Data processing agreement

1. Subject matter and duration

The processor processes personal data on behalf of the controller only to provide the service described in the Terms of service. The agreement lasts as long as the processor holds data of the account, so also after the service ends and until return or deletion (article 9).

2. Nature and purpose of the processing

Storing, consulting, processing, publishing on the links chosen by the controller, and deleting the data entered in the account, to write and send quotes, collect online acceptance, produce the PDF and measure how quotes are read. Processing is only on the controller's documented instructions: the Terms of service, this agreement and the way the controller uses the service, including the AI assistants it connects, are instructions.

3. Categories of data and of data subjects

Data subjects: the controller's clients, and the contact people named on their cards and in quotes.

• first and last name, company name, addresses, email, phone and other contact details;
• VAT number, tax code, SDI code, PEC and other tax data;
• content of quotes, proposed services and amounts, and the notes the controller writes;
• reading statistics described in the notice for people who receive a quote: day, duration, actions on the page, device type, browser, language and country, referring site, without IP address;
• the acceptance record: name written, date and time, choices, IP address, country, browser and verification code.

The controller must not enter special categories of data (article 9 of the Regulation) or data on criminal convictions, unless strictly necessary and communicated to the processor.

The data of the account's user (email, name, sessions, billing) is processed by the provider as controller, under the Privacy policy for users, and is not covered by this agreement.

4. Obligations of the processor

The processor:

• processes data only on the controller's documented instructions, and tells the controller if it thinks an instruction breaches the law;
• ensures that the people authorised to process the data are bound by confidentiality;
• applies the security measures of article 6;
• respects the conditions of article 5 for sub-processors;
• assists the controller as set out in articles 7 and 8;
• does not use the data for its own purposes and does not sell or give it away;
• makes available to the controller the information needed to show compliance with these obligations (article 10).

The controller remains responsible for having a legal basis for the data it enters, for informing its clients and for using the service lawfully. Preventivatoree shows the readers of a quote the general notice referred to in article 3; the controller may add to it.

5. Sub-processors

The controller gives the processor a general written authorisation to use the sub-processors below. With each of them the processor has a contract imposing data protection obligations equivalent to these.

The last three process only the user's data and not the controller's clients' data, and are listed for transparency. The AI assistants that the controller connects (Claude, ChatGPT, Gemini) are not our sub-processors: they are chosen and instructed by the controller, who is responsible for the relationship with them. The processor sends them only what they ask for through the connection.

Changes: the processor tells the controller by email at least 30 days before adding or replacing a sub-processor. The controller may object on data protection grounds by writing within that period; if no solution is found, it may close the account.

6. Security measures

The processor applies the following measures, which are in place in the service today:

• public quote links use random 192-bit codes that cannot be guessed or enumerated; quote pages are not indexed by search engines;
• connections over HTTPS only, with HSTS;
• a strict content security policy (CSP): scripts only from the site itself, never inline, no third-party services on the pages, no embedding in other sites;
• sign-in with Google or with a single-use email link valid for 15 minutes, with no password to keep; sessions on protected cookies, not readable by page scripts;
• AI assistants connect with OAuth 2.1 and can be revoked at any time;
• isolation between accounts: every operation on data is limited to the account that asks for it, and is covered by automated tests;
• accepted quotes cannot be modified: the database itself enforces it;
• encryption at rest of the database, managed by Cloudflare;
• reading statistics without IP address, with an anonymous code computed with a daily key that is deleted the next day, and automatic deletion after 13 months;
• staff access to account data only when needed to give support or fix a problem.

Note for the lawyer: the measures described are those actually present in the code. Confirm with the owner the line on staff access (today one person) and the encryption at rest, which depends on Cloudflare, before the annex is signed.

7. Assistance with data subject requests

The processor passes on to the controller without delay the requests it receives directly from data subjects and does not answer except on the controller's instruction. The controller can exercise most rights on its own from the dashboard (view, correct, delete cards and quotes, except the unchangeable acceptance records). For the rest, the processor assists the controller with appropriate technical and organisational measures, within times compatible with the deadlines of the Regulation. The controller may ask for the reading statistics of a quote to be deleted.

8. Personal data breach

The processor tells the controller by email, without undue delay and in any case within 48 hours of becoming aware of it, of any personal data breach affecting the account's data. The notice describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and of data concerned, the likely consequences and the measures taken or proposed, so that the controller can notify the Garante within 72 hours, if due, and inform the data subjects.

9. Return or deletion at the end of the contract

At the end of the contract, on the controller's written request (email to [CONTACT EMAIL]), the processor returns the personal data in a commonly used format or deletes it, as the controller chooses, and removes existing copies, unless the law requires them to be kept. Without a request, data is deleted at the end of the retention period stated in the Terms of service ([RETENTION PERIOD]). Return or deletion is handled by hand by the processor, not by a feature of the service.

10. Audits

The processor makes available to the controller the information needed to show compliance with the agreement and allows audits, including inspections, by the controller or an auditor it appoints, with at least 30 days' notice, in working hours, without hindering the service, and with the auditor bound by confidentiality. Audits cannot cover the data of other accounts. Costs are borne by the controller, unless serious breaches come to light.

Note for the lawyer: audit terms and costs are a proposal; adapt them to the size of the service.

11. Governing law

The Italian law and court stated in the Terms of service apply.