This Data Processing Addendum (“DPA”) forms part of the agreement between FINLEADGEN LLC, a Florida limited liability company doing business as PomeloHost, 135 E Dania Beach Blvd, Apt 1, Dania Beach, FL 33004 (“PomeloHost”, “Processor”), and the customer that accepts it (“Customer”, “Controller”) for the PomeloHost services (the “Agreement”, which includes the Terms of Service, any Master Services Agreement and any Reseller Agreement). It applies when PomeloHost processes Customer Personal Data on Customer’s behalf. Customer may accept this DPA online in its account or by signing it.
1. Definitions
- Customer Personal Data means personal data that Customer or its users store on, or transmit through, the services, and that PomeloHost processes on Customer’s behalf.
- Data Protection Laws means all laws that apply to the processing of Customer Personal Data under the Agreement, including, where applicable, the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended (“CCPA”), and other U.S. state privacy laws.
- Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
- Sub-processor means a third party engaged by PomeloHost that processes Customer Personal Data.
- Terms such as “controller”, “processor”, “data subject”, “processing”, “business”, “service provider” and “sell” or “share” have the meanings given in the Data Protection Laws.
2. Roles and scope
Customer is the controller (or, under the CCPA, the business) and PomeloHost is the processor (or service provider) for Customer Personal Data. PomeloHost is a separate controller for account, billing and support data it collects to run its business, which is covered by the PomeloHost Privacy Policy, not by this DPA. Details of the processing are set out in Annex 1.
3. Customer instructions
PomeloHost processes Customer Personal Data only on Customer’s documented instructions. The Agreement, this DPA and Customer’s use and configuration of the services are Customer’s complete instructions. PomeloHost will tell Customer if it believes an instruction violates Data Protection Laws. Customer is responsible for the lawfulness of the Customer Personal Data and for having a legal basis to process it.
4. PomeloHost obligations
PomeloHost will:
- process Customer Personal Data only to provide the services and as required by law; if the law requires other processing, PomeloHost will inform Customer first unless the law prohibits it;
- ensure that personnel with access to Customer Personal Data are bound by confidentiality obligations;
- implement the technical and organizational security measures described in Annex 2;
- assist Customer, taking into account the nature of the processing, in responding to data subject requests, and in data protection impact assessments and consultations with supervisory authorities, to the extent Customer cannot do so itself using the services;
- not access or review the content of Customer’s servers or mailboxes except as needed to provide support Customer requests, to prevent or address service, security or technical problems, or as required by law.
5. CCPA service provider terms
Where the CCPA applies, PomeloHost will not: sell or share Customer Personal Data; retain, use or disclose it for any purpose other than the business purposes specified in the Agreement, including any commercial purpose other than providing the services; retain, use or disclose it outside the direct business relationship with Customer; or combine it with personal data PomeloHost receives from other sources, except as permitted by the CCPA. PomeloHost will comply with the CCPA, provide the same level of privacy protection the CCPA requires, and notify Customer if it can no longer meet its CCPA obligations. Customer may take reasonable steps to stop and remediate unauthorized use. PomeloHost certifies that it understands these restrictions.
6. Sub-processors
Customer authorizes PomeloHost to use the Sub-processors listed in Annex 3. PomeloHost will bind each Sub-processor by written terms that protect Customer Personal Data at least as well as this DPA, and remains responsible for its Sub-processors’ performance. PomeloHost will give at least 30 days’ notice of a new Sub-processor by updating its Sub-processor list and emailing customers who subscribe to updates. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected service and receive a refund of prepaid fees for the unused period.
7. Security Incidents
PomeloHost will notify Customer without undue delay, and in any case within 48 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe, to the extent known, the nature of the incident, the categories and approximate number of data subjects and records affected, the likely consequences and the measures taken or proposed. PomeloHost will provide further information as it becomes available and take reasonable steps to contain and remediate the incident. Notification is not an admission of fault.
8. International transfers
Customer Personal Data is stored in data centers in the United States unless Customer selects another location where offered. To the extent Customer Personal Data subject to the GDPR is transferred to PomeloHost in the United States, the parties incorporate the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914 — Module 2 (controller to processor) or Module 3 (processor to processor), as applicable — with Clause 7 included, Option 2 (general authorization) in Clause 9 with the notice period in Section 6, the optional language in Clause 11 omitted, Irish law in Clause 17 and the courts of Ireland in Clause 18, and Annexes completed with Annexes 1–3 of this DPA. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum issued by the Information Commissioner is incorporated. If the Standard Contractual Clauses conflict with this DPA, the Clauses control.
9. Audits
PomeloHost will make available information reasonably necessary to demonstrate compliance with this DPA, including written answers to security questionnaires once per year. If Data Protection Laws require more, Customer may carry out an audit, at its own expense, with at least 30 days’ notice, during business hours, no more than once per year, under confidentiality terms, and in a way that does not disrupt PomeloHost’s operations or compromise other customers’ data.
10. Return and deletion
Customer can export its data at any time during the term using the services. After the services end, PomeloHost deletes Customer Personal Data from active systems within 30 days and from backups within 90 days, unless the law requires PomeloHost to keep it.
11. Liability and order of precedence
Each party’s liability under this DPA is subject to the limitations of liability in the Agreement, except where Data Protection Laws do not allow it. If this DPA conflicts with the Agreement regarding Customer Personal Data, this DPA controls.
Annex 1 — Details of processing
| Item | Details |
|---|---|
| Subject matter | Hosting, cloud servers, email, Microsoft 365 administration, managed IT and related services |
| Duration | The term of the Agreement plus the deletion period in Section 10 |
| Nature and purpose | Storage, hosting, backup, transmission and technical support, as instructed by Customer |
| Categories of data subjects | Customer’s employees, users, clients, website visitors and other individuals whose data Customer stores |
| Categories of personal data | Determined by Customer; typically names, contact details, account credentials, IP addresses, and any content Customer uploads |
| Sensitive data | Only if Customer chooses to store it; health data only under a signed Business Associate Agreement |
Annex 2 — Security measures
- Encryption of data in transit with TLS; encrypted backups.
- Access to production systems limited to authorized staff, with multi-factor authentication, unique accounts and least-privilege roles; access reviewed quarterly.
- Firewalls, network segmentation between customer environments, DDoS mitigation and continuous monitoring.
- Timely security patching of hosting platforms and management systems.
- Centralized logging of administrative access, retained for at least 12 months.
- Redundant storage (RAID) and regular backups stored off-site with a separate provider.
- Physical security at the data center: 24/7 staffing, access control and video surveillance.
- Written incident response plan, staff security training at onboarding and yearly, and confidentiality agreements for all personnel.
Annex 3 — Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| [Data center provider] | Data center facilities, power and network | United States |
| Backblaze, Inc. | Off-site backup storage | United States |
| Microsoft Corporation | Transactional email (Azure Communication Services); Microsoft 365 services ordered by Customer | United States |
| Stripe, Inc. | Payment processing and identity verification | United States |
| PayPal, Inc. | Payment processing | United States |
| FraudLabs Pro (Hexasoft Development Sdn. Bhd.) | Fraud screening of orders | Malaysia / United States |
Signatures
FINLEADGEN LLC (PomeloHost) — Name: Andrey Sharov · Title: Authorized Member · Signature: ________________ · Date: ________
[Customer Legal Name] — Name: ________________ · Title: ________________ · Signature: ________________ · Date: ________