Data Processing Agreement (DPA)

For the purposes of this DPA, the following terms shall have the meanings set out below:

Both parties agree to process personal data in accordance with the following principles. These principles form binding obligations and are intended to promote a consistent and high standard of data protection across all activities governed by this DPA:

To properly deliver the contracted services, the Client shall provide Prometeo with the personal data necessary for their execution.

This may include, by way of example:

• Full name
• Email address
• Tax identification number
• Phone number
• Bank account number
• Any other data required to fulfill the scope of the service

This DPA enters into force on the same date as the Master Services Agreement (MSA) and remains in effect for as long as Prometeo processes personal data on behalf of the Client.

Upon termination of the contractual relationship, Prometeo will, at the Client’s choice:

• Return all personal data and any copies thereof to the Client; or
• Permanently delete the personal data, including any backups, unless retention is required by applicable law.

If retention is legally required, Prometeo will block the data and store it securely, limiting its use strictly to compliance with such legal obligation, in accordance with applicable regulations.

Prometeo, acting as Data Processor, undertakes to:

Legal Compliance: Comply with all obligations applicable to data processors under relevant data protection laws and any other binding legal provisions.

Purpose Limitation: Process personal data solely for the purposes set out in this DPA and the Controller’s documented instructions. Prometeo shall not use the data for its own purposes.

Transparency and Cooperation: Provide the Controller with all necessary information to demonstrate compliance with this DPA and allow reasonable audits or inspections, as agreed.

Authorized Personnel: Ensure that any personnel authorized to process personal data:

• Are bound by a written confidentiality obligation;
  
• Have received appropriate data protection training; and
  
• Process data only in accordance with the Controller’s instructions or applicable legal requirements.

Security Measures: Implement and maintain appropriate technical, physical, and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized access, or disclosure. These measures shall include, at a minimum:

• Pseudonymization and/or encryption, where appropriate;
  
• Measures to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
  
• The ability to restore access to personal data in a timely manner in the event of an incident;
  

Regular testing and evaluation of the effectiveness of the implemented security measures.

Recordkeeping and Supervision: Maintain records of processing activities as required by law and make them available to the Controller or competent authority upon request. Cooperate fully with any regulatory audit or investigation.

Prometeo may engage third parties (“Sub-processors”) to perform specific personal data processing activities, provided that the Client gives prior written authorization.

By entering into the service agreement, the Client provides general authorization for Prometeo to subcontract essential ancillary services necessary for the standard operation of the services (e.g., cloud hosting, technical support).

Prometeo shall ensure that any Sub-processor is bound by the same data protection obligations as those set forth in this DPA, including appropriate technical and organizational measures to ensure data security and compliance.

Prometeo remains fully liable to the Client for any actions or omissions of its Sub-processors that result in a breach of this DPA.

Prometeo shall implement appropriate technical and organizational measures, considering the nature of the processing, to assist the Controller in responding to requests from Data Subjects exercising their rights under applicable data protection laws.

If Prometeo receives a data subject request directly, it must:

• Promptly notify the Controller; and
• Provide all relevant information necessary for the Controller to respond appropriately.

If the data is processed exclusively through systems managed by Prometeo, and if agreed with the Controller, Prometeo may respond directly to the request on the Controller’s behalf, in accordance with applicable legal deadlines. The Controller must still be informed of the request and the response provided.

In the event that Prometeo detects a personal data breach affecting data processed under this DPA, it shall notify the Controller without undue delay, to enable appropriate mitigation and response actions.

The breach notification shall include, at a minimum:

• A description of the incident and how it was detected;
• The categories and estimated number of affected data subjects and records;
• The likely consequences of the breach;
• Measures taken or planned to address and mitigate the breach;
• Contact details for further information or coordination.

If legally required, Prometeo will also cooperate with the Controller in notifying the relevant supervisory authority and affected data subjects.

The Client, acting as Data Controller, shall be solely responsible for the following obligations:

Lawful Basis for Processing

Ensure that all personal data provided to Prometeo is processed on a valid legal basis, in accordance with applicable data protection laws. The Client must be able to demonstrate this basis upon request.

Instructions to the Processor

Provide Prometeo with clear, lawful, and written instructions regarding the processing of personal data. Instructions must include:

• The purpose and scope of processing;
• The duration of the processing;
• The nature and categories of personal data;
• The categories of data subjects;
• The specific obligations and rights of the Client that Prometeo must support.

Transparency and Information Duties

Inform data subjects, in a clear and lawful manner, about the processing of their personal data, in compliance with applicable transparency requirements.

Data Subject Rights

Implement procedures and channels to allow data subjects to exercise their rights. Inform Prometeo of any request that involves data it processes, and provide necessary instructions for response.

Monitoring and Supervision

Actively monitor Prometeo’s compliance with this DPA and applicable laws. This includes the right to conduct audits or assign an independent auditor, with reasonable notice.

Notification of Personal Data Breaches

In the event of a data breach, the Client is responsible for assessing whether notification is required and, if so, notifying the relevant authority and affected data subjects. Prometeo shall support this process as necessary.

Impact Assessments and DPO

Where legally required, the Client shall conduct data protection impact assessments and appoint a Data Protection Officer.

Upon termination of the services, Prometeo shall return to the Client all personal data and any related documents or media, including all copies.

Once the data has been returned, Prometeo will proceed with its permanent deletion, unless retention is legally required.

If retention is required by law, Prometeo shall:

• Store the data securely,
• Block further processing, and
• Use the data solely to comply with the legal obligation.

The confidentiality obligations set forth in this DPA shall survive the termination of the services.