TAGGOR — DATA PROCESSING ADDENDUM (DPA)

Version: 1.0 — Commercial Release
Effective date: The date on which the applicable Terms of Service incorporating this DPA are accepted, or the effective date of a separately executed agreement incorporating this DPA.
Provider: Haftware Sistemas de Internet Ltda., CNPJ 31.659.341/0001-05, Rua Silveira Martins, No. 810, Suite 504, Centro, Novo Hamburgo, Rio Grande do Sul, ZIP 93510-310, Brazil (“Haftware” or “Taggor”).
Privacy contact: privacidade@taggor.dev. Contractual notices: contato@taggor.dev.

This Data Processing Addendum (“DPA”) forms part of Taggor’s Terms of Service (“Terms”) between Haftware and the customer identified in the relevant account, subscription or separately executed agreement (“Customer”). The customer agrees to this DPA by accepting the Terms; a second click, signature, or optional acknowledgment in Settings is not required for this standard DPA to apply. A separately executed DPA, if any, prevails to the extent it addresses the same processing. This DPA applies whenever Haftware processes Customer Personal Data on Customer’s behalf. Schedule A describes the processing; Schedule B sets out security measures; Schedule C contains supplementary provisions for applicable US privacy laws; Schedule D addresses international transfers.

1. Definitions, parties and roles

1.1 Definitions. “Applicable Data Protection Laws” means privacy and personal-data laws applicable to the particular processing, including, where relevant, Brazil’s Lei Geral de Proteção de Dados (Law 13,709/2018, “LGPD”), the EU General Data Protection Regulation (“EU GDPR”), the UK GDPR, and applicable US state privacy laws (including the California Consumer Privacy Act, as amended, “CCPA”). “Customer Personal Data” means personal data or personal information that Haftware processes on Customer’s behalf through components, collections, submissions, associated notification and delivery features, or related instructions. “Data Subject” includes a visitor or other natural person to whom such data relates. “Subprocessor” means a third party engaged by Haftware to process Customer Personal Data on its behalf. “Security Incident” means a confirmed breach of security resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. Terms such as controller, processor, business, service provider, contractor, sale, and sharing have the meanings assigned by the applicable law.

1.2 Contracting parties. The Customer is the individual or legal entity legally bound by the Terms, not merely the technical workspace owner where that person acts for an organization. A person accepting on behalf of an organization represents that the person has authority to bind it. Customer identification and contact details are those provided in the account, checkout, subscription records or executed agreement. Customer must keep this information accurate and provide the details required to complete any applicable international transfer instrument.

1.3 Allocation of roles. For Customer Personal Data, Customer generally acts as controller/business, and Haftware as processor/service provider, in each case to the extent consistent with the actual processing and Applicable Data Protection Laws. Where Customer is itself a processor on behalf of a third-party controller (including an agency acting for a site owner), Haftware acts as Customer’s subprocessor. Customer represents that it is authorized by its controller to engage Haftware and to provide the instructions under this DPA. Nothing in this DPA makes Haftware a party to Customer’s agreement with its own clients.

1.4 Haftware’s independent processing. Haftware may act independently as controller/business for its own account, identity, customer support, direct billing, fraud prevention, platform administration, and other independently determined processing described in its Privacy Policy. Those activities are not governed by Customer’s instructions under this DPA. The classification of a particular vendor depends on its actual function: a payment provider processing subscription payments is not, solely for that reason, a Subprocessor of visitor submissions.

2. Scope, duration and instructions

2.1 Subject matter. Haftware processes Customer Personal Data to build, host, serve, secure and support components, receive and store information submitted through them, display, export, notify about and delete submissions, and perform related actions Customer chooses through the Service. The subject matter, types of data, data subjects, purposes and processing duration are further detailed in Schedule A.

2.2 Documented instructions. Customer instructs Haftware through the Terms, this DPA, configuration of the Service, and lawful directions submitted through authorized interfaces or support channels. Haftware will process Customer Personal Data only on those documented instructions, except where applicable law requires otherwise. Where required by EU GDPR Article 28, Haftware will inform Customer of a legally required departure before processing, unless prohibited by law on important grounds of public interest, and will inform Customer if it believes an instruction infringes applicable EU or Member State data protection requirements, unless prohibited from doing so.

