This Data Processing Addendum ("DPA") is part of the agreement between Plugins cPanel Tecnologia Ltda. ("Provider") and the customer ("Customer") for our services: plugin installation, managed support, audit and hardening, and migration. It applies whenever Provider processes personal data on behalf of Customer, and it applies automatically when you order a service.
1. Roles and definitions
Customer is the controller of the personal data on its servers (or a processor acting for its own customers). Provider is the processor (or sub-processor). "GDPR", "UK GDPR" and "CCPA/CPRA" and the terms "controller", "processor", "personal data", "service provider" and "personal data breach" have the meaning given in those laws.
2. Details of the processing
- Subject matter and purpose: performing the ordered service on Customer servers (installation, monitoring, updates, audits, hardening, migration and support).
- Duration: the term of the service plus the period needed to return or delete data (section 11).
- Nature: remote access to servers (SSH, WHM, cPanel) where personal data may be visible or stored, such as hosting accounts, website files, databases, email, logs and IP addresses.
- Data subjects: Customer staff and Customer end customers, website visitors and email users.
- We do not seek out personal data. Access is limited to what the service requires.
3. Customer instructions
Provider processes personal data only on Customer's documented instructions, which are this DPA, the service order and Customer's support requests. Provider tells Customer if it believes an instruction breaks the law.
4. Confidentiality
Everyone at Provider who can access Customer personal data is bound by a duty of confidentiality, and access is limited to people who need it to deliver the service.
5. Security measures
- Access to Customer servers uses named engineers, least privilege, and credentials or keys shared through a secure channel. Credentials are never kept in tickets or chat history.
- Connections use encryption (SSH, TLS). Access and actions on Customer servers are logged by Provider where the service allows it.
- Before risky changes (migrations, hardening, updates) a restorable backup is confirmed.
- Access is removed when the service ends. Working copies of Customer data made during a service are deleted when it is complete.
- Provider's own systems are protected by access control, separate admin credentials, rate limiting and security updates.
6. Subprocessors
Customer authorizes Provider to use subprocessors. Provider gives Customer the current list on request at contact@pluginscpanel.com. Provider binds them to data protection duties no less protective than this DPA. Provider notifies Customers at least 30 days before adding or replacing a subprocessor, by email to those who asked to be notified at contact@pluginscpanel.com. Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve it, Customer may end the affected service and receive a refund of the unused prepaid period.
7. International transfers
Where personal data from the EEA, Switzerland or the UK is transferred to a country without an adequacy decision, the parties rely on the Standard Contractual Clauses (Module 2 or 3 as applicable) and the UK Addendum, which are incorporated by reference, with the details in this DPA as their annexes.
8. Assistance
Taking into account the nature of the processing, Provider helps Customer, at reasonable cost where it is significant, to answer requests from data subjects, to carry out impact assessments and to consult supervisory authorities.
9. Personal data breach
Provider notifies Customer without undue delay, and no later than 72 hours, after becoming aware of a personal data breach affecting Customer personal data, with the information it has about the nature, the data affected, likely consequences and the measures taken.
10. Audits
Provider makes available the information needed to show compliance. Customer may audit Provider once a year, or after a breach, with 30 days' notice, during business hours, remotely first, at Customer's cost and under confidentiality, without disrupting other customers.
11. Return and deletion
When the service ends, and at Customer's written request, Provider deletes or returns Customer personal data within 30 days, unless the law requires keeping it. Provider confirms the deletion in writing on request.
12. California (CCPA/CPRA)
Provider acts as Customer's service provider. It does not sell or share Customer personal data, does not retain, use or disclose it outside the business purpose of the service or outside the direct business relationship, and does not combine it with data from other sources, except as the law allows. Provider will tell Customer if it can no longer meet these duties.
13. Liability and governing law
Liability under this DPA is subject to the limits in the Terms of Service. This DPA is governed by the same law and courts as the Terms of Service (State of Florida, USA), without limiting any rights data subjects have under mandatory law.
14. Signed copy and contact
This DPA takes effect when you order a service. If you need a countersigned copy or have questions, write to contact@pluginscpanel.com. Provider: Plugins cPanel Tecnologia Ltda., Beacon Tower, 20200 West Dixie Highway, Suite 902, Aventura, FL.