Contract · 04
Data Processing Agreement (Processor)
Between the Customer, as data controller (Responsable del Tratamiento under Law 1581 of 2012), and NTC CAPITAL HOLDING S.A.S. ("NexToCloud"), NIT (Colombian tax ID) 902.096.121-7, as data processor (Encargado del Tratamiento under Law 1581 of 2012) Version 2.0 · Effective as of: October 20, 2026 · Last updated: October 20, 2026
1. Definitions#
The terms Data Subject, Personal Data, Sensitive Data, Controller, Processor, Processing, Authorization, Privacy Notice, Transfer, and Transmission have the meanings given to them in Law 1581 of 2012 and Decree 1074 of 2015. In addition:
- Customer Personal Data: the personal data contained in the Customer Data.
- Sub-processor: a third party that NexToCloud engages to carry out part of the processing.
- Security Incident: a breach of security codes or the loss, theft, or unauthorized access to or use of Customer Personal Data.
- Instructions: those contained in the Terms, this Agreement, the Order Form, the configuration that the Customer defines on the Platform, and those that the Customer gives in writing.
Other capitalized terms have the meanings given to them in the Terms.
2. Purpose and roles#
2.1. The Customer, as Controller, entrusts NexToCloud, as Processor, with the processing of Customer Personal Data necessary to provide the contracted Services: hosting, storage, organization, consultation, processing, communication through the enabled channels, instrumental use, backup, support, and deletion.
2.2. Shared responsibility model. NexToCloud provides and operates the technology infrastructure and the Platform. The Customer makes the decisions about the data: what it collects, for what purpose, under which authorizations, through which channels it contacts data subjects, and for how long it retains the information.
2.3. NexToCloud acts exclusively in accordance with the Customer's Instructions. If NexToCloud considers that an Instruction violates the law, it will inform the Customer and may refrain from carrying it out.
3. Categories of data subjects, data, and purposes#
3.1. The scope depends on the modules activated by the Customer:
| Module | Data subjects | Data categories | Authorized purposes |
|---|---|---|---|
| Platform core | The Customer's staff and Authorized Users, including third parties enabled by the Customer | Identification, contact, role, credentials, activity logs | Management of access, permissions, auditing, and security of the Customer Workspace |
| HealthCare (Health App) | The Customer's patients and their companions | Identification, contact, appointment data (date, time, procedure, practitioner, location, status), payer or insurer, authorizations, PQRS (petitions, complaints, claims and suggestions) and, when enabled by the Customer, strictly necessary sensitive health data | Scheduling, confirmation, reminders, and rescheduling of appointments; management of authorizations and PQRS; operational reporting |
| WhatsApp Messaging | The Customer's End Users | Phone number, profile name, message content, delivery and read status, attachments | Sending and receiving messages in the flows configured by the Customer; recording conversations as evidence |
| Artificial Intelligence and Voice | The Customer's End Users | Message content, audio, call recordings and transcripts, extracted intent | Interpreting messages and calls within the configured flows; transcription and summarization; handoff to human staff |
Swipe the table to the right to see all columns.
3.2. Migrated data. Historical data that the Customer delivers from its source systems is processed within the same categories and for the same purposes. The Customer warrants that such data is lawful.
3.3. Minimization. The Customer will not upload personal data that is unnecessary for the authorized purposes.
3.4. Closed purpose. No purpose other than those in this section is authorized.
4. Customer (Controller) obligations#
The Customer represents and warrants that:
a) It has a personal data processing policy and privacy notices in accordance with Law 1581 of 2012. b) It has obtained from each data subject the prior, express, and informed authorization required by law, including express authorization for sensitive data (such as health data), authorization to be contacted via WhatsApp, calls, or other channels, and, when it uses AI Features or call recording, notice that automated agents are involved and that the call is being recorded. c) It will keep evidence of those authorizations and will provide it to NexToCloud when necessary to respond to an authority. d) It gives lawful Instructions and guarantees the lawfulness, accuracy, quality, and relevance of the data. e) As Controller, it handles the inquiries and claims of its data subjects within the legal time frames. f) It registers its databases in the National Database Registry (RNBD) when required to do so. g) It manages the access of its staff and of the third parties it enables, and is responsible for their use of the Platform. h) It reports Security Incidents to the Superintendence of Industry and Commerce (SIC) and communicates them to data subjects, where applicable.
