Data Processing Agreement

This Agreement is entered into between:

Provider: [Company name — to be completed], hereinafter referred to as Doconti;

and

Customer: the entity identified in the contracting process and holder of the subscription.

This Agreement forms an integral part of the platform's Terms and Conditions.

It applies where Doconti processes personal data on behalf of the Customer, acting as a processor.

Where the Customer itself acts as a processor for a company or another controller, it declares that it holds appropriate authorisation to engage Doconti's services as a sub-processor, pursuant to the GDPR.

2.1. The Agreement governs the processing of personal data carried out by Doconti on behalf of the Customer, within the scope of the contracted SaaS services.

2.2. Processing commences when the Customer provides personal data in the service or authorises its collection.

2.3. The Agreement remains in force for as long as Doconti processes personal data on behalf of the Customer, including the periods of return, erasure, and legally permitted residual retention.

The processing may comprise:

• Collection and receipt;
• Recording;
• Organisation;
• Structuring;
• Storage;
• Authorised consultation;
• Data extraction;
• Document classification;
• Search;
• Authorised transmission;
• Process automation;
• Retention;
• Export;
• Erasure;
• Artificial intelligence operations necessary for the contracted services.

The purpose is to provide the document management and processing services contracted by the Customer.

4.1. Categories of data subjects

Depending on the documents uploaded, data of the following may be processed:

• Employees and collaborators;
• Company representatives;
• Customers and suppliers;
• Service providers;
• Shareholders, partners, and directors;
• Accountants and professionals;
• Other natural persons identified in the documents.

4.2. Categories of data

May include:

• Identification and contact details;
• Tax identification numbers;
• Billing data;
• Financial and banking information;
• Remuneration and employment data;
• Contractual information;
• Tax and accounting documentation;
• Technical access data;
• Other categories legitimately provided by the Customer.

The processing of special categories of data is conditional upon the existence of an appropriate legal basis, necessity, and proportionate safeguards.

5.1. Doconti shall process personal data only on documented instructions from the Customer or a legally competent authority, unless required to do so by applicable law.

5.2. Documented instructions comprise these contractual documents, service configurations, legitimate operations performed by authorised users, and additional instructions validly communicated.

5.3. Doconti shall inform the Customer without undue delay if, in its opinion, an instruction infringes the GDPR or other applicable data protection provisions, unless legally prohibited from doing so.

5.4. Doconti may suspend the execution of the contested instruction to the extent necessary to prevent the infringement, whilst seeking clarification.

5.5. The Customer is responsible for the lawfulness of its instructions and for determining the purposes and legal bases, without prejudice to Doconti's own independent duties.

6.1. Doconti shall ensure that persons authorised to process personal data are subject to a statutory or contractual obligation of confidentiality.

6.2. Access to data shall be limited to what is necessary to provide the services, deliver authorised assistance, ensure security, or comply with legal obligations.

6.3. Doconti shall maintain proportionate controls over administrative and privileged access.

7.1. Doconti shall implement technical and organisational measures appropriate to the risks presented by the processing, pursuant to Article 32 of the GDPR.

7.2. The measures may include, as appropriate, encryption, access control, logical segregation, vulnerability management, audit logs, recovery mechanisms, business continuity, and regular testing.

7.3. The operational description of the measures actually implemented shall be set out in the applicable security documentation.

7.4. The measures may evolve during the term of the contract, provided that the required overall level of protection is not unjustifiably reduced.

8.1. The Customer grants general authorisation for the use of the sub-processors identified in the list published at [Sub-processor list address — to be completed].

8.2. Doconti shall inform the Customer of the addition or replacement of sub-processors with reasonable notice, as a rule of 15 days, allowing for reasoned objections on data protection grounds.

8.3. Any objection shall be communicated in writing and substantiated by concrete risks.

8.4. Doconti shall endeavour to assess proportionate alternative measures. If an appropriate solution is not possible, the parties may terminate the affected services without early termination penalties in respect of those services.

8.5. Doconti shall contractually impose on sub-processors data protection obligations substantially equivalent to those required by law.

8.6. Doconti remains fully liable to the Customer for the performance of the sub-processors' obligations, pursuant to Article 28(4) of the GDPR.

