Terms and Conditions

These Terms and Conditions (the «Conditions») govern the contractual relationship between talqi, a trading name of Fusion Ingenieria Eficiente S.L.P (NIF: B65619298, Carrer Costa Daurada, 8, 5º 3ª, 08394 Sant Vicenç de Montalt, Barcelona) and the professional client or business (the «Client») contracting conversational AI agent services.

Contracting the service implies full acceptance of these Conditions. If the Client does not agree, they must not contract the service.

1. Definitions

«AI Agent»: conversational artificial intelligence system configured by talqi to serve the Client's end customers via one or more messaging channels, using a custom system prompt containing the Client's information, tone, and business rules.
«Messaging Channel» or «Channel»: communication platform through which the AI Agent interacts with end customers. Includes, without limitation: WhatsApp Business API, Instagram Messaging API, Telegram Bot API, integrated web chat, and other channels talqi may incorporate.
«Channel Provider»: entity owning the messaging platform (Meta Platforms for WhatsApp and Instagram, Telegram for Telegram, etc.).
«System Prompt»: technical and content instructions defining the AI Agent's behaviour, knowledge, and personality, written by talqi using the Client's information.
«Administration Panel»: interface through which the Client monitors conversations, intervenes manually, and receives AI Agent alerts. In the current version, implemented via Telegram; talqi may migrate to a proprietary web interface in future versions.
«Takeover»: functionality allowing the Client to take control of a conversation, temporarily pausing the AI Agent to respond personally.
«End Customer»: natural or legal person communicating with the Client's business via a messaging channel and served by the AI Agent.

2. Service description

talqi provides a managed conversational AI agent service including:

System prompt design and writing, personalised and including the knowledge base (FAQs, services, pricing, hours, policies).
Technical configuration: integration with the contracted messaging channel APIs, webhook configuration, connection to the Anthropic (Claude) API, and agent deployment.
Administration Panel: interface where the Client receives escalation alerts, can take control of conversations, and check agent status.
Operation and maintenance: monitoring, prompt updates, incident resolution, and conversational performance optimisation.
Periodic reports: usage metrics (messages, resolution rate, response time, escalations) delivered monthly.

2.1. Service limitations

The service does not include, unless expressly agreed:

Creation or management of the Client's accounts on messaging platforms (Meta Business, Telegram, etc.).
Mass messaging (broadcast) campaigns or outbound marketing automation.
CRM, ERP or other system integrations, except those included in the proposal.
Development of custom web applications, mobile apps, or dashboards.

2.2. AI — scope and limitations

The AI Agent uses large language models (LLMs) from Anthropic PBC (Claude models). The AI Agent is not infallible: it may generate inaccurate or inappropriate responses. talqi continuously optimises the prompt but does not guarantee 100% accuracy. The human escalation mechanism (takeover) is mandatory for this reason.

3. Supported messaging channels

talqi offers AI Agent deployment on the following messaging channels, subject to technical availability and each channel provider's terms of service:

Channel	Provider	Client requirements
WhatsApp Business API	Meta Platforms, Inc.	Verified Meta Business account, dedicated phone number
Instagram Messaging API	Meta Platforms, Inc.	Professional Instagram account linked to Meta Business
Telegram Bot API	Telegram FZ-LLC	Creation of a Telegram bot (assisted by talqi)
Integrated web chat	talqi (own infrastructure)	Access to the Client's website source code or CMS
Other future channels	According to provider	Will be communicated when available

The Client contracts one or more channels in the individual proposal. Adding further channels may result in an adjustment to the monthly fee, communicated to the Client in advance.

talqi does not guarantee continuity or stability of third-party provider APIs. Changes in policies, pricing, or channel availability by its provider are beyond talqi's control and do not constitute a breach of contract.

Platform policies: each messaging channel has its own usage policies. The Client undertakes to comply with the relevant provider's terms of service. In particular, since January 2026 Meta's WhatsApp Business API prohibits general-purpose chatbots; talqi agents comply with this regulation by being tied to a specific business.

