Data processing agreement

PERSONAL DATA PROCESSING TERMS
THE TRANQUILIDAD DIGITAL SERVICE

Version 1.0

Effective date: 1 April 2026

These terms govern access to and processing of personal data by in4byte soluciones digitales, S.L., tax identification number B21766035, at Calle Doctor Buenaventura Carreras 5, Unit 6, 18004 Granada, hola@in4byte.es, www.in4byte.es. in4byte acts as data processor when providing Tranquilidad Digital, including any associated backup, storage, monitoring, recovery, maintenance and support services.

The customer that determines the purposes and means of processing personal data held in its systems, devices, accounts, files or backups is the data controller.

These terms form part of the contract, service terms, accepted proposal or other document governing the provision of Tranquilidad Digital between in4byte soluciones digitales, S.L. and the customer.

The customer is responsible for obtaining any specialist advice it needs regarding data protection, information security or rules specific to its activity.

1. Purpose

These terms govern the processing of personal data by in4byte soluciones digitales, S.L. on the customer’s behalf where necessary to provide Tranquilidad Digital, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).

Depending on the service agreed, this may include technical access, backup setup and storage, checking backups, helping with recovery, preventive and corrective maintenance, and technical incident support.

2. Nature and purpose of processing

in4byte soluciones digitales, S.L. processes data solely to provide Tranquilidad Digital. This may involve the following activities:

configuring, running and monitoring backups of equipment, servers, folders, applications, databases, accounts or systems.
storing and managing backups, images, snapshots, files, versions, metadata and associated records.
monitoring backup status, alerts, errors, capacity, availability and technical events.
restoring some or all data at the customer’s request or to resolve an authorised incident.
accessing customer systems, dashboards, devices, NAS, servers, applications or services when required to provide the agreed service.
managing users, technical credentials, permissions, backup agents and applicable retention rules.
providing maintenance, remote or on-site support, and documenting incidents.
keeping logs and technical records needed to document the service, diagnose incidents and maintain security.
contacting the customer about service status, incidents, restores, maintenance, billing or support.

in4byte soluciones digitales, S.L. will use personal data held in customer systems or backups only to provide the service, unless a separate legal basis applies and the other use is governed by a separate document.

Access to backups or customer systems is limited to what is strictly necessary for setup, checks, maintenance, restores or incident resolution. It follows the customer’s documented instructions or is limited to actions reasonably necessary to protect the availability, integrity and security of the agreed service.

3. Duration

These terms apply while in4byte soluciones digitales, S.L. provides Tranquilidad Digital and processes personal data on the customer’s behalf.

They end with the main contract. Any applicable obligations to retain, return, erase, block or make data available continue under applicable law and the agreed service conditions.

4. Categories of personal data and data subjects

Depending on the systems included in the service, in4byte soluciones digitales, S.L. may process the personal data held in those systems or their backups on behalf of the customer. This can include:

identification and contact details.
professional, employment, administrative, commercial, accounting or billing information.
data in documents, images, emails, databases, business applications or customer records.
technical credentials, user identifiers, permissions, file paths, device names, IP addresses, metadata and logs.
data in full, incremental or differential backups, snapshots, disk images or backup repositories.
data arising from incidents, tickets, requests for support, restores and communications with the customer.
other personal data held or processed in the systems covered by the service.

Data subjects can include the customer’s clients, suppliers, employees, contractors, users, patients, students, contacts, representatives, directors or partners, and other people whose data is held in the systems or backups covered.

The customer is responsible for determining the lawfulness of processing, any appropriate safeguards and whether special categories of data, data about children, health, financial or employment data, or other sensitive information may be included in the service.

5. Instructions from the data controller

in4byte soluciones digitales, S.L. will follow the customer’s documented instructions, including for backups, restores, disclosures and international transfers, unless EU or Spanish law requires other processing. Where applicable, we will inform the customer in advance unless the law prohibits notice on important public-interest grounds.
Documented instructions may be contained in contracts, accepted proposals, terms, support tickets, emails, approved settings, administrative dashboards, restore requests or other reasonable means the parties use to manage the service.
If in4byte soluciones digitales, S.L. considers that an instruction infringes applicable data protection law, it will inform the customer without undue delay.

