Data Processing Agreement (DPA)

Last updated: October 26, 2026

Preamble

In compliance with Article 28 of the General Data Protection Regulation (GDPR), this agreement defines the terms and conditions under which

The Client, acting as Data Controller (hereinafter the “Controller”)

appoints

Damiano Carradori (hereinafter the “Processor”)

for the execution of personal data processing activities necessary for the provision of services.

1. Purpose of the Agreement

1.1. The purpose of this agreement is to appoint the Processor and provide instructions regarding the processing of personal data in the context of the use of the Platform. The processing activities that the Processor may carry out are limited to those strictly necessary for the provision of services related to each active Project, and in accordance with the documented instructions of the Controller. The processing may include, upon the Data Controller’s documented instructions, the collection and management of copies of identity documents uploaded by data subjects, solely for the purposes determined by the Data Controller and strictly limited to what is necessary for the provision of the Services. Where the Processor enables the AI Assistant for a Project with the Controller's agreement, the Controller instructs the Processor to process the personal data described in Article 3-ter through the large-language-model providers listed as sub-processors in Article 7, for the sole purpose of answering the questions of the users authorised by the Controller about the Project and of preparing changes and communication drafts, subject to the review and approval of those users. Where the Controller itself acts as processor on behalf of a third party, the references to the Controller in this agreement are read accordingly and the Controller warrants it holds the necessary authorisation from that third party.

2. Duration

2.1. This agreement shall remain valid and binding for the entire duration of the contractual relationship between the Parties and shall apply to each Project activated by the Controller through the Platform. For each Project, data processing begins on the activation date; after the Project’s expiration, as set forth in the Terms and Conditions, it continues only as needed for the return or deletion of data under Article 12.

3. Types of Data and Categories of Data Subjects

3.1. The categories of personal data processed are:

Identification data (name, surname, email, etc.)
Contact and RSVP data of guests, including their answers to the questions configured by the Controller
Content of the communications sent to guests and of the replies received
Content of the AI Assistant conversations entered by the users authorised by the Controller
Statistical and navigation data
Data contained in identity documents uploaded by data subjects, including, by way of example and not limitation: document type, document number, issuing authority, date of issue and expiry date, photograph, signature, place and date of birth
Any additional personal data voluntarily provided by data subjects that may be requested by the Controller during the use of the Platform

The Controller may configure optional questions whose answers may reveal special categories of personal data pursuant to Article 9 GDPR (for example, allergies, intolerances, dietary requirements linked to health or to religious or philosophical beliefs, or accessibility needs). By configuring such a question, the Controller instructs the Processor to process those answers for the purposes of the event. The Controller warrants that, before collecting such answers, it has identified and documented an applicable condition under Article 9(2) GDPR and has provided the required information. Where it relies on explicit consent, it shall obtain and be able to demonstrate that consent; providing an answer does not, by itself, establish explicit consent. For questions the Controller marks as sensitive in the Platform, the Platform shows the data subject a dedicated consent box next to the question, accepts a non-empty answer only once that box has been ticked, and records the time of consent together with the answer; the Controller remains responsible for the wording of the question and for the information given to data subjects.

3.2. The personal data processed under this Agreement relate exclusively to the guests of the events organised by the Controller and to any third parties whose data are entered by the Controller within the scope of the Projects, in respect of whom the Processor acts solely on behalf of the Controller.

3-bis. Processing of Identity Documents

3-bis.1. The Processor shall process identity documents solely on behalf of the Data Controller and in accordance with documented instructions, for purposes related to identity verification, compliance with contractual or legal obligations, or other purposes strictly connected to the provision of the Services.

3-bis.2. Access to identity documents shall be restricted to the users that the Controller authorises on the Project, namely users with the Admin (owner) role and users to whom the Controller assigns the Vendor role, and, solely for support purposes, to the Processor’s authorised personnel. All access shall be subject to access control measures, and every download is logged.

3-bis.3. Identity documents shall be retained only for the period strictly necessary to fulfil the purposes determined by the Data Controller. They are deleted together with the guest concerned and, in any case, are returned or deleted with the other personal data of the Project under Articles 12.2 and 12.5, unless retention is required by applicable law.

3-bis.4. The Processor is expressly prohibited from using identity documents for its own purposes or for any purpose other than those documented by the Data Controller.

3-bis.5. The processing of identity documents is carried out in compliance with the principles of data security and data minimization and on the basis of a risk assessment conducted by the Processor, in accordance with applicable data protection laws.

3-ter. Processing through the AI Assistant

3-ter.1. The AI Assistant is an optional feature of the Platform that the Processor may enable for a Project with the Controller’s agreement. It answers the questions of the users authorised by the Controller about the Project and prepares changes to guests, to RSVP sections and questions, and to communication drafts. It cannot send or schedule communications, nor send test messages: drafts are sent only through the Platform’s ordinary campaign workflow.

