Data processing agreement

1. Roles

• Customer — controller of the personal data it submits to or connects with Nucleo (or processor on behalf of its own clients, where it is an agency or group: in that case it warrants it has the authority to appoint us as sub-processor).
• Made in Evolve S.r.l. — processor, acting only on the Customer's documented instructions, which consist of this DPA, the Order Form, the Customer's configuration of the Service and any further written instruction consistent with the contract. We will inform the Customer if we believe an instruction infringes data protection law.
• For the Customer's administrators' account and billing data, and for our own website, we are an independent controller (see the Privacy policy).

2. Subject matter, nature, purpose and duration

• Subject matter: provision of the Nucleo modules activated in the Order Form (Brain, Catalog, Commerce, Intelligence) and of Atomo, including hosting, storage, indexing, search, AI-assisted classification, summarisation and generation, synchronisation with the systems connected by the Customer, support and backups.
• Nature: collection from connected sources, storage, organisation, structuring, retrieval, consultation, use, transmission to connected tools on the Customer's instruction, erasure. Processing is largely automated and includes AI-assisted analysis of communications; no decision with legal or similarly significant effects on data subjects is taken by the Service alone.
• Purpose: enabling the Customer to run its CRM, communications, knowledge base, finance, catalog, orders, stores, loyalty, customer care, analytics and marketing operations.
• Duration: the term of the subscription, plus the export and deletion periods in section 9.

3. Categories of data subjects and of data

• Data subjects: the Customer's employees, collaborators and Users; its customers, prospects, suppliers, partners and their staff; end consumers (orders, loyalty members, support requesters, marketing audiences); any third party appearing in communications, documents, calendars or call recordings connected to the Service.
• Categories of data: identification and contact data; professional data (role, company, department); content and metadata of emails, chats (including WhatsApp, Messenger, Instagram, Slack), calendar events, documents and files; audio recordings, transcripts and AI summaries of calls and meetings; commercial data (deals, quotes, contracts, invoices, payments); order, shipping, loyalty and purchase-history data; support tickets; marketing preferences, consents and campaign interactions; product and asset data (generally non-personal); technical data (logins, audit logs, IP addresses, identifiers); AI prompts and outputs.
• Special categories (art. 9), data of minors and criminal data are not required by the Service and must not be deliberately submitted unless agreed in the Order Form; their incidental presence in indexed communications is governed by the Customer's instructions (e.g. exclusion rules, retention limits).

4. Customer's obligations as controller

• Ensure a lawful basis (art. 6 GDPR) for every processing performed through Nucleo and provide data subjects with the information required by arts. 13-14, including information on the use of AI (Atomo) and on the sources connected.
• Employees' communications and files (Brain): comply with art. 4 of Italian Law 300/1970 (collective agreement with union representatives or authorisation of the National Labour Inspectorate, where the tools used may enable remote monitoring and are not strictly necessary for the job), art. 114 of the Privacy Code and the Data Protection Authority's guidelines on work email and internet; adopt an internal policy on the use of work tools; connect only work accounts; configure access so that colleagues and managers see only what is necessary; never use the Service to monitor employees' performance or behaviour, to reconstruct their activity or to infer emotions.
• Call recordings and transcripts: inform participants at the start of every recorded call, obtain agreement where required, and disable recording for participants who object.
• Messaging with consumers (WhatsApp Business, Messenger, Instagram): collect the required opt-in, respect Meta's policies and the consumers' rights, and provide the Customer's privacy notice.
• Marketing and profiling (Commerce, Intelligence): collect consents where required (art. 130 Privacy Code), honour opt-outs and objections, configure suppression lists, and review automated actions before approval.
• AI Act: the Customer is the deployer of Atomo within its organisation. It must ensure Users have adequate AI literacy (art. 4), not use the Service for practices prohibited by art. 5, inform workers and their representatives before deploying any AI use that qualifies as high-risk under Annex III (art. 26(7)) — a use Nucleo is not designed for — and keep human oversight over AI outputs and automated actions.
• Perform a data protection impact assessment (art. 35) where required — indexing of employees' communications with AI analysis and large-scale consumer profiling are typical triggers; we provide the information needed (section 7).
• Respond to data subjects' requests; keep contact data of its DPO/privacy contact updated in the Service.

