Data processing agreement

This agreement (DPA) supplements the license and service terms (the Terms) and any Order between the customer (the Customer, controller) and [RAGIONE SOCIALE], with registered office at [SEDE LEGALE], VAT number [P.IVA] (the Provider, processor), and governs the processing of personal data carried out by the Provider on behalf of the Customer in providing the Prynt service (the Service), under article 28 of Regulation (EU) 2016/679 (GDPR).

1. Definitions

The terms "personal data", "processing", "controller", "processor", "sub-processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given in article 4 GDPR. Customer Personal Data means the personal data contained in the Customer Data defined in the Terms and processed by the Provider on behalf of the Customer.

2. Subject matter, duration, nature and purpose

2.1 The Provider processes Customer Personal Data solely to provide the Service in accordance with the Terms, the Order and the documentation, as described in Annex 1.

2.2 The DPA has the same duration as the agreement and, after it ends, remains in force for as long as the Provider holds Customer Personal Data.

2.3 The Customer warrants that it has a valid legal basis for the processing entrusted to the Provider, that it has given data subjects the necessary information and that its instructions comply with the law.

3. Customer instructions

3.1 The Provider processes Customer Personal Data only on documented instructions from the Customer, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in that case it informs the Customer before processing, unless the law prohibits it.

3.2 The following constitute documented instructions: the Terms, the Order, the DPA and the configurations and actions that the Customer and its users perform in the Service (for example defining data sources and queries, publishing templates, generating documents, configuring webhooks, exporting or deleting data, using the AI assistant). Further instructions must be agreed in writing.

3.4 AI assistant with the Customer's key. The Designer's AI assistant works only if a user of the Customer enters their own OpenAI API key. In that case, on the Customer's instruction, the Provider transmits to OpenAI, with that key, the user's requests, the structure of the template, the names of tables and columns and, only if the user allows it, a limited number of sample rows. OpenAI processes this data under the contractual relationship between the Customer (or its user) and OpenAI: it is not a sub-processor of the Provider, and the Customer, as controller, assesses and governs that processing, including any transfers outside the EEA. The Provider does not store the content of requests and answers; owners and administrators can turn the feature off for the organization.

3.3 The Provider immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

4. Confidentiality of personnel

The Provider ensures that persons authorized to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, receive appropriate instructions and access data only to the extent necessary for their tasks. Through the administration console, platform operators have no access to the Customer's content or secrets (see Annex 2).

5. Security of processing

5.1 The Provider implements the technical and organizational measures described in Annex 2, appropriate to the risk under article 32 GDPR.

5.2 The Provider may update the measures in line with technical developments, provided that the overall level of security is not reduced.

5.3 The Customer is responsible for the measures within its control, including: managing users and roles, two-factor authentication, confidentiality of API keys and credentials, database users with only the read privileges needed, security of the servers on which it installs Prynt Gateway, choosing which parameters are recorded in run logs.

6. Sub-processors

6.1 The Customer gives the Provider general authorization to engage sub-processors. The sub-processors in use at the date of the DPA are listed in Annex 3 and in the list of sub-processors published on www.prynt.it.

6.2 The Provider informs the Customer, by email to the organization's owners and by updating the list, of any addition or replacement of sub-processors at least [30] days in advance. Within that period the Customer may object on reasonable data protection grounds; if the parties do not find a solution, the Customer may withdraw without penalty from the affected part of the Service, with a refund of fees paid and not used.

6.3 The Provider imposes on each sub-processor, by written contract, data protection obligations substantially equivalent to those of the DPA and remains liable to the Customer for the sub-processors' performance.

7. Transfers outside the EEA

7.1 The Service is hosted in the European Union. The Provider does not transfer Customer Personal Data outside the European Economic Area, except as stated in Annex 3 or notified under article 6, and except for transmissions to providers chosen by the Customer on its instruction (article 3.4).

7.2 Any transfer will comply with Chapter V GDPR, on the basis of an adequacy decision or of the standard contractual clauses adopted by the European Commission, with any supplementary measures needed.

