Data Processing Agreement

Version dated 21 October 2026

1. Parties and scope

1.1. This data processing agreement (Agreement or DPA) governs processing carried out by Gitogi Srl, whose registered office is at Piazza IV Novembre 4, 20124 Milan, Italy, Italian VAT and tax identification number 14288420962 (Gitogi), on behalf of the client identified in the accepted proposal (Client, referred to as Customer in the Terms and Conditions). Where the Client acts as a controller (Controller), Gitogi acts as a processor (Processor). Where the Client acts as a processor for another controller, Gitogi acts as a sub-processor, subject to clause 1.5; references to roles in this Agreement shall be read in accordance with that processing chain.

1.2. This Agreement supplements the Contract defined in clause 13 of the Terms and Conditions: the accepted proposal (Proposal), the schedules identified in the Proposal, agreed variations and the applicable general terms. It is entered into in writing, including electronically, by signature or acceptance of a Proposal that incorporates it and identifies its version, made available to the Client before acceptance. Publication on the website alone does not appoint Gitogi as a processor.

1.3. The Agreement covers activities such as data migration, business software configuration and support, software development and maintenance, and artificial intelligence integrations, where these involve processing on the Client's behalf.

1.4. It does not cover processing for which Gitogi independently determines the purposes and means, such as managing business contacts and its own administrative obligations, described in the Privacy Policy. Website retention periods do not automatically apply to project data.

1.5. If the Client itself acts as a processor for another controller, it must disclose this before processing starts and document its authorisation to appoint Gitogi as a sub-processor. This Agreement applies to that processing chain, with the necessary adaptations and any additional obligations disclosed and agreed before access to data.

1.6. Data protection terms have the meanings given in Regulation (EU) 2016/679 (GDPR). This Agreement takes precedence over conflicting provisions of the Contract on data protection. Project-specific additions must comply with the GDPR and must not reduce the safeguards in this Agreement. Applicable standard contractual clauses for international transfers take precedence in accordance with their terms.

2. Description and duration of processing

2.1. Processing concerns only the data necessary for the services identified in the Proposal. Its purpose is to deliver those services under the Client's instructions, without reusing the data for Gitogi's independent purposes.

2.2. Before processing starts, the parties shall record the following in the Proposal or in a processing schedule forming part of the Contract:

2.3. The examples in the table do not authorise every listed category or operation. Missing information necessary for processing must be completed in writing before the affected processing begins. Data being accessible in a system is not, by itself, an instruction to use it.

2.4. Processing continues for as long as required for the services and the exit arrangements under clause 11. During the project, Gitogi shall follow the retention periods and deletion instructions documented by the Client.

2.5. The Client shall not provide special category data under Article 9 GDPR or data relating to criminal convictions and offences under Article 10 GDPR unless the project expressly provides for this in writing beforehand, with the relevant lawful grounds and appropriate measures. If Gitogi identifies excessive or unforeseen data, it shall inform the Client and restrict processing to what is necessary to protect the data and arrange its return or deletion under instructions.

3. Client obligations and rights

3.1. Where acting as a controller, the Client determines the purposes and essential means of processing and is responsible for lawful grounds, required privacy information, including where data is obtained indirectly, and the lawfulness of its instructions. Where acting as a processor, the Client shall pass on to Gitogi only instructions consistent with the controller's instructions and the authorisation received, without thereby acquiring authority to determine the purposes and essential means of processing.

3.2. The Client shall provide only relevant and necessary data, identify contacts authorised to issue instructions and promptly supply information relevant to security and the exercise of rights.

3.3. The Client may issue documented instructions, obtain assistance and information, audit processing, object to sub-processor changes and choose return or deletion, as provided in this Agreement.

3.4. These obligations do not relieve Gitogi of duties or liabilities imposed directly on processors by law. This Agreement does not itself provide a lawful basis for processing data subjects' personal data.

4. Documented instructions

4.1. Gitogi shall process data only under the documented instructions in the Contract, processing schedule and subsequent written communications from authorised contacts, including instructions concerning transfers to third countries or international organisations.

