1. Scope and roles
This DPA applies where CodeSpar processes personal data on a customer's behalf and documented instructions in connection with the Service, acting as processor or operator. Personal data that CodeSpar processes as controller for its own account, billing, security, compliance, legal, and business purposes is covered by the Privacy Policy.
For this DPA, "CodeSpar" means CODESPAR TECNOLOGIA LTDA, CNPJ 68.398.673/0001-85.
2. Subject matter, duration, nature and purpose
The subject matter of the processing is personal data a customer submits to, configures in, or generates through the Service in the course of agentic payments orchestration and governance, including mandates, policy checks, transaction routing, receipts, and audit records.
The duration of processing is the term of the customer's agreement with CodeSpar, plus any retention period described in this DPA, the Terms, the Privacy Policy, or applicable law.
The nature and purpose of the processing is to provide, secure, maintain, support, document, and improve the Service on the customer's instructions.
3. Categories of data subjects and data
Data subjects may include the customer's users, employees, contractors, representatives, customers, end users, consumers, payers, payees, recipients, approvers, administrators, developers, and principals behind agents the customer operates on the Service.
Categories of data may include identification data, contact data, role and account data, transaction metadata, amounts, timestamps, routing details, receipts, mandate and policy data, audit records, support content, KYC/KYB results, sanctions or screening results, fraud prevention results, and other data submitted to or generated through the Service.
4. Customer instructions
CodeSpar will process personal data only on the customer's documented instructions, including instructions given through the Service's configuration, APIs, policies, mandates, connector setup, order forms, Terms, and this DPA, unless required to do otherwise by law. If legally permitted, CodeSpar will inform the customer before processing personal data contrary to the customer's instructions because of a legal requirement.
5. Confidentiality
CodeSpar ensures that personnel authorized to process personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.
6. Security measures
CodeSpar maintains technical and organizational measures designed to protect personal data, including:
- encryption of data in transit;
- encryption of data at rest;
- tenant isolation and access controls;
- production access restrictions;
- logging, monitoring, and audit trails;
- credential and API key protection measures;
- incident response procedures;
- vendor and subprocessor review appropriate to the nature of the Service; and
- reasonable administrative, technical, and organizational safeguards.
7. Subprocessors
CodeSpar uses subprocessors to help provide the Service. The current list is published at codespar.dev/legal/subprocessors. CodeSpar will give notice of new subprocessors as described on that page and imposes data protection obligations on subprocessors that are consistent with this DPA.
8. Assistance with data-subject requests
Taking into account the nature of the processing, CodeSpar will reasonably assist the customer in responding to requests from data subjects exercising their rights and in meeting the customer's compliance obligations relating to security, breach notification, data protection impact assessments, and consultations with authorities, to the extent the customer does not have access to the relevant information itself.
9. Breach notification
CodeSpar will notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's personal data and will provide information reasonably available to CodeSpar to help the customer meet its own notification obligations.
10. Deletion and return at termination
On termination of the customer's agreement with CodeSpar, and subject to any retention required or permitted by law, regulation, audit, security, dispute, or legitimate business needs, CodeSpar will delete or return the customer's personal data at the customer's choice where technically feasible and legally permitted.
11. Audits
CodeSpar will make available information reasonably necessary to demonstrate compliance with this DPA, in the first instance through security summaries, compliance materials, questionnaires, and available certifications. Where those are not sufficient, the parties will agree on the scope, timing, frequency, confidentiality terms, and reasonable safeguards for any further audit.
12. International transfers
Where CodeSpar transfers personal data internationally in connection with the Service, it uses appropriate safeguards required by applicable law, including Standard Contractual Clauses where GDPR applies and LGPD-compliant safeguards for transfers involving Brazil where required.
13. Regulated providers
Some payment, financial service, Pix, card, banking, Open Finance, wallet, foreign exchange, or settlement providers involved in routes configured by a customer may process personal data under their own legal and regulatory responsibilities. Those providers may not always act only as CodeSpar subprocessors.
For enabled BRL/Pix account services, Celcoin Instituição de Pagamento S.A., CNPJ 13.935.893/0001-09, code 509, provides the regulated account and Pix services and may process personal data under its own legal and regulatory responsibilities. CodeSpar provides software, interface, orchestration, and integration services for that route.
14. Liability
Each party's liability arising out of this DPA is subject to the limitations of liability set out in the Terms of Service, except where liability cannot lawfully be limited.
Need a countersigned copy for enterprise procurement? Email legal@codespar.dev.