Data Processing Agreement (DPA)

This agreement applies when a Vela user (the "Customer") uses the platform to collect personal data from third parties — such as visitors filling out a booking or contact form on a website built with Vela. In this case, the Customer is the Data Controller of that data and Vela is the Data Processor pursuant to Art. 28 GDPR. By accepting the Terms of Service, the Customer also accepts this agreement.

Parties

The Customer — the user holding a Vela license, as identified in their account details (the "Controller")

DIDIWEB DI DONNA MICHAEL — P.IVA 12288510964 — C.F. DDNMHL92R09B300B — Via Parma 48, 20025 Legnano (MI) — email michael.didonna.92@gmail.com (the "Processor" or "Vela")

1. Background and Definitions

1.1 The Controller uses the Vela platform to build and manage their website and, through it, collect personal data from their end users/customers (the "Visitors").

1.2 While providing the service, Vela processes this data solely on behalf of and under the instructions of the Controller, acting as Data Processor.

1.3 The terms "personal data", "processing", "controller", "processor", "data subject", and "personal data breach" have the meanings set out in Art. 4 GDPR.

2. Subject Matter, Nature, and Purpose of the Processing

Subject matter	Processing of Visitors' personal data collected through the Controller's website built with Vela
Nature and purpose	Receiving, storing, organizing, and providing the Controller with the data submitted by Visitors through the website forms (bookings, contact requests), solely to allow the Controller to manage them; sending related notifications to the Controller
Duration	For the entire duration of the service contract between the Parties
Data Subjects	Visitors/end customers of the Controller's website who fill out the forms
Categories of Data	Personal and contact details (name, email, phone), request/booking details (date, time, service, number of people, free-text message, and any additional fields set by the Controller), IP address for security purposes

The Controller must not use the forms to collect special categories of data (Art. 9 GDPR) without having an appropriate legal basis in place and informing Vela; the Controller remains solely responsible for the lawfulness of the data they choose to collect.

3. Obligations of the Processor

Vela agrees to:

• Documented instructions — process data only on documented instructions from the Controller (including those given through the platform settings and this agreement), unless required by law, in which case it will inform the Controller.
• Confidentiality — ensure that anyone authorized to process the data is committed to confidentiality.
• Security (Art. 32) — implement appropriate technical and organizational measures (Annex B), including encryption, access control, communication security, system resilience, and recovery procedures.
• Sub-processors — engage other processors only under the conditions set out in Section 4, holding them to the exact same protection standards.
• Support to the Controller — helping you handle requests from data subjects (articles 15-22) and meet obligations regarding security, data breaches, and impact assessments (articles 32-36).
• Data breaches — notifying you without undue delay after becoming aware of any incident, providing the details needed to meet your notification duties (articles 33-34).
• Deletion or return — at your choice, deleting or returning all personal data once the contract ends, unless legally required to keep it. You can delete individual requests/bookings at any time directly through the platform (permanent deletion). When the service ends (account deletion), all Visitor data is completely deleted.
• Compliance and audits — providing the information needed to demonstrate compliance with article 28 and allowing audit activities under agreed terms and with reasonable notice.

4. Authorized sub-processors

Sub-processor	Service	Location
Serverplan S.r.l.	Server and database infrastructure hosting the website and the collected data	Italy (EU)
Google (Firebase Cloud Messaging)	Delivering push notifications about new requests to the Controller	Non-EU (USA)
Serverplan S.r.l. (email)	Sending notification emails to the Controller	Italy (EU)

Vela will inform you of any additions or replacements of sub-processors, giving you the opportunity to object on legitimate grounds. For data transfers outside the EU, adequate safeguards apply under Chapter V of the GDPR (Data Privacy Framework and/or Standard Contractual Clauses).

5. Transfers to third countries

Any transfer of data to non-EU countries takes place exclusively with adequate safeguards in place pursuant to articles 44 et seq. of the GDPR (adequacy decision, EU-U.S. Data Privacy Framework adherence, or Standard Contractual Clauses).

6. Liability and duration

6.1 This agreement takes effect upon acceptance of the Terms of Service and remains in force for the entire duration of the contractual relationship, ending with it.

6.2 Each Party is liable for damages caused by data processing within the limits of Art. 82 of the GDPR.

6.3 For anything not expressly covered, reference is made to the GDPR and applicable law. Jurisdiction: the courts where the Processor has its registered office, unless mandatory law states otherwise.

Annex A — Processing details

• Data subjects: visitors/end customers of the websites created by the Controller with Vela.
• Types of data: name, email, phone number, request details and message, custom fields set by the Controller, IP address.
• Operations: collection via form, storage, viewing by the Controller, notification, deletion.
• Purpose: to allow the Controller to receive and manage bookings and requests from their customers.

Annex B — Security measures (Art. 32)

• AES-256-GCM encryption of sensitive data and caches; transmission via HTTPS/TLS.
• Argon2ID password authentication; protected sessions (HttpOnly/SameSite/Secure); anti-CSRF tokens.
• Role- and license-based access control; data isolation per Controller.
• Rate-limiting and automatic IP bans; IP pseudonymization in statistics.
• Backups and recovery procedures; logging of administrative activities (audit).

Annex C — List of sub-processors

As per Section 4. The updated list is available upon request to the Processor.