Data Processing Addendum — Mexico (LFPDPPP)

This Data Processing Addendum ("Addendum") supplements the BounceZero Data Processing Agreement ("Master DPA") and applies where the customer ("Responsible Party", "you") submits for verification email addresses relating to data subjects in Mexico. It sets out how BounceZero Ltd ("Processor", "we", "us") complies with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares ("LFPDPPP") when acting as a processor on your behalf. In the event of any conflict, the more protective obligation prevails.

1. Introduction

This Addendum forms part of the Master DPA. The terms defined in the Master DPA apply to this Addendum unless stated otherwise. Under LFPDPPP terminology, "responsible party" (responsable) means you, and "processor" (encargado) means BounceZero.

We process personal data on EU infrastructure (OVH, France). BounceZero does not maintain an establishment in Mexico; this Addendum governs our processing of personal data of Mexican data subjects on your behalf.

2. Governing Law and Regulator

The processing described in this Addendum is governed, so far as the data subjects are in Mexico, by the LFPDPPP, in force since 6 July 2010, its Regulations (Reglamento), and the guidance of the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI). Sanctions for non-compliance can include fines and, for processing of sensitive personal data, penalties under applicable law.

3. Role and Scope

For the email verification services described in the Master DPA, you act as the responsible party and we act as the processor (encargado) under LFPDPPP Art. 3(XIV). The subject matter, nature, and purpose of the processing are the same as set out in Section 2 of the Master DPA: syntactic validation, DNS/MX lookup, SMTP probing, catch-all detection, deliverability scoring, and fraud/abuse checks of the email addresses you submit.

We process personal data only on your documented instructions and never for our own benefit, except where applicable law requires otherwise.

4. Data Subject Rights (ARCO)

We will assist you in responding to requests from data subjects exercising their ARCO rights under LFPDPPP Art. 28:

• Acceso (access) — to know whether their personal data is being processed and what it is.
• Rectificación (rectification) — to correct inaccurate or incomplete data.
• Cancelación (cancellation) — to have data removed where it is no longer needed.
• Oposición (opposition) — to object to processing in the circumstances set out in the law.

If a data subject contacts us directly, we will forward the request to you without undue delay and comply with your reasonable instructions. You are responsible for the lawful basis of the processing, including the privacy notice (aviso de privacidad) and consent where required.

5. Breach Notification

We will notify you of any security incident affecting the personal data you submitted, without undue delay after confirming the breach, consistent with the Master DPA. As the responsible party, you decide on and carry out any notification to the affected data subjects required by LFPDPPP Art. 20 and the Regulations. We will provide the information needed to support that notification.

6. Cross-Border Transfers

Personal data of Mexican data subjects is processed on EU infrastructure. The LFPDPPP (Art. 36) permits transfers of personal data to processors that assume equivalent obligations. This Addendum, together with the Master DPA and its Standard Contractual Clauses, constitutes those equivalent obligations. A copy is available on request at [email protected].

7. Additional Obligations

• Privacy notice support: we will provide the information about our processing needed for your aviso de privacidad, on request.
• Confidentiality: personnel authorised to process personal data are bound by confidentiality obligations, as required by LFPDPPP Art. 19.
• Data minimisation: only the email addresses and derived metadata necessary for validation are processed.
• Deletion: personal data is retained and deleted in accordance with Section 8 of the Master DPA (up to 90 days after termination).
• Audit: we will co-operate with reasonable audits conducted by you or your authorised auditor, on reasonable prior written notice.

8. Contact

For enquiries about this Addendum or to exercise rights in respect of the processing described here, contact our Data Protection contact:

You may also refer to the Master DPA and its terms on sub-processors, security measures, retention, and liability at bouncezero.io/dpa.