Breach of these warranties is the sole responsibility of the Customer, which will hold NexToCloud harmless in accordance with the Terms.
5. NexToCloud (Processor) obligations#
Under Article 18 of Law 1581 of 2012, NexToCloud undertakes to:
a) Process Customer Personal Data solely in accordance with the Instructions and the purposes in section 3. b) Not use the data for its own purposes; not sell, assign, or disclose it to unauthorized third parties; not correlate it with data of other customers; and not use it to train general-purpose artificial intelligence models. c) Keep the data in a dedicated database for the Customer, separate from those of other customers. d) Apply the security measures in section 8 and in the Information Security Policy. e) Ensure confidentiality through agreements with its staff and Sub-processors, and limit access to the persons who need it to provide the Services. f) Update, rectify, or delete the data when instructed by the Customer, within five (5) Business Days, or provide the Customer with the tools to do so directly. g) Forward to the Customer, within two (2) Business Days after receipt, any inquiries and claims from data subjects that it receives directly, without responding to their merits unless instructed by the Customer. h) Record in the database the legend "claim in process" (reclamo en trámite) or "information under judicial dispute" (información en discusión judicial) when the Customer so indicates. i) Refrain from circulating information that is being disputed by the data subject and whose blocking has been ordered by the Superintendence of Industry and Commerce. j) Allow access to the information only to authorized persons. k) Report to the Superintendence of Industry and Commerce any Security Incidents that the law requires it to report as Processor, and cooperate with the Customer in managing them. l) Reasonably assist the Customer in complying with its obligations as Controller, including by providing information about the processing it carries out. m) Return and delete the data upon termination, in accordance with section 10.
6. Sub-processors#
6.1. The Customer grants NexToCloud a general authorization to engage the Sub-processors listed in the Sub-processor List published at nextocloud.ai/legal, for the functions described there.
6.2. NexToCloud enters into data protection and security terms with each Sub-processor that are at least equivalent to those of this Agreement, and is liable to the Customer for their performance, as provided in the Terms.
6.3. Changes. NexToCloud will give notice of the addition or replacement of Sub-processors that process Customer Personal Data at least fifteen (15) calendar days in advance, by updating the List and sending notice to the Administrator's email. Within that period, the Customer may object on reasonable data protection grounds. If the Parties cannot find an alternative, the Customer may terminate the affected module without penalty, with a refund of any amounts prepaid for periods not provided.
6.4. In emergency situations (for example, the abrupt cessation of a provider or a security risk), NexToCloud may replace a Sub-processor immediately, informing the Customer as soon as possible.
6.5. Providers of Third-Party Services contracted directly by the Customer (for example, its own WhatsApp Business account with Meta or its BSP) are not NexToCloud Sub-processors: the Customer contracts with them and is responsible for them.
7. International transmissions#
7.1. The processing involves hosting and processing data outside Colombia, mainly in the United States (Microsoft Azure, East US 2 and Central US regions) and in the regions of the Sub-processors.
7.2. The Customer authorizes these transmissions, which are covered by this Agreement as a transmission agreement (Decree 1074 of 2015, Article 2.2.2.25.5.2), by Article 26 of Law 1581 of 2012, and by External Circular 005 of 2017 of the Superintendence of Industry and Commerce.
7.3. In its capacity as a transmission agreement, NexToCloud undertakes to: (i) process the data on behalf of the Customer in accordance with the principles of Law 1581 of 2012; (ii) safeguard the security of the databases; and (iii) maintain confidentiality regarding the processing.
