1. Parties, roles and subject matter
This Agreement forms part of the contract between the customer and SKILLS IT SOLUCOES EM TECNOLOGIA LTDA, trading as Skills IT, CNPJ 05.699.856/0001-10, at Quadra ACSE 1, Rua SE 1, No. 38, suite 10, 2nd floor, Plano Diretor Sul, Palmas, Tocantins, postal code 77020-014, Brazil, the provider of Skyller.
It applies to personal data Skyller processes as processor on behalf of the customer as controller. If the customer acts as processor for another controller, it must be authorized to engage Skyller as a subprocessor and convey valid instructions.
Skyller's own processing for accounts, billing, security and legal claims follows the Privacy Policy, within the corresponding lawful purposes.
2. Processing description
| Element | Scope |
|---|---|
| Purpose | Provide contracted AI, document, search, collaboration, integration and automation features |
| Operations | Receipt, storage, organization, retrieval, transmission, inference, creation of derivatives and deletion |
| Individuals | Users, employees, contractors, customers, suppliers and other people in authorized content |
| Data | Identification and contact details, message and file content, images, voice, settings and associated records |
| Duration | Service term and time necessary for return, deletion or legally required retention |
Customers determine content and must minimize data. Sensitive categories or children's data require a specific assessment, legal grounds and appropriate controls. The parties must agree additional requirements needed for regulated uses before the relevant processing.
3. Documented instructions
Skyller will process data only on documented instructions, including the contract, settings and authorized requests, also regarding transfers. If the law requires different processing, it will inform the customer beforehand unless legally prohibited.
Skyller will inform the customer if it considers an instruction inconsistent with applicable law and may suspend the affected workflow pending clarification. Customers are responsible for lawful instructions, notices to individuals and access permissions.
4. Authorized people and security
Skyller will ensure that people authorized to process data are bound by contractual or statutory confidentiality duties and have access appropriate to their role.
Skyller will maintain technical and organizational measures proportionate to risk, considering the nature and context of processing, and review their suitability throughout service delivery. These measures must address access management, confidentiality, integrity, availability and data recovery within the contracted scope. Customers may request control information and evidence to assess suitability for their processing.
Customers manage members, credentials, integrations and sharing and must keep this access consistent with their instructions.
5. Subprocessors and changes
Customers give general authorization for subprocessors necessary for the features used, described in integrated services. Internal software components and services acting as independent controllers are not automatically subprocessors.
Before adding or replacing a subprocessor for covered processing, Skyller will inform the customer through appropriate means, including the registered contact, and provide a reasonable opportunity for a substantiated objection. The public list supplements that communication. Requests and objections should be sent to contato@skillsit.com.br.
The parties will seek a viable alternative. While an objection remains unresolved, the affected workflow may remain unavailable; if no solution is found, it may be terminated under the contract, preserving mandatory rights.
Skyller will require protection obligations consistent with this Agreement and remain responsible to the customer for performance of the processing obligations entrusted to subprocessors, to the extent required by applicable law.
6. AI and connected services
Prompts, context, files and outputs may be transmitted to providers needed for execution. Routing and fallback do not authorize purposes incompatible with instructions.
Skyller and the model API providers it selects and contracts do not use customer inputs, including prompts, messages and documents, or generated outputs to train artificial intelligence models. Skyller will maintain this condition when selecting and contracting those providers, including fallback routes. Inference processing and operational retention remain limited to authorized purposes. Retention and location must be compatible with instructions and contracted conditions. Independent services contracted and controlled directly by the customer are governed by their own agreements.
7. Assistance to customers
Taking account of the processing and information available, Skyller will assist customers with individual rights requests, security, impact assessments and consultations with authorities where required.
Requests received directly about customer data will be forwarded to the responsible party where possible; responses will not exceed its instructions unless legally required. The parties may coordinate scope and resources for extraordinary assistance without preventing compliance with legal obligations.
8. Personal data incidents
Skyller will notify the customer without undue delay after becoming aware of an incident involving personal data processed on its behalf. Initial information may be supplemented; completing the entire investigation is not a condition for notification.
Where available, notification will include the event's nature, affected data and individuals, likely consequences, containment measures and a contact point. Skyller will cooperate in investigation and mitigation. The controller assesses communications for which it is responsible and observes applicable deadlines.
9. Return and deletion
On termination, customers may choose return or deletion of covered data through available features or support. Skyller will coordinate the available format, stages and deletion of remaining copies unless retention is required by law.
The procedure covers relevant derivatives, such as extracted text, indexes, embeddings, caches and records containing content. Backups will remain protected until their removal cycle; if restored, deletion instructions must be reapplied.
Skyller will carry out or coordinate deletion of covered data, including with subprocessors, and provide confirmation describing the scope completed and legally justified retention. Steps requiring further processing will be tracked to completion, with updates to the customer. Records Skyller retains as controller will have their own legal basis, defined purpose and restricted access.
10. International transfers
Skyller will adopt a valid mechanism for covered transfers where required by law, considering the parties, destination and workflow. Applicable standard clauses will be incorporated in full into the relevant instrument, together with required information and annexes.
Customers may request information about the workflow and safeguards. Specific territorial restrictions must be agreed and verified before the relevant processing.
11. Evidence and audits
Skyller will make available information needed to demonstrate compliance with this Agreement and allow and contribute to audits by the customer or an authorized auditor. The parties will agree scope, notice and protection of third-party information without frustrating statutory audit rights.
Intrusive testing requires written authorization. Requests from competent authorities and justified urgent cases will be handled under applicable law.
12. Precedence, languages and survival
This DPA takes precedence in conflicts concerning covered processing. Mandatory legal duties remain applicable regardless of language. The Portuguese version guides interpretation of translation differences unless contract or law provides otherwise.
Protection duties survive while covered data remains. Earlier acceptance evidence stays linked to its respective version; publication does not change it retroactively.
Contact: contato@skillsit.com.br.