In short
This agreement governs how Clisec processes your servers' email when it analyzes it on your behalf. You are the controller of that data and Clisec the processor: it only uses it to protect you, following your instructions, without using it to train artificial intelligence models, and deletes it when the contract ends. It forms part of the terms of service. This is a translation for convenience; if there is any difference, the Spanish version prevails.
1. Parties and purpose
This agreement is entered into between the Customer, as controller, and Clisec Internet Ltda., as processor, under article 15 bis of Chilean Law 19.628, as amended by Law 21.719, and, where applicable, article 28 of the GDPR. It forms part of the terms of service and prevails over them on data protection matters.
2. Details of the processing
| Item | Description |
|---|---|
| Purpose | Detect and block spam, phishing, email fraud, malware and other threats in the Customer's inbound email |
| Nature | Receipt, automated analysis, classification, quarantine, logging and deletion |
| Categories of data | Headers, sender, recipients, subject, body, links, attachments, source IP and SMTP transcript |
| Categories of data subjects | The Customer's End users and the senders of the emails they receive |
| Sensitive data | Not specifically sought or processed. It may appear in email content and is protected with the same measures as the rest |
| Duration | While the contract is in force, plus the deletion period in section 9 |
3. Customer instructions
Clisec will process the data only on the Customer's documented instructions, expressed in these terms and in the settings the Customer defines in the panel. If Clisec considers an instruction unlawful, it will inform the Customer.
Clisec will not use the data for its own purposes, including training artificial intelligence models, nor sell or disclose it to third parties, except to authorized sub-processors or by legal obligation. Only Threat indicators describing malicious infrastructure may be used to protect other customers, under section 10 of the terms.
4. Personnel confidentiality
People authorized by Clisec to access the data are bound by confidentiality obligations and only access it as needed, for example to handle a Customer support request.
5. Security measures
- Encryption of data in transit between the Customer's server and Clisec's platform.
- Encryption at rest, at operating-system level, of the disks of the servers that store quarantine and logs.
- Logical separation of each customer's data.
- Least-privilege access control, with strong authentication for staff.
- Audit logs of administrative access.
- Analysis of suspicious attachments in isolated environments.
- Vulnerability management and security updates.
- Incident response plan and backups with restore tests.
6. Sub-processors
The Customer authorizes Clisec to engage the sub-processors listed in the Privacy policy. Clisec will impose on them by contract obligations equivalent to this agreement and remains liable for them. It will give at least 30 days' notice before adding or replacing a sub-processor, and the Customer may object on reasonable grounds and, if no solution is reached, terminate the contract at no cost.
7. Assistance to the Customer
Clisec will help the Customer, through appropriate technical and organizational measures, to respond to data subject requests, carry out impact assessments and meet its security and notification obligations. If a data subject contacts Clisec directly, the request will be forwarded to the Customer without delay.
8. Incident notification
Clisec will notify the Customer of any security breach affecting its data without undue delay and, in any case, within 48 hours of becoming aware of it, with the available information on its nature, the data and people affected, likely consequences and measures taken. This allows the Customer to meet its duty to inform the Chilean Personal Data Protection Agency and, if it is a regulated operator, the Law 21.663 deadlines before the National CSIRT.
9. Return and deletion
The Customer can remove its servers from its customer area at any time. Quarantine and logs are kept for only 15 days, so the Customer's email data is deleted no later than 15 days after removal or termination of the contract, unless the law requires keeping it. Within that period, the Customer may request an export of its available logs.
10. Information and audits
Clisec will make available to the Customer the information needed to demonstrate compliance with this agreement and allow reasonable audits, with 30 days' prior notice, during business hours, at the Customer's cost and subject to confidentiality, no more than once a year unless there is an incident or an authority requires it.
11. International transfers
Clisec processes email data on its own cloud in Chile. If it ever processed it outside Chile, it will only do so in countries with an adequate level of protection or with sufficient safeguards, notifying the Customer under section 6. Chile does not have a European Commission adequacy decision, so, for data subject to the GDPR, the parties will apply the relevant European Commission standard contractual clauses, which are deemed incorporated into this agreement.
12. Liability
Each party is liable for meeting its own legal obligations. If Clisec processes the data for a purpose other than instructed, it will be deemed the controller of that processing, under article 15 bis of Law 19.628.
Related documents: Terms and conditions of service · Privacy policy · Cookie policy