9.1. Doconti shall not carry out international transfers of personal data in breach of Chapter V of the GDPR.

9.2. Wherever applicable, legally recognised mechanisms shall be used, including adequacy decisions or standard contractual clauses.

9.3. Supplementary measures shall be adopted where required by the legal and technical assessment of the transfer.

9.4. Doconti shall make available appropriate information regarding sub-processors, destinations, and applicable safeguards, within legitimate confidentiality limits.

10.1. Taking into account the nature of the processing and the information available, Doconti shall assist the Customer in fulfilling the applicable obligations laid down in the GDPR.

10.2. This assistance shall include, to the extent possible, support regarding:

• a) Requests to exercise data subject rights;
• b) Security of processing;
• c) Assessment and notification of data breaches;
• d) Data protection impact assessments;
• e) Prior consultation with the supervisory authority, where required;
• f) Compliance documentation.

10.3. Ordinary assistance shall be provided through the mechanisms available on the platform and applicable support procedures.

10.4. Extraordinary work specifically requested may be subject to reasonable, pre-agreed costs, without prejudice to non-derogable legal obligations.

11.1. Doconti shall notify the Customer without undue delay upon becoming aware of a personal data breach affecting processing carried out on its behalf.

11.2. The notification shall contain, to the extent of available information, details concerning the nature of the incident, likely consequences, affected data, and measures taken or proposed.

11.3. Additional information may be provided in phases.

11.4. Where the Customer is the controller, it shall be responsible for assessing notifications to the supervisory authority and to data subjects, with due assistance from Doconti.

11.5. Doconti shall document personal data breaches concerning it in accordance with applicable statutory terms.

12.1. Doconti shall communicate to the Customer any requests received that relate to processing carried out exclusively on its behalf, unless otherwise required by law.

12.2. It shall not respond independently on the merits of such requests without appropriate instructions, except where legally required to do so.

12.3. Doconti shall make available proportionate mechanisms for locating, accessing, rectifying, exporting, and erasing data, according to the nature of the services.

13.1. Doconti shall make available to the Customer the information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR.

13.2. It shall allow for and contribute to legally required audits and inspections conducted by the Customer or an auditor mandated by it.

13.3. To safeguard the security and confidentiality of third parties, audits may be organised through documentation, reports, technical evidence, and controlled access procedures, without prejudice to statutory audit rights.

13.4. Audits must avoid unnecessary disruption and respect confidentiality obligations.

13.5. Extraordinary and proportionate costs associated with additional procedures requested by the Customer may be agreed in advance, without rendering statutory audit rights unworkable.

14.1. Following the end of the provision of services, the Customer may choose the return or erasure of personal data processed on its behalf, pursuant to Article 28(3)(g) of the GDPR.

14.2. In the absence of different, valid instructions, Doconti shall provide a standard period of 30 days for export, after which it shall proceed with the erasure of data subject to deletion.

14.3. The erasure of existing copies shall be carried out in accordance with applicable technical procedures, save for data whose retention is required by law.

14.4. Residual backup copies may not be reused for ordinary operational purposes and shall be erased in accordance with the documented retention cycle: [Period to be confirmed — to be completed].

14.5. Doconti may issue confirmation of erasure upon reasonable request, based on available evidence.

14.6. Data retained pursuant to a legal obligation shall remain subject to the applicable purpose limitation, confidentiality, and security requirements.

15.1. The Customer retains the responsibilities and liabilities legally attributed to it as controller or principal processor.

15.2. Doconti is responsible for complying with the obligations directly attributed to it by the GDPR as a processor and with any other contractually assumed obligations.

15.3. No provision shall transfer in full to one party the statutory liability proper to the other.

15.4. Liability for damages arising from infringements of the GDPR is governed, in particular, by Article 82 of the Regulation, and may not be excluded to the detriment of data subjects.

In the event of a conflict between this Agreement and general clauses of the Terms and Conditions, this Agreement shall prevail on specific matters of personal data protection, without prejudice to mandatory statutory provisions.

The Agreement enters into force upon acceptance of the Terms and applies throughout the duration of the personal data processing carried out on behalf of the Customer.

Material amendments shall be communicated in accordance with applicable contractual procedures, without diminishing statutory rights.

Data protection contact: [Privacy e-mail — to be completed]

Entity: [Company name — to be completed]