6. Obligations of in4byte soluciones digitales, S.L. as data processor

in4byte soluciones digitales, S.L. will:

process data for the agreed service and in accordance with the customer’s documented instructions.
ensure authorised staff are bound by contractual or legal duties of confidentiality.
implement technical and organisational measures appropriate to the risk, taking account of the state of the art, cost, nature, scope, context and purposes of processing, and the risks to individuals’ rights and freedoms.
take reasonable steps to maintain the availability, integrity and confidentiality of backups and systems within the agreed scope.
assist the customer, where possible and taking account of the nature of the processing, with responding to requests from data subjects.
assist with data security, breach notifications, impact assessments and prior consultation as appropriate, taking account of the processing and the information available to us.
delete or return personal data after the service ends, subject to legal retention requirements and any agreed retention, rotation or disposal periods.
make available the information necessary to demonstrate compliance and allow and contribute to reasonable checks under these terms.

7. Obligations of the customer as data controller

The customer is responsible for the following:

establishing the applicable legal basis for processing.
giving data subjects the information required by law.
keeping the data in systems and backups relevant, proportionate and limited to what is necessary.
defining the equipment, accounts and systems included in the service.
setting retention, rotation and disposal periods based on its activities and legal duties.
assessing whether the processing calls for further risk analysis, an impact assessment, stronger safeguards, specific encryption, separation or access restrictions.
confirming that the agreed features and service are appropriate for the intended processing.
obtaining the necessary authorisations, consents or permissions and providing any required notices.
keeping its contact details, authorised users and communication channels up to date.
avoiding use of the service to store, back up or process unlawful material or material that infringes third-party rights or falls outside the legitimate purposes of its activity.
documenting and authorising subcontracting where required by applicable rules.

8. Security measures

As of the effective date, in4byte soluciones digitales, S.L. applies risk-appropriate safeguards. Depending on the agreed service, these may include:

encryption of communications using secure protocols where applicable.
credentials, authentication and access controls based on user roles or operational needs.
access to customer systems and backups limited to authorised personnel.
logical separation of information by customer, repository, account or environment.
policies for backup, retention, rotation and verification suited to the agreed service.
monitoring of alerts, errors, backup status, capacity and other relevant events.
activity records, technical logs and incident documentation.
reasonable use of encryption, repository protection, passwords or keys where the technology and service permit.
backups, replication, redundant storage or equivalent measures where included.
updating, maintaining and reviewing the systems and tools used to provide the service.
organisational controls governing access to data.

Safeguards may be updated, replaced or strengthened by equivalent or stronger measures to maintain security.

Unless specifically agreed, the service does not guarantee that data loss will never occur, that recovery will be immediate in every case, or that systems or data outside the agreed scope or incorrectly configured will be covered. The proposal, contract or specific service terms define retention, backup frequency, estimated recovery times, monitoring and support.

9. Special categories of data and children’s data

The service provides general technical support. The customer, as data controller, is responsible for any decision to include health, children’s, biometric, employment or other sensitive data in its systems or backups.

By using the service for such data, the customer confirms it has assessed the service’s suitability, the applicable legal basis and any safeguards required for its activity.

in4byte soluciones digitales, S.L. provides infrastructure and technical services on the customer’s behalf. The customer decides which data is kept in its systems and why.

10. Subprocessors

The customer generally authorises in4byte soluciones digitales, S.L. to engage subprocessors that provide sufficient guarantees and are subject to substantially equivalent data protection obligations.

At the date of these terms, providers involved in providing the service may include:

OVHcloud for hosting, infrastructure, servers, connectivity or technical resources, preferably located within the EU.
Transactional email providers for service notices, support communications and alerts.
Providers of software, backup, monitoring, remote support, ticketing, security or systems management, if they process personal data on behalf of the customer.