2.3 Limited permitted operations. Haftware may use Customer Personal Data solely to provide the specific services described in Section 2.1, maintain availability and security, prevent and investigate abuse or fraud involving the Service, assist Customer, comply with applicable legal obligations, and carry out other processing expressly permitted by applicable processor/service-provider rules. It will not sell Customer Personal Data, share it for cross-context behavioral advertising, or use submission contents to train its own or third-party generative AI models. Security and anti-abuse access must be proportionate and restricted to personnel with a legitimate need.

2.4 Customer’s compliance. Customer determines the categories of information collected, lawful bases and consents where required, notices, purposes, content and design of forms, recipients, retention periods, and responses to Data Subjects. Customer must have all necessary authorizations, instruct Haftware lawfully, and not submit data prohibited by the Terms or applicable law. Ordinary contact information, telephone numbers and legally obtained identifiers (including Brazilian CPF or RG numbers) are not categorically forbidden; their collection remains Customer’s responsibility. Payment-card authentication data, prohibited financial details, unapproved copies of identity documents, and other restricted categories remain governed by the Terms and applicable law. Service controls, optional metadata classifications and consent records do not independently establish legal compliance.

3. Confidentiality and access

Haftware will ensure that persons it authorizes to access Customer Personal Data are bound by appropriate confidentiality duties (contractual or statutory), receive access only as required for their functions, and are subject to appropriate access controls. Haftware may access Customer Personal Data where reasonably necessary to deliver support requested by Customer, maintain or secure the Service, investigate suspected misuse, or comply with law; it must not use access for unrelated purposes. The confidentiality obligation survives termination for as long as the information remains confidential, subject to lawful disclosure requirements.

4. Security

4.1 Measures. Haftware will implement and maintain reasonable technical and organizational measures appropriate to the nature, scope, context and risk of processing, including the measures described in Schedule B, taking account of the state of the art, implementation costs, and risks to natural persons. Haftware may update measures, provided the overall level of protection is not materially reduced. No measure constitutes a guarantee that all incidents will be prevented.

4.2 Shared responsibility. Customer is responsible for the security of its website, scripts and components, its AI agents and other integrations, access assignments and credentials, lawful collection designs, and independent copies of data it needs. Haftware remains responsible for safeguards under its own control. Automated publishing checks, component compilation, Shadow DOM and runtime error boundaries are not certifications of source-code security and do not replace Customer’s validation of the components it publishes.

5. Subprocessors

5.1 General authorization. Customer grants general written authorization for Haftware to engage Subprocessors for the purposes in this DPA. The current public list, identifying relevant providers, purposes and available location information, is maintained at **the Subprocessor List linked from the Service’s Legal Documents section (/legal/subprocessors); the official list must be publicly accessible before this DPA is offered for acceptance. Subprocessor status depends on the processing performed: infrastructure/database and submission-email providers may process Customer Personal Data; providers used exclusively for identity or subscription billing may instead process Haftware-controlled account/billing data.

5.2 Changes and objections. Haftware will notify Customer by the account email or another effective subscribed channel at least 30 days before adding or replacing a Subprocessor that will process Customer Personal Data, except where an urgent legal or security necessity makes advance notice impossible, in which case notice will be given as soon as reasonably practicable. Customer may object in writing within 15 days after notice on reasonable and documented data-protection grounds. The parties will discuss a commercially reasonable alternative. If none is available, Customer may stop the affected processing or terminate the affected paid Service, with a refund of prepaid unused fees specifically attributable to it where legally required or agreed; termination and deletion remain subject to Sections 10 and 11. Silence after the objection period constitutes no objection, to the extent legally permitted.

5.3 Flow-down and responsibility. Haftware will enter into legally appropriate binding arrangements requiring Subprocessors to protect Customer Personal Data to a standard substantially equivalent to this DPA for the assigned processing, including required confidentiality, security, deletion, assistance and onward-transfer terms. Haftware remains accountable to Customer for its Subprocessors’ performance as required by applicable law. Customer’s authorization does not replace Haftware’s obligation to have lawful transfer arrangements with a provider in another country.

