Data Processing Addendum
Effective date: 28 October 2026
This Data Processing Addendum (“DPA”) forms part of the Terms of Use between APLUSB DECOR PRIVATE LIMITED (“Portal Jump”, the “Processor”) and the agency that uses the Service (the “Agency”, the “Controller”). It applies when Portal Jump processes personal data for the Agency, under the GDPR, the UK GDPR and other data protection law that applies (together “Data Protection Law”). It applies from the day the Agency first uses the Service, with no need to sign it.
1. The parties
- Company: APLUSB DECOR PRIVATE LIMITED
- Trading as: Portal Jump
- Registered in: India
- Email: hello@portaljump.co
The Agency is the organisation that holds the account. Its details are those it gave when it signed up.
2. Subject matter and duration
Portal Jump provides software that lets the Agency build trip links and itineraries, keep a Library of hotels and places, and receive leads. This DPA lasts as long as Portal Jump processes the Agency’s personal data.
3. Details of the processing
| Item | Detail |
|---|---|
| Purpose | To provide the Service to the Agency: store, show and secure trip data, pass leads to the Agency, and count visits. |
| Categories of data subjects | The Agency’s clients and travellers, the people named in trip content, people who send a lead through a contact box, and visitors to the Agency’s trip links. |
| Types of personal data | Client or group names on itineraries. Trip notes and photos that may show people. For leads: name, phone or email, and message. Visitor IP addresses, which the bot check and network layer see. Daily visit counts hold no personal data. |
| Special categories | None is intended. The Agency must not enter special category data, such as health information, unless it has told us and we have agreed in writing. |
| Frequency and nature | Continuous. Storing, retrieving, showing, encrypting and deleting. |
| Retention | While the account is open. Items the Agency deletes stay in a recycle bin for 7 days, then are removed for good. See section 11. |
4. Instructions
Portal Jump processes the personal data only on the documented instructions of the Agency, which are these terms, the Terms of Use and the Agency’s use of the Service, unless the law requires otherwise. We tell the Agency if we think an instruction breaks Data Protection Law. The Agency confirms that it has a lawful basis to give us the data, and has given its clients the information the law requires.
5. Confidentiality
Portal Jump makes sure that the people who may access the personal data are bound by a duty of confidentiality, and that access depends on their role.
6. Security
Portal Jump keeps technical and organisational measures that suit the risk, including:
- encryption in transit (HTTPS) and encryption of client names and leads before they are stored;
- separation of data by agency, and role based access inside each agency;
- passcodes stored only as hashes, and sign in only through Google or Microsoft;
- rate limits, a bot check and an append only audit record;
- photos cleaned of hidden location data before upload and checked again on the server.
7. Subprocessors
The Agency gives general authorisation for the subprocessors below. They are bound by terms that give the same level of protection as this DPA. Portal Jump stays responsible for them.
| Subprocessor | Service | Personal data |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, file storage, network security, rate limiting and the Turnstile bot check. | All data in the Service, and visitor IP addresses. |
| Google LLC | Sign in with Google. Google Maps and Street View embeds in trip pages. Google Sheets for demo requests (not Agency data). | Account data on sign in. The visitor’s browser contacts Google when a map loads. |
| Microsoft Corporation | Sign in with Microsoft. | Account data on sign in. |
Paddle.com Market Limited is the Merchant of Record for orders. It acts as an independent controller for payment data and is not a subprocessor of Agency data. Portal Jump will give the Agency at least 30 days’ notice, by email or in the app, before it adds or replaces a subprocessor. The Agency may object on reasonable data protection grounds within that time. If we cannot resolve it, the Agency may cancel the affected Service and get a refund of the unused part of the period it has paid for.
8. Helping the Agency
Portal Jump helps the Agency, taking into account the nature of the processing, to answer requests from people who use their rights (access, correction, erasure, restriction, portability and objection), and to meet its duties on security, breach notice, impact assessments and consulting authorities. If someone writes to us about the Agency’s data, we refer them to the Agency and do not answer on its behalf, unless the law requires it.
9. Personal data breaches
Portal Jump tells the Agency without undue delay, and where possible within 72 hours, after it becomes aware of a personal data breach that affects the Agency’s data. The notice describes what happened, the likely effects, and the steps taken, as far as known, and we add more as we learn it.
10. International transfers
The subprocessors may process data outside the UK and the European Economic Area, including in the United States. Where that is a restricted transfer, it takes place under an adequacy decision or data bridge that covers the subprocessor, or under the EU Standard Contractual Clauses (module 3, processor to processor, where the Agency is itself a processor, and otherwise module 2) with the UK International Data Transfer Addendum for UK data. Those clauses are part of this DPA, with the details in sections 1 to 3 and 7, and the law of the member state in which the Agency is established, or if none, of Ireland. On request, we give the Agency a copy.
11. Deletion and return
Items an Agency member deletes stay in a recycle bin for 7 days, can be restored, and are then removed for good by a daily job, together with photos that nothing else uses. After the Service ends, Portal Jump deletes the Agency’s personal data within 30 days, or returns it on request made before then, unless the law requires it to keep it. Audit records are kept as they hold the minimum needed for security and accountability, and are not used for anything else.
12. Audits
Portal Jump gives the Agency the information needed to show that it follows this DPA. If that is not enough, the Agency may, on 30 days’ notice, no more than once a year and under confidentiality, audit us, or have an auditor do so, in a way that does not disturb other customers.
13. Liability and law
The limits of liability in the Terms of Use apply to this DPA, to the extent the law allows, and do not limit the rights of data subjects. If this DPA conflicts with the Terms of Use on personal data, this DPA applies. The governing law is the one in the Terms of Use.
14. Contact
Questions about this DPA: hello@portaljump.co.