Data processing agreement

1.Parties and roles

1.1The Customer, the organization that uses Revisa, is the controller of the personal data processed under this Agreement. Prelude LTDA, CNPJ 30.493.260/0001-07, Rua Itaparica, 334/301, Serra, Belo Horizonte, MG, CEP 30240-130, Brazil, is the processor.

2.Subject matter and duration

2.1This Agreement covers the personal data contained in Customer Content, the part of the Customer Data that Prelude processes as a processor, to provide Revisa. For the Customer's account and organization data, Prelude is the controller, and the Privacy policy applies. This Agreement lasts as long as the Customer uses Revisa and, after that, until the Customer Data is deleted (Section 12).

3.Nature and purpose

3.1The processing consists of storing, organizing, indexing, displaying, sharing as the Customer directs, backing up, exporting and deleting Customer Content, so that the Customer and its Users (Members, Guests and its own Agents) can work with it.

4.Data and data subjects

4.1The Customer decides what goes in Revisa, so the personal data covered by this Agreement depends on its use. It typically includes:

• data: names, contact details, job and company details, identifiers, and whatever else appears in documents and emails;
• data subjects: the Customer's Users, and the people mentioned in its documents and emails, such as the staff of suppliers, clients and partners.

4.2Revisa isn't designed for sensitive personal data. If the Customer puts it in Revisa, the Customer is responsible for having a legal basis for it.

5.The Customer's instructions

5.1Prelude processes the personal data covered by this Agreement only on the Customer's documented instructions: the Terms, this Agreement, and what the Customer does in Revisa. If Prelude believes an instruction breaks the law, it will tell the Customer.

5.2Prelude doesn't use Customer Data to train AI models without the Customer's prior agreement.

6.Confidentiality

6.1Everyone at Prelude with access to Customer Data is bound to keep it confidential, and accesses it only as their work requires.

7.Security

7.1Prelude takes the security measures in Annex 1, and keeps them up to date.

8.Subprocessors

8.1The Customer authorizes Prelude to use the subprocessors in Annex 2. Prelude binds each one by a written contract that protects the data at least as much as this Agreement, and remains responsible for them.

8.2Prelude notifies the Customer before adding or replacing a subprocessor ([TODO: notice period before adding a subprocessor, e.g. 30 days]). The Customer may object on reasonable data protection grounds; if the parties can't reach an agreement, the Customer may cancel the Subscription. The same process applies to the providers involved in AI models made available by Prelude (Terms of service).

9.International transfers

9.1Where the personal data covered by this Agreement leaves Brazil or the European Union, Prelude relies on standard contractual clauses and the other mechanisms of LGPD art. 33, or on the EU–US Data Privacy Framework where the recipient is certified.

10.Assistance

10.1As far as is reasonable, Prelude helps the Customer answer data subjects' requests (Revisa's exports and deletions cover most of them), and with data protection impact assessments and consultations with authorities.

11.Security incidents

11.1If a security incident affects Customer Data, Prelude notifies the Customer without undue delay, within 48 hours of becoming aware of it, with what is known: what happened, which data and data subjects are affected, the likely consequences, and the measures taken. Prelude updates the Customer as it learns more.

12.Return and deletion

12.1When the Subscription ends, the Customer may export the Customer Data for 30 days. Then Prelude deletes it, and it clears from backups within 30 days, unless the law requires keeping it.

13.Audits

13.1Prelude makes available the information needed to show that it complies with this Agreement, and answers the Customer's reasonable questions (contato@prelude.ltda). On-site audits are possible by agreement.

14.Liability, precedence, law and language

14.1The Terms' limits of liability apply to this Agreement, to the extent the law allows. On data protection, this Agreement prevails over the Terms.

14.2This Agreement is governed by Brazilian law, and the courts of Belo Horizonte, MG have jurisdiction. It is written in Portuguese and translated into English and Italian: if the versions differ, the Portuguese version prevails.

Annex 1: Security measures

• Encryption of data in transit.
• Access to an organization's items limited to its Members and the Guests it invites.
• Regular backups.
• Staff access limited to what their work requires (least privilege).
• Every change to items, entities, rules and reviews recorded in a history.

Annex 2: Subprocessors