MyPeritoBack to home

LEGAL DOCUMENT — TEMPLATE

Data Processing Agreement (DPA)

Version: 2.0 · Last updated: 2026-07-10 · Legal reference: Art. 28 GDPR (Reg. (EU) 2016/679)

BETWEEN

MyPerito — hereinafter "the Data Processor"
Andrea Salomone — sole trader under the Italian flat-rate tax regime (self-employed professional); Italian VAT number 14760190968; Italian tax code SLMNDR95C13D969M; registered office and domicile at Via S. Bartolomeo del Fossato 20, 16149 Genova (GE); not registered with the Italian Companies Register (no REA number); certified email (PEC) salomone.io@pec.it; data protection contact: privacy@perito.my.

AND

[Client] — hereinafter "the Data Controller"
[Company name, registered office, VAT number, tax code, legal representative — completed at the time of signature.]

(collectively, "the Parties")

Recitals

A. The Controller has entered into a service contract with MyPerito for the use of the MyPerito platform to generate insurance survey reports (hereinafter, "the Service").

B. In providing the Service, MyPerito processes personal data on behalf of the Controller pursuant to Art. 28 of Regulation (EU) 2016/679 ("GDPR").

C. The Parties wish to govern the terms of that processing, in accordance with the applicable legislation.

Article 1 — Subject matter and duration

1.1 Subject matter of the processing: personal data contained in the documents uploaded by the Controller to the platform (survey case files, photographs, insurance policies, official records, records of the Controller's clients), as well as data automatically extracted from the documents.

1.2 Categories of data subjects: the Controller's clients, counterparties, surveyors, witnesses, third-party surveyors, persons involved in the claims covered by the survey reports.

1.3 Duration: the processing lasts as long as the main contract; the confidentiality and return/deletion obligations survive termination.

Article 1-bis — Special categories and criminal-offence data

1-bis.1 The Parties acknowledge that the documents and Case Contents uploaded by the Controller may include special categories of personal data within the meaning of Art. 9 GDPR (in particular data concerning health and personal injury) and, in certain cases, personal data relating to criminal convictions and offences within the meaning of Art. 10 GDPR.

1-bis.2 The Data Controller identifies and documents the legal basis for processing such data: for data under Art. 9 GDPR, most probably Art. 9, para. 2, letter f) (establishment, exercise or defence of legal claims); for data under Art. 10 GDPR, the conditions laid down in Articles 2-octies and 2-sexies of D.Lgs. 196/2003 (the Italian Codice Privacy).

1-bis.3 In view of the nature of such data, the Processor adopts technical and organisational measures appropriate to the risk pursuant to Art. 32 GDPR (see Article 5 and Annex A).

1-bis.4 Taking into account the nature of the processing (large-scale use of artificial intelligence systems to process data under Art. 9 GDPR), the processing is most probably subject to a data protection impact assessment (DPIA) pursuant to Art. 35 GDPR, which it is for the Controller to carry out; pursuant to Art. 28, para. 3, letter f), the Processor provides the technical information and assistance necessary for that purpose.

Article 2 — Nature and purposes

The Processor processes the personal data solely for:

  • structured extraction of the data from the uploaded documents;
  • automated generation of the survey report draft;
  • storage of, access to and download of the documents and reports by the Controller;
  • technical support requested by the Controller;
  • fulfilment of the legal obligations to which MyPerito is subject.

The Processor does not use the data for its own purposes, for marketing, for profiling, or to train artificial intelligence models.

Article 3 — Obligations of the Processor

The Processor undertakes to:

a) process the personal data solely on the basis of documented instructions from the Controller, including those relating to transfers outside the EU; the main contract and this DPA constitute the initial instructions;

b) ensure that the persons authorised to process the data are bound by confidentiality;

c) adopt appropriate technical and organisational measures pursuant to Art. 32 GDPR (see Article 5 and Annex A);

d) assist the Controller in handling data subject requests (Arts. 12–22 GDPR), within reasonable and proportionate timeframes;

e) notify the Controller, without undue delay and in any event within 24-48 hours of discovery, of any personal data breach, providing the information required by Art. 33 GDPR;

f) return or delete the personal data at the end of the contract, according to the timeframes set out in MyPerito's Data Retention and Deletion Policy;

g) make available to the Controller the information necessary to demonstrate compliance with the obligations of this DPA, and allow audits (including through qualified third parties appointed by the Controller) on reasonable notice and with due regard for the confidentiality of the Service's other clients.

h) assist the Controller, taking into account the nature of the processing and the information available to the Processor, in complying with the obligations under Arts. 32–36 GDPR, including communication of the breach to the data subjects (Art. 34), the data protection impact assessment — DPIA (Art. 35) and prior consultation of the supervisory authority (Art. 36);

i) immediately inform the Controller if it considers that an instruction given infringes the GDPR or other applicable data protection provisions (Art. 28, para. 3, final subparagraph).

