Data processing agreement

This agreement is part of the Terms and conditions and is entered into between the business that uses Kambak (the “Business”, data controller of the database) and Javier Bagdadi, domiciled at Av. del Libertador 6199, CABA (C1428), Argentina, owner of Kambak (“Kambak”, data processor or provider of data processing services, section 25 of Law 25,326). It is accepted by the owner of the Business when signing up or when we publish a new version. Version 2026-10-10.

1. Purpose

Kambak processes the personal data of the Business’s customers (the “End customers”) only to provide the service: issuing and updating cards in Google Wallet and Apple Wallet, recording visits and redemptions, sending the notifications the Business decides on, collecting membership fees on behalf of the Business and providing it with statistics.

2. Data and data subjects

• Data subjects: the End customers who join one of the Business’s cards (via QR, NFC, link or import).
• Data: name, email, phone number and date of birth (optional depending on the card), consent to promotions, card balance (stamps, points, balance, expiration date), history of visits and redemptions, membership payment status and technical pass identifiers.
• No sensitive data is processed (section 2, Law 25,326). The Business undertakes not to enter it in any field or notification.

3. Kambak acts only on the Business’s instructions

The instructions are those the Business gives when using the dashboard (creating cards, importing customers, sending campaigns, deleting a customer) and this agreement. Kambak does not use the data for its own purposes, does not sell it, does not assign it and does not cross-reference it with that of other businesses. If an instruction seems contrary to the law, it notifies the Business and may decline to follow it.

4. Kambak’s obligations

• Confidentiality (section 10): the people with access are bound by secrecy, also after their relationship with Kambak ends.
• Security (section 9): encrypted connections (HTTPS), hashed passwords, encryption of credentials and tokens, separation of each business’s data in the database and in the code, access restricted to the staff who need it, logging of sensitive actions (exports, deletions) and backups.
• Incidents: if Kambak detects a security incident affecting the Business’s data, it informs the Business without undue delay and at the latest within 72 hours of becoming aware of it, with whatever is known (what happened, what data, what was done) so that the Business can comply with its own obligations.
• Data subjects’ rights: the dashboard has tools to view, correct, export and delete (anonymize) customers. If an End customer writes to Kambak or uses My data, Kambak verifies their email and passes the request to the Business under Requests with the legal deadline (10 calendar days for access, 5 business days for rectification or deletion, sections 14 and 16).
• Cooperation: Kambak provides the Business with the reasonable information it needs to demonstrate that it complies with the law (for example, before the AAIP).

5. The Business’s obligations

• To inform its customers (the sign-up page already shows the notice and links to the Business’s privacy policy prepared by Kambak) and to have a legal basis for each use; in particular, to send promotions only to those who accepted them.
• To register its database with the AAIP’s National Registry of Databases when applicable.
• If it imports customers, to ensure that the data was obtained lawfully and with the consent it declares when importing.
• To respond within the deadline to its customers’ requests that reach it under Requests.
• To protect access to its account and give access only to staff who need it.

6. Sub-processors

The Business authorizes Kambak to use these providers, with confidentiality and security obligations equivalent to those in this agreement:

If Kambak adds or changes a sub-processor, it publishes it on this page and notifies it by email at least 15 days in advance; if the Business does not agree, it may terminate the service at no cost before the change takes effect.

7. International transfers

Some sub-processors are located in countries that the AAIP does not consider to have an adequate level of protection (for example, the United States). In those cases the transfer is made with the safeguards of section 12 of Law 25,326 and its regulations: contractual clauses with the provider that ensure an equivalent level of protection (models from DNPDP Provision 60/2016 or each provider’s terms), and only with the data necessary for the function.

8. Artificial intelligence

The AI features (provider: Anthropic, PBC) receive the Business’s texts, aggregated data or identifiers. Before sending, Kambak masks any emails and phone numbers that appear. The dashboard copilot may receive an End customer’s first name when the Business searches for or asks about them, never their last name, email or phone number. Exception: when the Business uploads a photo of a sheet or of paper cards to import customers, the image is sent as is to be read (the model is asked to extract only the name and stamps) and Kambak does not store it. Under the provider’s commercial terms, it does not use that data to train its models.

9. Audit

Once a year, or in the event of an incident, the Business may request information about the security measures. Kambak responds in writing within 30 days; an on-site audit is agreed in advance and at the Business’s expense.

10. End of service: return and destruction

• When the Business requests the closure of its account, it has 30 calendar days to download its data and its customers’ data (Settings → Danger zone → Export, JSON or CSV).
• When that period ends, Kambak closes the account and destroys the End customers’ personal data (irreversibly anonymizing it and revoking the passes), and deletes the Mercado Pago tokens. Everything is completed within 90 days of the closure, as required by section 25(2) of Law 25,326. Backups are overwritten in their normal cycle (up to 30 more days).
• Only the records the law requires us to keep (receipts for payments and orders, for tax and accounting obligations) and the visit history without data identifying anyone are retained.

11. Liability and term

Each party is liable for its breaches of this agreement and of Law 25,326. The agreement is in force while the Business uses Kambak and, where necessary (confidentiality, destruction), also afterwards. Changes are notified 30 days in advance and accepted from the dashboard. Questions: jabagdadi@gmail.com.