Data Processing Agreement

Art. 1 — Parties and scope

This agreement is entered into between the Customer, as controller, and NEURALWORD S.r.l., VAT number IT03570180244, as processor under art. 28 of Regulation (EU) 2016/679 (GDPR). It applies to personal data TrustInsider processes on the Customer’s behalf in providing the service and forms part of the Terms of service. Capitalised terms have the meaning given in the Terms and the GDPR.

Art. 2 — Subject matter, duration, nature and purpose

TrustInsider processes the data for the term of the contract and for the time needed to return or delete it, solely to provide the features chosen by the Customer: reading integrations, monitoring, reports, Ask, managing hosted pages and newsletters, publishing to authorised destinations. The categories of data and data subjects are described in annex 1.

Art. 3 — Customer instructions

TrustInsider processes the data only on the Customer’s documented instructions, consisting of this agreement, the Terms and the settings the Customer configures in the service, unless required by Union or Member State law; in that case it informs the Customer, where the law allows. If it considers that an instruction infringes data protection law, TrustInsider informs the Customer immediately. The Customer warrants the lawfulness of the data and of its instructions.

Art. 4 — Confidentiality and staff

Persons authorised to process the data are bound by confidentiality and access only what their task requires. Staff access to Customer data is limited, logged and justified, for example for support requested by the Customer.

Art. 5 — Security

TrustInsider applies the technical and organisational measures in annex 2, appropriate to the risk under art. 32 GDPR, and may update them provided the level of protection does not decrease.

Art. 6 — Sub-processors

The Customer gives TrustInsider general authorisation to engage the sub-processors listed in annex 3. TrustInsider imposes on them, by contract, data protection obligations no less protective than those of this agreement and remains liable for their performance. Before adding or replacing a sub-processor, TrustInsider updates the list on this page and notifies Customers on a paid plan at least 30 days in advance; the Customer may object on reasonable data protection grounds and, if no solution is found, terminate without penalty with a refund of the prepaid, unused part.

Art. 7 — International transfers

Data may be transferred outside the European Economic Area only to sub-processors covered by an adequacy decision, the EU-U.S. Data Privacy Framework or the standard contractual clauses of decision (EU) 2021/914, with any necessary supplementary measures. For transfers that require them, the parties agree that the standard contractual clauses, module 2 or module 3, apply and are deemed incorporated into this agreement.

Art. 8 — Assistance to the Customer

Taking into account the nature of the processing, TrustInsider assists the Customer with appropriate measures to respond to data subject requests, forwarding without delay those received directly, and assists it with its obligations on security, breach notification, impact assessment and prior consultation (arts. 32-36 GDPR), with the information available to it.

Art. 9 — Personal data breaches

TrustInsider notifies the Customer of any personal data breach affecting data processed on its behalf without undue delay and in any case within 48 hours of becoming aware of it, at the account email address, with the information under art. 33(3) GDPR available at that time, supplementing it as soon as possible, and immediately takes measures to contain it. The Customer may report incidents to privacy@trustinsider.com.

Art. 10 — Return and deletion

During the contract the Customer can export its data from the reserved area. At the end of the contract TrustInsider deletes or anonymises the data processed on the Customer’s behalf within 30 days, unless Union or Member State law requires its retention; encrypted backups are overwritten according to their ordinary cycle.

Art. 11 — Information and audits

TrustInsider makes available to the Customer the information necessary to demonstrate compliance with this agreement. The Customer may carry out, or have an independent auditor bound by confidentiality carry out, one audit per year with at least 30 days’ notice, without disrupting the service or accessing other customers’ data; audit costs are borne by the Customer unless a material breach is found. Audits requested by a supervisory authority are always possible.

Art. 12 — Liability and precedence

The parties’ liability is governed by the Terms, within the limits permitted by art. 82 GDPR. On data protection matters this agreement prevails over the Terms; the standard contractual clauses, where applicable, prevail over both. A signed copy of the agreement is available to Enterprise Customers who request it at privacy@trustinsider.com.

Annex 1 — Description of the processing

• Data subjects: the Customer’s authorised users; visitors to the Customer’s website, in aggregate form, through analytics integrations; newsletter subscribers and people filling in forms on pages hosted for the Customer; individuals mentioned in content the Customer uploads or publishes.
• Categories of data: contact and account data, traffic and search statistics normally in aggregate form, content and documents, identifiers of connected accounts, operation logs. No special category of data is required: the Customer undertakes not to enter any.
• Operations: collection through authorised integrations, storage, analysis, processing with artificial intelligence models, generation of reports and drafts, publishing to authorised destinations, deletion.

Annex 2 — Technical and organisational measures

• Encryption in transit (HTTPS with HSTS) and encryption at rest of the database and backups; application-level encryption of integration credentials with keys kept only in the production environment.
• Access control: sign-in by one-time link, two-step verification, workspace roles, SSO and SCIM provisioning for the Enterprise plan; limited and logged administrative access.
• Data separation by workspace, minimisation of data sent to model providers and masking of confidential data in assistant logs.
• Perimeter protection: security headers, request limits, anti-bot protection, verified webhook signatures, secrets only in environment variables.
• Continuity: encrypted backups, point-in-time database recovery, monitoring of errors and service status.
• Limited retention with automatic deletion on expiry, a documented breach management procedure and periodic review of the measures.

Annex 3 — Sub-processors

The list is updated at every change. Providers indicated as independent controllers process data on their own account, under their own terms, when the Customer connects or uses their services.