4.2. Where processing is required by Union or Member State law applicable to Gitogi, Gitogi shall inform the Client of that requirement beforehand, unless the law prohibits disclosure on important grounds of public interest.

4.3. Gitogi shall immediately inform the Client if it considers an instruction to infringe the GDPR or other Union or Member State data protection law. It shall not carry out the disputed instruction until the issue has been resolved lawfully. The Client's written confirmation alone does not make an unlawful instruction lawful.

4.4. Instructions changing the scope of the services shall follow the applicable contractual change procedure. Agreement on associated charges shall not delay mandatory data protection obligations.

5. Authorised persons and confidentiality

5.1. Gitogi shall permit access only to people who need it for their assigned tasks, provide appropriate instructions and ensure that they are subject to contractual or statutory confidentiality obligations.

5.2. Confidentiality obligations continue after the engagement ends. Gitogi shall adjust or revoke access rights when access is no longer required.

5.3. The status of external contractors depends on their actual activities and working arrangements: those processing under Gitogi's direct authority are covered by this clause; those acting as separate processors are covered by clause 7.

6. Security

6.1. Gitogi undertakes to implement and maintain technical and organisational measures appropriate to the risk under Article 32 GDPR, taking account of the nature, context and purposes of processing, the state of the art and implementation costs.

6.2. Before processing starts, the parties shall identify the measures applicable to the project in its documentation. The Security Measures page may be incorporated by identifying the relevant version and provisions; website features do not automatically extend to client environments.

6.3. The measures shall address at least:

• permissions, authentication, credential protection and access revocation;
• protection during transmission, storage and use, with encryption and pseudonymisation where appropriate to the risk;
• confidentiality, integrity, availability and resilience of the systems used;
• restoration of data availability and access following an incident, including responsibilities and arrangements for any backups;
• vulnerabilities, incidents, temporary copies and deletion;
• regular assessment of the effectiveness of the measures.

6.4. Where Gitogi works on Client accounts or infrastructure, the Client shall ensure appropriate measures for components it manages itself or entrusts to its own providers. Gitogi remains responsible for its access, activities and any configurations or measures assigned to it under the Contract. It shall report material deficiencies of which it becomes aware and cooperate in addressing them.

6.5. Updates to measures must not reduce data protection. Material project changes shall be documented and communicated to the Client; changes affecting instructions or agreed services shall also follow the applicable contractual procedure.

7. Sub-processors

7.1. By entering into this Agreement in writing, the Client grants Gitogi general authorisation to engage sub-processors on the conditions below.

7.2. Before processing starts, Gitogi shall provide the project's sub-processor list, including identities, activities, processing locations and any international transfers. The list may appear in the Proposal, processing schedule or relevant section of the Sub-processors page, provided that its applicable version is identified and made available to the Client. A website provider is not thereby authorised to process project data.

7.3. Gitogi shall give written notice of a proposed addition or replacement at least 15 days before the new sub-processor accesses data. Updating a webpage alone is insufficient. The Client may object within that period on reasonable, documented data protection grounds.

7.4. The new sub-processor shall not process the affected data during the objection period or, if an objection is raised, until it is resolved. The parties shall seek an appropriate solution. If none is found, the Client may terminate the affected services without penalty, paying for services properly performed; advance payments for services not performed shall be refunded. Other remedies available by law remain unaffected.

7.5. A shorter notice period requires the Client's prior specific written authorisation. Failure to respond to an urgent request does not constitute that authorisation.

7.6. Gitogi shall bind each sub-processor by a written agreement imposing the same relevant data protection obligations for the entrusted activities, including sufficient security safeguards. If a sub-processor fails to fulfil those obligations, Gitogi remains fully liable to the Client for their performance.

7.7. A provider appointed directly by the Client, processing data solely under that appointment, is not Gitogi's sub-processor. Account ownership or payment alone does not determine the role: the contractual relationships and actual activities do. Gitogi shall nevertheless follow instructions concerning the use of those environments.

