Last updated October 27, 2026
Data Processing Agreement
This agreement forms part of the Terms of Service when Porto processes personal information for you.
Roles
You are the controller of your visitors’ information. Porto is your processor.
Instructions
We process personal information only to provide the service and as you instruct in writing.
Confidentiality and security
Everyone at Porto with access is bound by confidentiality. We apply the security measures described on our Security page.
Subprocessors
You authorize the subprocessors listed in this legal center. We give 30 days notice before adding one, and you can object.
Helping you
We help you respond to requests from individuals and with any data protection impact assessment you need to do.
Breaches
We notify you within 72 hours of confirming a personal data breach that affects your information.
End of service
When the service ends, we return or delete your information within 30 days, unless the law requires us to keep it.
Transfers and audits
Where needed, the standard contractual clauses apply to transfers. We provide the information you reasonably need to confirm compliance, including answering security questionnaires.