4. Contracting process

The contracting process follows these steps:

Initial consultation: the Client requests information via the Website, messaging, or email.
Free audit (optional): talqi analyses the Client's current communications and presents opportunities.
Personalised demo: talqi configures a test agent with real business data.
Proposal and acceptance: detailed proposal with scope, channels, price, and conditions. Written acceptance formalises the contract.
Onboarding: the Client provides the necessary information and talqi deploys the AI Agent within 1 to 2 weeks.
Go-live: after joint testing, the AI Agent is activated on the contracted channels.

5. Pricing and payment

5.1. Pricing structure

Pricing is structured into the following items:

Item	Description
Setup fee	One-off payment. Configuration: prompt, technical channel integration, admin panel and testing
Monthly fee	Operation, maintenance, API, hosting, support, and agent optimisation
Additional channel	Each messaging channel added beyond the initially contracted one
Integrations	Booking APIs, CRM, database, or other systems

The amounts in force for each item are set out in the individual proposal accepted by the Client, which prevails for all purposes, and are published for guidance at talqi.io. Prices exclude VAT (21%).

5.2. Billing and payment

The setup fee is invoiced in full before configuration begins.
The monthly fee is invoiced in advance within the first 5 days of each month.
For billing purposes, a month is counted as 30 calendar days.
Payment methods: bank transfer, SEPA direct debit and card payment.
Non-payment exceeding 15 days entitles talqi to suspend the service (with 5 days' prior notice).
Unpaid amounts shall accrue late-payment interest at the statutory rate plus two percentage points.

5.3. Included volume and additional usage

Each plan includes a set monthly volume of conversations, stated in the individual proposal and published for guidance at talqi.io. Conversations beyond that volume are billed at the per-conversation rate set out in the proposal.

For billing purposes, a conversation is one that reaches three or more messages. Exchanges below that threshold do not count.

Where a contracted channel or integration generates third-party API costs not covered by the fee, talqi will pass them on at cost price, without markup, having informed the Client first.

6. Term and termination

6.1. Term

The contract has an indefinite term with monthly billing. There is no minimum commitment period.

6.2. Termination by the Client

The Client may terminate at any time, with no notice period and no penalty, by writing to soporte@talqi.io. The service remains active until the end of the period already paid for, and fees for the current period are non-refundable. Detailed conditions in clause 7.5.

6.3. Termination by talqi

talqi may terminate for:

Repeated non-payment (two or more consecutive unpaid fees).
Use of the AI Agent for unlawful purposes or contrary to regulations.
Material breach of the Client's obligations.
Force majeure making service provision impossible for more than 30 consecutive days.

Force majeure definition: pandemics, epidemics, or declared health emergencies; unilateral changes to the APIs, policies, or terms of service of channel providers (Meta Platforms, Telegram, etc.) or the AI provider (Anthropic); suspension or revocation of access to the WhatsApp Business API or other APIs by the provider's decision; natural disasters; armed conflicts; acts of terrorism; general strikes; cyberattacks on third-party infrastructure; large-scale electricity, internet, or telecommunications outages; governmental orders, judicial or administrative resolutions preventing service provision; and legislative or regulatory changes making service provision impossible or unlawful under the agreed conditions.

6.4. Effects of termination

Upon termination: (a) the AI Agent will be deactivated on all channels; (b) talqi will provide a data export within 15 days (CSV/JSON); (c) after 30 days, talqi will delete the data, unless legally required to retain it.

7. Cancellation and refund policy

7.1. Scope: business-to-business contracting (B2B)

The service is offered exclusively for professional, commercial or business use. The Client represents and warrants that it is contracting within the scope of its business or professional activity, and not as a consumer.

Accordingly, the right of withdrawal set out in articles 102 to 108 of the Consolidated Text of the General Law for the Defence of Consumers and Users does not apply, as that right is reserved to those acting for purposes outside their trade or profession (article 3 TRLGDCU).

