Data processing agreement

For technicians, integrators and MSPs · Last updated: 2026-11-08

This agreement is part of the terms of service and is accepted when LanFaro is used to review or monitor third-party networks (Business and MSP plans, or any use on behalf of a client). It meets article 25 of Colombian Decree 1377 of 2013 (transmission of personal data).

1. Parties and roles

• Controller: the technician or company that subscribes to LanFaro (“the Technician”). It decides which networks are reviewed, for what purpose and for how long, and holds the relationship with its end client.
• Processor: LanFaro (company being incorporated in Colombia). Registration details will be published once it is incorporated; meanwhile, write to vcdane22@gmail.com (“LanFaro”), which processes data only on the Technician’s behalf.

2. Subject matter

LanFaro provides the Technician with inventory, passive monitoring and reporting for the networks the Technician links. The data processed is the client network data the Technician chooses to sync: public IP and ISP, and per device IP, MAC, name, vendor, model, OS, ports and timestamps; and, if the Technician enables the monthly report, the client’s name and email. No sensitive data or traffic content is processed.

3. Technician’s duties

• Obtain the network owner’s authorisation before scanning it or installing the agent (terms, authorised-use clause).
• Inform its client of the processing and have the legal basis or data subjects’ authorisation where required.
• Handle its clients’ requests and complaints; LanFaro will assist through the dashboard tools.

4. LanFaro’s duties

• Process data only on the Technician’s instructions, given by configuring the service (linked networks, alerts, reports and the plan’s retention periods). Not use it for its own purposes, except aggregated anonymous statistics without identifiable network data.
• Keep it confidential, including its staff and subprocessors.
• Apply security measures: encryption in transit, per-account isolation (RLS), two-step verification available and enforced in the database when enabled, tokens stored only as hashes, signed updates and an audit log.
• Help the Technician respond to data subjects (data export and deletion from the dashboard).

5. Subprocessors

The Technician authorises LanFaro to use the subprocessors in the published list, under contracts imposing equivalent obligations. LanFaro will give 30 days’ notice before adding one that receives network data; if the Technician reasonably objects, it may end the service and request a pro-rata refund of the unused paid period.

6. Security incidents

If LanFaro becomes aware of an incident affecting the Technician’s data, it will notify the Technician without undue delay and within 72 hours at most, with what is known: what happened, which data and networks are affected, the measures taken and a contact. LanFaro will cooperate in notifying Colombia’s SIC and the data subjects where required.

7. Return and deletion

The Technician can export its data at any time from the dashboard. When the service ends or the account is deleted, LanFaro erases the network data; backups are overwritten in their normal cycle (30 days at most). Only accounting records required by law are kept.

8. Reasonable audit

Once a year, or after an incident, the Technician may request written information demonstrating compliance with this agreement. LanFaro will reply within 30 days with its policies and security measures. On-site audits, if essential, are agreed in writing with 30 days’ notice, during business hours and at the Technician’s cost.

9. International transfers

Subprocessors may process data outside Colombia, mainly in the United States, with the safeguards described in the data processing policy.

10. Term

This agreement lasts while the Technician uses LanFaro on behalf of its clients and, afterwards, until its data is deleted.