8. Assistance to the Customer

8.1 Taking into account the nature of the processing, the Provider assists the Customer with appropriate technical and organizational measures in responding to data subject requests. The Service provides self-service tools: export of the organization's data (ZIP archive), export of each user's personal data, deletion of the account and of the organization. If a data subject contacts the Provider directly about data for which the Customer is controller, the Provider forwards the request to the Customer without delay and does not respond on the merits without instructions.

8.2 The Provider assists the Customer, within the limits of the information available to it, with the obligations under articles 32-36 GDPR (security, breach notification, data protection impact assessments and prior consultation). Assistance beyond what is reasonable or caused by special instructions of the Customer may be charged as agreed.

9. Personal data breaches

9.1 The Provider notifies the Customer of any personal data breach affecting Customer Personal Data without undue delay and in any case within [48] hours of becoming aware of it, at the email address of the organization's owners and at [EMAIL REFERENTE PRIVACY CLIENTE] if provided.

9.2 The notification contains, as far as available: the nature of the breach, the categories and approximate number of data subjects and records concerned, the Provider's contact point, the likely consequences, the measures taken or proposed to address the breach and mitigate its effects. Information not immediately available is provided in phases.

9.3 The Provider takes reasonable steps without delay to contain the breach and cooperates with the Customer. Notification to the supervisory authority and communication to data subjects remain the Customer's responsibility as controller, unless otherwise agreed.

10. Deletion and return of data

10.1 During the agreement the Customer can export its data from the Service at any time. When the agreement ends, article 14 of the Terms applies: a [30]-day read-only export window, then deletion of the organization with a 30-day restore period followed by automatic permanent erasure of all the organization's data, including the organization's secrets and encryption keys.

10.2 Encrypted backup copies are deleted when they expire, at the latest within [12] months of erasure; until then they remain protected by the measures in Annex 2 and are not processed except for disaster recovery (in which case data already erased is erased again).

10.3 On written request the Provider confirms the erasure in writing. Retention required by law remains unaffected.

11. Information and audits

11.1 The Provider makes available to the Customer the information necessary to demonstrate compliance with article 28 GDPR, including through the technical documentation and this DPA, and answers reasonable security questionnaires.

11.2 The Customer may carry out, at its own expense, an audit, also through an independent auditor bound by confidentiality, with at least [30] days' written notice, no more than once a year unless there is a confirmed breach or a request from an authority, during normal business hours and without compromising the security or confidentiality of other customers' data. The Provider currently holds no third-party certifications.

12. Records and liability

12.1 The Provider keeps a record of processing activities carried out on behalf of controllers under article 30(2) GDPR.

12.2 The parties' liability for breaches of the DPA is governed by article 82 GDPR and, to the extent permitted, by the limitations in the Terms.

13. Precedence

In case of conflict between the DPA and the Terms, the DPA prevails as regards the protection of personal data.

Annex 1 — Description of the processing

How data from the Customer's databases is processed. The Service reads data from the Customer's databases read-only and only at preview or generation time, running the queries defined in the Designer, through Prynt Gateway installed by the Customer (outbound-only connections from the Customer's network) or through an encrypted direct connection. The rows read are used in memory to compose the document and are not stored by the Service as such; they remain in the generated document.

Retention in the Service (current configuration values, which may only be made stricter without notice):

Annex 2 — Technical and organizational measures

Before signing, the Provider verifies that each measure is actually active in the production environment.

Infrastructure and network

• Service hosted on a virtual private server at [FORNITORE HOSTING], in a data center in the European Union ([PAESE DATA CENTER]); components run in Docker containers.
• A single entry point: reverse proxy on ports 80/443; no internal service port exposed; the PostgreSQL database is reachable only from the containers' internal network.
• Firewall with only ports 22 (SSH, key-only access), 80 and 443 open; reverse proxy admin panel not exposed to the Internet; automatic operating system security updates and protection against repeated SSH sign-in attempts.
• Containers run as unprivileged users, without additional capabilities and with no-new-privileges.