3-ter.2. To provide the AI Assistant, the Processor transmits, as needed to answer each request, data from the following categories, relating solely to the Project concerned, to the large-language-model providers listed as sub-processors in Article 7:

the messages written by the users and the name of the Project;
the guests’ first and last name, email address, WhatsApp number, tags, group, RSVP status, invited sections and WhatsApp opt-in status;
the guests’ answers to the RSVP questions, both free text and selected options, including any answers revealing special categories of personal data referred to in Article 3.1; answers to hidden questions are excluded and, for document-upload questions, only whether a document has been provided is transmitted;
the subject and body of campaign messages and the content of drafts;
Project and application context (name, description, dates, language, plan and status, current page), RSVP section and question configuration (wording, choices, dates), record identifiers and guest-group composition, campaign, recipient, sending and delivery metadata, and the content, previews and results of proposed changes.

Additional calls to the same provider, using the configured utility model, process selected conversation content to generate titles and rolling summaries.

3-ter.3. The AI Assistant’s built-in tools do not retrieve uploaded identity-document files or their contents; for document-upload questions only whether a document was provided is disclosed. The Controller shall ensure that its users do not submit identity documents or their contents in messages or attachments.

3-ter.4. The large-language-model providers do not use the data received through the AI Assistant to train their models. They do not store conversation state once a request has been served; they may keep abuse-monitoring records of request data for up to 30 days, as set out in their terms applicable to the Processor’s account. Deleting a conversation from the Platform does not by itself delete those records before that period expires.

3-ter.5. Every change prepared by the AI Assistant is shown to the user as a preview and is applied only after the user has explicitly approved it in the Platform interface. No decision based solely on automated processing which produces legal effects concerning data subjects or similarly significantly affects them is taken through the AI Assistant.

3-ter.6. Conversations, including messages, generated answers, titles, summaries, approval decisions and usage counters, are stored in the Platform’s database (see Article 7 for processing locations) under the relevant Project. They are visible only to the user who created them and to the Processor’s authorised personnel for support purposes, and are retained until the user deletes the conversation or the Project is deleted. Deleting a conversation deletes its messages and its pending-change records. The separate records of changes applied and the drafts saved through the AI Assistant are retained until the Project is deleted; communications created from drafts follow the retention rules of campaigns.

3-ter.7. The Processor’s authorised personnel may use the AI Assistant on the Controller’s Project solely for support purposes, where necessary, and within the limits of this agreement.

3-ter.8. The Controller may at any time ask the Processor to deactivate the AI Assistant for a Project. The Processor may limit, suspend or withdraw the AI Assistant at any time, in particular for security reasons or to prevent abuse.

4. Data Transfers

4.1. The Processor processes personal data primarily within the European Economic Area (EEA). Where, for technical and operational reasons related to the provision of the Services, the Processor makes use of authorised sub-processors or infrastructures located outside the EEA, such transfers shall take place exclusively in compliance with Articles 44 et seq. of the GDPR.

4.2. In such cases, the Processor ensures that the transfer of personal data to third countries is based on appropriate safeguards, such as the Standard Contractual Clauses adopted by the European Commission, as well as the implementation of any supplementary measures required under applicable data protection laws.

4.3. The Controller expressly authorises such transfers, to the extent that they are necessary for the provision of the Services under this Agreement and in accordance with the provisions of this Article.

5. Technical and Organizational Measures

5.1. Before carrying out the processing under this appointment, the Processor shall implement all appropriate technical and organizational measures to ensure the protection of personal data. Upon the Controller’s request, the Processor shall provide a document describing in detail the security measures adopted in relation to the execution of this agreement. Should the Controller, by means of inspection or audit, deem that modifications are necessary, such changes shall be agreed upon by both Parties.

5.2. The Processor guarantees the security of processing pursuant to Articles 28(3)(c) and 32 of the GDPR, in particular with reference to Articles 5(1) and 5(2). These measures shall ensure an adequate level of protection and security appropriate to the risk, ensuring the confidentiality, integrity, availability, and resilience of systems. According to Article 32(1) GDPR, in assessing the adequacy of the security level, account shall be taken of the state of the art, implementation costs, and the nature, scope, context, and purposes of processing, as well as the risk probability and severity for the rights and freedoms of natural persons.

5.3. The technical and organizational measures are subject to technological evolution and development. Therefore, the Processor may adopt alternative appropriate measures in light of technological advancements. In such cases, the level of data protection must not be reduced.

5.4. With specific regard to the processing of identity documents, the Processor shall implement enhanced technical and organisational security measures, including, by way of example: encryption of data at rest and in transit, logical data segregation, strict access limitation, activity logging, and secure deletion procedures.

5.5. The technical and organizational measures adopted by the Processor are consistent with the risk assessment performed pursuant to Article 35 of the GDPR and are periodically reviewed and updated.

