Data processing agreement

Last updated: 9 October 2026

This agreement (the "Agreement") supplements the general terms of service and governs the processing of personal data carried out by Spiniello Marco (the "Processor") on behalf of the customer (the "Controller") in providing Easy Sign, under Article 28 of Regulation (EU) 2016/679 ("GDPR"). It is accepted on sign-up or subscription. In case of discrepancy the Italian version prevails.

1. Subject matter, nature and purpose

The Processor processes data only to provide the Service: receiving and storing uploaded documents, sending invitations and OTP codes, collecting signatures, sealing and delivering the signed document, keeping the audit trail and making it verifiable, following the Controller's documented instructions (the terms, this Agreement and the settings chosen in the Service).

2. Types of data and data subjects

• Data subjects: signers indicated by the Controller; people mentioned in uploaded documents.
• Data: name, role, company, email, PEC, mobile number, tax code if provided; technical data of operations (date and time, IP address, browser, OTP results); content of uploaded documents.

3. Duration

Processing lasts for the term of the contract. On termination the Controller may export data within 30 days; afterwards the Processor deletes it, except where the law requires retention.

4. Processor obligations

• process data only on documented instructions, informing the Controller if an instruction infringes the law;
• ensure that authorised persons are bound by confidentiality;
• implement the security measures of Article 32 GDPR (section 6);
• assist the Controller with data subject requests and with Articles 32-36 GDPR;
• notify the Controller of personal data breaches without undue delay and in any case within 48 hours of becoming aware;
• make available the information needed to demonstrate compliance and allow audits with reasonable notice, at the Controller's expense, without compromising other customers' security.

5. Sub-processors

The Controller gives general authorisation to use sub-processors for hosting and infrastructure, email, PEC and SMS delivery, payments and timestamp services. The Processor imposes equivalent obligations on them, remains liable to the Controller and gives at least 15 days' notice by email of new sub-processors; the Controller may object on reasonable grounds and, failing a solution, terminate.

6. Security measures

• encrypted connections (HTTPS/TLS, HSTS); hashed passwords (argon2), optional second factor, expiring sessions, CSRF protection and rate limiting;
• logical separation of customers' data, checked on every access to cases, API keys, webhooks and authorisations;
• personal, revocable signing links; single-use OTP codes stored only as HMAC; chained, append-only audit trail;
• documents stored with SHA-256 verification on every read; final PDF sealed with a timestamp;
• application logs without personal data in clear; backups and full export of cases.

7. Transfers

Data is processed within the European Economic Area. Any transfer to third countries by sub-processors takes place only with the safeguards of Chapter V GDPR.