Article 4 — Sub-processors

4.1 The Controller gives the Processor general authorisation to engage Sub-processors for the provision of the Service. The up-to-date list is:

  • Google LLC / Google Cloud EMEA Limited (Google Cloud Platform, Vertex AI / Gemini, Cloud SQL, Cloud Storage, Firebase Authentication) — storage and database in europe-west1 (Belgium); AI inference (Gemini) and Firebase authentication may take place outside the EU (see Art. 6). Certified under the EU-US Data Privacy Framework.
  • Anthropic, PBC (Claude — document generation on custom templates, "Stage-3") — processing in the USA; safeguards under Art. 6.
  • Resend, Inc. (delivery of transactional email) — delivery metadata only; no case-file content.
  • Sendinblue SAS (Brevo) (sending/receiving transactional email) — France/EU.
  • Stripe, LLC (payment processing) — processing in the USA; certified under the EU-US Data Privacy Framework (active).

4.2 The Processor gives the Controller at least 30 days' notice of any change to the list of Sub-processors. The Controller may object on documented grounds; in that case the Parties will negotiate an alternative solution or, failing that, the Controller may terminate the main contract.

4.3 The Processor imposes on its Sub-processors data protection obligations equivalent to those of this DPA.

Article 5 — Security measures (Art. 32 GDPR)

The technical and organisational measures adopted are described in Annex A and include, in summary:

  • AES-256 encryption at rest, TLS 1.2+ in transit;
  • multi-tenant isolation at database level (Row Level Security) and at storage level (path-tenancy);
  • authentication on every API request; signed download links with a 15-minute expiry;
  • data storage in the EU (europe-west1, Belgium); AI inference may take place outside the EU with appropriate safeguards (see Art. 6);
  • internal access logged and restricted to authorised personnel;
  • automatic daily Cloud SQL backups (14-day retention) and deletion protection;
  • automatic cleanup of temporary files at the end of processing.

Article 6 — Transfers outside the EU

Case-file storage and the database reside in the European Union (europe-west1, Belgium). Some processing involves a transfer outside the EU: AI inference through Google Vertex AI / Gemini and Firebase authentication (Google LLC, USA, certified under the EU-US Data Privacy Framework) and "Stage-3" document generation through Anthropic, PBC (USA). Those transfers are governed by the safeguard mechanisms of Chapter V of the GDPR — adequacy decision (DPF) and/or Standard Contractual Clauses (SCC) with supplementary measures (Transfer Impact Assessment), being formalised for suppliers not certified under the DPF.

In particular, for AI inference through Google Vertex AI / Gemini the processing may be routed to the «global» endpoint, which is not limited to the territory of the United States: that transfer is therefore covered — in addition, where applicable, to Google's certification under the EU-US Data Privacy Framework — by Google Cloud's Standard Contractual Clauses (SCC), supplemented by additional measures (Transfer Impact Assessment).

Article 7 — Deletion and return

On termination of the main contract, the Processor:

a) allows the Controller to export the data in a structured format (JSON/CSV for structured data; original formats for documents);

b) irreversibly deletes or returns the personal data on the Controller's instructions or at the end of the contractual relationship, save for data subject to legal retention obligations (e.g. invoicing); no automatic deletion at a fixed deadline is provided for;

c) on the Controller's written request, provides documented confirmation that the deletion has taken place.

d) retains the personal data only for the period necessary for the purposes of the Service and in any event no longer than the retention period defined by the Controller on the basis of its own legal and professional obligations; the Processor does not determine that period on its own and subjects the data to periodic review to verify its continuing necessity, deleting data that is no longer necessary.

Article 8 — Liability

The liabilities of the Parties are governed by the main contract and by the applicable legislation. Nothing in this DPA alters the limits of liability set out therein.

Article 9 — Amendments

Any amendment to this DPA requires written agreement between the Parties. In the event of legislative developments, the Parties undertake to renegotiate it in good faith.

Article 10 — Governing law and jurisdiction

This DPA is governed by Italian law. The courts of [to be defined at the time of signature] have exclusive jurisdiction over any dispute.

Annex A — Technical and organisational measures

Summarised from the Security one-pager (PDF) v1.1 and from the Retention Policy v1.0. Attached to this DPA at the time of signature.

  • Encryption: AES-256 at rest, TLS 1.2+ in transit.
  • Isolation: multi-tenant PostgreSQL Row Level Security; GCS path-tenancy.
  • Authentication: Firebase Authentication on every API request; signed URL with a 15-min TTL.
  • Residency: Google Cloud europe-west1 (Belgium).
  • Vertex AI Enterprise: contractual no-training clause on customer data.
  • Cleanup: automatic at the end of processing for temporary files; for persistent data, deletion on the Controller's request or at the end of the relationship (see Art. 7), with no automatic deletion at a fixed deadline.
  • Logging: every internal access to production data is logged.

Template for MyPerito internal use. To be personalised with counterparty details and contractual references at the time of signature. For enquiries: andrea@salomone.io.