8. International transfers

8.1. Gitogi shall transfer data outside the European Economic Area, or permit access from such countries, only under documented instructions and in compliance with Chapter V GDPR. Hosting servers in Europe does not, by itself, rule out a transfer.

8.2. Before a transfer, Gitogi shall make available information on recipients, countries, activities and the transfer mechanism. Where necessary, it shall implement the appropriate standard contractual clauses, assess the transfer conditions and apply suitable supplementary measures.

8.3. Adequacy decisions may be relied upon only within their scope and while applicable. Reliance on the EU–US Data Privacy Framework requires actual coverage of the recipient and the processing concerned.

8.4. Gitogi shall inform the Client if a safeguard ceases to apply and shall not continue the transfer without another valid ground. On request, it shall provide relevant documentation, with only those redactions necessary to protect information unrelated to the processing.

9. Assistance to the Client

9.1. Taking account of the nature of processing, Gitogi shall assist the Client through appropriate technical and organisational measures, insofar as possible, in responding to data subjects' rights requests.

9.2. If Gitogi receives a request concerning project data directly, it shall forward it to the Client without undue delay. It shall not independently decide whether to grant the request, unless required by law; it may acknowledge receipt and provide the Client's contact details.

9.3. Taking account of the nature of processing and the information available, Gitogi shall assist the Client with Articles 32–36 GDPR, including security, personal data breaches, data protection impact assessments and prior consultation.

9.4. Routine assistance and compliance with Gitogi's own obligations are included in the service fees. Additional services may be charged at previously agreed rates or under an accepted quotation. A fee dispute shall not suspend assistance necessary to meet mandatory deadlines or obligations.

10. Personal data breaches

10.1. Gitogi shall notify the Client of every personal data breach affecting data processed on its behalf without undue delay after becoming aware of it, in accordance with Article 33(2) GDPR. Notification shall not be delayed until the investigation is complete.

10.2. As information becomes available, Gitogi shall communicate:

• the nature of the breach, categories and approximate numbers of affected data subjects and records;
• likely consequences;
• measures taken or proposed to contain the breach and mitigate its effects;
• contact details for updates.

10.3. Missing information shall be provided in stages without further undue delay. Gitogi shall document the incident and cooperate in containment, investigation and recovery.

10.4. Decisions on notifications to supervisory authorities and communications to data subjects remain with the Client, except where Gitogi has a directly applicable legal obligation. Gitogi shall provide the necessary assistance.

11. Return and deletion

11.1. At the end of the processing services, the Client shall choose between return and deletion of the data. Where data is returned, Gitogi shall also delete copies remaining in its possession or with its sub-processors, unless Union or Member State law requires retention.

11.2. The Client may communicate its choice before the services end or within 30 days afterwards. By accepting this Agreement, it instructs Gitogi to delete the data if no different choice is communicated within that period. Gitogi shall remind the Client in writing of the deadline and the consequence of not responding.

11.3. Return and deletion from active systems and working copies shall be completed without undue delay and, unless a shorter period is agreed, within 60 days after the services end. Data shall be returned through an appropriately protected channel in a commonly used format suitable for the data. Additional migration work shall be agreed separately and shall not be a condition of the required return.

11.4. Where project backups do not allow immediate selective deletion, the parties shall document their cycle and maximum deletion period before processing starts. Until they are deleted, residual copies shall remain protected, segregated from ordinary use and available only for necessary restoration; any restoration shall reapply previously instructed deletions. Indefinite retention is not permitted.

11.5. During the exit process, processing shall be limited to return, deletion, security and legally required retention. For mandatory retention, Gitogi shall disclose the legal provision, affected data and retention period, where disclosure is permitted.

11.6. Where data remains in the Client's systems, Gitogi shall cease access, delete its own copies and cooperate in credential revocation. It shall not delete data from the Client's systems without instructions.

