Mekovault

Data Processing Agreement (DPA)

Translation for reference. The Spanish version is the binding one.

Version 1.0 · Effective: 2026 · This document is a reference template. To operate with a customer, we sign it as an annex to the service agreement.

1. Parties

  • Data Processor: Mekovault SpA, Santiago, Chile.
  • Data Controller: the Customer that contracts Mekovault’s services.

2. Subject matter

This DPA governs the processing of personal data that Mekovault performs on behalf of and in the name of the Customer as a result of providing the services (management of corporate identities in Google Workspace and other platforms).

3. Categories of data processed

  • Customer employees: first name, last name, corporate email, job title, department, manager, assigned permissions, session IP and user-agent.
  • External requesters (public form): email, name, reason for the request.
  • Activity records: immutable audit log of all administrative actions performed on the Customer’s identities.

4. Duration

For the duration of the service agreement. Upon termination, Mekovault deletes the Customer’s data within a maximum of 30 calendar days, except where legal retention obligations apply (tax invoicing, platform audit logs).

5. Obligations of Mekovault (Processor)

  • Process the data only in accordance with the Customer’s documented instructions.
  • Apply appropriate technical and organizational measures: TLS 1.3 encryption in transit, multi-tenant isolation with Row-Level Security in PostgreSQL, a dedicated vault per Customer in Infisical, AES-256 encrypted backups in Backblaze B2 with object lock.
  • Ensure that its personnel is committed to maintaining confidentiality.
  • Notify the Customer without undue delay (within 72 hours) of any security breach affecting personal data.
  • Assist the Customer in fulfilling its obligations regarding data subject requests (ARCO rights / GDPR Art. 15-22).
  • Assist the Customer in carrying out impact assessments (DPIA) when required.

6. Sub-processors

Mekovault engages sub-processors to provide the service. The updated list is published at /legal/sub-processors. We give 30 days’ notice of any change.

7. International transfers

Customer data is processed mainly in the United States (AWS us-east-1) with backup in Backblaze B2 US-West. Both providers adhere to the EU-US Data Privacy Framework (for data of EU residents).

8. Audit rights

The Customer may audit compliance with this DPA with 15 days’ prior notice. Alternatively, Mekovault provides documentary evidence (SOC 2 reports, internal policies) upon request.

9. Return or deletion of data

At the Customer’s request and at any time:

  • Export: Mekovault delivers the Customer’s data in a structured format (JSON/CSV) within 15 days.
  • Deletion: complete deletion (DB + sub-processors) is carried out within 30 days. Exceptions: platform audit log (5 years) and backups with object lock (until the retention period expires).

10. Liability

Each Party is liable for damages caused by its breach of this DPA or of applicable data protection regulations, up to the limit established in the service agreement.

11. Governing law

This DPA is governed by the laws of the Republic of Chile, in particular Ley 21.719. For customers with data subjects in the European Union, Regulation (EU) 2016/679 (GDPR) additionally applies.

To request the signable version of the DPA, write to legal@mekovault.com or directly to cloud@mekovault.com.