Data processing agreement

Last updated: 15 October 2026

This is a translation for convenience. If there is any difference, the Spanish version prevails.

Data processing agreement under Article 28 of the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). It is part of the terms of use and is accepted when a business is set up. If you need to sign it separately, write to us at [email protected].

1. The parties

• Controller: the business set up in Pathing.
• Processor: Andrés Rodríguez, owner of Pathing (pathing.app), contact [email protected].

2. Subject, duration and purpose

The processor processes the data only to provide the business with the Pathing service: tracking its jobs step by step, its customers, suppliers and partners, its appointments and materials, and the notices the business decides to send. The agreement lasts as long as the business uses the service.

3. Data and data subjects

• Data subjects: the business's customers, suppliers and partners, and its team.
• Data: whatever the business decides to store: name and contact details, jobs or orders with their steps, dates, amounts paid and outstanding, the fields the business creates itself (for example, measurements or job details), notes, messages sent, photos and attachments, and the log of who changed what.
• Special category data: Pathing is not a medical record. If the business stores health data (for example, a patient's treatment or a customer's allergies), it must have a legal basis to do so, store only what is essential and not show it to outside partners. The same measures in section 4 apply to that data.

4. Processor's obligations

1. Process the data only on the business's instructions, which are the way the business uses the app, including as regards transfers outside the European Economic Area (only those in section 5). If an instruction seems unlawful, the processor will say so. If a law required it to process the data differently, it will tell the business first, unless that law forbids it.
2. Not use the data for anything other than the service, nor disclose it, except to the sub-processors in section 5 or where required by law.
3. Make sure anyone accessing the data on its side is bound by confidentiality.
4. Apply security measures appropriate to the risk (Article 32 GDPR), including:
   • encrypted connections (HTTPS) and data hosted in the European Union;
   • each business isolated from the rest in the database, so no one from another business can read or change its data;
   • roles per business, and outside partners who only see the jobs sent to them, with the data the business chooses;
   • two-step verification, passkeys and confirming your identity again before sensitive actions;
   • an email to each person when their account is used from a new device, with a button to close all their sessions;
   • a log of who changed what; what enters the workflow is never deleted, only cancelled or archived;
   • daily encrypted database backups, kept for 90 days and tested every week to make sure they can be restored.
5. Help the business respond to people's rights (access, rectification, erasure, objection, restriction and portability), and pass on any request it receives directly.
6. Notify the business without undue delay, and in any case within 72 hours of becoming aware, of any security breach affecting its data, with the information available so the business can report it if needed.
7. Help the business, as far as it can, with impact assessments and consultations with the supervisory authority.
8. Make available the information needed to show it complies with this agreement and allow reasonable audits requested by the business.

5. Sub-processors

The business authorises the use of these providers, which process the data only to provide the service and under the same obligations:

If one is added or changed, we will give at least 30 days' notice, and the business may object and leave at no cost. The processor imposes the same obligations as this agreement on each sub-processor and is liable to the business for what they do (Article 28(4) GDPR).

If someone in the business connects Claude to their account, or the business sends a WhatsApp message from its own phone, that is the business's decision; neither Anthropic nor WhatsApp are sub-processors of Pathing (see the privacy policy).

6. When it ends

When the business leaves the service, it decides whether its data is returned (in an open format), handed over to another provider or deleted. The processor will do so within the following 30 days; it disappears from backups within 90 days at most, as they are renewed. If a law requires any data to be kept, it is returned to the business, which will keep it. The processor may only keep, blocked, what is needed while liabilities may arise from its relationship with the business (Article 33 of Spanish Organic Law 3/2018).

7. What the business is responsible for

• Having a legal basis to process its customers', suppliers' and team's data, and giving them the information the GDPR requires.
• Deciding who gets into Pathing, with which role, and what each outside partner sees.
• Deciding, and telling its team, whether Claude may be connected to the business's accounts.
• Handling its customers' requests (access, rectification, erasure…), with the help described in section 4. The business can change or clear a customer's details from their record; to also erase their history, it asks us and we do it within 30 days at most, keeping the record numbers so traceability is not broken.
• Supervising the processing, with the information and audits in section 4.

8. Liability

If the processor uses the data for anything else, discloses it or breaches this agreement, it will be considered the controller for that processing and will be liable for the infringements committed.