6. Data Subject requests

6.1 Customer lead. Customer is primarily responsible for receiving, verifying and responding to Data Subject requests concerning Customer Personal Data. To the extent within Haftware’s control, Haftware will provide reasonably available self-service functionality and reasonable assistance needed for Customer to meet its obligations, taking into account the nature of the processing and information available to Haftware.

6.2 Direct requests. If Haftware receives a request apparently concerning Customer Personal Data, it will, where identifiable and legally permitted, promptly notify Customer or direct the requester to Customer, without independently deciding the substantive rights request unless required by law. Haftware need not build new search or reconciliation capabilities not included in the Service, but must provide assistance required by applicable law; extraordinary assistance may be subject to reasonable, previously disclosed charges where lawful.

7. Security incidents

7.1 Notice. Haftware will notify Customer without undue delay after becoming aware of a Security Incident involving Customer Personal Data, using the account’s security or owner contact. Its initial notice may be preliminary and will contain information then reasonably available on the nature of the incident, impacted data, likely consequences and measures taken or proposed. It will provide material supplemental information as reasonably available and cooperate to the extent required by applicable law.

7.2 Statutory notifications. Customer ordinarily determines whether to notify Data Subjects or authorities as the controller/business, and Haftware will provide legally required assistance. This does not prevent Haftware from making notifications directly required of it by law. Neither party is required to assert unverified details or disclose sensitive security information unnecessarily. Contractual notice is not an admission of liability.

8. Assistance and compliance evidence

Haftware will, considering the nature of processing and information available to it, reasonably assist Customer with legally required impact assessments, prior consultations with authorities, and documented compliance inquiries to the extent required by Applicable Data Protection Laws. Haftware will make available information reasonably necessary to demonstrate its compliance with the processor obligations under this DPA, subject to confidentiality, security and protection of other customers’ information.

9. Audits and verification

9.1 Ordinary review. Customer may request relevant documentation and a reasonable written security questionnaire. Where applicable law requires an audit right, Customer or an independent auditor bound by confidentiality may assess compliance no more than once per 12 months upon at least 30 days’ notice, during regular business hours and under a mutually reasonable scope and security protocol. Documentary or remote review is the default; on-site inspection will be used where legally required or a documented material compliance gap cannot reasonably be resolved remotely.

9.2 Exceptions and restrictions. Additional reasonable verification may be permitted where an applicable regulator requires it, following a material Security Incident, or where law confers a nonwaivable monitoring/remediation right (including applicable CCPA rights). Reviews may not compromise other customers’ data, trade secrets, security or service availability. Customer bears its own costs and, where lawful and agreed in advance, Haftware’s reasonable incremental costs. No provision restricts statutory regulator powers or rights that cannot lawfully be limited.

10. Retention, return and deletion

10.1 During service. Customer selects the retention and deletion settings available under its subscription and remains responsible for legally appropriate periods. Haftware will apply the applicable plan restrictions and documented deletion instructions, subject to lawful retention. Customer should export information it needs before downgrading, canceling or deleting the workspace; the Service is not an indefinite archive.

10.2 At termination. Upon expiration or termination of the affected Service, Haftware will, at Customer’s choice and to the extent practicable and required by law, provide a reasonable opportunity to export available Customer Personal Data and then delete it or return it and delete existing copies within a commercially reasonable wind-down period, subject to the product’s published deletion process and applicable legal obligations. Deletion can be irreversible. Where an immediate statutory deletion is required, Haftware will act without undue delay consistent with applicable law.

10.3 Restricted residual retention. Backups may retain copies for their ordinary protected rotation period, during which access is restricted and they will not be used for routine business processing. Certain limited security, audit, abuse-prevention, legal defense, accounting or deletion-verification records may be retained only where law permits or requires and according to documented schedules. Upon restoration, previously deleted data must again be subject to deletion controls. No specific backup deletion interval is guaranteed unless expressly documented and verified in the official retention schedule.