7.2. Demos

This clause 7 does not apply to demos. A demo is a test agent configured by talqi: the "Personalised demonstration" described in clause 4, as well as the generic demo available on the Website. talqi may configure a demo on its own initiative for a potential client, without a prior request.

No cost and no obligation: a demo is free and pre-contractual. It creates no payment obligation and does not constitute a contract, whether it was requested or created by talqi on its own initiative.
Its own window: each demo has its own availability window, set by talqi case by case. talqi may modify, withdraw or delete it at any time. The trial period under clause 7.4 is a separate matter and does not begin with a demo.
Information used: the demo answers questions based on publicly available information about the business gathered from the internet: its own website and public listings or directories (services, prices, opening hours and published content). The business's customer database and conversation history are not incorporated, and no personal data is processed. Any business may request the removal of its demo by writing to rgpd@talqi.io; in the absence of a contract, the demo is deleted in any event.

Once the business contracts the service, talqi acts as data processor in accordance with clause 11 and Annex I (DPA).

The free audit is not a demo. The "Free audit" described in clause 4 is a consultation: talqi analyses the business's current communications and presents opportunities for improvement. No agent is configured and no service is delivered, so this clause 7.2 does not apply to it.

7.3. Setup fee: non-refundable

The setup fee is non-refundable once paid.

The setup fee is consideration for a one-off deliverable, not for the ongoing provision of the service: design and drafting of the system prompt, technical integration with the contracted channels, configuration of the admin panel and testing (clause 5.1). It is work actually performed and delivered, and is not recoverable once carried out.

The setup fee applicable to each product is set out in the individual proposal, in accordance with clause 5.1.

Sole exception: if talqi does not begin or does not complete the configuration for reasons attributable to talqi, the setup fee is refunded in full.

7.4. Trial period and start of billing

Product	Free trial	Start of billing
Business chatbot	30 days, no card	After the trial, if the Client confirms
WhatsApp AI	30 days (first subscription month)	Second month
Blanca add-on	—	From activation

The trial period runs from the agent's go-live (deployment into production), not from acceptance of the proposal.
talqi does not store any payment method and makes no automatic charges. The trial does not automatically convert into a paid subscription.
Once the trial ends, billing begins only if the Client confirms continuation, in accordance with clause 5.2 (invoiced in advance within the first 5 days of each month; bank transfer, SEPA direct debit or card payment).

7.5. Subscription cancellation

No lock-in and no notice period: the Client may cancel at any time by writing to soporte@talqi.io, with no minimum term and no penalty.
Effects: the service remains active until the end of the period already paid for. No further charges are issued.
No pro-rata refunds: no partial, prorated or unused-time refunds are issued for the current period.
Renewals are non-refundable once invoiced.

7.6. Finality of payments

Since the Client has a 30-day free trial to evaluate the service with its real customers before any charge, subscription fees once paid are final and non-refundable.

7.7. Effect on data after cancellation

Clause 6.4 applies: deactivation of the AI Agent across all channels, data export within 15 days (CSV/JSON) and deletion after 30 days. Conversation messages are automatically deleted 90 days after the last message (clause 11.2).

Retention under legal obligation: invoices and transaction records are retained for 4 years (article 66 of the General Tax Law) and accounting documentation for up to 6 years (article 30 of the Commercial Code), regardless of cancellation of the service.

7.8. Non-payment, direct debit returns and chargebacks

A returned direct debit or a chargeback initiated without prior notice to talqi entitles talqi to immediately suspend access to the service and to the APIs until the balance is settled.
Bank charges arising from the return or the chargeback will be passed on to the Client.
Clause 5.2 additionally applies in respect of non-payment: suspension for non-payment exceeding 15 days with 5 days' prior notice, and late-payment interest.

