ControvistoVerified by a person

Data Processing Agreement (Article 28 GDPR)

Version of 20 October 2026 · English translation of 30 October 2026

This English text is a translation of the Italian Accordo sul trattamento dei dati (art. 28 GDPR). In the event of any discrepancy between the two versions, the Italian version prevails.

This agreement forms part of the contract for the use of Controvisto and applies from the moment the firm (the “Controller”) creates its register. Alessandro Richard, an Italian sole proprietorship (ditta individuale) — Via Roma 123, 15020 Villadeati (AL), Italy — VAT no. IT10689390010 — certified e-mail (PEC) [email protected] — e-mail [email protected] is the “Processor”. This agreement applies where the customer processes personal data in the register as a controller in the course of a professional or business activity; it does not apply to a Free plan user who is an individual using the service for purely personal or household purposes (Article 2(2)(c) GDPR). Terms such as “personal data”, “processing”, “controller”, “processor” and “personal data breach” have the meaning given to them in Regulation (EU) 2016/679 (“GDPR”).

1. Subject matter and duration

The Processor processes on behalf of the Controller the personal data entered in the Controvisto register, solely for the purpose of providing the service described in the Terms of Use, for the whole duration of the contract and for the subsequent period set out in section 9.

2. Nature of the data and data subjects

Personal data of the firm’s professionals and assistants (name, qualification, professional registration, e-mail, role, logins) and the data that the Controller chooses to enter in the register. The service is designed so that no data identifying clients appear in the register: the Controller undertakes to use only internal references for its matters (Article 5(1)(c) GDPR, data minimisation) and not to enter special categories of personal data (Article 9 GDPR) or personal data relating to criminal convictions and offences (Article 10 GDPR). Sealed documents are not transmitted: the Processor receives only their fingerprint.

3. Instructions

The Processor processes the data only on documented instructions from the Controller, which consist of the contract, this agreement and the use of the functions of the service. The Processor informs the Controller if, in its opinion, an instruction infringes data protection law.

4. Confidentiality

Persons authorised to access the data are bound by confidentiality. The Processor accesses the register data only when this is necessary for support requested by the Controller, for an export requested in writing, for the security of the service or to comply with a legal obligation.

5. Security (Article 32 GDPR)

  • Data stored in the European Union, encrypted in transit (HTTPS) and on the disks of the database provider.
  • Separation of each firm’s data enforced by the database: the functions of the service return only the data of the firm to which the logged-in user belongs; there is no direct access to the tables.
  • Login with password and mandatory two-step verification; no more than two devices per account; after more than 6 hours of inactivity the session can be reopened only with the authenticator app code, and every 90 days from the last full login both password and code are required again; e-mail alert at every login from a device never used before; the device, inactivity and 90-day limits are also enforced by the database, with the login session tied to the device.
  • Roles within the firm: the owner sees the whole register; professionals and assistants see the entries they have written or checked; assistants do not issue seals.
  • Unalterable history of every entry, change and revocation; access log available to the owner of the firm.
  • Backup copies of the database, with restore testing.
  • Seals cannot be changed or deleted, only revoked with a reason; their date is fixed every day with OpenTimestamps.

6. Sub-processors

The Controller gives general authorisation for the use of the sub-processors listed in the Privacy Notice (Supabase for the database, logins and service functions; Cloudflare for website hosting; Aruba for sending the service e-mails). The Processor informs the Controller by e-mail at least 30 days before adding or replacing a sub-processor; the Controller may object by cancelling at no cost. The Processor imposes on its sub-processors obligations equivalent to those in this agreement.

7. Assistance to the Controller

The Processor assists the Controller, as far as possible and taking into account the nature of the processing, in responding to requests from data subjects, in data protection impact assessments and in prior consultations. While the subscription is active, the functions for exporting the register (CSV), the matter file (PDF), the history and the access log allow the Controller to respond to access and portability requests on its own.

8. Personal data breaches

The Processor notifies the Controller without undue delay, and in any event within 48 hours of becoming aware of it, of any personal data breach affecting the Controller’s register, providing the information available for the notification required by Article 33 GDPR.

9. End of processing: return and deletion (Article 28(3)(g) GDPR)

If the subscription is not renewed or is cancelled, the firm moves to the Free plan and the Controller can still view the register. At any time the Controller may ask support in writing ([email protected]) for the return of the data: the Processor sends a complete export of the register, in CSV and JSON format, to the e-mail address of the owner of the firm.

On the Controller’s written request, or automatically for a firm on the Free plan after 24 months without any access by the people in the firm (never earlier than 30 days after notice to the Controller by e-mail), the Processor deletes the register data (entries, tools, people, history, logins and devices). Only the data needed to comply with legal obligations (invoicing) and the public data of seals already issued are kept; those seals remain verifiable for at least 10 years, as set out in the Terms of Use. Backup copies are deleted in accordance with their normal rotation cycle.

10. Audits

The Processor makes available to the Controller the information necessary to demonstrate compliance with this agreement and allows for audits, with reasonable prior notice and without compromising the confidentiality of other customers.