Data processing agreement (DPA)

1. Parties and purpose

This data processing agreement (DPA) is entered into between your business — a travel agency, workshop, beverage store, or a customer of one of Michinauta's services — as controller, and Michinauta as processor. It is part of the terms of service (AGB) you accepted and applies whenever Michinauta processes personal data on your behalf to provide the contracted service. It applies both under the General Data Protection Regulation (GDPR, Art. 28), because Michinauta's establishment is in Germany, and under Ecuador's Organic Law on Personal Data Protection (LOPDP, Art. 34) and its implementing regulation, because your business is usually established in Ecuador and answers for the data of its own customers.

2. Nature, purpose, and duration

The processing consists of storing, hosting, transmitting, and backing up the personal data you upload or that is generated while using the service: customer management, products, orders or bookings, accounting and electronic invoicing, and the rest of the functions of the product you signed up for. The purpose is solely to provide that service under the main contract. This DPA lasts as long as the main contract: it starts when you begin using the service and ends when that contract ends, without prejudice to section 10 on deletion or return at termination.

3. Types of data and categories of data subjects

The data subjects are, on one side, your business's own customers (the people or companies you serve) and, on the other, the users your business registers to use the platform. The data processed includes:

Identification and contact: name or legal name, identification (ID number, tax ID), address, phone, and email of your business's customers.
Tax data: whatever an electronic receipt (invoices, credit notes) issued in your business's name requires.
Orders, bookings, and vehicles: depending on the product, travel quotes and files, workshop work orders and their associated vehicles, or store orders.

Michinauta does not expect to process special categories of data (Art. 9 GDPR; sensitive data under the LOPDP), such as health, biometric, or trade-union or religious data. Do not upload that kind of data to the platform unless it is strictly necessary for the service you contracted; if it is, notify Michinauta in writing beforehand, under section 4.

4. Instructions

Michinauta processes personal data only on your documented instructions. Ordinary use of the product's features is itself a documented instruction. Any additional or different instruction must be given in writing (email to info@michinauta.com or another channel we agree on). Processing at the sub-processors' locations in section 7, including those outside Switzerland and the European Union, takes place on your documented instruction, which you give by accepting this AVV.

If Michinauta believes an instruction infringes the GDPR, the LOPDP, or any other applicable data protection law, it tells you before carrying it out. Michinauta does not use the data for any purpose of its own or for one different from the purpose that gave rise to this engagement.

5. Confidentiality of personnel

Michinauta's staff with access to the personal data you process are bound by a duty of confidentiality, whether by law, by contract, or by an express commitment, and only access the data they need for their role (least-privilege access).

6. Technical and organizational measures (TOMs)

Michinauta applies these measures across the ERP infrastructure:

Location: the servers are in Switzerland (Infomaniak Public Cloud).
Encryption in transit: all public traffic uses HTTPS.
Encryption of the electronic signature: the electronic signature (.p12) is stored encrypted with a dedicated key.
Backups: daily database backups, kept locally for 14 days, replicated and end-to-end encrypted to Swiss Backup (Infomaniak, Switzerland) with 90 days of retention.
Per-customer isolation: each registered business has an isolated space (multi-tenant) with its own users, data, and configuration.
Access control: role-based access within each business.
Access logs: kept and deleted after 90 days.
Rate limits: rate limiting to contain abuse and attacks.
Two-factor authentication: available to users, who can turn it on from their account.

These measures may be updated to keep or improve the level of protection, never to lower it below what is described here.

7. Sub-processors

You give general authorization for Michinauta to use these sub-processors:

Infomaniak Network SA (Switzerland): hosting and backups.
Zoho Corporation B.V. (Netherlands): sends the platform's emails, with data in the EU (Netherlands and Ireland).
Cloudflare, Inc. (United States): delivers and protects the site; relies on the EU-U.S. Data Privacy Framework (DPF) and on standard contractual clauses.
Anthropic PBC (United States): only when the relevant feature is available and you turn on and expressly accept the Help assistant, catalog loading, or AI Analysis; relies on standard contractual clauses. The assistant sends the question text and Michinauta content that is already published. If you use it to load the catalog, it also sends the photo you choose to upload; that photo may contain names, RUC, or other third-party data visible in it. In Michi Viajes, Michi Taller, and Michi Bodega, AI Analysis (Pro plan), when ANALISIS_IA_ENABLED is enabled and the administrator expressly accepts it, sends only aggregate figures for the business over the last 30 days, such as sales or invoicing, margin, receivables, and other totals; it sends no unaggregated records, names of customers, passengers, or products, license plates, ID numbers, RUC, electronic signatures, or passwords. In Michi Bodega, the administrator expressly accepts it with the same notice as the Help assistant. By default, Anthropic does not use them to train its models. Anthropic deletes what is sent and answered within 30 days, unless its automated system flags it as a possible violation of its usage policy, in which case it may keep it for up to 2 years, or the law requires it to keep it.

Stripe Payments Europe, Ltd. (Ireland) and Triple A Technologies Pte. Ltd. (Singapore) process only Michinauta's own billing data, as independent providers of Michinauta, and not your business's ERP data. They are therefore not sub-processors under this AVV.

The SRI and Payphone are not sub-processors either. The SRI receives the electronic receipts that your business is legally required to issue, and Michinauta sends them to it on your instruction. Payphone is your business's own payment gateway: it is turned on with the credentials your business uploads, Michinauta does not hold that money, and when a customer pays, Payphone receives the amount and a reference. In both cases the data goes out on your instruction, as controller.

