Data Processing Agreement

1. Parties & Roles

Parties & Roles

• Controller: the Client organisation using KadmilOS API products.
• Processor: Andrea Camillo Anastasi, P.IVA IT05992760875, Via Livorno 51 INT 9, 95021 Aci Castello (CT), Italy — operating KadmilOS (kadmilos.vinket.eu).

2. Subject Matter

Subject Matter

Processing of personal data and product-related data submitted via the KadmilOS API (account contacts, API usage logs, DPP / eco / carbon records the Client creates) solely to provide the contracted services.

3. Duration

Duration

For the term of the Client subscription plus retention periods in Privacy Policy §6 (account/API: subscription + 12 months; invoices: 7 years Italian tax law; usage logs: 90 days).

4. Nature & Purpose

Nature & Purpose

• Hosting, storage, retrieval, and structured export of Client-submitted product data
• Account management, invoicing, and service communications
• Security logging and abuse prevention
• No sale of Client data; no secondary marketing use of product payloads

5. Types of Data & Data Subjects

Types of Data & Data Subjects

• Account contacts: name, email, company, VAT (Client employees / contractors).
• Product data: SKU identifiers, materials, origin, Client-supplied CO₂ figures, eco scores (may include personal data if Client embeds it — Client remains responsible for lawfulness).
• Technical: API timestamps, endpoint, response codes.

6. Processor Obligations

Processor Obligations

• Process only on documented Client instructions (these Terms + API use).
• Ensure persons authorised to process are under confidentiality.
• Implement appropriate technical and organisational security measures.
• Engage subprocessors only under written contracts imposing equivalent duties; current list in Privacy §5.
• Assist Client with data-subject requests and DPIAs where reasonable.
• Delete or return personal data after retention ends, unless EU/IT law requires storage.
• Notify Client without undue delay of a personal-data breach affecting Client data.

Primary hosting: EU-region database. CDN / edge delivery may transit non-EU nodes for performance (see Terms §8).

7. Controller Obligations

Controller Obligations

• Ensure a lawful basis for all personal data submitted to KadmilOS.
• Do not instruct Processor to process unlawfully.
• Do not treat Processor outputs as legal certification, Registry acceptance, or EmpCo / CSRD clearance (see Terms §10–11).

8. Subprocessors

Subprocessors

Current subprocessors are listed in the Privacy Policy §5 (payments, EU database hosting, transactional email, hosting/edge, aggregate logs). Material changes notified via account email with 30 days to object before the change takes effect for paid plans where feasible.

Standard Contractual Clauses or equivalent safeguards apply where a subprocessor processes outside the EEA.

9. Audit

Audit

Upon reasonable written notice (max once per 12 months unless a competent authority requires otherwise), Processor will provide information reasonably necessary to demonstrate Art. 28 compliance. On-site audits only where remote evidence is insufficient, at Client's expense, during business hours, without disrupting other customers.

10. Contact

Contact

Andrea Camillo Anastasi · P.IVA IT05992760875

Email: andrea@vinket.eu

Related: Terms · Privacy

VinKet marketplace: vinket.eu