1. Parties
This Data Processing Agreement is entered into between:
Data Controller (Customer):
The legal entity or individual that uses the Yabrix Services and determines the purposes and means of the processing of personal data.
Data Processor:
CAHAMS INTERNET S.L., with registered office at Calle General Díaz Porlier, 48, 1A, 28001 Madrid, Spain, Tax ID ESB85084317, operating the Yabrix platform (“Yabrix”).
2. Subject Matter and Duration
This DPA governs the processing of personal data by Yabrix on behalf of the Customer in the context of providing the Services.
The processing shall continue for the duration of the Customer’s use of the Services and any additional period required to comply with applicable legal obligations.
3. Nature and Purpose of Processing
Yabrix processes personal data solely to provide the Services, including:
- Collection and aggregation of web analytics data
- Processing of short-link and QR-code redirect requests
- Collection and aggregation of link interaction and campaign attribution data
- Operation of dashboards, reports, and insights
- Technical support and service maintenance
- Security measures necessary to provide and protect the Services on behalf of the Customer
Processing is limited to what is strictly necessary to deliver the Services.
4. Categories of Data and Data Subjects
Categories of personal data may include:
- Technical identifiers and usage data
- Data minimization and privacy-preserving processing of IP addresses
- User agent, timestamps, page URLs, destination URLs, and referrer data
- Short-link and QR-code interaction data
- Campaign attribution data, including UTM parameters where applicable
- Device, browser, operating system, and approximate geographic information derived from technical request data
- Account-related identification data (for registered users)
Categories of data subjects may include:
- Website visitors of the Customer
- Individuals who access short links, scan QR codes, or otherwise interact with links created through the Service
- Authorized users of the Customer’s Yabrix account
Yabrix does not intentionally process special categories of personal data.
5. Customer Obligations
The Customer represents and warrants that:
- It has a valid legal basis for processing personal data
- It complies with all applicable data protection laws
- It obtains any required user consent when enabling cookies or persistent identifiers
- It provides required privacy disclosures to end users
- It ensures that its use and distribution of short links, QR codes, campaign parameters, and related tracking or attribution features complies with applicable data protection and electronic communications laws
The Customer remains solely responsible for the legality of the data collected through the Services.
6. Yabrix Obligations
Yabrix shall:
- Process personal data only on documented instructions from the Customer
- Ensure personnel authorized to process data are bound by confidentiality
- Implement appropriate technical and organizational security measures
- Not use the personal data for its own purposes
- Assist the Customer, where reasonably possible, in responding to data subject requests
7. Security Measures
Yabrix implements appropriate technical and organizational measures to protect personal data, including:
- Data minimization and anonymization of IP addresses
- Access controls and least-privilege principles
- Secure infrastructure and encrypted communications
- Monitoring and incident response procedures
Absolute security cannot be guaranteed, but safeguards are continuously reviewed and improved.
8. Subprocessing
The Customer authorizes Yabrix to engage subprocessors for the provision of the Services.
Subprocessors may include infrastructure providers, payment processors, and communication services.
Yabrix ensures that all subprocessors are bound by data protection obligations no less protective than those set out in this DPA.
An up-to-date list of subprocessors will be made available to the Customer upon request. Where Yabrix relies on the Customer's general authorization to engage subprocessors, Yabrix will provide reasonable notice of intended material changes concerning the addition or replacement of subprocessors, giving the Customer an opportunity to object on reasonable data protection grounds.
9. International Data Transfers
Where personal data is transferred outside the European Economic Area, Yabrix ensures appropriate safeguards, including Standard Contractual Clauses or equivalent mechanisms, in accordance with GDPR requirements.
10. Assistance and Data Subject Rights
Taking into account the nature of processing, Yabrix shall assist the Customer, where reasonably possible, in fulfilling obligations related to:
- Data subject access requests
- Rectification, erasure, and restriction requests
- Data protection impact assessments (where applicable)
11. Personal Data Breaches
Yabrix shall notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer’s data, and provide reasonable information to support compliance with GDPR obligations.
12. Deletion or Return of Data
Upon termination of the Services, Yabrix shall, at the Customer's choice, delete or return personal data processed on behalf of the Customer and delete existing copies, unless applicable law requires continued storage.
13. Audits
Upon reasonable request, Yabrix shall make available information necessary to demonstrate compliance with this DPA and applicable data protection obligations.
Yabrix shall allow for and contribute to reasonable audits or inspections by the Customer or an auditor authorized by the Customer, where necessary to demonstrate compliance with applicable data protection law. Audits shall be subject to reasonable advance notice and appropriate confidentiality, security, scope, and operational constraints, and shall not unreasonably interfere with Yabrix's operations.
14. Liability
Liability under this DPA is subject to the limitations set out in the Terms of Service.
15. Governing Law
This DPA shall be governed by the laws of Spain, and any disputes shall be subject to the exclusive jurisdiction of the courts of Madrid, Spain.