Appointment of the Personal Data Processor

Last modified: June 5, 2025

Hereby, the User, in the capacity of Data Controller (hereinafter referred to as the “Controller”), in order to comply with the provisions of European Regulation 2016/679 and its subsequent amendments and additions, appoints Webidoo S.p.A., with registered office in Milan, Via Gioberti 8, VAT no. 10076860963, as Data Processor (hereinafter referred to as the “Processor”), pursuant to and for the purposes of Article 28 of EU Regulation 679/2016, within the scope of the personal data processing acti…

Therefore, the Processor is entrusted with the task of carrying out personal data processing operations on behalf of the Controller, in accordance with the requirements set forth by:

• EU Regulation 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (hereinafter GDPR);
• General provisions of the Italian Data Protection Authority (hereinafter Privacy Authority);

The Controller, through this document, provides appropriate instructions for carrying out the processing operations entrusted to the Processor in compliance with the applicable privacy regulations and, pursuant to Article 28.3 of the GDPR, shall monitor the proper fulfillment of obligations as well as of the instructions given.

In carrying out the assignment, the Processor shall:

1. process personal data solely for the purpose of performing the contract and, subsequently, only in accordance with what may be agreed upon in writing by the Parties, and shall therefore act exclusively on the basis of documented instructions provided by the Controller. In particular, the Processor shall not exercise any control over the personal data and shall not transfer such data to third parties, unless such transfer is e…

1. not retain or use personal data for purposes other than those specified and necessary to provide the services agreed upon in the contract;
2. not retain personal data for its own purposes;
3. before starting any processing and, if necessary, at any other time, inform the Controller if, in its opinion, (i) any instruction given by the Controller violates the law, and (ii) the Processor is subject to legal provisions that may render it wholly or partly impossible or unlawful to act in accordance with the instructions given by the Controller or as required by applicable law;
4. in order to ensure compliance with the Controller’s instructions, make use of adequate processes and any other technical measures suitable to implement the instructions provided by the Controller, including (i) procedures suitable to ensure respect for the rights and requests made to the Controller by data subjects regarding their personal data, (ii) the adoption of suitable interfaces or support systems enabling informat…
5. comply with applicable law and fulfill the obligations set forth in this appointment in such a way as to prevent the Controller from incurring a violation of any obligation established by the same applicable law;
6. Request prior authorization from the Controller for the provision of new services involving the processing of personal data covered by this agreement, not previously regulated by contract or legal act.

CHARACTERISTICS OF THE PERSONAL DATA SUBJECT TO PROCESSING

The Data Controller defines, in compliance with Article 28 of the GDPR, the following identifying elements of the data processing entrusted to the Processor

PROCESSOR’S PERSONNEL

1. Design the individuals authorized to process data, providing them with written assignment to carry out such operations and ensuring that, in compliance with Article 29 of the GDPR, they receive privacy training concerning the methods of processing the data they have access to;
2. Also pursuant to Article 29 of the GDPR, supervise the activity of the authorized personnel, ensuring that they receive and follow appropriate operational instructions and that they fully safeguard the confidentiality and security of the personal data processed.

SUB-PROCESSOR

1. Request written authorization from the Controller in the event of appointing third parties as “External Data Processors” either directly by Webidoo or by the Processor, if signing authority has been granted, pursuant to Article 28 of the GDPR;
2. Supervise the activities possibly entrusted to further Processors, as provided by Article 28 of the GDPR, ensuring that the processing complies with the Regulation requirements and the provisions contained in this appointment letter and the Operational Instructions.

RECORD OF PROCESSING ACTIVITIES

1. Prepare and keep up to date a record of all categories of processing activities carried out on behalf of the Controller, pursuant to Article 30(2) of the GDPR; furthermore, the Processor agrees to promptly provide a copy upon request from the Controller and/or competent authorities;
2. Provide the Controller with all information regarding the processing of Personal Data necessary for the Controller to maintain their own record of processing activities, pursuant to Article 30(1) of the GDPR.

IMPACT ASSESSMENT (DATA PROTECTION IMPACT ASSESSMENT)

1. Promptly provide the Controller with all information necessary to carry out any data protection impact assessment activities pursuant to Article 35 of the GDPR (i.e., Data Protection Impact Assessment).

