LGPD (Brazil's counterpart to the GDPR) and Data Processing Terms
JSK CLOUD E INFRAESTRUTURA LTDA, registered under CNPJ No. 53.748.621/0001-14, with headquarters at Avenida dos Autonomistas, 2561, Vila Yara, Osasco - SP, CEP 06090-020, operates under the HypeHost brand.
This page explains how we process personal data and establishes the Data Processing Agreement (DPA) applicable to VPS, Bare Metal, and Colocation services, according to the activities actually contracted.
These terms form part of the Terms of Service when incorporated into the agreement. Their application does not depend on issuing an individual DPA, without prejudice to specific conditions expressly agreed.
Privacy and data subject rights contact channel: legal@jeskesolutions.net.
1. Our role in data processing
HypeHost acts as a controller for processing performed for its own purposes, such as registration, contract management, billing, customer service, fraud prevention, security, and compliance with legal obligations.
When processing personal data on behalf of the customer, HypeHost acts as a processor or subprocessor, depending on the customer's role and the operation performed. The customer may be a controller or process data on behalf of another controller.
For Colocation, classification takes into account the services actually provided and authorized interventions. Providing space, power, and cooling does not, by itself, imply administration of data on the customer's equipment.
2. Personal data and purposes
Depending on the relationship with HypeHost, we process:
- Registration and contact data: for identification, contracting, communication, and account management.
- Contractual and financial data: for billing, payments, collections, and tax obligations.
- Customer service data: messages, requests, and information sent to our support channels.
- Technical and security data: IP addresses, access logs, service identifiers, and events necessary for operations and abuse prevention.
- Hosted data: information stored, transmitted, or processed in the contracted environment, according to the customer's instructions.
Our own processing activities rely, according to their purpose, on the legal bases of performance of a contract, compliance with a legal or regulatory obligation, the regular exercise of rights, and legitimate interest, subject to their requirements. Where processing depends on consent, that consent must be specific and may be withdrawn.
Acceptance of contractual terms does not constitute blanket consent to any use of personal data.
3. Processing on behalf of the customer
Processing performed by HypeHost on behalf of the customer is limited to service delivery, documented instructions, and applicable legal obligations. It may involve storage, transmission, processing, authorized support, and deletion of data during the agreement and termination procedures.
The categories of hosted personal data and data subjects are determined by the customer, according to its use of the environment. The customer is responsible for ensuring the lawfulness of these operations and the instructions sent to HypeHost.
The contract, service settings, and requests made through authorized channels may document these instructions. If HypeHost identifies an instruction incompatible with the law, it will inform the customer and may suspend execution of the instruction in question until the issue is resolved.
HypeHost does not routinely inspect the contents of hosted applications and databases. Any technical access must have a defined purpose, be limited to what is necessary, and comply with applicable authorizations and obligations.
For operations performed on its behalf, the customer authorizes the use of subprocessors necessary to deliver the service. HypeHost must require those subprocessors to comply with confidentiality, security, and cooperation obligations appropriate to the processing performed, while remaining responsible for its own legal obligations.
Material changes to the list of subprocessors will be communicated to the customer 30 days in advance, subject to the exceptions in section 11. The customer may submit an objection with supporting reasons through the privacy contact channel, and the parties will assess alternatives applicable to the contracted service.
4. Responsibilities by service
Services are unmanaged unless management is expressly contracted. Operational responsibilities are allocated according to the product and contracted scope:
| Service | HypeHost's responsibilities | Customer's responsibilities |
|---|---|---|
| VPS | Host hardware, virtualization, segregation between instances, connectivity, and contracted infrastructure. | The instance's operating system, applications, users, permissions, security settings, encryption, and backups under the customer's management. |
| Bare Metal | Provision and maintenance of contracted hardware, power, and connectivity. | Operating system, any hypervisor, applications, access, encryption, and backups under the customer's management. |
| Colocation | Space, power, cooling, connectivity, and authorized and contracted physical interventions. | The customer's own equipment, components, logical administration, applications, and stored data. |
The allocation of tasks does not remove either party's legal duties or responsibilities for the controls and activities under its management.
