Data Processing Agreement

Last updated: June 15, 2026

Overview

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Bruxus (“Processor”) and our customers (“Controller”) for the processing of personal data in connection with the use of the Bruxus platform.

Scope

This DPA applies whenever the Controller uses Bruxus services and the Processor processes personal data on behalf of the Controller subject to applicable data protection laws, including GDPR and LGPD.

Processing Details

Subject Matter

Provision of website and digital product creation platform, including hosting, support, and related services.

Duration

Processing occurs for the duration of the agreement between Controller and Processor.

Nature and Purpose

Hosting, storage, analytics, support, and platform maintenance.

Categories of Data Subjects

End users, customers, and visitors of the Controller’s websites built on Bruxus.

Types of Personal Data

Names, email addresses, IP addresses, usage data, and any other data submitted through the Controller’s Bruxus-built websites.

Obligations of the Processor

  • Process personal data only on documented instructions from the Controller
  • Ensure personnel involved in processing are subject to confidentiality obligations
  • Implement appropriate technical and organizational security measures
  • Notify the Controller without undue delay of any personal data breach
  • Assist the Controller in fulfilling data subject rights requests
  • Return or delete personal data upon termination of services

Sub-processors

The Controller authorizes the Processor to engage sub-processors, including cloud hosting providers and analytics services. The Processor maintains an up-to-date list of sub-processors available upon request.

Security Measures

The Processor maintains a comprehensive information security program, including:

  • Encryption at rest and in transit
  • Access controls and authentication mechanisms
  • Regular security assessments and penetration testing
  • Incident response procedures
  • Business continuity and disaster recovery plans

Audit Rights

The Controller may request information demonstrating compliance with this DPA. On-site audits are subject to reasonable notice and mutual agreement.

Liability

Each party’s liability under this DPA is subject to the limitations set forth in the Terms of Service.

Governing Law

This DPA is governed by the laws specified in the Terms of Service.

Contact

For DPA-related inquiries, contact legal@bruxus.com.