1. Parties, application and definitions
This agreement is between ONMAKE S.r.l., identified in document 01 (the "Processor"), and the customer identified in the order or accession form (the "Customer"), for personal data processed on the Customer's behalf through Editor Ultra. The Customer is a controller or a processor authorised to appoint ONMAKE as sub-processor. In the latter case instructions must comply with those of the original controller and the Customer ensures the required authorisation. GDPR terms have their meaning under Regulation (EU) 2016/679.
This agreement and Annexes A-D become binding through electronic acceptance or signature linked to the parties' identities and the version. Enabling personal-content processing requires the complete sub-processor list and applicable safeguards to be available to the Customer: a brand name alone does not identify the appointed legal person. The DPA prevails over general terms on data protection; it is not an international-transfer standard contractual clause.
Processing for which ONMAKE legitimately determines its own purposes, including its commercial relationship, tax obligations and legal claims, is outside this DPA and described in notice 03. This distinction does not allow ONMAKE freely to reclassify customer documents as its own data.
2. Instructions and purposes
ONMAKE processes data only on documented Customer instructions, including service functions, this agreement and requests from authorised users. Ordinary instructions include requested import, processing, saving, verification, export and erasure. User-selected external destinations must be lawful and compatible with GDPR Chapter V; a command does not cure an unlawful transfer.
ONMAKE does not use content for advertising, data commercialisation, AI-model training or improvement, independent profiling or development using unauthorised real data. It does not supply AI models of its own and does not send content to AI providers: transmissions to an AI provider chosen by the Customer or its users (in-browser assistant, MCP, REST API) take place by the Customer's decision and are not processing carried out by ONMAKE on its behalf. If law requires further processing, ONMAKE informs the Customer beforehand unless legally prohibited. If an instruction infringes applicable law, ONMAKE promptly informs the Customer and suspends only the affected operation pending clarification or correction, subject to overriding duties.
3. Customer duties
The Customer determines purposes, data and individual categories and ensures lawful bases, notices, user authority and lawful documents, including articles 9 and 10 conditions where relevant. It assesses suitability for professional use and does not upload data requiring safeguards not met by the agreed measures. Customer responsibility does not remove the Processor's own duties.
The Customer gives consistent instructions, updates permissions, protects credentials and cooperates on incidents and rights. Additional requirements such as residency, enhanced confidentiality or sector rules must be agreed before processing; they are not presumed from subscription alone.
4. Confidentiality and authorised personnel
ONMAKE limits access to persons needing it for assigned tasks, binds them to confidentiality or verifies an equivalent legal duty, gives appropriate instructions and training, and promptly revokes unnecessary access. Privileged access must be identifiable and traceable. Staff must not copy documents to personal environments, development repositories or unauthorised AI tools. Confidentiality survives termination.
5. Security
ONMAKE implements risk-appropriate technical and organisational measures under article 32, including at least Annex B commitments. It considers data categories, the state of the art, costs, nature, purposes and risks to people, and periodically assesses effectiveness, availability, integrity, confidentiality and recoverability. It does not materially reduce safeguards during the relationship; equivalent or improved changes are documented.
A contractual safeguard must be implemented before processing the data to which it applies. Adopting a DPA is not a test certificate and does not make an unmitigated known vulnerability acceptable. For a critical defect, ONMAKE disables the affected function or applies proven equivalent mitigation, informing the Customer where necessary.
6. Sub-processors
The Customer gives general authorisation only for the categories and entities identified in the validated named list in Annex C supplied with the DPA. Before additions or replacements, ONMAKE gives at least thirty days' notice of identity, tasks, location and safeguards, allowing reasoned data-protection objections. ONMAKE seeks a reasonable alternative; if none exists, the Customer may terminate only the affected service without penalty and receive the unused prepaid portion.
If urgent replacement is required to prevent a serious risk or comply with law, ONMAKE informs the Customer as soon as possible, documents urgency and preserves objection and termination rights. It imposes substantially equivalent obligations on sub-processors and remains responsible to the Customer for their performance under article 28(4). Authorisation does not cover AI providers, unidentified recipients or non-compliant transfers.
7. Rights and assistance
Taking account of the processing, ONMAKE assists through appropriate measures with access, rectification, erasure, restriction, objection and portability. Requests concerning Customer documents are forwarded without undue delay, normally within three working days; ONMAKE does not substantively respond without instructions unless law requires it. It must not collect disproportionate additional identification data.
ONMAKE provides information and assistance for impact assessments, prior consultation, security and authority investigations, considering information available to it. Ordinary assistance and assistance needed to remedy its own breach attract no extra charges. Extraordinary work outside ordinary service may be subject to reasonable charges agreed beforehand, without delaying mandatory duties.
8. Personal data breaches
ONMAKE notifies the Customer without undue delay after becoming aware of a personal data breach and commits to an initial notice within twenty-four hours. It does not wait for a completed investigation. Notice, provided in stages if necessary, describes the nature, indicative categories and numbers of individuals and records, likely consequences, measures taken or proposed and operational contact, to the extent then known.
ONMAKE preserves evidence, contains risks, records the incident and assists notifications and communications. The Customer decides and performs its own notifications, including the GDPR seventy-two-hour deadline where applicable; ONMAKE's contractual deadline does not replace it. Neither party communicates in the other's name without authority unless legally required. Reporting is not automatically an admission of liability.
