BACK TO ZERO
Take your team back to zero

Data Processing Agreement

Effective Wednesday, September 30, 2026 · Avila Integradores de Soluciones SA de CV

This Agreement is part of the Terms of Service and applies to the personal data the Customer enters in Back to Zero.

1. Roles

The Customer is the controller of the data it enters (for example, names of its customers and team members on sales). Avila Integradores de Soluciones SA de CV is the processor: it processes that data on the Customer’s behalf and only to provide the Service.

2. Instructions

We process data only on the Customer’s documented instructions, which are the Terms, this Agreement and the Customer’s settings in the app. If we believe an instruction infringes the law, we will inform the Customer.

3. Confidentiality and access

Team members who may process data are bound by confidentiality. Our team sees activity metrics for each company (counts and dates, such as the number of sales logged or the date of the last session) and aggregated platform statistics. Business data only with support access, granted by the company’s admin (read-only, 24 hours, revocable and recorded in its log).

4. Security measures

  • Encryption in transit (HTTPS) and irreversibly hashed passwords; encrypted second-factor secrets.
  • Logical isolation between companies, verified by automated tests.
  • Change and access logs; periodic backups.
  • Payments processed by Stripe (PCI DSS certified); we do not store card data.

5. Sub-processors

The Customer authorizes the sub-processors in the published list. We will give at least 30 days’ notice before adding a new one; the Customer may object by closing its account. We require each sub-processor to meet equivalent data protection obligations.

6. Data subject rights

The app lets the Customer view, correct, export and delete its data. If we receive a request from a data subject about the Customer’s data, we will forward it and reasonably assist the Customer.

7. Security incidents

If a breach affects the Customer’s data, we will notify the Customer without undue delay and no later than 72 hours after confirming it, with the information available to help it meet its own obligations.

8. End of service

When the account is closed, the Customer may export its data for 30 days; after that we permanently delete it, and from backups within the following 30 days, unless the law requires retention.

9. Transfers

Data is hosted in Dallas, Texas, Estados Unidos. The Customer is responsible for informing its data subjects and, where applicable, obtaining their consent for that transfer.

This Agreement is governed by the laws of the United Mexican States. This is a translation; the Spanish version prevails.

10. Audit

Upon reasonable request, we will make available to the Customer the information necessary to demonstrate compliance with this Agreement.