This Data Processing Agreement explains how PointOne processes personal data on behalf of its customers when delivering contracted services.
It does not replace the Privacy Policy, which covers information PointOne handles for its own business purposes.
“Applicable Data Protection Law” means privacy and data protection requirements applicable to the particular processing, considering the parties, individuals, jurisdictions and activities. “Customer Personal Data” means personal data processed by PointOne on behalf of Customer. “Processing” includes accessing, storing, transmitting, modifying, backing up, returning and deleting personal data. “Subprocessor” means an external provider processing Customer Personal Data for PointOne in connection with the Services. “Security Incident” means a confirmed compromise of the confidentiality, integrity or availability of Customer Personal Data.
The Customer ordinarily determines the purposes and lawful basis of processing and is responsible for appropriate notices, authorizations, data minimization and handling data-subject requests. PointOne acts on documented Customer instructions when providing development, hosting, maintenance and support. Under Colombian law, the parties’ roles may correspond to Responsable and Encargado del Tratamiento, where applicable. Each party remains responsible for its own mandatory legal duties.
Customer instructs PointOne to process Customer Personal Data only to deliver, secure, maintain, back up, troubleshoot and terminate the contracted website services, including Customer-approved integrations; to follow further lawful documented instructions; or to comply with law. PointOne will not sell Customer Personal Data or independently use it for advertising, profiling or unrelated marketing. PointOne may notify Customer and pause an instruction reasonably believed to be unlawful, where permitted.
PointOne’s authorized personnel ordinarily administer Customer website data directly. PointOne does not authorize external providers to independently use Customer Personal Data for their own marketing or unrelated purposes. Nevertheless, hosting, storage, backup, network, email or other infrastructure providers may technically store, transmit or otherwise process Customer Personal Data even when their staff do not routinely view it. Such providers will be treated as Subprocessors when the legal definition applies. Hostinger is the anticipated hosting infrastructure provider; its actual processing role, contractual protections and relevant locations must be verified. PointOne will not claim that no third party processes data merely because only PointOne personnel have routine administrative access.
Customer grants general authorization for infrastructure Subprocessors reasonably necessary for the Services. PointOne will use appropriate contractual confidentiality, security and data protection terms, maintain a current list of relevant Subprocessors and provide legally required notice of material changes. Where applicable, Customer may object on reasonable documented privacy grounds; the parties will work in good faith toward a lawful solution. PointOne remains responsible for its own DPA obligations and Subprocessor conduct to the extent required by law and contract.
PointOne will restrict access to authorized personnel and contractors with a service need and appropriate confidentiality obligations. It will maintain proportionate access controls, authentication, secure connections where appropriate, software updates, vulnerability response, backup procedures and incident handling. Backup frequency follows the active SLA: Starter monthly, Business weekly, Premium daily. Security tier labels do not guarantee immunity from incidents, and no recovery point or restoration time is guaranteed unless separately agreed.
PointOne operates from Colombia and may use infrastructure in Brazil and other verified provider locations. The parties will implement additional notices, contractual safeguards or transfer mechanisms where required by law. Neither the use of a Brazilian server nor this DPA alone proves that all processing occurs in Brazil or that every international transfer requirement has been met.
PointOne will notify Customer without undue delay after confirming a Security Incident affecting Customer Personal Data and identifying the affected Customer. It will provide available information about the incident, likely effects and containment steps, with updates as reasonably available. PointOne will cooperate with Customer on required notifications to regulators or individuals, without overriding mandatory duties imposed directly on PointOne. A two-hour initial technical support response under the SLA, when applicable, is distinct from legal breach notification and does not guarantee incident resolution.
PointOne will reasonably assist Customer with lawful access, correction, deletion and other data-subject requests and with applicable risk assessments or regulatory inquiries, to the extent information and technical capability permit. PointOne may refer requests concerning Customer Personal Data to Customer. Exceptional assistance outside ordinary services may require an agreed scope and reasonable fee, except where prohibited by law or necessary to remedy PointOne’s breach.
Following termination or expiration of the contracted service, PointOne will offer the Customer a reasonable formal handover of Customer-provided content and Customer Personal Data in its possession, in a commonly usable format where technically feasible, irrespective of whether the USD 1,000 development acquisition threshold has been met. The handover may be documented by email or delivery confirmation. PointOne will retain the operational Customer website data for up to thirty (30) calendar days after the effective service end date to facilitate handover and orderly closure, then delete it from active databases, hosting accounts and other systems under PointOne’s control, unless a longer period is required by law, a documented dispute, or another valid legal basis. Customer should request export promptly and maintain its own copy. If earlier deletion is legally required or requested and feasible, PointOne will act accordingly.
Transfer of PointOne-owned original project-specific source code and assignable development rights is separate from return of Customer Personal Data and Customer-owned content. Such source-code delivery and rights transfer follow the Service Agreement: eligible cumulative payments of USD 1,000 for the same project and satisfaction of other applicable conditions, subject to third-party licenses and formal assignment requirements. If the threshold is not met, PointOne need not transfer its proprietary original development code merely because the service ends; however, it must not withhold Customer Personal Data solely on that basis. This DPA does not modify the intellectual-property provisions of the Terms of Service.
PointOne intends to delete Customer Personal Data from active systems within the thirty-day period in Section 10. Residual copies in managed backups, disaster recovery systems, provider snapshots or immutable logs may not be immediately erasable on an individual-customer basis. Such copies will remain access-restricted, will not be used for ordinary operations, and will be deleted or overwritten according to the shortest technically available verified retention cycle consistent with legal obligations. PointOne will not promise complete deletion from “all places” within thirty days unless it can verify that every relevant system and provider supports it. Upon reasonable request, PointOne may confirm completion of the deletion process and identify any legally or technically retained residual categories.
PointOne will maintain legally required processing records and provide reasonable information necessary to demonstrate compliance with this DPA. Legally mandated audit rights remain available subject to reasonable confidentiality, security, scheduling and protection of other customers’ information. Where permissible, documentation or third-party assurance may substitute for direct inspection.
Unless separately agreed in writing, the Services are not designed for special-category, highly sensitive or heavily regulated information requiring enhanced safeguards. Customer must notify PointOne before introducing such information. PointOne may require additional safeguards, pricing, technical review or a specific addendum.
The Service Agreement governs commercial matters, including liability allocation, to the extent permitted by Applicable Data Protection Law. This DPA controls in case of conflict specifically concerning Customer Personal Data; mandatory statutory provisions prevail. If a jurisdiction requires prescribed processor terms, transfer clauses or another addendum, the parties will execute those terms where applicable. No particular foreign law is assumed to apply solely because a website is publicly accessible.
PointOne — operated by Bruno Góngora, Bogotá, Colombia. Email: support@pointoneweb.com. Website: https://pointoneweb.com.
For each termination, PointOne should internally record:
This record is an operational control, not a requirement that the Customer sign a new agreement to obtain its personal data.
Document status: Revised draft for approval. Operational verification required for Subprocessors, data export, active-system deletion and backup retention.