CasaPorte › Security and Privacy › DPA

Data Processing Agreement

Entered into by [DEVELOPER’S LEGAL NAME], represented by [NAME], with address at [ADDRESS] (the “Controller”), and [CASAPORTE’S LEGAL NAME], represented by [NAME], with address at [ADDRESS] (“CasaPorte” or the “Processor”), under the following clauses.

1. Purpose

CasaPorte processes personal data on behalf of the Controller only to provide the digital showroom of its development, CasaPorte Pulse, its sales team’s panel, and Mi Casa, its buyers’ app (the “Service”), under the services agreement between the parties dated [DATE] (the “Main Agreement”), Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties, its Regulations and applicable guidelines (the “Law”). ◆ Confirm the regulations in force.

2. Data and data subjects

• The Controller’s buyers and leads: name, email, phone and any message they write; residence of interest; their visit to the showroom (levels and residences viewed and for how long, device type, browser and operating system, country per the network, source page, campaign or link) and a random device identifier.
• The Controller’s buyers in Mi Casa: name, email, phone and language; their purchase (residence, price, reference, dates and payment plan) and their payments; their sessions and what they change in their account; the record of which privacy notice they accepted and when, and their ARCO requests.
• The Controller’s team: name, email, password derivation, roles, sessions (IP, device type, last activity) and the record of the changes they make in the panel, with its IP.

The Service is not designed for sensitive personal data, and the Controller agrees not to load such data into it. Financial and patrimonial data (payment receipts and, when requested for the file, bank statements or tax ID) is processed only with the data subject’s express consent, which Mi Casa collects in a checkbox separate from the notice.

3. Instructions

CasaPorte processes the data only on the Controller’s documented instructions. The configuration and use of the panel by the Controller’s team are instructions. CasaPorte will inform the Controller if it believes an instruction infringes the Law. CasaPorte will not use the data for its own purposes, will not sell it and will not contact the data subjects.

4. Confidentiality

CasaPorte limits access to the data to people who need it to provide or support the Service, bound by confidentiality. Changes made in the panel by CasaPorte’s support account are recorded in the Controller’s change log.

5. Security measures

CasaPorte applies the administrative, technical and physical measures in Annex A and maintains them for the life of the Service. It may improve them without notice, but not reduce their level of protection.

6. Subprocessors

The Controller authorizes the subprocessors in Annex B. CasaPorte will give [30] days’ written notice before adding or replacing one; the Controller may object on reasonable grounds and, if the parties cannot agree, terminate the affected Service. CasaPorte will bind each subprocessor to protection obligations equivalent to this agreement and remains responsible for them. ◆

7. Transfers

The Controller acknowledges that the subprocessors in Annex B provide their services from the United States (Cloudflare also from its global network), and that this is necessary for the Service. ◆ Review the treatment of international transfers under the Law.

8. Data subject rights

CasaPorte will help the Controller answer access, rectification, cancellation and objection (ARCO) requests. If a request reaches CasaPorte directly, it will forward it to the Controller within [5] business days without answering it itself, except for what the Service resolves on the Controller’s instructions: the “Borrar Mis Datos” (Delete My Data) button on the showroom’s notice, which immediately erases the name and phone of a data subject who arrived through a personal link, and My Account in Mi Casa, where the buyer downloads, corrects, objects to secondary uses of and deletes their data. Each such request is recorded and visible to the Controller in CasaPorte Pulse. Deletion runs after 30 days and keeps, without data identifying the data subject, what Annex A lists. ◆ Retention periods and purposes to be confirmed by the Controller.

9. Security breaches

CasaPorte will notify the Controller without undue delay, and no later than [72] hours after confirming it, of any breach affecting its data, with what is known of its nature, the data and data subjects affected and the measures taken, so the Controller can inform data subjects under the Law. ◆

10. Retention, return and deletion

During the Service, data is retained as described in Annex A. When the Main Agreement ends, or earlier on the Controller’s written request, CasaPorte will deliver a copy of its data in a commonly used format and then delete it from its systems within [30] days, except what the law requires it to keep. Copies in the database’s restore history expire on their own within 30 days at most. Today, delivery and deletion are done by hand. ◆

11. Audit

CasaPorte will make available to the Controller the information reasonably necessary to demonstrate compliance with this agreement, [once a year] and with [30] days’ notice. The certifications of its infrastructure (Cloudflare) serve as evidence of the physical measures. ◆

12. Liability

[TO BE AGREED BY THE PARTIES: liability caps and their relation to the Main Agreement.] ◆

13. Term, governing law and jurisdiction

This agreement lasts as long as the Main Agreement, and its confidentiality and deletion obligations survive its termination. It is governed by the laws of the United Mexican States; for its interpretation the parties submit to the courts of [CITY], waiving any other venue. ◆

Annex A · Security Measures

• Infrastructure: Cloudflare Workers, Pages, D1 and R2; database moving to Supabase (Postgres, United States), where only the Service’s server has access: row-level security with no rules and no permissions for the public keys. No servers of our own.
• Encryption: HTTPS (TLS) in transit; at rest, Cloudflare’s (AES-256) on D1 and R2 and Supabase’s (AES-256). The Controller’s third-party tokens (WhatsApp) encrypted with 256-bit AES-GCM.
• Passwords: PBKDF2-SHA256 with 100,000 iterations and its own salt; at least 10 characters.
• Sessions: __Host-, Secure, HttpOnly, SameSite=Strict cookie on the panel’s own domain; they expire in 12 hours; only their SHA-256 fingerprint in the database. Single-use invitations (7 days) and single-use reset links (24 hours).
• Sign-in: closed for up to 15 minutes after 5 failures per account or 10 per IP. Per-IP attempt limits on forms and appointments, and Cloudflare Turnstile.
• Access: roles and permissions per person, enforced by the server on every request; scope by organization and development; immediate blocking and removal of members.
• Change log: every panel write with person, date, before and after, and IP; the database prevents editing or deleting it.
• Showroom measurement: no cookies or third-party trackers; the IP is not stored with the visit.
• Mi Casa: its own domain and cookie, separate from the panel; no data before the record that the buyer accepted the Controller’s current notice, a record the database prevents from being edited or deleted; financial data only with its separate checkbox; ARCO rights exercised by the data subject in My Account; no one on the team can delete a buyer’s account.
• Retention: visits and leads for the life of the Service; panel sessions 12 hours and Mi Casa sessions 90 days; audit log, notice acceptances and ARCO requests for as long as the organization exists; purchase and validated payments while the contract is alive and up to 10 years after ◆; when a buyer deletes their account, their name, email and phone are removed from everything kept; restore history up to 30 days.

Annex B · Subprocessors

• Cloudflare, Inc. (United States, global network): hosting and network, database (D1), storage of photos and payment receipts, anti-bot protection for forms and, only on casaporte.app, cookieless analytics.
• Supabase, Inc. (United States, western region): database (Postgres), where the Cloudflare D1 database is moving.

If email sending through Resend, Inc. (United States) is switched on, it is added to this annex with the notice in clause 6.

Back to Security and Privacy