Data Processing Agreement

1. Parties, roles and application

This agreement supplements the Terms of Service between the customer identified in the account or order and Netter S.r.l., Via Indipendenza, 06081 Assisi (PG), Italy, VAT no. IT03569900545, contact info@netter.io. It applies when the customer entrusts personal data to Netter for its own purposes through enabled service features.

The customer acts as controller or as a processor authorised by its controller to engage Netter. Netter acts as processor or subprocessor within the assignment. For its own account, security and accounting processing, Netter instead acts under the privacy notice. Acceptance of the contract referring to this agreement documents its inclusion in the relationship; any specific instructions are retained in writing.

2. Description of processing

3. Customer instructions and obligations

Enabled features, submitted requests and agreed orders constitute documented instructions within the contract's scope. The customer determines purposes, legal basis, notices to data subjects and lawfulness of disclosure. It ensures it is entitled to give instructions and use any data received from other controllers.

The customer chooses content proportionate to its purposes and assesses AI and PII filter limitations. It does not use the standard service for data or operations requiring safeguards not agreed. Netter informs the customer if it believes an instruction infringes applicable law and requests clarification before continuing the relevant processing, subject to legal obligations.

4. Netter's obligations

Netter processes data solely for the customer's documented purposes and instructions, unless required by law; in that case it informs the customer before processing, where permitted. Authorised persons are bound by confidentiality and receive access limited to assigned activities.

Netter adopts technical and organisational measures appropriate to risk, taking account of the processing's nature. Measures include communications protection, access controls, logical separation of company scopes, encryption of stored content and PII maps, credential protection, abuse controls and incident management. The PII filter does not replace other data protection obligations.

Ordinary processing does not include training Netter's own models with entrusted content. Information received from the customer is not used for purposes incompatible with the assignment.

5. Subprocessors and locations

The customer generally authorises subprocessors necessary for the described service categories, with Netter required to identify them and communicate their function and location. Before introducing a new subprocessor or a material replacement, Netter informs the customer with an ordinary notice period of 15 days so it may raise reasoned data protection objections. In case of objection, the parties seek a solution before the relevant processing.

Netter imposes relevant data protection obligations on subprocessors equivalent to those of the assignment and remains responsible to the customer under Article 28 GDPR. Authorisation does not permit indiscriminate forwarding to any model or supplier.

6. International transfers

Netter does not make transfers subject to Chapter V GDPR on the customer's behalf without required instructions and conditions. When a supplier or access method entails transfer to third countries, the recipient, locations and applicable mechanism are identified, such as an adequacy decision or standard contractual clauses with necessary assessments and supplementary measures.

This agreement alone is not a standard clause for international transfers and does not replace assessment of each supplier. Relevant information must be available to the customer before the processing concerned.

7. Assistance, rights and incidents

Taking account of the processing's nature and available information, Netter assists the customer with data subject rights, security, impact assessments and any necessary consultations. Requests received directly concerning customer data are forwarded to or coordinated with the customer, subject to independent legal obligations.

Netter notifies the customer without undue delay of personal data breaches affecting entrusted data of which it becomes aware. It provides available information about the event's nature, affected data and people, possible effects, measures taken and a contact, with further updates when needed. The customer retains its responsibilities for notifying authorities and data subjects.

8. Audits and documentation

Netter provides information necessary to demonstrate compliance with assignment obligations and allows audits under Article 28 GDPR, including inspections by the customer or its appointed party. Procedures and timing are agreed proportionately to risk, protecting confidentiality, security and other customers' data without preventing exercise of statutory audit rights.

Requests for activities beyond the service may be arranged through a specific assignment; this does not limit mandatory duties of cooperation, communication and assistance.

9. Return, deletion and precedence

At the end of processing, at the customer's choice and instruction, Netter returns or deletes entrusted data and copies, except retention required by law. Available export and deletion functions provide an operational channel; for further needs, the customer writes to info@netter.io. Ordinary content expiry remains described in the privacy notice.

Any backups must follow defined cycles, remain separate from ordinary use and respect deletion instructions even upon restoration. Activating backups not already present requires definition of their procedures. Data Netter retains for its own obligations remains limited to those purposes.

In case of conflict concerning instructions and protection obligations for entrusted data, this agreement prevails over general terms, subject to mandatory rules and any valid specific agreements.