Data Processing Agreement (DPA)
Version [número], effective as of [fecha].
This agreement forms part of the Terms of Service (https://monitor.tecdex.net/en/terms/). It applies when the Customer, while using Monitoreo TECDEX, provides personal data to Servicios Tecnológicos TecDex SpA ("TECDEX") for TECDEX to process on the Customer's behalf.
1. Roles and purpose
- The Customer is the controller (controlador under the LGPD) of the personal data it enters into the Service, and TECDEX is the processor (operador under the LGPD) that processes that data on the Customer's behalf.
- TECDEX is a controller in its own right for the data it uses to manage the business relationship (for example, account and billing data), as described in the Privacy Policy (https://monitor.tecdex.net/en/privacy/).
- The details of the processing are set out in Annex A.
2. Instructions
TECDEX processes the data only to provide the Service and in accordance with the Customer's documented instructions. These instructions are the Terms, this agreement and the settings the Customer configures in the portal. If TECDEX believes an instruction is unlawful, it will inform the Customer.
3. Confidentiality
TECDEX personnel with access to the data are bound to keep it confidential. They access it only when needed to provide the Service or to give support.
4. Security
TECDEX maintains technical and organizational measures appropriate to the risk, including: passwords stored as a hash (argon2id), a mandatory second factor, monitoring credentials encrypted in a write-only vault, encrypted connections, separation of each customer's data, destination control (public addresses only), backups and an audit log. [Complete with the description of backups and business continuity that the lawyer considers necessary.]
5. Sub-processors
- The Customer authorizes TECDEX to use the sub-processors listed in the Privacy Policy (currently: Amazon Web Services for sending emails and Zoho for support email). Google is involved only if the person chooses to sign in with Google. Paddle acts as Merchant of Record and processes payment data as an independent controller.
- TECDEX will notify the Customer at least [30] days in advance before adding or replacing a sub-processor. The Customer may object on reasonable grounds. If no solution is found, the Customer may terminate the Service at no additional cost.
- TECDEX requires each sub-processor to comply with data protection obligations equivalent to those in this agreement.
6. Data subject rights
TECDEX helps the Customer respond to requests for access, correction, deletion, objection and portability, to the extent the Service allows. If TECDEX receives a request directly, it forwards it to the Customer.
7. Security incidents
TECDEX will notify the Customer without undue delay, and no later than [48] hours after becoming aware of an incident affecting the Customer's personal data. The notice will include the available information so that the Customer can meet its own notification obligations.
8. International transfers
- Chile: Transfers are made in accordance with Ley 19.628 (Chilean Law No. 19,628) and, once it enters into force, Ley 21.719 (Chilean Law No. 21,719). [Mechanism to be defined by the lawyer.]
- Brazil (LGPD): When the Customer is subject to the LGPD and the transfer of data to TECDEX in Chile, or from TECDEX to its sub-processors outside Brazil, is an international transfer, the parties adopt the cláusulas-padrão contratuais (standard contractual clauses) approved by Brazil's National Data Protection Authority (ANPD) in Resolução CD/ANPD n.º 19, de 23 de agosto de 2024 (Annex II). These clauses are incorporated into this agreement in their entirety and without changes, in the version that applies to the relationship between controller (Customer) and processor (TECDEX). See Annex B.
- European Union: [If there are customers subject to the GDPR: the European Commission's standard contractual clauses (Decision 2021/914), Module 2 or 3. To be defined by the lawyer.]
9. Return and deletion
When the Service ends, the Customer may request its reports for [X days]. After that, TECDEX deletes the Customer's personal data, except for data that the law requires to be kept.
10. Audit
At the Customer's request, and no more than once a year, TECDEX will provide the reasonable information needed to demonstrate its compliance with this agreement. [Define whether on-site audits are allowed and under what conditions.]
11. Order of precedence
If there is a conflict between this agreement and the Terms regarding personal data, this agreement prevails. If there is a conflict with the ANPD's cláusulas-padrão contratuais, those clauses prevail.
Annex A — Description of the processing
| Aspect | Details |
|---|---|
| Data subjects | The Customer's users in the portal; individuals whose data appears in the addresses, notes or reports that the Customer enters |
| Categories of data | Users' name, email, role and language; monitored addresses; test account credentials (encrypted, unreadable by TECDEX); incident notes |
| Sensitive data | Not expected. The Customer must not enter it |
| Purpose | Monitoring the availability of the Customer's services, sending alerts and generating reports |
| Operations | Collection, storage, consultation, sending of alerts, generation of reports, deletion |
| Duration | While the account is active and for [X days] afterwards |
| Location | TECDEX's own servers in Chile; emails through Amazon Web Services (USA) |
Annex B — ANPD cláusulas-padrão contratuais (Brazil)
[The lawyer must attach here the full official text, in Portuguese, of the cláusulas-padrão contratuais (standard contractual clauses) in Annex II of Resolução CD/ANPD n.º 19/2024, without modifications, and complete only the fields that the text itself leaves open (identification of the parties and description of the transfer, which corresponds to Annex A). Official source: Diário Oficial da União and the ANPD website (gov.br/anpd).]