7.9. Summary

Item	Refundable?	Conditions
Setup fee	No	Non-refundable once paid. Sole exception: breach attributable to talqi (clause 7.3)
Trial period	Not applicable	30 days free and without a card. No charge during the trial
Current monthly fee	No	The service remains active until the end of the paid period
Renewals	No	Non-refundable once invoiced
Demos	Not applicable	Free and pre-contractual (clause 7.2)

8. Client obligations

Provide truthful and up-to-date information for AI Agent configuration.
Keep active their accounts on the contracted messaging platforms and comply with their terms of service.
Designate at least one administrator with access to the administration panel.
Inform their end customers that they may be served by an AI system (EU Regulation 2024/1689).
Notify talqi of changes in their business that affect the AI Agent.
Not use the AI Agent for spam, unlawful content, or content infringing third-party rights.
Comply with GDPR/LOPDGDD in their relationship with end customers.
Pay fees on time.

8.1. Opt-out mechanism (STOP)

In accordance with AEPD guidelines on chatbots and artificial intelligence, the AI Agent will incorporate an opt-out mechanism allowing end customers to request that automated communications cease. The AI Agent will be configured to:

Recognise and respect opt-out keywords: «STOP», «no more messages», «unsubscribe» and equivalent expressions.
Confirm to the end customer that their opt-out request has been received.
Immediately cease automated communications with that end customer.
Record the opt-out request to prevent future automated communications.

The Client undertakes not to deactivate or modify the opt-out mechanism, and to respect opt-out requests from their end customers, in accordance with Article 21 of the GDPR.

9. talqi obligations

Provide the service with professional diligence.
Configure the AI Agent according to the agreed specifications.
Maintain the operational infrastructure and monitor the agent.
Notify technical incidents affecting the service.
Attend to modification requests within a maximum of 48 working hours.
Comply with data protection regulations as data processor.
Deliver monthly performance reports.
Not access or disclose Client data for purposes other than the service.

10. Service level (SLA)

Metric	Commitment
AI Agent availability	99% monthly (excludes channel provider API outages and scheduled maintenance)
Agent response time	< 5 seconds per message (normal conditions)
Critical incident response	< 4 hours (Mon–Fri, 9:00–18:00 CET)
Change request response	< 48 working hours
Performance reports	Monthly, by the 10th of the following month

Outages caused by channel providers (Meta, Telegram, etc.), the AI provider (Anthropic), or force majeure do not count towards availability calculations.

11. Personal data processing — Data Processor

talqi acts as data processor (Art. 28 GDPR) with respect to end customer data. The detailed data processing conditions are set out in Annex I — Data Processing Agreement (DPA), which forms an integral part of these Conditions and is deemed accepted automatically upon acceptance of the Conditions.

11.1. Data processed

End customer identifier on the messaging channel (phone number, username, profile ID).
Profile name (if available on the channel).
Message content (text, images, documents, voice notes).
Data voluntarily provided in the conversation.
Metadata: date, time, duration, channel used.

11.2. Purpose and retention

Data is processed exclusively to provide the service. Maximum retention: 90 days from the last message (configurable). Automatic deletion upon expiry of the retention period.

11.3. Sub-processors

Sub-processor	Function	Location
Anthropic PBC	Natural language processing (Claude API)	USA (see 10.3.1 international transfers)
Amazon Web Services (AWS)	Cloud infrastructure (servers, databases)	EU (eu-west-1, Ireland)
Meta Platforms, Inc.	WhatsApp Business API / Instagram Messaging API	USA/EU (per Meta policy)
Telegram FZ-LLC	Telegram Bot API	UAE/EU (per Telegram policy)
MongoDB, Inc.	Database as a service (Atlas)	EU

Sub-processors may vary depending on the contracted channels. talqi will inform the Client of any new sub-processors with sufficient advance notice.

