DPA - Data Processing Agreement

1.01As integral parts of this agreement, CORETECH and the CLIENT agree on the following factual premises:

• (a) as indicated in the service contract, CORETECH provides IT services as described therein (IaaS, SaaS, related maintenance services) which involve the need to potentially access CLIENT data, as a technical prerequisite for providing the services or provide related assistance;
• (b) this therefore means that CORETECH carries out processing of the personal data managed by the CLIENT through the services provided, performing such processing exclusively on behalf of the latter;
• (c) the personal data managed by the CLIENT through the Services in question can be of any type, common, particular, or even related to criminal convictions or crimes, being only the CLIENT to decide how to use the Services and which personal data to enter and which processing, CORETECH limiting itself to providing only IT Services;
• (d) the CLIENT can also carry out the processing of personal data by deciding the purposes and means of processing or he can in turn process the data on behalf of another subject, from which he receives instructions on the processing of such personal data;
• (e) the CLIENT can therefore be either directly a data controller (or co-owner) or a data processor or sub-manager depending on the type of service that the CLIENT provides to third parties;
• (f) given these premises, it is necessary to regulate how CORETECH manages the processing of personal data on behalf of the CLIENT, in order to ensure that the processing respects the privacy regulations and guarantees the protection of the rights and freedoms of the data subjects;
• (g) this agreement is intended to govern the obligations and rights of the parties, CORETECH and the CLIENT, concerning compliance with the requirements of privacy legislation, in particular Regulation (EU) 2016/679 (hereinafter GDPR) and the privacy code referred to in Legislative Decree 30.06.2003 no. 196, as amended by Legislative Decree 10.08.2018 no. 101 and any subsequent amendments or additions as well as the related regulatory framework deriving from it;
• (h) CORETECH has adopted technical and organizational measures to ensure that the services offered to its customers have adequate protection, according to market technical standards, in order to ensure effective protection of the rights and freedoms of data subjects in relation to their personal data.

1.02 This agreement shall be understood as an integral part of the CORETECH service supply contract, governing the resulting obligations under art. 28 GDPR, allocating them between CORETECH and the CLIENT according to the principle of shared responsibility as specified below.

2.01 For the purpose of applying and interpreting this agreement, the terms and expressions used shall be understood as indicated below:

• (a) The definitions that have been indicated in the service contract concluded between CORETECH and the CLIENT will be taken into account;
• (b) Account shall also be taken of the regulatory definitions provided by privacy legislation, including first and foremost the provisions of art. 4 § 1 GDPR as well as what is established by the application practice of the competent European bodies and of the Italian Data Protection Authority, in addition to relevant European and Italian case law;
• (c) For ease of exposition, the "processor" is the person who processes data on behalf of a controller, while the "sub-processor" is the person who processes data on behalf of a processor or another sub-processor;
• (d) In the course of this agreement for simple display convenience, CORETECH is indicated as the data processor, even if it qualifies as a sub-manager concerning the role played by the CLIENT.

3.01 The CLIENT appoints CORETECH as processor of the personal data processed through the IT services that are the subject of the supply contract concluded with the latter, authorizing CORETECH to process, on behalf of the CLIENT, the related personal data and only insofar as necessary for the provision of the IT services themselves, in compliance with the contractual terms of supply and as established in this agreement.

3.02 Concerning the election, it is agreed that:

• (a) The purposes of processing the personal data transmitted by the CLIENT are exclusively those of providing the IT services referred to in the previous paragraph and are carried out on behalf of the CLIENT by CORETECH, as processor, according to the indications of this agreement or also upon specific written instruction of the CLIENT, always provided that this complies with privacy legislation and with the contractual terms of the service;
• (b) The processing allowed to the processor referred to in the previous letter also includes technical assistance, updating and maintenance of the IT systems requested by the CLIENT, if applicable also in "on premise" mode, and may consist of all related support operations and therefore by way of example:
  • - data migration activities aimed at installing and testing software or IT services;
  • - assistance and update services that involve (even if only occasionally) remote access to CLIENT data (e.g. via remote access tools such as TeamViewer, VPN, etc.);
  • - data analysis (DB, screens, data exports, etc.) of the CLIENT to verify technical problems and carry out maintenance or technical support activities;
• (c) The data controller may carry out the treatments in an automated and/or paper way, always as necessary for the purposes indicated above;
• (d) The CLIENT decides the type of personal data to be processed through the IT services provided by the data controller, which may be common personal data, of a particular category or relating to convictions or crimes;
• (e) The category of data subjects refers to natural persons such as customers, suppliers or employees of the CLIENT, depending on the type of activity or services offered in turn by the latter to third parties, directly or indirectly;
• (f) The duration of processing is limited to the duration of the service as described in the general terms of supply and at the end personal data will be deleted according to what is contractually established, unless otherwise instructed in writing by the CLIENT, always provided that this complies with privacy legislation and with the contractual terms of the service. This is without prejudice to the case provided for by art. 28 § 3 lett. g) GDPR relating to where European Union law or Italian law requires data retention;
• g) The CLIENT declares and warrants that it has all the powers necessary to appoint the processor in relation to the personal data that the latter will process on its behalf, in compliance with privacy legislation.

