Data Processing Addendum history

The versions of our Data Processing Addendum since April 2024, with what changed.

When we change our Data Processing Addendum, we update the document and record the date here. Each entry below says what changed and links to the full text as it was published, so you can read the version that applied at any given time.

Archived versions are kept for reference only: the current version is the one that applies. For customers who signed up before a revision, it applies 30 days after its announcement on our notices page, unless they accept it earlier. Notices are sent by email to account holders who have not unsubscribed, and anyone can subscribe to them.

  1. Current

    Version 4.0.0. In effect today

    Roles and scope

    • Section 2(a) no longer singles out the United States, and states that requests sent to the EU base URL of the API are answered by servers located in the European Union, after passing through our network provider, whose entry point depends on where the request comes from.
    • Section 2(c) states the purposes for which we act as an independent controller, and their limits: we use the personal data sent through the API to improve our services and data only in aggregated or de-identified form, do not sell the personal data you provide, do not use the personal data of your end users for advertising, and do not reveal that it originates from you.
    • The Addendum does not apply to LIR services, for which we act as a controller.
    • The Addendum forms part of the Terms of Use, or of any other agreement that governs your use of the Services, and prevails over the rest of the agreement on the processing of personal data.
    • A revision applies to new customers when it is posted, and to existing customers 30 days after its announcement on our notices page. Notices are also shown in the dashboard and sent by email to account holders.

    Our obligations as a processor (Section 6)

    • We inform you if an instruction appears to infringe data protection law.
    • New subprocessors are announced on our notices page at least 15 business days ahead. These notices are also shown in the dashboard and sent by email to account holders.
    • An objection to a new subprocessor must rest on reasonable grounds relating to the protection of personal data. If it ends in a termination, the refund covers the unused part of the current subscription period.
    • Transfers by subprocessors outside the European Economic Area rely on appropriate safeguards, such as the Standard Contractual Clauses, or on an adequacy decision.
    • Audit: we first show our compliance with documents. For an on-site audit, expenses must be reasonable and we do not unreasonably refuse an independent auditor. The auditor must not be a competitor of Ipregistry, linked to one, or otherwise manifestly unsuitable.
    • Data incidents: we give you the information available to us, to help you meet your own notification obligations.
    • Deletion or return of personal data also applies at the end of the Services. After that, personal data is kept only where the law requires it, and in backups for up to one year.
    • A new clause covers requests from public authorities.

    International transfers (Section 7)

    • Where Brazilian law requires the clauses approved by the Brazilian authority, they apply in place of the European ones.

    Schedules

    • Schedules 1.1 and 1.2: purposes aligned with section 2(c), and retention periods refer to the Privacy Policy.
    • Schedule 1.1 covers the data sent through the API only. Account data is handled by Ipregistry as a controller.
    • Section 1 and Schedule 2: the subprocessors are the providers shown as involved in API requests on the service providers page.
    • Schedule 3: access with multi-factor authentication, SSH keys and IP-based restrictions, a written confidentiality obligation for anyone given access, and encryption of backups.
    • Schedule 5: the encryption measures asked of customers are stated consistently, as TLS 1.2 or higher in transit and an industry standard algorithm at rest.

    Form

    • The Addendum carries a version number.
    • Signed copies are handled by electronic signature, and signing also covers the Standard Contractual Clauses where they apply. The signature page states that a later revision applies whether or not it was signed.
    • Wording simplified and layout updated.

  2. In effect until November 13, 2026

    Earliest revision kept in this history.