses a request concerning Client Data directly to Nimboo, Nimboo will forward it to the Client without delay and will not handle it on its own, unless instructed by the Client.

11. Return and deletion at the end of the relationship

11.1 During the relationship, the account's management can export Client Data in open formats (CSV and JSON) on the Pro and Select plans. At the end of the relationship, for any reason, the Client has 30 calendar days to request the export of its data; at the Client's request, Nimboo will deliver the information in those formats.

11.2 Once that period has ended, and within the 90 calendar days following termination, Nimboo will delete Client Data from its active systems, except for data it must retain by legal obligation.

11.3 Backup copies are not modified individually: the Client Data contained in them expires according to their retention cycles, which as of this date are up to 14 weeks for the database and up to 30 days for files. While they subsist, the copies remain subject to this Agreement and are not used for any purpose other than recovery from incidents.

12. Audit and verification

12.1 Nimboo will make available to the Client the information necessary to demonstrate compliance with this Agreement, through its architecture and security documentation, responses to reasonable security questionnaires and the public certification reports of its infrastructure providers.

12.2 The Client may request such information up to once a year, or at any time after a Security breach that affects it, by writing to legal@nimboo.com.mx. Nimboo will respond within a reasonable period.

12.3 The information that Nimboo provides for this purpose is confidential and may only be used to verify compliance with this Agreement.

13. Liability

13.1 Each party's liability arising from this Agreement is governed by the limitations and exclusions of liability set out in the Terms, without prejudice to the mandatory provisions of applicable law.

13.2 Each party is liable for its own breaches of the Law and of this Agreement.

14. Term, precedence and amendments

14.1 This Agreement remains in force for as long as Nimboo processes Client Data, including the post-termination period described in clause 11.

14.2 With respect to the processing of Client Data, this Agreement prevails over any contrary provision of the Terms.

14.3 Amendments to this Agreement will be published at saleskit.nimboo.com.mx/legal/tratamiento-de-datos and notified to the Client at least 30 calendar days in advance, on the same terms as amendments to the Terms.

15. Governing law and authority

15.1 This Agreement is governed by the laws of the United Mexican States. For its interpretation and performance, the parties submit to the jurisdiction agreed in the Terms.

15.2 The competent authority in matters of protection of personal data held by private parties is the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance), pursuant to article 2, section XV, and articles 38 et seq. of the Law.

16. Contact

For any matter related to this Agreement, or to request a signed copy:

Email: legal@nimboo.com.mx
Location: Cancún, Quintana Roo, Mexico.