Data processing agreement (DPA)

Article 28 of Regulation (EU) 2016/679. Last updated: 5 September 2026.

Between the AtelierX user (trade professional / business, the Controller) and SHARDANA SOCCORSO SOCIETA' COOPERATIVA SOCIALE A R.L., VAT 01179390958, registered office Piazza Convento 1, 09073 Cuglieri (OR) (the Processor), application technical manager Guerra Maurizio.

This agreement applies when the Controller uses AtelierX and enters third-party personal data (customers, clients and suppliers). It appoints a processor under GDPR Article 28 and applies alongside the privacy notice and terms.

1. Subject matter

The Processor provides AtelierX (atelierx.pro) and processes personal data uploaded by the Controller only to provide the service on the Controller's instructions. It does not use that data for its own marketing or sell it.

2. Data and data subjects

• Data subjects: the Controller's customers/clients and any employees or suppliers entered in records.
• Data categories: identity and contact details (name, phone, email, address), optional tax details (VAT number, tax code, PEC, SdI code), operational content (requests, quotes, jobs, appointments, stock, vehicles/registration numbers for workshops), technical logs.
• Special categories (Article 9): not requested. The Controller must not upload health, biometric or judicial data.
• Purpose: management of the Controller's business.
• Duration: account lifetime plus up to 30 days after deletion; rotating backups (up to 30 files); AtelierX subscription tax records as required by law.

3. Instructions

The Controller gives instructions by using the app (entering, editing, exporting and deleting data). Further instructions must be sent in writing to support@atelierx.pro. The Processor informs the Controller if an instruction infringes the GDPR.

4. Processor obligations

• Process data only for AtelierX unless required by law.
• Ensure confidentiality for people with access, including administrative support.
• Apply appropriate Article 32 security measures: HTTPS, password hashing, two-factor authentication, rate limits, backups, protected administrative access and a firewall.
• Assist the Controller where possible with data-subject rights, DPIAs and breaches involving data in AtelierX.
• Delete or return data at the end of the service through in-app export and account deletion. Rotating backups expire through their cycle.
• Provide reasonable information to demonstrate compliance with this agreement.

5. Controller obligations

• Act as controller for its customer data and have a legal basis for entering it.
• Do not upload excessive data or special categories.
• Handle relevant data-subject requests; AtelierX provides export and account deletion.
• Protect credentials and the Authenticator device.

6. Subprocessors

The Controller gives general authorisation for the entities below. The Processor gives reasonable notice of new categories through a page update or email. The Controller may object on substantiated grounds and close the account.

Services activated directly by the Controller with its own keys (Fattura24, Fatture in Cloud, WhatsApp, AI providers) are not Shardana subprocessors: the Controller contracts with them directly.

7. Transfers outside the EU

Hosting and backups: EU. Stripe and, if used, the Controller's QR/AI services may involve transfers under Article 46 safeguards (SCCs).

8. Data breaches

The Processor informs the Controller without undue delay after confirming a breach involving data processed on its behalf. The Controller assesses notification to the supervisory authority within 72 hours and to data subjects.

9. Duration and governing law

This agreement lasts while the account is active and for the deletion/backup period. Italian law applies. The Processor's court has jurisdiction, subject to mandatory consumer protections.

Contact: support@atelierx.pro · Certified email (PEC) info@pec.shardanasoccorso.org

← Home