11.3.1. International data transfers

Processing by Anthropic PBC involves the transfer of data to the United States. In accordance with Articles 44 to 49 of the GDPR and CJEU case law (Schrems II, C-311/18), talqi has adopted the following safeguards:

EU-US Data Privacy Framework (DPF): Anthropic PBC is self-certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), which constitutes a valid adequacy basis under Article 45 GDPR for data transfers to this importer.
Standard Contractual Clauses (SCCs): as a complementary safeguard, the relationship with Anthropic PBC is governed by Anthropic's Data Processing Agreement (DPA), which incorporates the Standard Contractual Clauses approved by the European Commission (Implementing Decision 2021/914).
Transfer Impact Assessment (TIA): talqi maintains documented TIA for the US transfer, considering the nature of customer service conversational data (not special categories), complementary technical measures (TLS 1.3 transit encryption, transitory processing without persistent storage by Anthropic per their API policy) and the legal framework of the destination country.
Complementary measures: Anthropic does not use API data to train AI models. Data is processed transiently and not stored beyond the time required to generate the response, per Anthropic's current API data policy.

The Client may request a copy of documentation relating to international transfers (including the applicable TIA and SCCs) by writing to rgpd@talqi.io.

11.4. Security measures

Encryption of credentials and tokens at rest (AES-256).
Encrypted communications (TLS 1.3) in transit.
Data isolation by tenant (unique identifier, logical segregation).
Automated daily backups.
Access control: only authorised talqi personnel, exclusively for service provision.
Cryptographic verification of incoming webhooks.
Retention policy: automatic deletion after 90 days (configurable).

11.5. Processor obligations

Not to process data for purposes other than those indicated.
Not to disclose data to third parties other than authorised sub-processors.
To assist the Client in fulfilling their GDPR obligations.
To notify security breaches to the Client within a maximum of 48 hours of detection.
To return or delete data upon contract termination (clause 6.4).

12. Artificial intelligence and automated decisions

In accordance with Article 22 of the GDPR:

The AI Agent does not make decisions with legal or significant effects. Its function is informational.
The end customer may request human attention at any time.
talqi does not use conversation data to train AI models.
Conversations processed by Anthropic are subject to their no-training-on-API-data policy.

EU AI Act (Regulation (EU) 2024/1689): the service is generally classified as a limited-risk AI system (transparency obligation, Art. 50). However, the risk classification may vary depending on the Client's sector: an agent handling health-related queries (dental or aesthetic clinics) could be classified as high-risk under Annex III of the Regulation. talqi will carry out a risk-level assessment for each deployment and take appropriate additional measures. The Client undertakes not to deactivate or conceal transparency information and to cooperate with talqi in the risk assessment.

13. Confidentiality

Both parties undertake to maintain the confidentiality of reserved information, an obligation that survives 2 years after contract termination.

Exceptions: (a) publicly available information; (b) disclosure required by law; (c) information legitimately received from third parties.

talqi may reference the Client as a customer (name and sector), unless the Client objects in writing.

14. Limitation of liability

talqi shall not be liable for damages arising from:

Erroneous AI Agent responses (generative AI is not infallible).
Interruptions or changes to channel provider APIs.
Changes in policies or pricing of Meta, Telegram, Anthropic, or other providers.
Client actions, including lack of supervision or outdated information.
Force majeure or unforeseen circumstances.
Loss of profit, loss of revenue, data loss, reputational damage, or any indirect or consequential damage.

Direct damages: talqi's total cumulative liability to the Client for direct damages shall not exceed the total fees paid in the last 6 months prior to the causative event.

Indirect damages: talqi shall in no event be liable for indirect, incidental, special, consequential, or punitive damages, including — without limitation — loss of profit, loss of revenue, loss of business opportunities, data loss, or reputational damage, regardless of whether talqi had been advised of the possibility of such damages.

These limitations shall not apply in cases of wilful misconduct or gross negligence by talqi, nor where mandatory legislation prohibits limiting liability.

15. Intellectual property

talqi's source code, architecture, tools, and procedures are the exclusive property of talqi. The business content of the prompt (FAQs, pricing, services) is and shall remain the property of the Client, who may request a copy after termination.

16. Communications

Email: rgpd@talqi.io and the Client's address.
Administration Panel: for operational matters relating to the agent.
Termination, complaints, and legal matters: by email only.

