Data Processing Agreement (DPA)

1. Parties

Controller: the Customer

Processor: YecoAI

2. Scope

3. Processor obligations (Art. 28(3))

• Process only on documented instructions (including these Terms, panel settings, and this DPA), including transfers, unless EU/Italian law requires otherwise. We may refuse an instruction that, in our reasonable view, infringes GDPR or other Union/Member State law, and will tell you why (Art. 28(3)(a)).
• Confidentiality of authorised persons.
• Art. 32 TOMs (section 4).
• Engage sub-processors only as authorised below; impose equivalent Art. 28 duties by contract.
• Assist with data-subject rights, Arts. 32–36, and your Art. 22 setup (human review via Copilot/Approvals).
• Delete or return End User data on termination (section 8).
• Make information available to demonstrate compliance; allow audits (section 9).

4. TOMs and Yeco-PII

• TLS in transit; AES-256 (or equivalent) at rest for credentials and ticket bodies.
• Yeco-PII: automated detection and redaction of personal data before text is sent to language models, summary jobs, or other downstream systems. Yeco-PII itself processes personal data for that purpose. Staff do not read ticket conversations.
• Access control, audit log, backups in the EU, incident process.

5. Sub-processors (general authorisation)

You authorise the entities on the live sub-processor list (copied below). We will give at least 14 days’ notice of changes (email or panel) so you may object. If you object on reasonable GDPR grounds we will discuss alternatives; if we cannot accommodate, you may terminate the affected service. A BYOK or self-hosted model that you operate is not YecoAI’s sub-processor.

Privacy Shield is not a transfer tool. You remain solely responsible for Art. 13/14 notices to End Users and for your Art. 30 record as controller. YecoAI keeps its own processor Art. 30 record internally; it is not a public certificate.

6. Transfers

Extra-EEA, UK and Swiss transfers use EU SCCs and/or the UK IDTA / UK Addendum to those SCCs, Swiss-recognised SCCs, and the EU-US, UK-US and Swiss-US Data Privacy Frameworks where the importer is certified. We do not rely on Privacy Shield. The UK, Swiss and US addenda in §§10–12 apply automatically when those laws apply to the processing.

7. Breach

We notify you without undue delay and within 48 hours of becoming aware of a personal-data breach affecting End User data we process, with information so you can notify the Garante, ICO, FDPIC or a US AG within the statutory period if you are the controller/business. Contact: [email protected] / PEC.

8. Return and deletion

On termination, at your choice we delete or return End User personal data within 30 days, except Italian/EU legal retention. Written confirmation on request.

9. Audits

You may audit compliance with 14 days’ notice during business hours, or accept a current independent report where available. Audits must not compromise other tenants.

10. UK Addendum

When UK GDPR applies, this DPA is the Art. 28 UK GDPR contract. The ICO’s International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B.1.0, in force as updated by the ICO) is incorporated. Tables: exporter = YecoAI (processor) and/or Customer (controller) as applicable; importer = each extra-UK sub-processor on the live list; frequency = continuous for the subscription; nature and purpose = as in §2; ending = end of processing plus deletion/return. Mandatory clauses of the Addendum prevail over this DPA on UK transfers.

11. Swiss Addendum

When the nFADP applies, this DPA is the processor contract (Art. 9 nFADP). EU SCCs apply with the Swiss standard adaptations: references to the GDPR include the nFADP; ‘Member State’ includes Switzerland; the competent authority is the FDPIC; the governing law of the SCCs may be Swiss law where required by the FDPIC. Swiss-US DPF may be used where the importer is certified.

12. US service-provider terms

When US state privacy laws (including CPRA, VCDPA, CPA, CTDPA, UCPA, TDPSA) apply to End User data you send us, YecoAI is your service provider / processor / contractor. We will: (a) process only for the business purposes in §2 and your panel settings; (b) not sell or share that data; (c) not retain, use or disclose it outside the direct business relationship except as permitted by those laws; (d) not combine it with personal data from other sources except to provide the Service or as those laws allow; (e) assist you with consumer requests you validly pass to us; (f) notify you if we determine we can no longer meet these obligations; (g) allow you to take reasonable and appropriate steps to stop unauthorised use, including the audit rights in §9. You warrant you have provided any required notices and obtained any required consents from End Users in the US.

13. Law

The commercial contract is Italian law (Tribunale di Cuneo). GDPR, UK GDPR, nFADP and US state privacy laws apply to the processing they cover. Public-law investigations follow the competent authority. Allocation of private loss follows the Terms.