Data Processing Agreement

Last updated: 24 October 2026

This is a translation provided for convenience. In case of any discrepancy, the Spanish version prevails.

This document governs the processing of personal data that BIOMAG, S.L.U. (the “Processor”) carries out on behalf of the Customer (the “Controller”) when providing the AIM CODEX service, in accordance with Article 28 GDPR. It forms part of the Terms of service and applies when the Customer includes personal data of third parties in the documents it processes through the Service.

1. Purpose and role of the parties

The Controller (the Customer) determines the purposes and means of processing the personal data contained in its documents and recipients. The Processor (BIOMAG, S.L.U.) processes it only to provide the Service and on the documented instructions of the Controller, contained in this agreement and in the Controller’s use of the Service.

2. Description of the processing

• Nature and purpose: hosting, sealing, keeping, verifying and enabling the sharing and acceptance of the Controller’s documents, generating and keeping the related proof.
• Duration: while the service relationship is in force, without prejudice to the retention periods for the proof that the Controller decides.
• Types of data: those the Controller decides to include in its documents (typically identification and contact data; the Controller must avoid including special categories unless it has a legal basis and says so).
• Categories of data subjects: those the Controller determines (e.g. customers, employees, signatories, recipients).

The public timestamping chain receives only the cryptographic fingerprint (hash) of the document; it receives neither the content nor any personal data.

3. Obligations of the Processor (Art. 28.3 GDPR)

• Process the data only on documented instructions from the Controller, including with regard to international transfers, unless required by law (in which case it will inform the Controller, if the law allows).
• Ensure that persons authorised to process the data have committed themselves to confidentiality.
• Apply appropriate technical and organisational security measures (Art. 32 GDPR): access control, encryption in transit, integrity and sealing of the proof, incident logging and backups.
• Assist the Controller in responding to data subjects’ rights and in meeting its obligations (security, breach notification, impact assessments and prior consultations).
• Notify the Controller without undue delay of any personal data breach it becomes aware of.
• At the Controller’s choice, delete or return the data at the end of the service, unless retention is required by law.
• Make available to the Controller the information needed to demonstrate compliance and allow for and contribute to audits, including inspections.

4. Sub-processors

The Controller authorises the Processor to use the sub-processors published at aim-codex.ai/subencargados: Railway (hosting, servers in the Netherlands), Resend (email, European region), Migadu-Mail GmbH (mailbox and backup email, Switzerland) and, only when the Controller or its users use the artificial intelligence features, OpenRouter, Inc. (USA), routing to providers that neither keep the data nor use it for training. The Processor imposes on each sub-processor, by contract, the same data protection obligations that this document imposes on it, and remains liable to the Controller for their compliance. Any new or changed sub-processor is published on that page before it applies; the Controller may object by writing to hola@aim-codex.ai.

The artificial intelligence features are optional and only process what is sent to them: the text and, for meeting minutes, the audio recording, which is sent to the artificial intelligence provider to be transcribed and which CODEX does not keep (only its fingerprint and size). The Controller decides whether to use them, informs the data subjects whose data may appear in those documents —and the attendees before recording a meeting— and does not use them with special categories of data.

5. International transfers

Data is hosted in the European Union. Any transfer or access from outside the European Economic Area —because Railway, Resend and OpenRouter are US companies, and because the text and audio sent to the artificial intelligence are processed in the United States— is covered by the European Commission’s Standard Contractual Clauses included in those providers’ data processing agreements (Module 2 in OpenRouter’s) and, in the case of Resend, also by the EU-US Data Privacy Framework. Switzerland and the United Kingdom have an adequacy decision.

6. Obligations of the Controller

The Controller guarantees that it has a legal basis for processing the data it includes in the Service, that it has informed the data subjects where appropriate, and that it gives the Processor lawful instructions. The Controller is solely responsible for the lawfulness of the content it seals or shares.

7. Execution

Acceptance of the Terms of service implies acceptance of this Data Processing Agreement. If the Controller needs a specific signed document for its compliance records, it may request it at hola@aim-codex.ai.