Data Processing Agreement (DPA) — Article 28 GDPR
This DPA governs personal data processing performed by UESE ITALIA S.p.A. as Processor on behalf of a Customer acting as Controller or, where relevant, primary Processor. It supplements the Firmato agreement and applies to processing performed on Customer instructions.
1. Subject matter, duration and nature
UESE processes personal data to provide application hosting, document management, signature workflows, notifications, support, audit, security, backups, repository and integrations requested by the Customer. Processing lasts for the contractual term and any subsequent return, deletion, retention or legal-hold period required by contract or law.
2. Data subjects and data categories
Data subjects may include Customer users, employees, contractors, customers, suppliers, signers, representatives and other individuals whose data appears in documents. Data may include identifiers, contact and professional details, contractual data, signatures, logs, IP addresses and any additional data entered by the Customer, including special categories only where lawfully processed and necessary.
3. Documented instructions
UESE processes data only on documented Customer instructions, including instructions embodied in the configured use of the platform, unless processing is required by applicable Union or Member State law; in that case UESE informs the Customer before processing unless legally prohibited.
4. Confidentiality and authorisation
UESE ensures persons authorised to process Customer data are bound by confidentiality and access data according to need, role and least-privilege principles.
5. Technical and organisational measures
Measures include, according to risk: access controls and RBAC; 2FA for sensitive functions; encryption of secrets; TLS; logging and audit; backups; logical tenant segregation; vulnerability and patch management; upload controls; incident response; business continuity; and periodic review. The Customer acknowledges that measures evolve with the state of the art and may be replaced by equivalent or stronger controls.
6. Subprocessors
The Customer grants general authorisation for subprocessors necessary to provide the service, subject to substantially equivalent data protection obligations. UESE maintains an updated list/categories and, where required by Article 28 GDPR and the contractual model, informs the Customer of intended changes and permits reasoned objections on data-protection grounds.
7. International transfers
UESE does not transfer personal data outside the EEA unless a valid Chapter V GDPR mechanism applies. In the absence of adequacy, the European Commission Standard Contractual Clauses may be used with transfer assessments and supplementary measures where needed.
8. Data subject requests
Taking account of the nature of processing, UESE assists the Customer through appropriate technical and organisational measures in responding to data-subject requests. If UESE receives a request concerning data processed solely on Customer instructions, it forwards it to the Customer unless another legal duty applies.
9. Personal data breaches
UESE informs the Customer without undue delay after becoming aware of a personal data breach affecting Customer processing and provides reasonably available information needed for notification and documentation obligations. Notice does not constitute an admission of liability.
10. DPIAs and prior consultation
UESE provides reasonably necessary information for data protection impact assessments and prior consultations relating to the service, taking into account the nature of processing and information available to UESE.
11. Audit and compliance information
UESE makes available information necessary to demonstrate compliance with Article 28 GDPR and allows reasonable audits, preferably through documentation, attestations or remote review. On-site audits require notice, confidentiality, security and non-interference and, absent a confirmed material non-compliance, may be subject to reasonable Customer-borne costs.
12. Return and deletion
On termination, at the Customer’s choice and subject to legal duties, legal hold and backup constraints, UESE deletes or returns Customer personal data. Residual backup copies are isolated from ordinary use and deleted according to the applicable retention cycle.
13. Customer obligations
The Customer is responsible for lawfulness, fairness and transparency, legal bases, information to data subjects, retention settings and use of the platform according to its instructions. The Customer must avoid uploading excessive or unlawful data.
14. Liability and precedence
Liability between the parties follows the GDPR and main contract. On data protection matters, this DPA prevails over commercial conditions, subject to more protective clauses or applicable SCCs.
15. Incorporated annexes
The functional annexes comprise the processing description in this DPA/order, technical and organisational measures in the Security Center, the subprocessor list/categories and any SCCs or transfer addenda signed by the parties.
16. Versioning, precedence and evidence retention
Firmato records the version made available and, where the application flow provides for acceptance, the corresponding acceptance evidence including date, account and technical audit information. Material changes may require renewed acknowledgement or acceptance. Language and country are separate variables: language determines the linguistic version, while country determines the applicable national supplement.