5. Our obligations as processor

• Process personal data only on documented instructions, including for transfers outside the EEA, unless required by EU or Member State law (in which case we inform the Customer beforehand, unless prohibited).
• Ensure that persons authorised to process data are bound by confidentiality and trained, and access Customer Data only when necessary for support, security or maintenance, with logged access.
• Implement the technical and organisational measures in Annex A (section 11) and keep them up to date; assist the Customer with security of processing, breach notification, DPIAs and prior consultations (arts. 32-36).
• Assist the Customer, through the Service's functions and, where needed, our support, in responding to data subjects' requests (arts. 15-22); forward to the Customer without undue delay any request received directly.
• Notify the Customer of a personal data breach affecting Customer Data without undue delay and in any case within 48 hours of becoming aware of it, with the information available at that time, and complete it as investigation progresses, so that the Customer can meet its own 72-hour deadline under art. 33 GDPR.
• Not use Customer Data for our own purposes, not sell it and not use it to train AI models; use only aggregated, de-identified usage statistics to operate and improve the Service.
• Delete or return Customer Data at the end of the Service (section 9) and make available the information necessary to demonstrate compliance, allowing audits (section 8).
• Maintain a record of processing activities as processor (art. 30(2)) and, where applicable, appoint a DPO and an EU representative.

6. Sub-processors and AI providers

The Customer gives general authorisation to the sub-processors listed below and on the current sub-processor list delivered with the Order Form. We notify the Customer's administrators by email at least 30 days before adding or replacing a sub-processor; the Customer may object on reasonable data-protection grounds within that period, in which case we will seek a solution and, failing that, the Customer may terminate the affected module with a pro-rata refund. We impose on every sub-processor data-protection obligations equivalent to this DPA and remain fully liable for their performance.

• DigitalOcean LLC (USA; data centres Frankfurt and Amsterdam, EU) — cloud infrastructure, databases, object storage, backups.
• Twilio Inc. — SendGrid (USA; EU data residency region) — transactional and notification emails sent by the Service.
• Google Ireland Ltd. / Google LLC — Google Workspace APIs (Gmail, Calendar, Drive), Google Analytics 4 and Google Ads data sources, Google Merchant Center and Search Console connectors, BigQuery export — only for the sources the Customer connects.
• Microsoft Ireland Operations Ltd. / Microsoft Corporation — Microsoft 365 and Microsoft Teams connectors and Microsoft Clarity data source — only if connected.
• Meta Platforms Ireland Ltd. — WhatsApp Business Platform, Messenger, Instagram messaging and Meta Ads data source — only if connected; messaging content is processed by Meta under its own terms as independent controller/processor as described in its Business Terms.
• Slack Technologies Ltd. (Salesforce) — Slack conversations connector — only if connected.
• Klaviyo, Inc. (USA) — marketing platform synchronisation (profiles, consents, campaign events) — only if connected.
• Fireflies.ai Corp. (USA) — meeting recordings and transcripts imported into Brain — only if connected by the Customer.
• Documenso, Inc. (USA) — electronic signature of the documents the Customer sends for signature from Brain (the document, and the names and email addresses of the signers) — only if used by the Customer.
• Anthropic (Claude models), OpenAI (GPT models) and Google Ireland Ltd. / Google LLC (Gemini API) — the large language model providers routed by Atomo — processing of prompts, document excerpts and images submitted to Atomo for chat, classification, summaries, embeddings and text generation, under API terms that exclude the use of Customer Data to train their models and limit the retention of prompts. Transfers to the United States are covered by the EU-U.S. Data Privacy Framework or by Standard Contractual Clauses, depending on the provider. The Customer can restrict the providers used for its tenant in Settings → AI.
• Notion Labs, Inc. (USA) — Notion workspace connector (pages and databases imported into Brain) — only if connected by the Customer.
• Windsor.ai (Switzerland) — connectors for the marketing, advertising and analytics data sources of Intelligence — only for the sources the Customer connects.
• This is the complete list of our sub-processors at the date at the top of this page; any addition or replacement follows the notification procedure above.
• Systems the Customer connects (its ERP, e-commerce, helpdesk, marketplaces, payment providers, ad platforms) are the Customer's own providers, not our sub-processors: data flows to them only on the Customer's instruction and under the Customer's contracts with them.