5.6. With specific regard to the AI Assistant, the Processor implements, among others, the following measures: the tools available to the AI Assistant can access only the data of the Project bound to the authenticated request; every change proposed by the AI Assistant to guest data, RSVP configuration or communication drafts is preceded by a preview and requires the user’s explicit approval, which is cryptographically verified before the change is applied; logs never contain the content of conversations; per-user rate limits and a global switch to deactivate the feature are in place; the data are not used to train models; the built-in tools never retrieve identity documents.

5.7. The Processor shall ensure that the persons authorised to process personal data under this agreement, including its personnel, contractors and the sub-processors referred to in Article 7, have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they process personal data only on the Controller’s documented instructions, within the limits of their respective tasks.

6. Data Subject Rights and Assistance

6.1. The Processor undertakes to cooperate with the Controller and provide full assistance, to the extent that it is reasonable or possible, in order to help the Controller respond to data subject requests in the exercise of their rights.

6.2. In particular, the Processor undertakes to (i) immediately forward to the Controller any request received from data subjects concerning the exercise of their rights and, where feasible or appropriate, (ii) assist the Controller in designing and implementing all technical and organizational measures necessary to respond to such requests.

6.3. Without prejudice to the fact that responsibility for responding to and fulfilling data subject requests lies exclusively with the Controller, the Processor may be instructed to fulfil specific requests, provided such tasks do not require disproportionate effort and are based on written instructions from the Controller.

7. Sub‑processors

7.1. The Controller hereby authorizes the Processor to engage third‑party sub‑processors. Such sub‑processors must be bound by the same contractual obligations set forth in this agreement, pursuant to Article 28(4) of the GDPR.

7.2. As of the date of this agreement, the Parties acknowledge that the Processor makes use of the following sub‑processors, with whom it undertakes to enter into appropriate agreements in compliance with Article 28(4) of the GDPR (“SCC”: Standard Contractual Clauses adopted by the European Commission; “DPF”: EU-US Data Privacy Framework):

Google Cloud EMEA Limited / Google LLC — Service: Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions (region europe-west1), Cloud KMS, App Check/reCAPTCHA; Personal data: All personal data processed through the Platform; Location: European Union (Cloud Firestore multi-region eur3, Cloud Storage multi-region EU, Cloud Functions europe-west1); Firebase Authentication, Cloud KMS and App Check/reCAPTCHA may involve processing in the United States; Transfer safeguard: Google Cloud Data Processing Addendum with SCC / DPF
OpenAI Ireland Ltd / OpenAI, L.L.C. — Service: Large language models for the AI Assistant; Personal data: The data described in Article 3-ter; Location: United States; Transfer safeguard: SCC / DPF; no model training on API data; no stored conversation state; abuse-monitoring logs up to 30 days
Twilio Ireland Limited (SendGrid) — Service: Email delivery and delivery events; Personal data: Recipients’ email addresses, message content and delivery events (no open or click tracking); Location: United States; Transfer safeguard: SCC / DPF
Meta Platforms Ireland Limited — Service: WhatsApp Business Platform; Personal data: Guests’ phone numbers, outbound messages and inbound replies; Location: European Union / United States; Transfer safeguard: SCC / DPF
Neon, Inc. — Service: Managed PostgreSQL database holding the document-access audit log; Personal data: Actor reference, resource accessed, IP address, timestamp and outcome; Location: European Union (AWS eu-central-1, Frankfurt); Transfer safeguard: SCC / DPF
Vercel Inc. — Service: Hosting of the operator console (Processor’s staff only) and of the website; Personal data: Account and controller contact data, Project configuration and approvals, staff notes, and guest and communication data processed through the operator-console functions; Location: European Union (Frankfurt) and United States (Washington); Transfer safeguard: SCC / DPF
Google Cloud EMEA Limited (Google Workspace) — Service: Company email and document tools used for support and for handling requests from data subjects and Controllers; Personal data: Content of emails and documents exchanged for support and requests; Location: European Union / United States; Transfer safeguard: Google Workspace Data Processing Addendum with SCC / DPF

7.3. The transfer of data to a third‑party processor may only take place once all conditions for the appointment referred to in point 7.1 above have been met.

7.4. The Processor must maintain an up‑to‑date list of sub‑processors. The Processor gives the Controller written notice of any intended addition or replacement of a sub‑processor at least 30 days before engaging it, allowing the Controller to object before the new sub‑processor begins processing. In the event of an objection, the Processor may terminate the contract with respect to the Project or Projects affected by the change, by giving the Controller 30 days’ written notice.

7.5. The Processor remains fully liable to the Controller for the actions and omissions of any sub‑processors.

7.6. Where a sub‑processor operates outside the EU/EEA, the Processor must ensure that the transfer of data is lawful, as described in Article 4 of this agreement.