5. Security and confidentiality
HypeHost uses access controls appropriate to the roles performed, mandatory multifactor authentication for employees, segregation of the administrative network, VPN access, and access and audit logs.
Access to personal data must be restricted to authorized people and the needs of their activities, subject to a duty of confidentiality. HypeHost commits to adopting technical and administrative measures appropriate to the processing under its responsibility.
The customer must protect credentials, keep its systems updated, and configure security controls for the environment it administers. Contracting infrastructure does not replace these activities.
6. Location and international transfers
The hosting infrastructure is installed in Brazil at the ASCENTY SP03, SP04, SP05, and FTZ1 facilities, according to the contracted location. Use of these facilities does not mean each customer's data is replicated across all of them.
The WHMCS installation and its administrative database are also in Brazil. Snapshots, while available, are kept on separate servers within HypeHost's infrastructure.
Ancillary customer service, monitoring, connectivity, network protection, and payment services may involve personal data processing outside Brazil. Contracting a regional environment does not, by itself, exclude access or supplementary operations in other countries.
HypeHost commits to observing the legal bases and international transfer mechanisms provided by the LGPD and ANPD regulations, according to each operation. Information about sharing and transfers may be requested through the privacy contact channel, without prejudice to information that must be publicly disclosed.
8. Incidents and cooperation
Upon becoming aware of an incident related to service delivery that may compromise personal data processed on behalf of the customer, HypeHost will notify the customer without undue delay, provide available information, and cooperate with assessment and appropriate measures.
Each party will fulfill the notification obligations incumbent on it toward data subjects and authorities. HypeHost will also cooperate, within its scope of activities, in handling data subject requests and verifying compliance with data protection obligations, while respecting confidentiality and third-party rights.
9. Retention and termination
Data is retained for the period necessary for its respective purposes and applicable obligations.
- VPS: after cancellation takes effect, the instance is deleted together with the corresponding backups and snapshots administered by HypeHost, subject to legal preservation obligations.
- Bare Metal: media administered by HypeHost undergoes deletion and preparation for reuse according to the equipment and storage technology.
- Colocation: management of data and media on the customer's equipment remains its responsibility, unless a specific intervention is authorized and contracted.
- Account data: registration data for accounts with no active services is deleted after six months of inactivity, except for information whose retention is necessary on legal grounds.
- Administrative records: tax and contractual documents, payment information, customer service records, and technical logs may be retained for the periods necessary to comply with legal obligations, resolve disputes, and regularly exercise rights, according to the purpose of each record.
The customer must export its data and maintain necessary backup copies while the service remains available, subject to contractual termination conditions. The existence of snapshots or backups does not guarantee their availability after cancellation.
When the purpose ends and no grounds for retention remain, data must be deleted or anonymized.
10. Data subject rights
Under the LGPD, data subjects may request confirmation of processing, access, correction, information on sharing, portability, anonymization, blocking, or deletion, as well as object and withdraw consent in applicable circumstances.
Requests must be sent to legal@jeskesolutions.net. We may request proportionate information to confirm the requester's identity and protect the data involved.
Where a request concerns data processed on behalf of a customer, HypeHost will provide guidance or forward the request to the party responsible for processing and provide appropriate cooperation. Data subjects may also exercise their right to petition the ANPD.
11. Updates and contractual conditions
These terms may be updated to reflect changes in services, processing activities, or legislation. Material changes affecting contracts in force will be communicated 30 days in advance, except where the deadline for adjustments follows from a legal obligation or an order from a competent authority.
Specific data protection conditions may be agreed by contract, subject to mandatory rules and data subject rights. Acceptance of these terms does not remove legal responsibilities or authorize processing incompatible with the stated purposes.
Questions about this document may be sent to legal@jeskesolutions.net.