11.7. Gitogi shall confirm completion in writing, identifying any residual copies, the reason for retention and the deletion deadline. This Agreement continues to apply to those copies.

12. Artificial intelligence

12.1. AI use in the services is also governed by clause 22 of the Terms and Conditions. The safeguards in this Agreement take precedence for personal data.

12.2. Gitogi shall not use Client data to train, fine-tune or improve its own or third-party models. A project requiring those operations needs a specific written agreement defining purposes, data, roles, lawful grounds, recipients and safeguards. Client authorisation alone does not replace those requirements.

12.3. Before data is sent to an AI service, the project documentation shall identify the service, contracting provider, processing locations, data transmitted, retention periods and terms governing use of the content. Clauses 7 and 8 apply where Gitogi appoints the provider.

12.4. Except for a specific project under clause 12.2, Gitogi shall use services whose contractual terms exclude the use of Client content for training. It shall not enter project personal data into personal-use tools without a data processing agreement appropriate to the role performed.

12.5. Data minimisation and, where appropriate, pseudonymisation or anonymisation shall be applied before transmission. Replacing a name with a code does not automatically anonymise data.

13. Information and audits

13.1. Gitogi shall provide all information necessary to demonstrate compliance with Article 28 GDPR and this Agreement and shall allow and contribute to audits, including inspections, by the Client or its appointed auditor.

13.2. Routine audits shall normally be arranged on 30 days' notice, during working hours and in a manner proportionate to their scope. No strict annual cap applies. Notice shall be shortened or waived where required by an authority, an incident, reasonable indications of non-compliance or another urgent data protection need.

13.3. The parties shall protect confidentiality, security and other clients' data without preventing necessary audits. Gitogi may initially provide available documentation and audit reports, but these do not replace a necessary inspection.

13.4. Gitogi shall ensure that its sub-processor agreements permit sufficient information and verification. A provider's terms must not render the Client's Article 28 GDPR rights ineffective.

13.5. Each party shall bear its ordinary internal costs; the Client shall pay its appointed auditor. Any exceptional assistance charges must be agreed beforehand and must not obstruct an audit. Gitogi shall bear the reasonable costs of an audit made necessary by its established breach.

14. Liability

14.1. Data subjects' rights and liability under Article 82 GDPR remain unaffected, including rights of recourse as provided by law.

14.2. Between the parties, clause 27 of the Terms and Conditions applies only insofar as its limitations are validly agreed and legally permitted. Liability for wilful misconduct or gross negligence, liability that cannot be limited under Article 1229 of the Italian Civil Code, and other mandatory obligations are not limited.

14.3. Nothing reduces data subjects' rights, authorities' powers or Gitogi's obligations concerning sub-processors. This Agreement does not automatically transfer administrative fines from one party to the other.

15. Duration, amendments and final provisions

15.1. This Agreement remains effective for as long as Gitogi or its sub-processors process project data. Obligations intended to survive, including confidentiality and liability, continue according to their nature.

15.2. Amendments shall follow clause 34 of the Terms and Conditions, subject to the written-form requirement and this Agreement's safeguards. Publishing a new version does not itself amend existing DPAs. New mandatory rules apply as required by law; the parties shall document necessary adjustments without delaying compliance.

15.3. Italian law applies. Contractual dispute provisions apply only if validly agreed and consistent with mandatory jurisdiction rules and data subjects' rights.

15.4. Where Articles 1341 and 1342 of the Italian Civil Code require specific written approval, the Proposal must identify the affected provisions and obtain that approval, including for the limitations incorporated by clause 14.2 and any jurisdiction derogations. A general reference to this DPA does not replace such approval.

15.5. This English version is provided for convenience. In the event of any inconsistency or difference in interpretation, the Italian version prevails, subject to mandatory law.

Data protection contacts

For instructions and communications concerning this Agreement: info@gitogi.com. Italian certified email (PEC): pec@pec.gitogi.com.

Gitogi shall send notices to the Client using the contacts in the Proposal or processing schedule. The Client must keep these up to date, particularly for personal data breach notifications.