This agreement is the personal data transmission contract under article 2.2.2.25.5.2 of Colombian Decree 1074 of 2015, between the Client, as Controller, and Phanteus, as Processor. It forms part of the Terms and Conditions and of each service order, and is accepted together with them. The Spanish version is the reference text.
In short: your customers’ data is yours, and you decide how it is used. Phanteus stores and processes it only so your site, store or point of sale works, securely and confidentially. You must have your own data policy, obtain authorizations and handle your customers’ requests; we help with the technical side.
1. Purpose and scope
Phanteus processes, on the Client’s behalf, the personal data the Client or its end users enter into the service. For example:
| Service | Data subjects | Typical data |
|---|---|---|
| Trebial Web | People who write through the site’s forms | Name, email, phone, message |
| Trebial Commerce | Store buyers | Name, mobile, email, ID (optional), delivery address, orders, payment method and status |
| Trebial POS | Point-of-sale customers and staff | Name, ID, contact details, purchases, receivables, system users |
| All | Users of the Client’s dashboard | Name, email, role and activity logs |
Duration: as long as the service lasts, plus the exit period in the Terms (section 18).
2. Client instructions
Phanteus processes the data only to provide the service and according to the Client’s instructions. The settings the Client makes in the platform (for example, which data a form asks for or which payment methods a store accepts) are such instructions. If an instruction seems unlawful to us, we will tell the Client and may decline to follow it.
3. Phanteus’s obligations as Processor
Under article 18 of Law 1581 of 2012, Phanteus undertakes to:
- Not use the data for its own purposes, sell it or disclose it to third parties, except to the sub-processors in section 5 or by order of an authority.
- Protect the data with reasonable measures:
- encryption in transit;
- isolation of each Client’s data;
- role-based access with database-level rules;
- encrypted secrets, audit logs and backups.
- Keep it confidential and require the same from the members of its team who have access.
- Help the Client respond to data subjects: if a person writes to us to exercise their rights over the Client’s data, we will forward the request to the Client within five (5) business days. We will also provide tools to access, correct, export or delete the data.
- Report incidents: if we confirm a security incident affecting the Client’s data, we will inform the Client without undue delay and in any case within seventy-two (72) hours, with the information available and the measures taken. This lets the Client meet its duties to the SIC and data subjects.
- Record the “claim in progress” tag and information under judicial dispute when the Client instructs.
- Return or delete the data when the service ends, within the exit period in the Terms, except what the law requires us to keep.
- Provide reasonable information to show compliance with this agreement, for example by answering a questionnaire, with prior notice and without access to other clients’ data.
4. The Client’s obligations as Controller
Under article 17 of Law 1581 of 2012, the Client undertakes to:
- Have and publish its own Data Policy and, where applicable, its privacy notice on its site or store.
- Obtain data subjects’ authorization where the law requires it. Trebial Web offers an authorization checkbox in its forms and orders; the Client must write the text that goes with it.
- Inform the purposes and use the data only for them.
- Handle its data subjects’ inquiries and claims within the legal deadlines.
- Not load sensitive data or data about minors without meeting the law’s special requirements.
- Have a legal basis for each use it makes, including sending commercial messages.
- Answer to data subjects and authorities for the decisions it makes about the data.
5. Sub-processors
The Client authorizes Phanteus to rely on the providers listed in the Personal Data Policy (section 9): database infrastructure, hosting and email delivery. Phanteus:
- requires protection obligations from them equivalent to those in this agreement;
- will notify the Client before adding or replacing a provider that processes its data, so that the Client can terminate the service if it disagrees.
The payment gateway the Client contracts (for example, Wompi) is not a Phanteus sub-processor: it has its own relationship with the Client and the buyer.
6. International transmissions
The data may be stored on servers in the United States and other countries where the sub-processors operate. The Client authorizes those transmissions, which are made with the contractual safeguards of article 2.2.2.25.5.2 of Decree 1074 of 2015.
7. Liability
- Each party is liable for its own obligations.
- Phanteus is not liable for the processing the Client decides on, or for the Client’s lack of authorizations or policy.
- The limitations of liability and indemnity in the Terms and Conditions (sections 15 and 16) apply to this agreement.
8. Term
This agreement is effective from the Client’s acceptance of the Terms and Conditions and lasts while Phanteus processes data on its behalf.