Data Processing Agreement

Version 2026-10-23 · Effective October 21, 2026

1. Scope and role of each party

This agreement is part of the Business Terms. It governs how INDEXA, S.R.L. (“INDEXA”), RNC 1-31-79391-6, processes the personal data of the customers of a business (the “Business”) when the Business uses the Timbro services Sell (with Invoicing), Serve, and Collect. The processing complies with Law No. 172-13 on the comprehensive protection of personal data (“Law 172-13”).

The Business is the controller of its customers’ data: it decides why and how the data is processed. INDEXA acts as processor: it processes the data on behalf of the Business to provide Timbro, following the Business’s instructions, and to produce the aggregated data that section 2 allows. Those instructions are the Business Terms, the configuration the Business sets in Timbro, and its requests through the API.

This agreement does not cover the data INDEXA processes as controller, such as the data of Cuenta Timbro or of the people who use Portal Timbro. That data is governed by the Privacy Policy.

2. Data and purposes

Data: name, email, RNC or cédula, business name, tax address when the Business includes it, purchase and invoice details, and payment data. INDEXA does not store the full card number or its security code.

Serve conversation data: when the Business activates Serve, which is in beta, the messages its customers write and receive, their phone numbers, their voice notes and, when transcribed, the text of those notes, as well as the orders that come out of the conversation. The Serve annex also governs that service.

Purposes:

with the Sell service, issuing, sending to the DGII, storing, and delivering invoices, and showing their history to the Business;
with the Collect service, processing payments with the Business’s acquirer;
with Serve, replying to customers on behalf of the Business, assembling their orders, and allowing the Business to take over the conversation;
across all services, producing aggregated or de-identified data for analytics and statistics.

Aggregated data for analytics: the Business authorizes INDEXA to produce, from the data it processes on behalf of the Business, aggregated or de-identified data within the meaning of Law 172-13, and to use it for analytics and statistics. That data does not reasonably allow a person, the Business, an invoice, or a transaction to be identified. To produce it, INDEXA:

uses only the fields each analysis needs, and never certificates, passwords, keys, or full card data;
does not publish or provide groups small enough to reveal who they correspond to;
does not attempt to re-identify anyone from it, and prohibits anyone who receives it from doing so;
does not sell or transfer personal data or identifiable information about the Business.

Once aggregated or de-identified, that data is no longer personal data of the Business’s customers, and INDEXA may keep it after the relationship ends.

Who can see conversations: the Business and the people it authorizes in Portal Timbro. The Timbro team accesses a conversation only when necessary to provide the service, to handle a request from the Business, or to comply with a legal obligation.

Retention of conversations: INDEXA keeps conversations for as long as necessary to provide Serve to the Business and to comply with legal and tax obligations. When the relationship ends, section 4 applies.

Repeat customers: this feature applies only when it is available and the Business activates it. Using the purchases made with a Cuenta Timbro at the Business, INDEXA calculates how many times the person buys again and shows it to the Business under a pseudonymous identifier, different at each business, with no name or contact details. The Business sees the name and contact details only if the person agreed to share them with it in their Cuenta Timbro, and that person can withdraw their consent. The Business may not attempt to link identifiers from other businesses or identify anyone who has not consented.

3. Obligations of the Business

The Business:

has the legal basis and gives the notices the law requires for the data it brings into Timbro, including notice to its customers that an automated assistant is serving them when it uses Serve, and any consent required for the data to be processed outside the Dominican Republic;
brings in only the data that is necessary;
handles its customers’ requests about their data, that is, the rights of access, rectification, cancellation, and objection recognized by Law 172-13.

4. Obligations of INDEXA

INDEXA:

processes the data only on the Business’s instructions and gives notice if it believes an instruction violates the law;
requires confidentiality from the people with access to the data;
applies the measures in the Security Policy;
uses only the providers listed in Providers that process data, requires those that process data on its behalf to meet suitable confidentiality and security obligations, and gives 30 days’ notice before adding another, so the Business can object or cancel;
helps the Business respond to its customers’ requests, through Timbro’s lookup and export features, and to handle a customer’s request to speak with a person when the Business uses Serve;
notifies the Business without undue delay if a security incident affects that data;
when the relationship ends, keeps lookup and export of the Business’s invoices available for at least 30 days, as the Business Terms provide, and then keeps only what the law requires it to keep and what is needed to handle claims.

5. Data outside the Dominican Republic

The Business authorizes INDEXA to process the data on its providers’ servers outside the Dominican Republic, mainly in the United States, as the Privacy Policy explains. When the Business uses Serve, this includes Meta (WhatsApp Business) and the artificial intelligence model providers listed in Providers that process data. INDEXA requires the providers that process data on its behalf to maintain suitable security and confidentiality measures. Meta processes channel data under its own policies and those the Business accepts with Meta.

6. Audit

Upon reasonable request from the Business, and no more than once a year, INDEXA provides written information about its security measures and its providers. An on-site audit takes place only if agreed in writing, for example in a contract for the Enterprise plan.

7. Governing law and contact

This agreement is governed by the laws of the Dominican Republic. Any dispute is submitted to the competent courts of the Distrito Nacional, as the Business Terms provide.

If you have questions about this agreement, write to hola@timbro.do.

Responsible party: INDEXA SRL, RNC 1-31-79391-6. Contact:hola@timbro.do.