11. International transfers

Transfers involving Customer Personal Data will be subject to the specific requirements of the law governing each transfer. Customer authorizes the processing locations and Subprocessors disclosed in the current Subprocessor List, subject to lawful transfer mechanisms and this DPA. Customer’s acceptance of this DPA does not, by itself, execute transfer clauses between Haftware and a US-hosted infrastructure provider; Haftware must ensure that its own arrangements with each relevant recipient provide the legally required safeguards. The jurisdiction-specific provisions in Schedule D apply when their legal conditions are met. If a required transfer mechanism cannot lawfully be put in place, the affected processing must not take place until addressed.

12. Term, hierarchy and liability

12.1 Term. This DPA applies while Haftware processes Customer Personal Data for Customer, including any lawful post-termination retention or deletion period. Obligations intended to survive do so for the period required by their nature or applicable law.

12.2 Priority. This DPA controls conflicts with the Terms only as to processing Customer Personal Data on Customer’s behalf; a mandatory transfer instrument prevails over conflicting contractual terms for the transfer it governs. A specifically executed DPA controls the same subject matter over this standard DPA. The Privacy Policy governs notices about Haftware’s independently controlled processing, subject to law.

12.3 Allocation of liability. Between Haftware and Customer, the disclaimers, aggregate cap and third-party indemnity provisions in the Terms apply to claims concerning this DPA to the maximum extent permitted by applicable law. No provision reduces rights or remedies of Data Subjects or supervisory authorities, displaces a party’s direct statutory obligations, or restricts liability where prohibited by law, including where applicable GDPR Article 82 or LGPD Article 42 imposes nonwaivable responsibility. Customer remains responsible for unlawful decisions or instructions within its control; Haftware remains responsible for its own acts and omissions to the extent imposed by law. No indemnity requires a party to reimburse another for the latter’s own nontransferable legal wrongdoing.

12.4 Law and forum. The governing law and venue clauses of the Terms apply to ordinary interparty disputes to the extent enforceable. Mandatory data-protection law, supervisory authority jurisdiction and jurisdiction-specific transfer clauses are unaffected.

13. Changes and electronic acceptance

The version of this DPA presented or made accessible at acceptance of the Terms is incorporated by reference and becomes binding upon that acceptance. Haftware may retain evidence of version, date, account/workspace and accepting user. An optional acknowledgment in account settings may provide additional evidence but is not a condition for standard-DPA effectiveness. Material changes to this DPA will be notified in accordance with the Terms and applicable law; changes requiring fresh affirmative acceptance or a specific instrument will not take effect for the affected processing without it. Publishing a new version does not retroactively erase obligations accrued under earlier versions.

14. Language and notices

Official English and Brazilian Portuguese versions may be made available. The official version actually presented and affirmatively accepted governs the parties’ agreement, without waiving mandatory law or overriding authentic language requirements for mandatory transfer clauses. If the parties sign a separate agreement containing different language terms, that agreement controls within its scope. Notices under this DPA may be sent to the registered account email; send privacy correspondence to privacidade@taggor.dev and formal contractual notices to contato@taggor.dev.

Schedule A — Processing description

Schedule B — Technical and organizational measures

Haftware will maintain measures proportionate to the sensitivity and risks of the Customer Personal Data it processes, including: (1) tenant/workspace access separation and authorization controls; (2) role-based access, least privilege and controlled administrative access; (3) transport protection for authenticated interfaces and database connections; (4) secure treatment of authentication secrets and credentials; (5) minimization and redaction of sensitive content from operational logs where feasible; (6) logging and investigation of significant security-relevant administrative activity; (7) controls over code compilation and publication, without representing those controls as comprehensive audits; (8) patching, vulnerability management and abuse-mitigation processes proportionate to the Service; (9) protected backup, restoration and deletion procedures appropriate to the deployed production environment; (10) personnel and Subprocessor confidentiality obligations and access management; and (11) an incident-handling process able to support notifications required by Section 7. Any detailed technical description separately published as an official security exhibit will be binding only if expressly incorporated. The published commitments must be verified against the production environment before accepting real Customer Personal Data.

Schedule C — US state privacy provisions (where applicable)

C.1 Purpose and roles. Where CCPA/CPRA or similar US state privacy law applies to a Customer’s disclosure of personal information to Haftware, the limited and specified business purposes are: hosting and delivering components selected by Customer; receiving, transmitting, storing, presenting, exporting and deleting submissions; delivering Customer-configured notifications; maintaining requested account/workspace functions and security, detecting incidents, preventing misuse, debugging and performing other permitted internal operations strictly connected with providing those services. Customer discloses the information only for those purposes. This schedule applies only to personal information processed in a legally relevant service-provider/processor capacity and does not automatically characterize Haftware’s independent account or billing processing.

