Preliminary version, subject to legal review.
Data processing agreement
Last updated: October 23, 2026
This agreement is part of the Terms of service, and the company accepts it by accepting them. It governs how Trato processes, on the company's behalf, the personal data in its conversations with end customers.
Parties and roles
- Controller: the company that contracts Trato. It decides why and how the data in its conversations is used.
- Processor: Servicios Informáticos E-brain SpA (Chilean tax ID 76.834.222-3), at Av. Bosques de Montemar #30, Viña del Mar, Valparaíso, Chile, which operates Trato.
This agreement covers only the data Trato processes on the company's behalf. Data for which Trato is the controller (for example, each end customer's Trato account, billing or security logs) is covered by the Privacy policy.
Purpose and duration
Trato processes the data only to provide the contracted service to the company: receiving, storing, displaying and delivering its conversations with end customers, and the features the company turns on.
The agreement lasts as long as the company has its account and, afterwards, during the deletion period described in "End of the service".
Data and data subjects
| Data subjects | Data |
|---|---|
| The company's end customers and contacts | Name and @nickname (if they share them), verified email, messages, files, photos and voice messages, consents (for example, to promotions), campaign and link context, origin (link, QR, widget, WordPress or app) and language. |
| The company's team | What it writes in conversations: replies, internal notes and assignments. Trato is the controller of their account data (see the Privacy policy). |
Trato doesn't ask for sensitive data. If the company asks for it or receives it in its conversations (for example, health data at a clinic), it does so under its own responsibility: it must have its own terms and privacy notice with its end customers, stating what data it asks them for and why, and the legal basis to process it. Trato applies the same security measures to it as to all other data.
The company's instructions
Trato processes the data only on the company's documented instructions. These instructions are the Terms of service, this agreement and what the company sets up in the console or through the API, for example: the AI Agent and automatic replies, translation, integrations (Zoho Desk, webhooks and MCP) and deleting contacts.
If Trato believes an instruction breaks the law, it tells the company and may decline to follow it in the meantime. Trato doesn't use this data for its own purposes or sell it: it only uses it to provide, maintain and protect the service.
Confidentiality and access by Trato's team
The people at Trato who can access the data are bound to keep it confidential and access it only when needed for the service.
Trato's support team enters a company's account only with its permission: an administrator authorizes it from the console, with a level and a time limit, and each access is recorded in the company's audit log.
Security
Trato applies at least these measures:
- encrypted connections and securely stored passwords;
- hosting on Oracle Cloud Infrastructure in Chile, with data encrypted at rest;
- files and documents in private storage with no public access, checked automatically; they're delivered only to people with permission, through signed links that expire;
- role-based access control and an audit log;
- integration keys stored encrypted;
- limits on attempts and usage, and API keys with permissions the company can revoke;
- automatic deletion when retention periods end.
Trato may improve these measures, but not lower their level.
Subprocessors
The company authorizes Trato to use these subprocessors to provide the service:
| Subprocessor | Purpose | Location |
|---|---|---|
| Oracle Cloud Infrastructure | Hosting, database, files and sending emails | Chile |
| Anthropic | Artificial intelligence: suggestions, automatic replies, summaries and translation, only if the company uses those features | US |
| Apple and Google, and the browser's push service | Push notifications on end customers' phones and browsers | US |
Trato requires them by contract to meet data protection obligations equivalent to those in this agreement and is liable to the company for their compliance. Anthropic doesn't use this data to train its models.
The integrations the company turns on (Zoho Desk, webhooks, the API or the MCP) send data where the company indicates. The company chooses and contracts those destinations, and they aren't Trato's subprocessors.
Changes to subprocessors
Trato notifies the company, by email or in the console, at least 30 days before adding or changing a subprocessor. If the company has a reasonable data protection reason to object, it can tell Trato within that period; if they don't reach an agreement, the company can end the service before the change takes effect.
International transfers
The data is hosted in Chile. It leaves the country only to the subprocessors listed above (for example, to Anthropic in the US, if the company uses AI), with contractual safeguards that require them to protect it as the law demands.
If the company or its end customers are in Brazil, the parties adopt for these transfers the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024), which prevail over this agreement in what they govern.
Data subjects' rights
Trato helps the company respond to its end customers' requests (access, rectification, erasure, objection, portability and blocking). To do this, an administrator can download a full copy of the data from the console and delete a contact with its entire history.
If a data subject writes to Trato about data Trato processes on a company's behalf, Trato forwards the request to that company without delay and doesn't answer it on its own, unless the company asks it to.
Security incidents
If Trato becomes aware of a security incident affecting the company's data, it notifies the company without undue delay and, where possible, within 48 hours. The notice includes what is known: what happened, which data and how many people may be affected, what measures were taken and a contact.
Trato works with the company so it can meet its own obligations to notify the authority and data subjects.
End of the service
If the company closes its account, it has 30 days to download a full copy of its data from the console. After that, Trato deletes the data from its conversations, except what the law requires it to keep.
Backups are deleted in their normal cycle and remain protected by this agreement in the meantime.
Information on compliance
Trato makes available to the company the information needed to show that it complies with this agreement: this document, the Privacy policy, the description of its security measures and the audit log of its account. It also answers reasonable security questionnaires.
Liability, governing law and contact
Each party's liability is as set out in the Terms of service. This agreement is governed by Chilean law, and disputes are resolved before the courts of Viña del Mar, as the Terms state.
If this agreement and the Terms of service say different things about personal data, this agreement prevails. Trato may update it as described in "Changes to these terms", without lowering the level of data protection.
For questions about this agreement, write to contacto@grupodtg.com.