8. Controller’s Audit Rights

8.1. The Controller has the right to conduct inspections or have them carried out by an appointed auditor. The auditor shall assess the Processor’s compliance with this agreement as part of their audit activities, by means of periodic or random checks, which shall generally be notified in advance.

8.2. The Processor shall allow the Controller to verify compliance with its obligations as required under Article 28 of the GDPR. Upon request, the Processor shall provide the Controller with all necessary information and, in particular, evidence demonstrating the adoption of appropriate technical and organizational measures.

8.3. Evidence of compliance with such measures — which may also relate to activities not covered by this agreement — may be provided by:

adherence to approved codes of conduct under Article 40 of the GDPR;
certifications issued under an approved certification mechanism in accordance with Article 42 of the GDPR;
current audit certifications, reports, or excerpts of reports prepared by independent entities (e.g., auditors, data protection officers, IT security departments, or data protection auditors);
relevant certifications issued by IT security or data protection auditors.

8.4. The Processor may charge the Controller a reasonable fee for conducting such inspections.

9. Assistance to the Controller

9.1. The Processor shall assist the Controller in fulfilling its obligations regarding personal data security, reporting of data breaches, data protection impact assessments, and prior consultations as described in Articles 32 through 36 of the GDPR, including by:

maintaining appropriate standards of protection through technical and organizational measures that take into account the nature, circumstances, and purposes of the processing, the likelihood of data breaches, and the severity of potential risks for natural persons;
notifying the Controller of any personal data breach without undue delay after becoming aware of it; the Processor’s operational target is to send the Controller a first notice within 24 hours of becoming aware of a breach, with the information available at that time, supplemented as the investigation progresses;
assisting the Controller in responding to data subject requests to exercise their rights.

9.2. The Processor may request a reasonable fee from the Controller for assistance services that are not included in the description of the core services and that are not required due to errors, violations, or misconduct attributable to the Processor.

10. Controller’s Authority

10.1. The Processor shall not process any personal data under this appointment except on the documented instructions of the Controller, unless processing is required by European Union or Member State law to which the Processor is subject. In that case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

10.2. The Processor shall immediately inform the Controller if, in its opinion, an instruction of the Controller, including a request to modify the processing of personal data, infringes the GDPR or other European Union or Member State data protection provisions. In such a case, the Processor may refrain from carrying out any activity that could lead to such an infringement until the instruction is confirmed or amended.

11. Liability

11.1. Each Party agrees to indemnify and hold the other Party harmless from any damages or expenses arising from its own negligent breach of this agreement, including any negligent breach committed by its legal representatives, subcontractors, employees, or other agents. Each Party also agrees to indemnify the other Party against any claims made by third parties due to or in connection with its own negligent violations.

11.2. The provisions of Article 82 of the GDPR remain unaffected.

12. Deletion and Return of Personal Data

12.1. The Processor shall not create copies or duplicates of the data without the knowledge and consent of the Controller, except for backup copies to the extent necessary to ensure proper data processing, and for data retention required by law.

12.2. Personal data of guests that the Controller deletes through the Platform during a Project are deleted at that time, subject to Article 12.5. When the processing services for a Project end, whether on its expiration under Section 4 of the Terms and Conditions, on its deletion by the Controller or on termination under Article 7.4, the Processor returns or deletes the personal data of that Project, at the Controller’s choice, within 30 days. Unless the Controller requests their return before that deadline, the data are deleted. This agreement continues to govern any remaining processing until return or deletion is complete.

12.3. After return or deletion, the Processor may retain information needed to demonstrate the proper and lawful execution of the processing activities only within the limits of Article 12.5.

12.4. The documentation referred to in point 12.3 must be retained by the Processor in compliance with applicable statutory retention periods or as otherwise required. The Processor may deliver such documentation to the Controller upon termination of the contract to discharge its contractual retention obligations.

12.5. After guests are deleted, or the personal data of a Project are returned or deleted under Article 12.2, the Processor deletes all remaining copies of the personal data concerned, including message content, guest replies and residual technical records, within 30 days. The only exceptions are: (a) delivery records that contain no message content, namely message identifiers, the recipient’s email address or phone number, timestamps, delivery status and changes to WhatsApp opt-in status, which the Processor keeps as controller of its own service records for up to 24 months, to demonstrate the performance of the Services and to handle complaints; (b) data whose retention is required by Union or Member State law, for the period so required; and (c) access and security audit records that contain no document or message content, namely document-access audit rows, public API audit events and authentication and security-rules logs, which the Processor keeps as controller of its own security records for up to 24 months, to investigate incidents and demonstrate compliance. WhatsApp conversations that are also linked to another active Project, because the guest wrote to the shared sending number, remain available to that other Project only. The Processor imposes the same deletion obligations on its sub‑processors.