7. International transfers

Customer Data is stored and processed in the European Union. Transfers to sub-processors established outside the EEA (support access, AI providers, US-based tools the Customer connects) are based on the EU-U.S. Data Privacy Framework for certified organisations and otherwise on the Standard Contractual Clauses (Decision 2021/914, modules 2 and 3) with a transfer impact assessment and supplementary measures (encryption, data minimisation in prompts, pseudonymisation where feasible). Upon request we provide the Customer with the relevant documentation. Nucleo's own systems (application, databases, storage, backups) are hosted exclusively in the European Union; the third-party providers listed in section 6 may process data in the United States under the Data Privacy Framework or the Standard Contractual Clauses, as indicated in their respective privacy notices.

8. Audits and information

We make available on request our security documentation, sub-processor list, penetration test summaries and third-party certifications or reports of our infrastructure providers. Not more than once per year (or after a breach or a request from a supervisory authority), the Customer may audit our compliance with this DPA, directly or through an independent auditor bound by confidentiality, with 30 days' notice, during business hours, without disrupting the Service and at its own cost; findings are confidential.

9. Return and deletion

• During the term, the Customer can export Customer Data through the Service (exports, APIs, warehouse push) and delete records at any time.
• After termination, Customer Data remains available for export for 30 days; it is then deleted from production systems within 60 days and from encrypted backups within a further 90 days, unless EU or Member State law requires retention (in which case data is isolated and processed only for that purpose). Deletion is confirmed in writing on request.
• Data sent to AI providers is retained by them only for the limited period set out in their API terms and is never used to train their models.

10. Liability

Each party is liable for damage caused by processing in breach of the GDPR under art. 82. Between the parties, liability under this DPA is subject to the limitations of the Terms of service (B16), except for damages arising from wilful misconduct or gross negligence and for administrative fines imposed on a party for its own infringement.

11. Annex A — Technical and organisational measures (summary)

• Hosting in EU data centres (Frankfurt, Amsterdam) on ISO 27001 / SOC 2 certified infrastructure; one logically separated database per customer tenant; dedicated architectures available under Custom.
• Encryption in transit (TLS 1.2+) and at rest (AES-256 on volumes, object storage and backups); secrets managed outside the code base and rotated; HSTS and modern cipher suites.
• Identity: single sign-on via our OpenID Connect identity provider, two-factor authentication, role-based access control per module with least-privilege defaults, session expiry, audit logs of administrative and data-access events retained for 12 months.
• Operations: infrastructure as code, automated CI/CD with tests and static analysis before deployment, dependency and vulnerability management, host firewalls limited to required ports, monitoring and alerting, public status page.
• Backups and continuity: daily encrypted backups with 30-day retention in the EU, with restore procedures tested periodically; documented recovery procedures for infrastructure incidents.
• AI safeguards: provider API terms with no training on customer data; prompts limited to the data necessary for the task; provider selection per tenant; AI outputs labelled; sending messages, deletions, merges, bulk operations and price changes require explicit human confirmation, other changes made by Atomo are logged and reversible, background AI activities can be switched off one by one; prohibited-use controls.
• People: confidentiality undertakings, access on a need-to-know basis, security and AI-literacy training, offboarding procedures; sub-processor due diligence and contracts.
• Incident management: documented response procedure, customer notification within the period in section 5, post-incident review.

12. How to obtain the signed DPA

The countersigned DPA (with the completed Annexes and the current sub-processor list) is delivered with your Order Form — or beforehand on request at privacy@nucleoplatform.com (or hello@madeinevolve.com).