Encryption

• All traffic to the website, the application and the API uses HTTPS with TLS certificates, mandatory redirect from HTTP and HSTS.
• Credentials of the Customer's databases (direct connections) and webhook secrets encrypted with AES-256-GCM and envelope encryption: one data key per organization, itself encrypted with a master key kept outside the database. Credentials are write-only: they are never returned to the interface or the APIs.
• With Prynt Gateway, credentials are encrypted in the browser with the Gateway's public key (ECIES: ECDH P-256, HKDF, AES-256-GCM): the Provider stores only a blob it cannot decrypt; alternatively credentials are configured only on the Gateway and never pass through the Service.
• Off-site backups encrypted with age (public-key cryptography) before leaving the server; the private key is not kept on the server.

Access to the Customer's databases

• Always read-only access: READ ONLY transactions, query validation per dialect, timeouts and row and size limits; the public API accepts no SQL, only the template code and parameters.
• Prynt Gateway opens only outbound connections (WebSocket over TLS); it authenticates with a key pair generated on the Customer's server; every request from the Service is signed, short-lived and protected against replay; the Gateway repeats the read-only check and applies its own limits; immediate revocation from the Service.
• Direct connections: TLS with certificate verification required in production, protection against SSRF (rejection of private networks, loopback and the platform's network, with re-checking of DNS resolution).
• The Service shows the script to create a read-only database user and warns if the configured user has write or administrative privileges.

Access control and isolation

• Roles per organization and workspace (Owner, Admin, Developer, Designer, Viewer) with least-privilege permissions per function.
• Data isolation per workspace also in the database through PostgreSQL Row-Level Security; the application does not connect with users able to bypass it.
• Passwords stored with PBKDF2-HMAC-SHA512 (100,000 iterations, per-user salt); temporary lockout after failed attempts; rate limits per IP and email on sign-in, registration and recovery.
• Two-factor authentication (TOTP) with recovery codes; the organization can make it mandatory for its members.
• Server-side sessions with a random token in an HttpOnly, Secure, SameSite cookie; only its hash in the database; idle and absolute expiry; session revocation; CSRF protection.
• Workspace API keys with scopes, test/production mode, optional expiry and immediate revocation; only the SHA-256 hash in the database.
• License keys, invitation, verification and reset tokens stored only as hashes.

Platform administration console

• Separate application on a dedicated host, reachable only from authorized IP addresses, with mandatory two-factor authentication re-checked on every request, sessions of 30 minutes of inactivity (8 hours at most) and a fresh code for dangerous actions (suspending or deleting organizations, exports, changes to licenses and roles).
• No user impersonation; operators see metadata (organizations, users, usage, technical status) but never secrets, credentials, key hashes or the content of single-use links.
• Every operator action is recorded in the audit log with author, IP, previous and new values.

Logging and monitoring

• Append-only audit log of relevant operations and log of data access by queries (user or key, data source, duration, rows, outcome: never the values).
• Structured application logs with a correlation identifier, without unnecessary personal data (masked emails, report parameters logged only if the Customer chooses so).
• Automatic checks every 5 minutes of services, endpoints, certificates, disk space and backup freshness, with alerts to operators.

Availability and recovery

• Daily backup of the database and files (assets and documents), backup at every release, encrypted copies kept at external storage ([FORNITORE BACKUP]) with retention of 14 daily / 8 weekly / 12 monthly copies.
• Periodic verification of backups by restoring into an isolated temporary database and full restore tests; documented disaster recovery procedure.

Data protection by design

• Self-service export of the organization's data and of users' personal data; account deletion with anonymization of audit entries; organization deletion with a restore period and automatic permanent erasure, including the organization's encryption keys.
• Minimal retention of generated documents and automatic erasure of expired data.
• Security headers (restrictive Content Security Policy, HSTS), no third-party tools in the pages.

Organizational measures

• Access to production systems limited to authorized staff, with personal SSH keys; production secrets kept in a password manager.
• Incident and data breach management procedure; documented procedures for data subject requests.
• [ALTRE MISURE ORGANIZZATIVE: staff training, confidentiality agreements, internal policies].

Annex 3 — Authorized sub-processors

See the list of sub-processors, which forms an integral part of the DPA in the version in force on the date of signature.