Data processing agreement (DPA)

This agreement ("DPA") supplements the General terms of service and is entered into under Art. 28 of Regulation (EU) 2016/679 ("GDPR") between:

• the Customer, as controller (the "Controller");
• Druido Eventi S.r.l., VAT 04137511202, registered office at Via Rizzoli 4, 40125 Bologna (BO), Italy, as processor (the "Processor").

1. Subject and duration

The Processor processes personal data on behalf of the Controller for the sole purpose of providing the TARGA service described in the Terms. The DPA has the same duration as the contract and, after it ends, until the data is returned or deleted in accordance with section 11.

2. Nature and purpose of the processing

Collection, recording, storage, consultation, publication on the serial number pages, sending of service communications, export and deletion of data, in order to manage the documentation of the Controller's machinery, requests for paper copies of the instructions and the related obligations.

3. Categories of data subjects and data

The Service is not intended for processing special categories of data (Art. 9 GDPR) or data relating to criminal convictions and offences. The Controller undertakes not to enter them.

4. Obligations of the Controller

The Controller guarantees that it has a valid legal basis for the processing entrusted, that it provides data subjects with the information required by Arts. 13 and 14 GDPR (including for the paper copy request form) and that it gives instructions that comply with the law.

5. Obligations of the Processor

• process the data only on documented instructions from the Controller, which include the Terms, this DPA and the functions of the Service used by the Controller;
• inform the Controller if it considers that an instruction infringes data protection law;
• ensure that persons authorised to process the data are bound by confidentiality;
• adopt the security measures of section 6 (Art. 32 GDPR);
• assist the Controller in responding to requests from data subjects, as far as possible with appropriate technical and organisational measures;
• assist the Controller with security, breach notification, data protection impact assessment and prior consultation (Arts. 32-36 GDPR);
• make available the information necessary to demonstrate compliance with this DPA and allow the audits of section 9.

6. Security measures

• encryption of communications (HTTPS/TLS) and storage of passwords as hashes;
• logical separation of each customer's data and role-based access control;
• append-only audit log chained with cryptographic fingerprints;
• immutable published versions with SHA-256 fingerprint;
• daily encrypted backups of the database and documents, kept for 30 days in a separate data centre in the European Union, with periodic restore tests;
• limits on login attempts and on requests to public forms;
• servers located in the European Union, at providers with recognised security certifications;
• regular updating of software components and vulnerability management.

Support access. The Provider does not access the content uploaded by the Customer (manuals, text blocks, models, serial numbers and related documents), except as set out below. The Provider's support staff access the Customer's content only with the Customer's express authorisation, granted by a user with the owner or administrator role from Settings > Support, or by approving a specific, reasoned request from the Provider. The authorisation is time-limited (4, 24 or 72 hours), can be revoked at any time with immediate effect and allows viewing only, without the possibility of modifying, publishing or deleting data.

Every support access (grant, start of session, each page viewed, closing and revocation) is recorded, with date, time and the name of the operator, in the Customer's activity log, which the Customer can consult and which cannot be modified, and in an internal log of the Provider that also cannot be modified. The Provider's administration accounts are protected by mandatory two-factor authentication and each of their actions is recorded in a log chained with cryptographic fingerprints, kept for the duration of the contract and the following 10 years.

7. Sub-processors

The Controller gives a general authorisation to the use of the sub-processors listed below. The Processor imposes on each sub-processor data protection obligations equivalent to those of this DPA and remains responsible for their actions.

Service emails (invitations, notifications, notices, receipts of paper requests) are sent from a mail server run directly by the Provider, without third-party providers. Visit statistics (Umami) also run on the Provider's servers.

For managing the contractual relationship, the Provider processes, as controller, aggregate and billing data (company data, plan, subscription status, usage counts) and the strictly necessary data of the Customer's users (name, email, role, date of last access). Payments are handled by Stripe Payments Europe, Ltd., which acts as an independent controller, including for its own legal obligations on anti-money laundering and fraud prevention, and not as a sub-processor. Anthropic receives the texts of the manuals to be translated, which normally do not contain personal data.

The Processor informs the Controller by email of the addition or replacement of a sub-processor at least 30 days in advance. The updated list is always published on this page. The Controller may object on reasonable grounds related to data protection; if no solution is found, the Controller may withdraw from the contract without penalty for the part of the Service concerned.

8. Transfers outside the European Union

Data is stored in the European Union. Transfers to third countries take place only with the safeguards of Chapter V GDPR. For the machine translation service provided by Anthropic, PBC (United States), the transfer is based on the Standard Contractual Clauses adopted by the European Commission with Implementing Decision (EU) 2021/914, supplemented by additional measures where necessary. Under the provider's commercial terms, data sent through the API is not used to train the models and is kept only for a limited period, normally no longer than 30 days.

9. Audits

The Controller may verify compliance with this DPA by requesting documentation and, with at least 30 days' written notice and no more than once a year except in case of breaches, through an auditor bound by confidentiality. The costs of the audit are borne by the Controller.

10. Personal data breaches

The Processor informs the Controller without undue delay, and in any case within 48 hours of becoming aware of it, of any personal data breach concerning the Controller's data, providing the information available to allow the Controller to notify the supervisory authority and, if necessary, communicate it to the data subjects.

11. Return and deletion

When the contract ends the Controller can export its data for the grace period set in the Terms. After that period, the Processor deletes the personal data, including the data in backups within their normal 30-day rotation cycle, subject to retention obligations required by law.

12. Liability and final provisions

The limitations of the Terms apply to liability between the parties, to the extent permitted by Art. 82 GDPR. In case of conflict between this DPA and the Terms on data protection, this DPA prevails. Data protection contact: info@mattiazucchini.com.