SECURITY AND INCIDENT MANAGEMENT

1. Ensure that processing is carried out in accordance with the technical, IT, organizational, logistical and procedural security measures prepared and deemed appropriate by the Controller, as referred to in Article 32 of the GDPR and specified in the Operational Instructions;
2. Promptly, and in any case within 24 hours of the discovery of a security incident, inform the Controller, in accordance with Article 33 of the GDPR, of any event that may constitute, even accidentally, a breach of the security of personal data, such as destruction, loss, alteration, unauthorized disclosure or access to personal data transmitted, stored or otherwise processed, providing the Controller with all available informat…
3. The Processor shall act immediately to investigate the personal data breach and identify, prevent and mitigate the adverse effects of such breach, in accordance with its obligations under this clause and, with prior agreement from the Controller, to take any necessary action to remedy the breach. The Processor shall not release or publish any press release, notice or report concerning the personal data breach without the prior w…

REQUESTS FROM DATA SUBJECTS AND AUTHORITIES

1. Promptly provide the Data Controller, and in any case within 24 hours of receipt, with all information necessary to comply with the data subject’s request, pursuant to Articles 15, 16, 17, 18, 20 and 21 of the GDPR, i.e. access, rectification, erasure, restriction, portability, objection to processing.
2. Immediately inform the Controller, and in any case within 24 hours of receipt, of any request, order or inspection activity by the Data Protection Authority or Judicial Authority.

AUDIT

1. Ensure that the Controller has access to the Processor’s premises and those of any Sub-Processors, to computers and other information systems, records, documents and all that may reasonably be required to verify that the Processor and/or its subcontractors comply with the obligations outlined in this Appointment (or in any Sub-processing agreement), provided that such audits do not involve the review of all third-party data …

POSSIBLE PROCESSING OF PERSONAL DATA OUTSIDE THE EUROPEAN ECONOMIC AREA

1. Where personal data is processed by the Processor or – except as provided in Article 7 – by a company of the Processor’s Group or by other Sub-Processors, outside the European Economic Area or in a territory that does not guarantee an adequate level of data protection recognized by the European Commission, the transfer shall be governed by the Standard Contractual Clauses defined by the European Commission, which shall regu…
2. Any processing carried out outside the territory of the European Union by one of the above-mentioned parties must be communicated to the Controller in advance.

ERASURE OF PERSONAL DATA

1. The Processor shall delete personal data processed for the execution of the contractual services at the end of the retention period indicated by the Controller and in any circumstance in which such deletion is requested by the Controller, including when it must occur due to the exercise of the relevant right by the Data Subject.
2. Upon termination of this Appointment, for any reason whatsoever, the personal data must, at the discretion of the Controller, be destroyed or returned to the Controller, together with any physical media or documents containing personal data owned by the Controller.

JOINT LIABILITY

1. Be jointly liable for any damage caused by data processing, pursuant to Article 82 of the GDPR, in case of failure to comply with the GDPR and/or the Operational Instructions provided (i.e., the principle of Liability).

If, for any reason, the underlying legal relationship between the Processor and the Data Controller ceases or becomes ineffective, this appointment shall also automatically lapse without the need for further communication or revocation.

The Processor acknowledges that failure to diligently and correctly execute the above indications and attached Operational Instructions may serve as an assessment criterion for their performance and may entail liability toward both the Controller and the Data Subjects, pursuant to and for the purposes of applicable law.

Operational Instructions

Operational Instructions for the processing of personal data addressed to Data Processors under Article 28 of Regulation (EU) 679/2016

INDEX

1) DEFINITIONS

1.1) Personal data

1.2) Personal data processing

1.3) Entities involved in the processing

2) ADEQUATE SECURITY MEASURES

2.1) Rules of ordinary diligence

2.2) Access to data from the workstation

2.3) Management of system access passwords

2.4) Use and safekeeping of authentication tools

2.5) Use of antivirus and other precautions

2.6) Data storage media

2.7) Paper-based archives

2.8) Means of transmission and reproduction of documents

3) SUITABLE SECURITY MEASURES

3.1) Processing of personal data related to specific types of Authorized Persons – System Administrators

3.3) Personal data breaches of Data Subjects

3.4) Communications to the Controller

3.5) Processing of personal data with the help of third parties

3.6) Fulfillment of Data Subjects’ rights requests

1) DEFINITIONS

1.1) Personal data

Personal data means any information relating to an identified or identifiable natural person (referred to as the Data Subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

1.2) Personal data processing

The processing of personal data consists of any operation or set of operations performed with or without the aid of an electronic device or any other automated process, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of the data.