C.2 Prohibitions. Haftware will not (a) sell or share that personal information; (b) retain, use or disclose it for any purpose other than the limited business purposes above or other purposes expressly permitted by applicable law; (c) use it for unrelated commercial purposes or outside the direct business relationship; or (d) combine it with information obtained from other customers or Haftware’s own consumer interactions except as expressly permitted by applicable law and subject to applicable restrictions. Haftware will not use submission content for cross-context behavioral advertising or model training.

C.3 Protection and cooperation. Haftware will provide the level of privacy protection required of a service provider/contractor under applicable law, implement reasonable security measures, assist Customer with legally applicable consumer requests, and require equivalent restrictions from relevant subcontractors. Customer retains the right, on notice, to take reasonable and appropriate measures to verify compliance and to stop and remediate unauthorized processing, subject to legitimate security safeguards. Haftware will notify Customer if it determines it can no longer meet applicable statutory obligations. Customer may direct reasonable corrective measures and, where legally permitted and necessary, suspend the affected transfer or terminate the affected processing.

C.4 Other US privacy laws. Where another applicable state privacy law requires additional processor terms concerning instructions, confidentiality, assistance, security, subprocessors, assessments or deletion, Sections 1–13 of this DPA will apply consistently with that law, without purporting to waive mandatory obligations.

Schedule D — International transfers

D.1 Brazil / LGPD. If the LGPD applies to an international transfer from Brazil, the relevant exporter and importer must rely on a mechanism valid under LGPD Article 33 and ANPD Resolution CD/ANPD No. 19/2024, as amended. Where the ANPD’s standard contractual clauses are the selected mechanism, the legally required full, unmodified official clauses and party/transfer details must form part of the instrument executed between the actual exporter and importer. This DPA does not purport to substitute for clauses that Haftware must execute directly with a US Subprocessor. Transfers to destinations covered by a valid ANPD adequacy decision may rely on that decision within its scope. Customer and Haftware will cooperate on information reasonably needed for transfer transparency duties, without transferring Customer’s controller obligations to Haftware by contract.

D.2 EU/EEA to Brazil. As of this DPA’s preparation, Commission Implementing Decision (EU) 2026/179 of January 26, 2026 recognizes Brazil as adequate for covered transfers from the EU/EEA to controllers and processors subject to the LGPD. Accordingly, EU Standard Contractual Clauses are not required solely for such an adequately covered transfer to Haftware in Brazil. This does not dispense with GDPR Article 28 obligations or safeguards for onward transfers from Brazil to other countries. If adequacy ceases to cover a transfer, the parties must implement a valid transfer mechanism (including the applicable unmodified EU SCC module and completed appendices if chosen) before the affected transfer continues.

D.3 UK restricted transfers. The EU adequacy decision does not establish UK adequacy for Brazil. Where a restricted transfer under UK GDPR requires safeguards, the parties must put in place a valid UK International Data Transfer Agreement or the ICO’s UK Addendum to the EU SCCs, with completed required tables and data-transfer particulars, and any required risk assessment, before the affected transfer takes place. Acceptance of this standard DPA alone is not a representation that an incomplete UK transfer instrument has been executed. A UK customer requiring this mechanism should contact privacidade@taggor.dev before transferring restricted personal data.

D.4 Other regimes and onward transfers. Any Swiss or other jurisdiction-specific transfer requirements must be addressed where they actually apply. Haftware will not treat the mere publication of a Subprocessor List or Customer’s general authorization as a substitute for legally required onward-transfer mechanisms with its own providers. If specific transfers cannot meet mandatory requirements, they must be suspended or restricted rather than described as compliant by contract alone.

Official legal references (informational only): LGPD; ANPD Resolution 19/2024; EU Brazil Adequacy Decision 2026/179; GDPR; EU SCCs Decision 2021/914; ICO UK IDTA/Addendum guidance; CCPA regulation §7051.