Equipment, servers, NAS devices and storage managed directly by in4byte soluciones digitales, S.L. are its own infrastructure and remain subject to the safeguards and obligations in these terms.

in4byte soluciones digitales, S.L. may change subprocessors as necessary to provide the service. We will communicate changes in updated terms, by electronic means, through the customer area or as set out in the service terms.

The customer may raise a reasonable, substantiated data protection objection in writing within a reasonable period after notice or publication. The parties will work in good faith to find a solution. If they cannot, either party may terminate the affected service.

11. International transfers

We aim to process Tranquilidad Digital data within the EU or EEA where compatible with the agreed service and the customer’s systems.

Where the service, a tool or a subprocessor involves a transfer outside the EEA, in4byte soluciones digitales, S.L. will apply or require appropriate safeguards under applicable law, such as standard contractual clauses or another valid transfer mechanism.

12. Communication with users, customer staff and authorised third parties

Where necessary to provide the service or resolve an incident, in4byte soluciones digitales, S.L. may contact users, staff, administrators, technical providers or others authorised by the customer. Contact is limited to providing the service, resolving incidents, restoring data, checking backups or maintaining the systems covered.

We make those communications on the customer’s behalf and in line with its instructions.

13. Exercise of rights

The customer, as controller, is responsible for responding to requests from data subjects.

If in4byte soluciones digitales, S.L. receives a request about data it processes on the customer’s behalf, it will forward the request without undue delay unless the law requires it to deal with the request differently.

Erasing, correcting or restricting data held in backups may require retention, rotation or restore procedures, without affecting the customer’s obligations as controller.

14. Personal data breaches

in4byte soluciones digitales, S.L. will notify the customer without undue delay when it becomes aware of a personal data breach affecting data processed on the customer’s behalf. Where possible, we will provide the information the customer needs to meet its notification and communication obligations.

Report security incidents to hola@in4byte.es.

The customer will cooperate in good faith by providing information, access, decisions or authorisations needed to contain, investigate, recover from or document the incident.

15. Data retention, return and deletion

While the service is in place, the customer may request a restore, download or export of data backed up under the agreed service, subject to technical availability.

When the service ends, in4byte soluciones digitales, S.L. will delete, return or make available personal data processed for the customer in line with its reasonable instructions and the service’s technical terms, unless retention is required by law or separately agreed.

The customer must request export, return or restore before the service ends or within any period specified in the contract. After that the provider may delete copies under its deletion, rotation and expiry procedures.

Where retention is required by law, data will be blocked or retained only as necessary for the required period.

16. Information and verification

in4byte soluciones digitales, S.L. will provide information reasonably necessary to demonstrate compliance with its obligations as processor.
Requests for checks or audits must concern processing under these terms, allow reasonable notice and be proportionate. They must protect confidentiality, security and the service provided to other customers, including technical architecture, credentials, security settings and trade secrets.
Where sufficient, we may respond with documentation, certifications, written responses or other reasonable evidence without requiring an intrusive on-site audit or compromising system security.

17. Confidentiality

in4byte soluciones digitales, S.L. ensures that people authorised to access personal data for the service are subject to appropriate contractual or legal duties of confidentiality.

The duty of confidentiality continues after the contract ends.

18. Liability

Each party is responsible for losses, penalties, costs and claims attributable to its breach of these terms or applicable law.
The customer remains responsible for lawful processing, the data included in its systems and backups, notices to data subjects, the agreed scope of backups and applicable retention periods.
in4byte soluciones digitales, S.L. is responsible for its obligations as processor. The customer remains responsible for its own decisions and the consequences of instructions, configurations, exclusions, source errors, technical limitations, lack of cooperation or uses outside the agreed service.

19. Changes to these terms

in4byte soluciones digitales, S.L. may update these terms to reflect changes in law, operations, technology, security, infrastructure or subprocessors. The current version will be published or communicated electronically and will apply from publication or the date stated, subject to any contractual rights the customer has.

20. Data protection contact

For questions about these terms or personal data processed through the service, contact:

in4byte soluciones digitales, S.L.
hola@in4byte.es
www.in4byte.es