Data Processing Agreement

1. Definitions

For the purposes of this Agreement, the definitions set out in the Brazilian General Data Protection Law (LGPD) apply, in particular:

Controller: natural or legal person responsible for decisions regarding the processing of personal data;
Processor: natural or legal person that processes personal data on behalf of the controller;
Personal Data: information related to an identified or identifiable natural person;
Processing: any operation performed with personal data, as defined in the LGPD.

2. Purpose

This Data Processing Agreement (“DPA”) governs the processing of personal data carried out by MINIVPS, as Processor, on behalf of the customer, who acts as Controller, in the context of providing cloud computing services.

3. Roles of the Parties

The customer acknowledges that it is solely responsible for determining the purposes and means of processing the personal data entered, stored or processed in its virtual environments.

MINIVPS will act exclusively as Processor, processing personal data according to the customer’s documented instructions and within the technical limits of the contracted services.

4. Obligations of MINIVPS (Processor)

Process personal data only according to the Controller’s instructions;
Adopt appropriate technical and administrative measures to protect the data;
Ensure the confidentiality of the data processed;
Notify the Controller of relevant security incidents;
Assist the Controller, where technically feasible, in complying with the legal obligations set out in the LGPD.

5. Obligations of the Customer (Controller)

Ensure it has a valid legal basis for processing the personal data;
Provide lawful, clear and documented instructions to MINIVPS;
Respond to requests from data subjects;
Properly configure its systems and applications;
Be liable for any violations resulting from misuse of the services.

6. Sub-processors

The customer authorizes MINIVPS to engage sub-processors strictly necessary to provide the services, provided they assume contractual obligations equivalent to those set out in this DPA.

7. International Data Transfer

Due to the nature of cloud computing, personal data may be stored or processed in data centers located in Brazil or abroad, subject to the appropriate safeguards required by applicable law.

8. Security Incidents

MINIVPS will make reasonable efforts to notify the Controller of security incidents that may pose a relevant risk to the personal data processed, within a reasonable time after becoming aware of the event.

9. Data Retention and Deletion

Personal data will be processed while the contractual relationship is in force and deleted or anonymized after it ends, except where retention is required by law.

10. Liability

Each party shall be liable for damages resulting from breach of its respective legal and contractual obligations, within the limits set out in the Terms of Service.

11. Term and Contractual Integration

This DPA takes effect on the date the services are purchased and forms part, for all purposes, of the MINIVPS Terms of Service, the SLA, the Privacy Policy and the AUP.

12. Jurisdiction and Governing Law

This Agreement is governed by the laws of the Federative Republic of Brazil, and the courts of Itajaí/SC are elected as the venue, unless otherwise provided by law.

Data Processing Agreement (DPA)