1.3) Entities involved in the processing

Italian and European regulations identify the roles that, at various levels of responsibility, must ensure the proper management of personal data:

• The Controller, the entity responsible for decisions regarding the purposes and methods of personal data processing, including the aspect of data security;
• The Data Protection Officer, the internal or external individual tasked with promoting and coordinating all necessary activities to ensure full compliance with privacy and data protection regulations;
• The Processor, the natural or legal person who processes personal data on behalf of the Controller, based on a specific appointment;
• The person authorized to process the data, who performs personal data processing operations in accordance with the instructions given by the Controller and/or Processor;
• The Data Subject, the natural person to whom the personal data refers.

Furthermore, with the Decision of November 27, 2008, the Data Protection Authority also identified System Administrators, typically in the IT field, as professionals responsible for managing and maintaining “data processing systems or their components,” including database administrators, network and security infrastructure administrators, and administrators of complex software systems (applications).
2) ADEQUATE SECURITY MEASURES

Below are the security measures that the Processor must comply with and enforce among all individuals authorized to process personal data within its organization, in order to comply with applicable regulations and minimize the risks of destruction or loss, including accidental loss, of such data, as well as unauthorized access or processing not permitted or not aligned with the purposes of collection (Art. 32 of the GDPR).

2.1) Rules of ordinary diligence

In performing processing operations, it is necessary to adhere to and enforce certain rules of ordinary diligence to prevent unauthorized persons from gaining access to personal data being processed, thereby compromising its confidentiality, integrity, and availability.

The Processor must therefore ensure that, within the scope of activities carried out on behalf of the Controller, particular attention is paid to not disclosing personal data of Data Subjects to unauthorized third parties, nor sharing or communicating such data in any form to individuals who do not require it to perform their job duties (the risk of disclosure increases, for example, when making personal copies of the data being processed).

In addition to these general rules, for the same purposes, it is also required that, if workstations are temporarily left unattended (for more than 15 minutes), any paper documentation containing personal data must be collected so that it is not left available to individuals who may pass nearby. Files containing personal data must be closed and workstations or consoles providing access to personal data must be locked.

2.2) Access to data from the workstation

All persons authorized to process data within the Processor’s organization who access personal data stored and/or processed through electronic and IT systems are required, where applicable, to use user IDs and passwords.

When leaving the workstation, users should close active applications or access and administrative tools for operating systems, databases, and applications, or lock the workstation and, in any case, set up a password-protected screen lock that activates automatically after a few minutes of inactivity.

2.3) Password management for system access

Authorized personnel within the Processor’s organization must observe the following rules: change the password upon first login after assignment, regardless of the access location; ensure that passwords are at least 8 characters long and meet established criteria (e.g., use of special characters, uppercase and lowercase letters, etc.); avoid using easily guessable information such as their own or relatives’ names, birthdates, tax codes, and avoid automatic login processes. If no expiry is set by th…
Passwords must be kept confidential and not shared with third parties; avoid writing them on paper, agendas, or sticky notes, and always use a different password from the ones used in the past 6 months. Passwords used in the workplace must not match those used for personal internet services/sites.

If a password is compromised (e.g., accidentally lost, shared with third parties for work reasons, etc.), it must be changed immediately.

2.4) Use and safekeeping of authentication tools

In some cases, individuals may be provided with additional authentication tools to access workstations or systems/applications (e.g., smart cards, one-time password generators, or biometric tools).

These tools provide personal authentication credentials and, as such, must be carefully stored: they must not be handed over to others, left unattended, or have their characteristics, IDs, serial numbers, one-time passwords, or any identifying information disclosed.

When logging in to a system or workstation with their own credentials, users must ensure that no one else — even if authorized to process data — performs operations using those credentials.

2.5) Use of antivirus software and other precautions

The External Processor is required to implement all necessary measures to minimize the damage caused by computer viruses.

Authorized personnel must ensure that antivirus software is always active while the client workstation is connected to the company LAN, and allow the software to perform updates and scans, without disabling it.

When using removable media (CD/DVD, USB drives, external disks, flash memory), it is always advisable to scan them with the antivirus software before executing any contained files, unless automatic scanning is enabled.