4.01 The parties acknowledge that the CLIENT can take different positions concerning the privacy policy, being the owner (or co-owner) of the processing for personal data for which he decides the purposes and means of treatment or if he processes the data personal on instruction and on behalf of others, processor or sub-processor as the case may be.

4.02 In the event that the CLIENT carries out the processing operations on behalf of a data controller or processor or a sub-processor, the CLIENT guarantees that this agreement complies with the instructions received and the powers conferred, having verified the regularity of his position before signing the CORETECH supply conditions and this agreement.

4.03 In the case envisaged by the preceding paragraphs, CORETECH will assume the role of data processor or sub-processor depending on the role played by the CLIENT.

4.04 Upon signing the contract for the supply of the services offered by CORETECH, the CLIENT must specify in the order form its role with respect to the personal data that will be processed with the ordered services and, in the absence of such indication, it shall be understood that the CLIENT assumes the role of controller.

4.05 If during the course of the supply contract, the CLIENT's role changes, he is required to communicate it to the data controller, in the manner specified therein.

4.06 CORETECH will complete the processor's register pursuant to art. 30(2) GDPR, indicating the role of the CLIENT with respect to the personal data covered by the supply contract, as declared by the latter as indicated above.

5.01 In performing this agreement, CORETECH, as processor, will comply with the CLIENT's instructions in relation to the personal data being processed, unless the operations requested by the instructions are not provided for in this agreement or entail changes in IT and organizational resources not included in the service supply contract.

5.02 In the latter case, CORETECH will assess the feasibility of the instructions and, if feasible, will agree with the CLIENT the aforementioned changes and related costs. In the absence of agreement, the instructions will not be implemented, and the provisions of this agreement shall apply.

5.03It is understood that the CLIENT's instructions also falling within this agreement and in any case the treatments carried out as data controller, will be carried out as long as they do not involve, in the opinion of CORETECH, a violation of the privacy legislation or an order imposed by a public authority.

5.04 In the latter case CORETECH will send written reasons to the CLIENT without delay, without prejudice to any prohibitions provided by law.

6.01 THE CLIENT generally authorizes CORETCH, as processor, to appoint sub-processors for the performance of part of its duties provided this is in compliance with the supply contract and this agreement.

6.02 The aforementioned authorization entails the power to add new sub-processors or replace them, and to amend the related contractual agreements.

6.03The general authorization granted is governed as follows:

• (a) The appointed person must present adequate guarantees of adequacy both in relation to the safety of processing and concerning the protection of the rights and freedoms of the interested parties and in any case respectful of the market standards of the sector;
• (b)The processing of personal data carried out by the sub-processor will be limited only to what is necessary for the provision of subcontracted services and insofar as relevant and useful for the performance of part of the services covered by the CORETECH supply contract;
• (c)The appointment of the sub-processor will be made in writing, imposing protection obligations no less than those provided for by this agreement and by art. 28 GDPR;
• (d) The CLIENT will be notified in advance in writing of the appointment within a term of 30 (thirty) days, which within the aforementioned term may oppose in writing. In case of opposition by the CLIENT, CORETECH may withdraw from the supply contract with 30 days notice, without proceeding with the appointment of the sub-manager in relation to the Services to be supplied with the CLIENT;
• (e)The list of sub-processors appointed by CORETECH can be found in the CLIENT's reserved area, in the "contractual communications" section.