17. Amendments

talqi may amend these Conditions with 30 days' notice for material changes. The Client may terminate without penalty before the changes take effect. Minor amendments apply without prior notice. Current version at talqi.io/legal.

18. Dispute resolution

Spanish law applies. The parties will attempt amicable resolution before resorting to legal proceedings. Jurisdiction: Courts and Tribunals of Barcelona.

EU online dispute resolution platform: https://ec.europa.eu/consumers/odr/

19. Final provisions

Assignment: the Client may not assign the contract without talqi's written consent.
Partial invalidity: if any provision is declared void, the remaining provisions retain their validity.
Waiver: tolerance does not constitute a waiver of the right to demand future compliance.
Entire agreement: these Conditions and the accepted proposal constitute the entire agreement.
Right of withdrawal: as a service contracted between businesses, the consumer right of withdrawal does not apply, as set out in clause 7.1.

Last updated: July 2026 · Version 1.1

Document prepared for: Fusion Ingenieria Eficiente S.L.P, talqi (NIF: B65619298) · Barcelona, Spain.

Drafted in accordance with applicable Spanish legislation (LSSI-CE, GDPR, LOPDGDD, EU AI Act Regulation (EU) 2024/1689, Spanish Consumer Law) and AEPD guidelines on chatbots and AI. Professional legal review is recommended before publication. The owner's Tax ID (NIF) MUST be filled in before publishing at talqi.io/legal.

Annex I — Data Processing Agreement (DPA)

The complete and up-to-date version of this DPA is available under the "DPA" tab on the Privacy Policy page.

This Data Processing Agreement (the «DPA») forms an integral part of the Terms and Conditions of Service. Acceptance of the Conditions by the Client constitutes automatic acceptance of this DPA, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).

For the purposes of this DPA, the Client acts as data controller and Fusion Ingenieria Eficiente S.L.P, operating under the trading name talqi (NIF: B65619298), as data processor. This DPA enters into force on the date the Client accepts the Terms and Conditions — whether by signing the service proposal, confirmation by email, or any other means evidencing acceptance — and shall remain in force while talqi processes personal data on behalf of the Client.

A1. Subject matter

The Client instructs talqi to process end customers' personal data exclusively for the provision of the conversational AI agent service described in the Terms and Conditions. talqi shall process personal data only in accordance with the Client's documented instructions, unless required to do so by Union or Member State law.

A2. Personal data processed

A2.1. Categories of data subjects

End customers of the Client communicating via the contracted messaging channels.

A2.2. Types of personal data

Channel identifiers: phone number, profile name, username, user ID.
Message content: free text, images, documents, voice notes sent during the conversation.
Voluntarily provided data: full name, email, address, preferences, enquiry details.
Metadata: date, time, conversation duration, channel used, status (bot/human).

A2.3. Special categories of data

talqi does not intentionally request or collect special categories of data (Art. 9 GDPR). However, end customers may spontaneously disclose health or other sensitive data in free conversation. The AI Agent is configured not to store or specifically process such data, and to redirect the end customer to human attention when such queries are detected.

A3. Purpose and duration of processing

Purpose: to provide the conversational agent service (answering queries, managing escalations, capturing leads, generating performance reports).

Duration: processing shall continue for the duration of the contractual relationship between the parties. Conversation messages are automatically deleted 90 days after the last message (configurable by the Client). Captured lead data is retained until contract termination, at which point it is exported to the Client and deleted in accordance with clause 6.4 of the Terms and Conditions.

