Data Processing Agreement (DPA)

This English version is provided for convenience only. In case of any discrepancy, the Italian version shall prevail.

1. Parties and subject matter

This Data Processing Agreement (hereinafter, the “DPA”) governs the processing of personal data carried out in connection with the use of the IKIbrain platform.

The Agreement is entered into between:

• the Customer, identified by the data provided at registration or subscription to the service, acting as Controller;
• IKIweb Internet Media S.r.l., with registered office at Via Varzi 6, 21052 Busto Arsizio (VA), Italy, VAT no. IT02848390122, acting as Processor (hereinafter, “IKIweb”).

This DPA forms an integral part of the IKIbrain General Terms of Service.

2. Nature and purpose of the processing

IKIweb processes personal data solely on behalf of the Customer and to the extent necessary to provide, manage, maintain, secure and technically support the IKIbrain service, in accordance with the Customer’s documented instructions, including those set out in this Agreement and in the service configuration.

The essential features of the processing are described in Annex A.

IKIweb does not use the content of conversations or of the Knowledge Base for its own commercial purposes or to train its own artificial intelligence models.

The Customer independently determines the purposes and legal bases of the processing and is responsible for the lawfulness of the data and content processed through the service.

3. Processor obligations

IKIweb undertakes to:

• a) process personal data only on the basis of the Customer’s documented instructions, unless required to do so by law;
• b) ensure that persons authorised to process the data are bound by confidentiality obligations;
• c) implement technical and organisational measures appropriate to the risks, in accordance with Article 32 GDPR;
• d) assist the Customer, taking into account the nature of the processing and the information available, in complying with the obligations under Articles 32–36 GDPR;
• e) assist the Customer, through appropriate technical and organisational measures and insofar as possible, in handling data subject requests;
• f) notify the Customer without undue delay after becoming aware of a personal data breach affecting data processed on its behalf;
• g) make available the information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR.

Where IKIweb considers that an instruction from the Customer infringes applicable data protection law, it shall inform the Customer.

4. Customer obligations

The Customer, as Controller, is responsible for:

• a) determining the purposes and legal bases of the processing;
• b) preparing privacy notices and fulfilling its obligations towards data subjects;
• c) the lawfulness of the data and content entered into the platform;
• d) configuring and using the service in compliance with applicable law;
• e) handling data subject requests and any notifications to the competent authorities.

The standard service is not intended for the intentional processing of special categories of personal data referred to in Article 9 GDPR, unless otherwise agreed in writing.

The Customer undertakes not to configure or use the service to systematically collect such data without first agreeing the applicable conditions with IKIweb.

The spontaneous entry of such information by users does not constitute authorisation to use it for further purposes.

5. Sub-processors

The Customer grants IKIweb a general authorisation to engage sub-processors for the provision of the service.

IKIweb undertakes to impose on sub-processors data protection obligations substantially equivalent to those set out in this Agreement, as required by Article 28 GDPR.

IKIweb may change or replace sub-processors by notifying the Customer at least 15 days in advance and giving the Customer the opportunity to object on documented grounds relating to the protection of personal data.

In the event of an objection, IKIweb will assess possible alternative solutions. Where it is not reasonably possible to continue providing the service, the parties may terminate the contractual relationship in accordance with the applicable terms.

IKIweb remains liable to the Customer for the performance of the sub-processors’ obligations, as provided for by the GDPR.

The list of sub-processors is set out in Annex C.

6. International transfers

Where the processing involves transfers of personal data to countries outside the European Economic Area, IKIweb ensures compliance with the applicable provisions of Chapter V GDPR.

Such transfers may take place on the basis of adequacy decisions, standard contractual clauses or other instruments lawfully provided for by law.

7. Security of processing

IKIweb implements technical and organisational measures appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature of the processing and the characteristics of the service.

The measures may be updated or replaced over time, provided that an appropriate level of security is maintained pursuant to Article 32 GDPR.

The main categories of measures adopted are described in Annex B.

8. Retention, return and deletion

Personal data are retained for as long as necessary to provide the service, in accordance with the contractual terms and the applicable retention settings.

Where available, the Customer may configure shorter retention periods and request early deletion of the data.

Upon termination of the service, the Customer may export the data using the features available in the platform.

At the Customer’s choice, IKIweb will return or delete the personal data processed on its behalf, within the operational timeframes of the service, deleting existing copies unless retention is required by law.

