Data Processing Agreement
Conditions applying to the personal data the Client hosts.
This English text is provided for information. The contract is governed by Argentine law and the Spanish version is the one that binds, under clause 32.1. Read the binding Spanish version
1 Subject matter, nature and duration
1.1 This Data Processing Agreement, hereinafter the “Agreement”, governs the processing of personal data that Sitios Hispanos SRL, hereinafter “SitiosHispanos.Com”, carries out on behalf of the Client when providing the contracted services.
1.2 It forms part of the General Terms and Conditions of Service under their section 2.1 and applies where the Client hosts personal data, their own or that of third parties, in databases, mailboxes, files, applications or any other component under their administration.
1.3 The nature of the processing is the storage, hosting, transmission, backup, restoration and technical processing necessary to provide the service. Its purpose is exclusively that provision.
1.4 The Agreement applies for as long as any service involving the Client’s personal data remains in force, and extends to the retention windows provided for in section 25 of the Terms.
1.5 The categories of data and of data subjects are determined by the Client according to what they choose to host. SitiosHispanos.Com neither defines nor knows them in advance.
1.6 The Agreement may be accepted electronically on contracting or renewing, and is recorded with its version and date under section 4 of the Terms.
2 Roles of the parties
2.1 The Client is the controller: they determine the essential purposes and means, choose what data to host and with what configuration, and are answerable for holding a legal basis, notices and consents.
2.2 SitiosHispanos.Com acts as processor or infrastructure provider, as corresponds to the nature of the service.
2.3 With respect to the Client’s own account, billing, contact, support and security data, SitiosHispanos.Com acts as controller under its Privacy Policy. That processing falls outside this Agreement.
2.4 No clause of this Agreement makes SitiosHispanos.Com the controller of the data the Client hosts, nor the Client the processor of the data SitiosHispanos.Com processes as controller.
3 Documented instructions
3.1 SitiosHispanos.Com processes hosted data only in accordance with the Client’s documented instructions. The Terms, this Agreement, the order, the configuration the Client applies on the platform and the requests they submit by ticket constitute documented instructions.
3.2 Hosted data is not processed for own purposes, nor transferred, sold or used for advertising, profiling or model training.
3.3 If an instruction from the Client is, in the reasonable view of SitiosHispanos.Com, contrary to applicable law, it will inform the Client and may suspend execution until the instruction is confirmed, corrected or withdrawn.
3.4 Where a legal obligation requires processing beyond the instructions, SitiosHispanos.Com will inform the Client before doing so, unless the rule itself prohibits this.
4 Staff confidentiality
4.1 SitiosHispanos.Com personnel who may access hosted data are bound by confidentiality obligations that survive the end of their engagement.
4.2 Access is granted on the principle of least privilege and only to those who need it for a specific task.
4.3 Administrative access to content is logged. Sensitive inspections require dual internal authorisation.
5 Security measures
5.1 SitiosHispanos.Com applies the technical and organisational measures incumbent on it under articles 9 and 10 of Law 25,326, in respect of the infrastructure and the layers under its control.
5.2 Those measures comprise, depending on the service: encryption in transit, access control on least privilege, logging of administrative access, environment segmentation, backup as per the contracted plan, updating of the components it administers, and incident response procedures.
5.3 The security obligations that the law imposes on SitiosHispanos.Com are not transferred to the Client. The allocation of layers in section 12 of the Terms distributes tasks; it does not release either party from its own legal responsibilities.
5.4 The Client is responsible for the measures corresponding to the layers they administer, under section 16 of the Terms, including the security configurations they choose to apply or disable.
6 Location and international transfers
6.1 The content the Client hosts remains on infrastructure owned by SitiosHispanos.Com. Its location is disclosed before contracting and on a material change, at the Client’s request by ticket.
6.2 SitiosHispanos.Com does not engage third parties to process the data the Client hosts on its behalf. Should it become necessary to engage one in future, the Client will be notified at least thirty calendar days in advance and may object on reasonable data protection grounds; if no equivalent alternative exists, they may terminate the affected component with a proportionate refund for the period not provided.
6.3 Any communication of data to a recipient located outside the Argentine Republic that is necessary for a specific operation is carried out under articles 11 and 12 of Law 25,326.
6.4 A Client with regulatory requirements as to localisation must state them before contracting, so that it can be verified whether the chosen service can meet them.
7 Assistance with data subject rights
7.1 If a data subject exercises a right before SitiosHispanos.Com over data hosted by the Client, they will be directed to the Client, and the Client will be informed where they can be identified.
7.2 SitiosHispanos.Com assists the Client, so far as the nature of the service allows, so that they can handle requests for access, rectification, updating and deletion over the data they host.
7.3 Assistance is limited to the tools and technical access available in the contracted service. Tasks exceeding that scope may be quoted separately under section 12.5 of the Terms.
8 Security incidents
8.1 SitiosHispanos.Com notifies the Client without undue delay of any security incident of which it becomes aware affecting data hosted by them in the layers under the control of SitiosHispanos.Com.
8.2 The notification includes the information available at the time: nature of the incident, categories and approximate volume of data and data subjects affected, likely consequences, measures taken and a point of contact. The information is completed as the investigation progresses.
8.3 SitiosHispanos.Com adopts containment measures and cooperates reasonably with the Client so that they can meet their own notification obligations.
8.4 Incidents originating in layers administered by the Client are likewise communicated where SitiosHispanos.Com detects them, even though handling them falls to the Client.
9 Return or deletion
9.1 The Client may export their data throughout the life of the service and during the retention window following expiry provided for in section 25 of the Terms.
9.2 Once that window has elapsed, SitiosHispanos.Com logically deletes the hosted data. Residual copies are overwritten in accordance with their technical cycles and remain inaccessible for ordinary use.
9.3 Data that must be retained under a legal obligation, for the defence of rights or for fraud prevention is excepted, with restricted access and for the period strictly necessary.
9.4 At the Client’s request, and where technically possible, a record of the deletion is provided.
10 Audits
10.1 SitiosHispanos.Com makes available to the Client the information reasonably necessary to evidence compliance with this Agreement.
10.2 The Client may request an audit on reasonable notice, no more than once a year save for an incident or a request from an authority, during business hours, without affecting the operation or the security of other clients and subject to confidentiality.
10.3 The audit does not extend to access to other clients’ data, configurations or infrastructure, nor to information whose disclosure would compromise the security of the platform.
10.4 The reasonable costs of an audit requested by the Client are borne by them, unless the audit evidences a breach attributable to SitiosHispanos.Com.
11 Liability and Client configurations
11.1 Each party is answerable for breaching the obligations this Agreement assigns to it.
11.2 SitiosHispanos.Com is not answerable for the consequences of configurations, permissions, backup exclusions, integrations or architectural decisions adopted by the Client in the layers they administer, to the extent that their consequences were disclosed to them.
11.3 The foregoing does not exclude the liability of SitiosHispanos.Com for its own acts, for breaching the security measures incumbent on it, or for failing to take the actions reasonably required after acquiring actual knowledge of a risk.
11.4 The liability limits in section 30 of the Terms apply to this Agreement, with the exceptions provided for there, among them breach of confidentiality or of data protection.
12 Term and version
12.1 This Agreement may be updated. Material changes are notified following the procedure in section 28 of the Terms.
12.2 The applicable version is the one identified at the foot of this document and the one recorded in the Client’s electronic acceptance.