A4. Processor obligations (talqi)

talqi, in its capacity as data processor, undertakes to:

Process personal data only in accordance with the Client's documented instructions.
Ensure that persons authorised to process data have committed to confidentiality or are subject to a statutory confidentiality obligation.
Implement the technical and organisational measures described in clause A6 of this DPA.
Not engage another processor (sub-processor) without prior general authorisation from the Client, which is deemed granted for the sub-processors listed in clause 11.3 of the Terms and Conditions. talqi will inform the Client of any changes to sub-processors with 30 days' advance notice, allowing the Client to object.
Assist the Client, taking into account the nature of the processing, through appropriate technical and organisational measures, to fulfil its obligation to respond to requests for the exercise of data subjects' rights (access, rectification, erasure, portability, objection, restriction).
Assist the Client in ensuring compliance with obligations relating to processing security, breach notification, impact assessment, and prior consultation (Arts. 32–36 GDPR).
At the Client's choice, delete or return all personal data upon completion of service provision, and delete existing copies unless Union or Member State law requires their retention.
Make available to the Client all information necessary to demonstrate compliance with the obligations in Art. 28 GDPR, and allow and contribute to audits or inspections carried out by the Client or an authorised auditor.

A5. Controller obligations (Client)

The Client, in its capacity as data controller, undertakes to:

Ensure it has a legitimate legal basis for processing its end customers' data via the AI Agent.
Inform its end customers of the data processing and use of artificial intelligence, facilitating the exercise of their rights.
Provide documented instructions to talqi regarding data processing.
Notify talqi of any updates to its Record of Processing Activities that affect the service.

A6. Technical and organisational measures

talqi implements the following security measures in accordance with Article 32 of the GDPR:

Technical measures:

Encryption of data at rest (AES-256) for credentials and access tokens.
Encryption of data in transit (TLS 1.3) for all communications.
Logical data isolation by tenant (tenant_id in all database documents).
Cryptographic verification of incoming webhooks (Meta signature, Telegram).
Automated daily database backups with 30-day retention.
TTL indexes in MongoDB for automatic deletion of messages after the retention period.
Continuous monitoring via Grafana Cloud with real-time alerts.

Organisational measures:

Restricted access: only authorised talqi personnel (currently one person) access data, exclusively for service provision.
Documented retention policy: 90 days for messages (configurable), contract duration for leads.
Documented security breach management procedure.
Periodic security measure reviews (at least annually).

A7. Security breach notification

In the event of a personal data security breach, talqi shall:

Notify the Client without undue delay and, in any case, within a maximum of 48 hours of becoming aware of the breach.
Provide the Client with the information necessary for it to comply with its obligation to notify the AEPD within 72 hours pursuant to Article 33 of the GDPR.
Cooperate with the Client in investigating, mitigating, and documenting the breach.

The notification periods to the Client (48h) and to the AEPD (72h) run simultaneously from the moment of detection, not consecutively.

A8. International transfers

International data transfers are governed by clause 11.3.1 of the Terms and Conditions. In summary: the transfer to Anthropic PBC (USA) is made on the basis of Standard Contractual Clauses (SCCs) and a documented Transfer Impact Assessment (TIA), with complementary technical measures (encryption, transitory processing, no training on API data).

A9. Audits

The Client has the right to carry out audits or inspections to verify compliance with this DPA, directly or through a third-party auditor subject to confidentiality. Audits shall be conducted with a minimum of 15 working days' advance notice, during business hours, and in a manner that does not disproportionately interfere with talqi's operations. talqi may demonstrate compliance through third-party certifications or audit reports, where available.

A10. DPA term

This DPA enters into force automatically when the Client accepts the Terms and Conditions of Service, and shall remain in force while talqi processes personal data on behalf of the Client. Confidentiality obligations and those relating to the return or deletion of data shall survive termination of the DPA and the service contract.

Acceptance of the Terms and Conditions — by any means evidencing the Client's consent (proposal signature, email confirmation, acceptance on a web form) — constitutes the execution of this DPA in accordance with Article 28.9 of the GDPR, which expressly permits electronic format.

Integrated acceptance: this DPA does not require a separate signature. It is deemed accepted and binding from the moment the Client accepts talqi's Terms and Conditions of Service, of which this Annex forms an integral part. Art. 28.9 GDPR expressly recognises the validity of data processing contracts in electronic format.

Last updated: July 2026 · Version 1.1

Document prepared for: Fusion Ingenieria Eficiente S.L.P, talqi (NIF: B65619298) · Barcelona, Spain.