Data Processing Agreement (DPA)
Last updated:
Parties and subject matter
This agreement supplements the Terms and Conditions of Use and governs, under Article 28 of Regulation (EU) 2016/679 (GDPR), the processing of personal data that the user of the Service, as Data Controller (hereinafter the "Customer"), entrusts to RadarWave di Gianluca Sordiglioni, Italian VAT number 11105080151, Via Monte Cervino 13, 20021 Bollate (MI), Italy, as Data Processor (hereinafter "RadarAddress"), by uploading contact lists to the Service through the web form, files or the API.
The agreement applies upon acceptance of the Terms at registration, with no separate signature required. At the Customer's request, RadarAddress provides a signed copy.
Nature, purpose and duration of processing
The processing consists of the automated handling of the contact lists uploaded by the Customer: normalisation and verification of postal addresses, deduplication with a consolidated record, generation and verification of the Italian tax code, name enrichment, verification of email addresses, phone numbers and websites, preparation of lists for the Italian public opt-out register. It involves no automated decisions producing legal effects on data subjects.
The purpose is solely to carry out the processing requested by the Customer. The processing lasts for the time needed to process the data and make the result available, and in any case no longer than 30 days from upload, unless deleted earlier by the Customer. The agreement remains in force for the whole life of the account.
Types of data and categories of data subjects
Identification and contact data: names, titles, postal addresses, phone numbers, email addresses, websites, tax codes, dates and places of birth, gender (declared or inferred from the first name) and the Customer's internal identifiers. Data subjects: customers, members, donors, contacts, suppliers and other persons present in the Customer's contact lists.
The Service is not intended for special categories of data (Article 9 GDPR) or for data relating to criminal convictions and offences (Article 10 GDPR): the Customer undertakes not to upload them.
Customer's instructions
RadarAddress processes the data only on the Customer's documented instructions. The instructions consist of the Terms, this agreement and the choices the Customer makes when using the Service (type of processing, options and parameters of each job). RadarAddress informs the Customer if it considers that an instruction infringes the GDPR or other data protection provisions.
The data is processed and stored on servers located in the European Union and is not transferred to third countries.
Obligations of RadarAddress
RadarAddress undertakes to:
- process the data solely to carry out the processing requested, without disclosing or disseminating it to third parties or using it for its own purposes;
- ensure that the persons authorised to process the data have committed themselves to confidentiality;
- adopt appropriate security measures under Article 32 GDPR: encrypted transmission (HTTPS), access to the infrastructure restricted to authorised staff with personal credentials, account passwords stored only in encrypted form, access logs, automatic deletion of files at the end of the retention period;
- assist the Customer, with appropriate technical and organisational measures, in responding to data subjects' requests (Articles 12-23 GDPR) and in complying with the obligations under Articles 32-36 GDPR, taking into account the nature of the processing and the information available to it;
- notify the Customer of any personal data breach without undue delay after becoming aware of it, with the information needed for the Customer to meet its own notification obligations;
- make available to the Customer the information needed to demonstrate compliance with the obligations of this agreement.
Sub-processors
The Customer gives RadarAddress general authorisation to engage the following sub-processors, bound by contract to the same data protection obligations as those set out in this agreement:
- Aruba S.p.A. (Italy): provider of the server infrastructure on which the Service is hosted.
The payment and electronic invoicing providers (Stripe, Datev Koinos) process only the Customer's billing data, never the data contained in uploaded files. RadarAddress informs the Customer of any addition or replacement of a sub-processor by updating this page and by email to registered users; the Customer may object in writing within 15 days and, in the event of objection, withdraw from the Service under the Terms.
Deletion and return of data
Uploaded files and result files are deleted automatically 30 days after upload; until then the result can be downloaded by the Customer. The Customer may delete them earlier, at any time, with the "Delete" button on the My jobs page. When the account is closed, all files are deleted. Only usage and accounting data (number of operations, date, amount charged) and technical system logs remain, which contain no data from the files, for the time required by legal obligations.
Audits
The Customer may verify compliance with this agreement by requesting the necessary information in writing or, no more than once a year and with 30 days' notice, through an inspection carried out by itself or by an independent auditor, at its own expense, during business hours and without prejudice to the security and confidentiality of other customers.
Liability, governing law and language
The liability of the parties is governed by Article 82 GDPR and by the Terms. This agreement is governed by Italian law; the courts of Milan, Italy have jurisdiction over any dispute.
This document is written in Italian. Versions in other languages are provided for convenience only: in the event of any discrepancy, the Italian version prevails.
Contact
For any request concerning this agreement, write to: info@radarwave.it.