9. Transfers and authority requests
Declared ordinary locations are in Annex C. ONMAKE neither transfers data nor permits non-EEA access without documented instructions and a valid Chapter V mechanism, including required assessments and supplementary measures. Where standard clauses are used, the module appropriate to the actual relationship is selected; this DPA does not replace clauses under Decision (EU) 2021/914.
ONMAKE informs the Customer of binding authority requests concerning its data unless prohibited, verifies legality, limits disclosure to what is necessary and uses reasonably available remedies against disproportionate or unlawful requests. It does not automatically recognise non-EU orders contrary to applicable law, including GDPR article 48.
10. Duration, return and erasure
Processing lasts as needed for the service and completion of return and erasure under Annex D. On termination the Customer chooses return or erasure, subject to mandatory retention. Return uses common machine-readable formats and is free for ordinary operations; ONMAKE does not make retrieval conditional on plan renewal.
After retrieval, or earlier on instruction, data is erased from active systems and subsequently backups within the agreed periods. Legally retained data is isolated, used only for that obligation and erased when it ends. ONMAKE confirms completion on request, identifying residual copies and their latest deletion date. Local copies controlled by the Customer and copies at its chosen destinations are not falsely represented as erased by ONMAKE.
11. Information, audits and cooperation
ONMAKE supplies information necessary to demonstrate article 28 compliance, including sub-processors, relevant records, safeguard summaries and control results. The Customer may audit or appoint an independent auditor, ordinarily on ten working days' notice and once yearly. Those limits do not apply to incidents, substantiated suspicion of breach or authority requests.
Arrangements protect security, other customers' data and relevant secrets without making audit rights ineffective. Independent reports may streamline, not eliminate, further necessary checks. Each party normally bears its own costs; ONMAKE bears remediation of its breaches. Authority access is not conditional on commercial arrangements or contractual notice.
12. Liability, termination and accession
Liability to individuals and allocation between parties follow the GDPR and law. Commercial caps do not limit article 82 rights or mandatory duties. Automatic transferability of administrative penalties is not promised. For an uncured serious breach or persistent unlawful instructions, the non-defaulting party may terminate the affected service with reasons, preserving return and rights.
Customer identity and address are those of the order; the privacy contact may be updated without changing controllership. For accession outside checkout: Customer legal name ____________________; identifier and registered address ____________________; representative and authority ____________________; privacy contact/email ____________________; order reference ____________________; date and signature ____________________. ONMAKE authorised representative ____________________; date and signature ____________________. Electronic accession replaces these fields with verified particulars and retained acceptance evidence.
Annex A. Description of processing
Subject matter: the Editor Ultra web service and processing of content the Customer saves on ONMAKE servers or sends to the server for processing. Nature: receiving, organising, processing, converting, technical checking, requested storage, authorised access, return and deletion; transmission to expressly instructed destinations (FTP/FTPS/SFTP servers indicated by the Customer). Purpose: carrying out those operations and strictly necessary security and support measures, not independent analysis of content.
Data subjects: the Customer's users and collaborators, clients and assisted persons, counterparties, employees, suppliers and persons named in documents. Data: identifiers, contact details, professional, financial and contractual information, document content, metadata, images and signatures. Special categories and criminal-offence data only within lawful instructions and adequate measures.
Frequency: according to use. Duration: the relationship plus return and deletion. Sources: the Customer and authorised users. Data that stays only on the device is not acquired by ONMAKE until an operation transfers it to the server. Transmissions to AI providers chosen by the Customer or its users are not ONMAKE processing on the Customer's behalf.
Annex B. Measures applied
Identity and segregation. Authentication with an ONMAKE account; server-side user verification on each request; a separate document folder per user; a per-user store of FTP connections with permissions restricted to the service; subscription, block and suspension checks at sign-in and every two minutes during use. For external agents: revocable personal keys or OAuth authorisation, a limit of twenty invalid attempts per ten minutes per address, a call log without content.
Data lifecycle. Server-side PDF previews held in memory with a thirty-minute expiry; document deletion available even after termination; FTP connection passwords are not saved on the server. End-to-end encryption is not represented.
Technical management. Component updates, validation of inputs and file paths, conversions run by the engine installed on the same machine as the service, incident handling under document 10. Other measures or service levels (for example encryption at rest, recovery times) apply only if agreed in the order.
Annex C. Supplier chain
Application infrastructure: Microsoft Azure, declared region Italy North, for execution, storage and relevant copies. Accounts and authorisations: Supabase, EU Frankfurt region, for identity, permissions, subscriptions and the agent log. Email and website: Aruba, in Italy, for sign-in emails and hosting of www.onmake.it. Inclusion in the DPA depends on actual operations on content: part of account management remains in ONMAKE's independent role.
The ExactDOC conversion engine is installed on the same machine as the service. Stripe and Openapi, for payments and invoices of ONMAKE's own relationship, are not sub-processors of the Customer's documents. No AI model provider is engaged by ONMAKE: AI providers chosen by the Customer or its users are not ONMAKE sub-processors.
Annex D. Retention and deletion
Active documents: until deletion or termination; after termination, reading, exporting and deleting under document 12. PDF previews: at most thirty minutes from creation. Backups and logs follow the periods communicated by ONMAKE to the Customer; retention of invoices and contract evidence by ONMAKE as controller is governed separately and does not authorise general retention of the Customer's documents. A legal impediment to deletion is communicated and limited.