7.01 Always in compliance with privacy legislation, the processor may transfer the CLIENT's personal data, if technically possible via encryption systems according to internationally recognized technical standards, even outside the European Economic Area (EEA) or from a country that does not enjoy an adequacy decision by the European Commission pursuant to art. 45 of the GDPR, exclusively if it appoints a sub-processor pursuant to the previous art. 6 and subject to one of the following conditions:

• (a)the standard contractual clauses provided for in European Commission Decision 2010/87/EU of 5 February 2010 are entered into with the sub-processor appointed by CORETECH, which is hereby authorized by the CLIENT to sign them;
• (b)or if the sub-processor is located in the United States, also through application of the "Privacy Shield", www.privacyshield.govreferred to in the European Commission Decision 2016/1250 / EU of 12 July 2016;
• (c)or, if the sub-processor is part of a corporate group in relation to intra-group transfers, the latter has obtained approval of BCR (binding corporate rules).

7.02 The data controller provides the CUSTOMER with information and suitable documentation concerning the above.

7.03 In the order form, the CLIENT may choose not to apply this clause by ticking the relevant option and in that case personal data will be processed by CORETECH exclusively within the European Economic Area (EEA).

7.04 A different agreement between the parties remains.

8.01 The parties acknowledge that the efficiency, security and compliance with privacy legislation of the cloud services provided by CORETECH are the subject of shared responsibility between CORETECH and the CLIENT, which obliges both parties to act with due diligence in managing the IT scope within their competence and under their own responsibility.

8.02 By way of example, to understand the concept of shared responsibility, it is summarized in the web page gdpr.php, of which the relevant pdf file was extracted and sent to the imprint parties
sha256: 5c548cea59adc7229b8b3e9d7 c85a63b13ae7fc998562dbcb84ce58c7199bbf6) the division of tasks with the CUSTOMER, relating to the services offered by CORETECH. The contents of the aforementioned page may be updated over time concerning the technological development of the services offered.

8.03 Each party also undertakes to comply with its obligations under privacy legislation and to cooperate in good faith in the application of this agreement in order to guarantee the rights and freedoms of data subjects.

9.01 The method of communication takes place with the same forms provided for in the general conditions of supply.

10.01 As regards the applicable law, the applicable language and the applicable forum, reference is made to the general conditions of supply.

11.01 CORETECH, as processor, undertakes in the context of the processing provided for in this agreement, relating to the supply of the IT services described above, to adopt appropriate technical and organizational measures, according to market technical standards, in order to protect the lawfulness of personal data processing, their confidentiality, integrity, availability and the resilience of the services provided.

11.02CORETECH declares to have prepared an information security and privacy compliance management plan, which summarizes the protection measures to manage its services in compliance with the previous paragraph.

11.03 A summary of the protection measures adopted are contained in the technical sheet A) attached to this agreement.

11.04 CORETECH may update the protection measures to maintain or increase the security levels of the services and for this purpose the service contract regarding operating procedures shall apply.

11.05 In any case, it is understood that CORETCH, to protect the personal data entrusted to it with this agreement, may take all the measures, including extraordinary ones, provided for in the supply contract, including the suspension of services.

11.06 If the CLIENT requests to adopt further technical and organizational measures, CORETECH reserves the right to verify the feasibility of the request and to agree, if necessary, the relative methods and costs.

11.07 Before accepting this agreement, the CLIENT has checked the security measures indicated above, finding them suitable for the data processing it carries out.

12.01 The data controller periodically audits his information management system and privacy compliance plan, of which he draws up a written report. If deemed appropriate, he will also carry out third-party audits according to international standards and best practices.

12.02 In order to demonstrate compliance with this agreement, the data processor may also show the CLIENT, at its headquarters, the documentation referred to in the previous paragraph, without extracting a copy and the verification and the results will be recorded.

12.03 The CLIENT retains the right to carry out, at its own expense, third-party audits in order to verify compliance with this agreement, through its own specialized staff or professionals of proven experience, in any case bound in writing by confidentiality obligations. CORETECH may object to the appointment of professionals who are in a conflict of interest, not sufficiently qualified or not independent and in that case the CLIENT must propose a different name or carry out the audit directly. The audit report will be made available to the person in charge of the procedure free of charge.

12.04 The methods of conducting the audit referred to in the previous point will be agreed by the parties, and CORETECH will communicate the hourly cost of its staff appointed to assist, in any case not less than the hourly rate for technical assistance.

12.05 The verification activities involving any sub-managers appointed by CORETECH will be carried out in the manner agreed with the latter, in compliance with their privacy compliance policies.

13.01 The CLIENT is aware that the use and safety of the services purchased by CORETECH requires a suitable configuration of the services, which is decided autonomously by the CLIENT according to the general conditions of supply.