Additional precautions regarding email usage include: avoid responding to emails that request read confirmations (unless from known accounts) or ask to unsubscribe from mailing lists; promptly report spam or unsolicited commercial, sexual, or financial messages to the designated technical unit; avoid participating in or forwarding chain emails (e.g., so-called “chain letters”).

2.6) Data storage media

When removable media is used for temporary storage of personal data (e.g., for copying or transferring information), precautions must be taken to protect data confidentiality.

Such media should be used only after previously stored data has been deleted, and care should be taken not to leave them unattended. To further minimize the risk of disclosure, it is recommended to encrypt data stored on such media and share the encryption password only with the intended recipient.

2.7) Paper-based archives

The External Processor must ensure that all personal data stored on paper is kept in closed archives or preferably in lockable storage units (e.g., filing cabinets, lockers), where documents must be placed after processing operations are completed.

2.8) Means of document transmission and reproduction

For data processing involving printers and photocopiers, documents containing personal data must not be left unattended near these devices. Users must ensure that no originals or copies are left in the machine. In case of poor print quality, printed documents should be destroyed and not reused as scrap paper.

3) SUITABLE SECURITY MEASURES

Below are the suitable measures prescribed by the Data Protection Authority, current legislation and/or directly required by the Data Controller, which the External Processor must comply with when processing data to which these measures apply (Art. 32 of the GDPR).

3.1) Processing of personal data by specific categories of Authorized Persons – System Administrators

All individuals involved in the designation and monitoring of authorized personnel within the Processor’s organization, assigned with System Administrator roles, must comply with the provisions of the Data Protection Authority’s decision dated November 27, 2008 (“Measures and precautions required for data controllers using electronic systems concerning the appointment of system administrators”), as described below.
3.2) Personal Data Breach of Data Subjects

In the context of personal data processing carried out on behalf of the Controller, the Processor and individuals authorized by the Processor may become directly responsible for, or become aware of, a personal data breach, which constitutes a data breach. A data breach is defined as any “security breach that results in, even accidentally, the destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored, or otherwise processed in the context of providing a publicly accessible communication service.”

Therefore, all External Processors must prevent such breaches by identifying and implementing technical and organizational measures appropriate to the existing risk, in order to safeguard the personal data of the Data Subjects.

In the event a breach occurs, pursuant to Article 33 of the GDPR, the External Processor must promptly notify the Controller, no later than 24 hours after detection of the security incident, and must provide any additional information that may be requested.

3.3) Communications to the Controller

The Processor must provide the Controller with any information relating to any relevant matter for the purposes and effects of the GDPR and, more generally, of the Data Protection Legislation. The Processor may not make independent decisions regarding the purposes and means of Processing. In case of necessity and urgency, the Processor must inform the Controller as soon as possible, so that the latter may take appropriate decisions.

Additionally, the Processor must immediately notify the Controller of any request, order, or inspection activity by the Data Protection Authority or the Judicial Authority.

3.4) Processing of Personal Data Involving Third Parties

Pursuant to Article 28 of the GDPR, the Processor, regardless of the type of data processed, as well as the methods and purposes of the processing, may, with the prior written authorization of the Controller, engage another Processor (referred to as Sub-Processor) to whom it transfers/delegates, in whole or in part, the processing of personal data. This Sub-Processor must be formally appointed through a designation letter containing detailed operational instructions based on the type of data processed, and the method and purpose of the processing.

The Sub-Processor shall be bound, through a contract or other legal act, by the same data protection obligations contained in the contract or other legal act between the Controller and the initial External Processor.

If the Sub-Processor fails to fulfill its data protection obligations, the initial External Processor shall remain fully liable to the Controller for the fulfillment of the Sub-Processor’s obligations.

3.5) Handling of Data Subjects’ Rights Requests

If, in the course of its activities, the Processor is directly or indirectly involved in handling requests from Data Subjects regarding access, updating, rectification, integration, erasure, anonymization, or blocking of data processed in violation of the law — rights further extended by the GDPR to include data portability and the right to be forgotten (Articles 15, 16, 17, 18, 20, and 21 of the GDPR) — the Processor must cooperate, within the prescribed modalities and timelines, and in any case no later than 24 hours from the receipt of such requests, to fulfill them.