Hotelbeds supports hotels, activities and transfers using the agency's own credentials or in managed mode using Michinauta's credentials. With its own credentials, the agency contracts directly with Hotelbeds; the same applies to DePay and Binance Pay, configured with credentials per agency. In those cases Michinauta only transmits data on the agency's instructions; each provider's role and transfer safeguards are governed by the agency's contract with that provider. In managed mode, Hotelbeds is a recipient of Michinauta; its official policy identifies Hotelbeds Spain, S.L.U. (Spain). The privacy policy details the data sent per product and the applicable transfer regime. The provider's registered office does not determine all processing locations.

Michinauta gives you at least 30 days' notice before adding or changing a sub-processor. You can object on a reasonable data protection ground within that period; if we cannot reach an agreement, you can end the affected service.

Under Art. 28(4) GDPR, Michinauta imposes on each sub-processor, by contract, the same data protection obligations that this AVV sets for Michinauta, and remains liable to your business for the sub-processor's failure to meet those obligations.

By accepting this AVV, your business, as controller, authorizes Michinauta in writing to use the sub-processors on this list, including for storing the data (Art. 34 LOPDP). Apart from them and the recipients described above, which receive data on your instruction, Michinauta does not transfer or communicate the data it processes on your behalf to anyone else, not even for its storage.

8. Transfers and international exposure

Under the GDPR, sending data to a sub-processor outside the European Union (United States) is an international transfer that relies on the EU-U.S. Data Privacy Framework or on standard contractual clauses under Article 46, depending on the recipient, as detailed in the privacy policy.

According to Art. 34 of Ecuador's LOPDP and Art. 23 of Resolution SPDP-SPD-2026-0004-R, engaging Michinauta abroad as a processor is not treated as a transfer. Even so, this agreement discloses the international exposure: the servers are in Switzerland, which has an adequacy decision from the European Commission; the sub-processors in section 7 and their country; and the encryption described in section 6.

If a foreign authority requests access to the data we process on your behalf, Michinauta notifies you, unless a law legally prohibits it from doing so.

If your business wants to document this engagement with the standard contractual clauses of Ecuador's Superintendencia de Protección de Datos Personales (SPDP), as good practice, Michinauta makes them available as an annex (see section 13).

9. Assistance to the controller

Michinauta assists you, within what the nature of the processing and the information available to it allow, so you can comply with:

data subject requests to exercise their rights (access, rectification, erasure, portability, and the others the GDPR and the LOPDP recognize);
a data protection impact assessment (DPIA), where applicable;
notifying a personal data breach to the supervisory authority and, where applicable, to the affected data subjects.

If Michinauta detects a security breach affecting the data it processes on your behalf, it notifies you without undue delay, and at most within 48 hours of becoming aware of it, with the information available at that time, so you can meet the GDPR's 72-hour deadline to your supervisory authority.

10. Deletion or return at termination

When you cancel the paid plan, your account moves to the Free plan and remains active: you can continue to view and export your data. Michinauta has no automatic deletion and does not delete them automatically when you cancel. On your written request for deletion, we first provide you with the complete export through Configuración → «Descargar todos mis datos», in JSON format, and then Michinauta deletes all of your business data from active systems, including tax records, with confirmation within 30 days. The confirmation does not cover backups. This contractual processor confirmation period does not extend any applicable shorter legal deadline, including deadlines for data subject requests.

When the contract ends, under Art. 34 LOPDP, the personal data Michinauta processed on your behalf is destroyed or returned to you, at your choice, under the supervision of the Personal Data Protection Authority (SPDP) where the LOPDP applies to the processing. This is carried out through the export and the deletion on request described above.

Your business, as controller, has the obligation to retain its tax records and other legally required records and must keep the export before deletion. That obligation does not fall on Michinauta as processor: it does not act as an archive for your business after the contract. Michinauta retains only its own subscription invoices and accounting records under § 147 AO, as controller of those data, not your business tax records. Cancelling the paid plan does not by itself end the service: the account continues on the Free plan, with the viewing and export features available under that plan.

The backups described in section 6 can still hold already-deleted data until their own retention ends (14 days on the server and 90 days in the remote copy), after which they are removed from there too; the deletion confirmation does not cover them.

11. Audits and inspections

On reasonable request, Michinauta gives you the information needed to show compliance with this DPA. If you need an audit beyond that information, we schedule it with reasonable advance notice, at a time and scope that does not compromise the security of other businesses on the platform (because of the multi-tenant isolation in section 6), and the reasonable costs of that audit are yours to bear unless it reveals a breach by Michinauta.

12. Liability

Each party's liability for the processing of personal data is governed by Art. 82 GDPR and by the LOPDP, as applicable. For anything this DPA does not specifically regulate, the liability clause of the terms of service (AGB) governing the main contract applies.

13. Annex: SPDP model clauses

The RIPD model contractual clauses recognized by Ecuador's Superintendencia de Protección de Datos Personales (SPDP) in Resolution SPDP-SPD-2026-0004-R, are available as an annex to this DPA on request for Ecuadorian agencies, workshops, or stores that want to use them. Art. 23 of that resolution provides that engaging a processor is not a transfer or communication of personal data; these clauses are therefore not an obligation in a processing engagement but good practice (Art. 24). Write to info@michinauta.com to request it. See also the privacy policy and the Legal Notice.