8. Security measures#
NexToCloud applies, at a minimum, the following measures, detailed in the Information Security Policy:
- A separate database for each Customer, with the database derived from the user's signed identity.
- Encryption at rest (AES-256) and in transit (TLS 1.2 or higher).
- Strong authentication, role-based access control, and server-side permission validation.
- Vault-based secrets management and passwordless connections using managed identities.
- Logging of changes to and exports of personal data.
- Multi-layer backups with restore testing.
- AI architecture built on minimization: models have no direct read access to the databases; authority over the data resides on the server.
These measures may evolve, provided they maintain an equivalent or higher level of protection.
9. Security incidents#
9.1. NexToCloud will notify the Customer of any Security Incident affecting Customer Personal Data without undue delay and no later than seventy-two (72) hours after its confirmation, at the Administrator's email and the notifications email, with the information available: the nature of the incident, the categories and approximate volume of data and data subjects affected, the likely consequences, the measures taken, and recommended mitigation measures. The information will be supplemented as it becomes available.
9.2. The Customer decides on and carries out the communications to data subjects and the reports to the Superintendence of Industry and Commerce that are its responsibility as Controller. NexToCloud will cooperate in good faith and will report what the law requires of it as Processor.
9.3. Notification of an incident does not constitute an admission of fault or liability.
10. Return and deletion#
10.1. During the term, the Customer may export its data using the Platform's tools.
10.2. Upon termination of the Services, the regime set out in the Terms applies: a full export in CSV or JSON within five (5) Business Days after the request; a recovery window of thirty (30) calendar days; deletion of the active database when that window expires; and deletion of backups upon completion of their retention cycle, during which they remain encrypted, isolated, and out of use. NexToCloud will certify the deletion at the Customer's request.
10.3. NexToCloud may retain any data that a legal rule requires it to retain, subject to the same safeguards set out in this Agreement.
11. Verification#
11.1. Upon request and up to once (1) per year, or at any time following a Security Incident, NexToCloud will provide the Customer with reasonable evidence of compliance with this Agreement: responses to security questionnaires, certifications from its cloud provider, a backup report and the results of the latest restore test, or a technical verification session.
11.2. Verification will not provide access to other customers' data, to unrelated NexToCloud confidential information, or to production systems. On-site or third-party audits must be agreed in writing, at the Customer's expense.
12. Health data and other sensitive data#
12.1. The Customer acknowledges that health data is sensitive data that requires the express authorization of the data subject, who is not obligated to grant it.
12.2. The Platform does not store medical records (historia clínica) within the meaning of Resolution 1995 of 1999 and Law 2015 of 2020, unless the Customer expressly contracts a module that involves them. In that case, the module's Specific Terms will update this Agreement.
12.3. The processing is governed by the Colombian data protection regime. Foreign rules (for example, the U.S. HIPAA or the European GDPR) do not apply to this relationship unless expressly agreed.
13. Liability#
13.1. Each Party is liable to data subjects and to the Superintendence of Industry and Commerce for the obligations inherent to its role.
13.2. NexToCloud is not liable for the lawfulness, accuracy, or lack of authorization of the data that the Customer decides to process, or for the Customer's Instructions.
13.3. As between the Parties, the limitation of liability and the indemnities set out in the Terms apply, unless otherwise agreed in a specific contract.
14. Term#
This Agreement remains in effect for as long as NexToCloud processes Customer Personal Data and survives termination of the Services until such data has been fully deleted. Confidentiality obligations regarding personal data survive indefinitely.
15. Contact#
Data protection matters: privacidad@nextocloud.ai · Carrera 112 F # 72 C - 03, Torre 9, Apartamento 102, Engativá, Bogotá D.C.
Versioned document. Previous versions are kept at nextocloud.ai/legal.