Deletion from backup systems may take place according to their retention cycles, during which the data remain protected and are not used for ordinary purposes.

9. Assistance and data subject requests

IKIweb provides the Customer with the assistance reasonably necessary to fulfil its obligations under the GDPR, taking into account the nature of the processing and the information available to it.

Data subject requests received directly by IKIweb and relating to processing carried out on behalf of the Customer are forwarded to the Customer, unless otherwise required by law.

Any extraordinary activities not included in the ordinary features of the service may be subject to a separate financial agreement, without prejudice to the mandatory obligations provided for by law.

10. Audits and inspections

IKIweb makes available to the Customer the information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and allows for and contributes to the audits provided for by law.

The arrangements for audits are agreed in advance, taking into account the requirements of security, confidentiality and continuity of the service, as well as the rights of other customers.

The reasonable and documented costs of audits requested by the Customer are borne by the Customer, to the extent permitted by applicable law.

11. Term and amendments

This DPA enters into force upon acceptance of the IKIbrain General Terms of Service and remains in effect for the entire duration of the contractual relationship.

Provisions which by their nature are intended to survive termination of the service remain in effect until the related activities have been completed.

IKIweb may update this Agreement for regulatory, technical or organisational reasons, in compliance with applicable law.

Material changes are notified to the Customer by email at least 30 days in advance. If the Customer continues to use the service after that period, the changes are deemed accepted. If the Customer does not accept them, it may withdraw from the contract before they take effect, in accordance with the applicable contractual terms.

The mandatory obligations provided for by data protection law remain unaffected.

12. Final provisions

This DPA forms an integral part of the IKIbrain General Terms of Service and is deemed accepted upon acceptance of the latter, the date and version of which are recorded by the system.

In the event of conflict between this Agreement and other contractual provisions relating to the processing of personal data on behalf of the Customer, this DPA prevails.

This Agreement is governed by Italian law.

Contractual disputes fall under the jurisdiction of the courts of the place where IKIweb has its registered office, subject to mandatory legal limits.

Communications relating to this Agreement may be sent to help@ikiweb.it.

Annex A – Description of the processing

Subject matter: processing of personal data in connection with the provision of the IKIbrain platform.

Duration: for the entire duration of the contractual relationship and for the subsequent period necessary to return or delete the data.

Nature of the operations: collection, recording, organisation, storage, consultation, processing, transmission, retrieval and erasure.

Purposes: provision of the AI-based conversational assistance service, management of interactions, optional lead collection, analysis of conversations on behalf of the Customer, maintenance, technical support and security.

Categories of data subjects: visitors and users of the Customer’s websites or digital services, as well as other individuals whose data are lawfully processed through the platform.

Categories of personal data:

• Content of conversations.
• Identification and contact data, where provided.
• Technical data necessary for the operation and security of the service.
• Any personal data contained in content uploaded by the Customer.

Retention period: the Customer may set automatic deletion of conversations after 60, 90 or 180 days. If no setting is chosen, conversations are retained for the duration of the subscription.

Termination of the service: upon termination of the service, conversations, Knowledge Base content and uploaded files are automatically deleted within 90 days, unless the subscription is reactivated within that period and unless retention is required by law. The Customer may still request early deletion as provided for in the Agreement.

Backups: backup copies are retained for a maximum of 60 days and then automatically deleted.

Annex B – Technical and organisational measures

IKIweb implements security measures proportionate to the nature of the service and the risks of the processing, including:

• Protection of communications using secure transmission protocols.
• Authentication and access control systems.
• Availability of strong authentication tools.
• Logical separation of customer data.
• Backup and restore procedures.
• Measures to protect against unauthorised access and abuse.
• Security incident management procedures.
• Restriction of data access to authorised personnel.
• Data retention and deletion procedures.

The measures may be modified or updated over time, in compliance with the security requirements of the GDPR.

Annex C – Sub-processors

To provide the IKIbrain service, IKIweb relies on the following providers, to the extent that they process personal data on its behalf:

Any use of Google Fonts via direct connection to Google servers will be assessed for the purpose of updating this list.

The list may be updated in accordance with Article 5 of this Agreement.

Acceptance

This DPA forms an integral part of the IKIbrain General Terms of Service and is deemed accepted upon acceptance of the latter, the date and version of which are recorded by the system.