Data Processing Agreement (DPA)
Last updated: 29 October 2026
1. Parties and roles
This Agreement supplements the Terms of Service pursuant to Art. 28 GDPR. The Agency or Client entering data of its own clients into the Platform acts as data controller ("Controller"); GRUPPO G COMUNICAZIONE S.R.L., registered office at Via Buenos Aires 34, 10134 Turin (TO), Italy, VAT and Tax Code 10329430010 (EU VAT IT10329430010), REA TO-1124060, email and certified email (PEC) marinoacg@legalmail.it acts as data processor ("Processor").
2. Subject matter, nature and duration
The Processor processes data solely to provide the Platform: storage of client profiles and content, AI-assisted drafting, keyword research and creation of reports and editorial plans. Processing lasts as long as the commercial agreement.
3. Types of data and data subjects
Identification and contact data of End clients and their contacts possibly entered in profiles or texts; editorial content; keywords and locations. Special categories of data (Art. 9 GDPR) are not expected to be processed and the Controller undertakes not to enter them.
4. Processor obligations
Process data only on documented instructions from the Controller (use of the Platform constitutes instruction); ensure confidentiality of authorised staff; implement appropriate security measures (Art. 32); assist the Controller in responding to data subject requests and with Arts. 32-36 obligations; notify any personal data breach without undue delay and, where possible, within 48 hours of becoming aware of it.
5. Sub-processors
The Controller grants general authorisation to engage the following sub-processors: application hosting and infrastructure (Emergent Labs); database and file storage (MongoDB Atlas, MongoDB Inc.); storage of social post photos and videos (Cloudflare R2, Cloudflare Inc., EU area); AI text and image generation (Google LLC – Gemini); search data and keyword volumes (DataForSEO); publishing automation (Make, Celonis); destination WordPress websites and social networks chosen by the User. The Processor will notify any replacement or addition at least 15 days in advance; the Controller may object on reasonable grounds and, failing agreement, terminate the service.
6. Transfers outside the EU
Any transfers outside the EEA take place only on the basis of adequacy decisions or Standard Contractual Clauses.
7. Security measures
Password hashing, HTTPS connections, expiring token authentication, role-based access control, data isolation per account and per client, database backups, login attempt limiting.
8. Audits
The Processor makes available to the Controller the information needed to demonstrate compliance with this Agreement and allows reasonable audits, with at least 15 days' notice and at the Controller's expense.
9. Return and deletion
Upon termination of the service the Processor, at the Controller's request, returns data in an exportable format within 30 days and then deletes them, unless retention is required by law.