13.02 The CLIENT undertakes to configure, to the extent of its competence, the aforementioned services in order to guarantee an adequate level of protection concerning its personal data processing area in compliance with the privacy legislation.

13.03 In any case, the CLIENT will promptly inform CORETECH in the event of suspicion or findings of security violations of the services purchased, providing appropriate documentation in this regard.

4.01 It is understood between the parties that if the CLIENT uses third-party components or services on CORETECH services, CORETECH will not be responsible for their management, including in relation to protection measures for compliance with privacy legislation.

15.01 In the event CORETECH becomes aware of an event that is giving rise or may have given rise to a violation of personal data referred to in this agreement, it will inform the CLIENT as soon as possible, in the manner provided for in the assistance contract, transferring the information at your disposal.

In any case CORETECH will send the CLIENT, without delay and as far as reasonably possible, a written report describing the possible damage caused and the causes if known, the protection measures adopted to avoid or mitigate potential risks, and suggesting to the CLIENT the appropriate measures to protect the personal data processed. The CLIENT will in any case always be kept constantly updated.

15.02 It is understood that the above communication does not constitute acknowledgment of a non-fulfillment or responsibility of the data controller, in relation to the violation reported therein.

15.03 The parties agree that, in compliance with art. 33 and 34 of the GDPR, it is for the CLIENT to make the communications provided therein to the Supervisory Authority under its exclusive responsibility.

16.01 The data controller undertakes to assist the CLIENT in ensuring compliance with the obligations established by the privacy legislation concerning the services provided, in particular also with regard to the obligations relating to the principles of minimization of the processing of personal data (privacy by design & privacy by default), as well as the data protection impact assessment (DPIA) and prior consultation.

16.02 About the previous point, the data controller will only be required to provide information relating to the services provided that may be useful to the CLIENT and which represent the standard methods with which they are configured and provided.

16.03 If the CLIENT requests personalized assistance in relation to the type of service it intends to configure within its own autonomy, CORETECH will be entitled to a fee that will be agreed with the CLIENT together with the related procedures for carrying out the requested assistance.

17.01 If the processor receives requests for the exercise of rights from data subjects in relation to personal data that it processes on behalf of the CLIENT under this agreement, it shall be required to send them without delay to the CLIENT, who will handle the aforementioned requests, directly or also through the controller if different from the CLIENT itself.

17.02 The processor will assist the CLIENT by providing all information in relation to the services managed by CORETECH on the basis of this agreement and will invite the data subject to contact the CLIENT in order to exercise their rights, highlighting its position as processor.

17.03 The CLIENT, therefore, takes every fulfillment regarding the management of the rights of the interested parties, except as indicated in the two previous paragraphs relating to the data controller.

18.01 If the CLIENT must satisfy requests relating to data subjects for the exercise of their rights in relation to personal data covered by this agreement, the processor will provide the information requested by the CLIENT insofar as it relates to this agreement, in relation to the services purchased by the CLIENT.

18.02 In any case, the CLIENT will process the aforementioned request directly, limiting the data controller to fulfill the above.

19.01 In the event that it is necessary for the CLIENT to satisfy requests for portability of personal data, the data controller will provide, exclusively in relation to the services purchased by the CLIENT, only the useful information to extract them in a format compliant with the privacy legislation and provided this is reasonably possible.

19.02 If instead the CLIENT requests the technical assistance needed to carry out the aforementioned extraction, CORETECH will assess the technical feasibility and, if applicable, agree with the CLIENT the related procedures and costs to be borne by the CLIENT.

20.01 CORETECH has the right to modify the conditions envisaged for this agreement in compliance with the privacy legislation, according to the provisions of the general supply conditions, without prejudice to the CLIENT's right to withdraw.

21.01 For all activities carried out in violation of privacy legislation, committed negligently or willfully by the CLIENT using the services provided by CORETECH, from which any extra-judicial or judicial claim may arise against CORETECH, including claims related to the CLIENT's breach of these terms, the CLIENT undertakes to assume all liability and to indemnify and hold CORETECH harmless as soon as possible, releasing it from the aforementioned claims.

21.02 The CLIENT will have to directly bear any type of cost, compensation for damages and charges, including any professional expenses, which may arise from such claims, in addition to any further damage suffered by CLIENT.

21.03 The CLIENT has the right to prove CORETECH's liability for violation of this agreement.

21.04 The CLIENT will inform CORETECH, as soon as possible, of any actions that may be brought against it.

22.01 This agreement replaces any other prior agreement or instruction relating to the management of personal data regarding the Services provided by CORETECH.