Data Processing Agreement

The parties

This agreement is entered into between the organisation that uses SCDD and accepts the Terms of Service (the “Customer”), as controller, and CIRCULARWARE S.R.L., with its registered office at Via dell'Ospedale 16, 12062 Cherasco (CN), Italia, VAT no., tax code and Companies Register number 04067220048, REA CN-333814, share capital � 10.150,00 i.v., PEC circularwaresrl@pro-pec.it (“CircularWare”), as processor.

Recitals

A. CircularWare provides SCDD, a web service for supply chain due diligence with which each company prepares its own dossier (profile, self-assessment, documents, improvement plan, production capacity), shares it with the clients it chooses and answers the checklists its clients ask it to fill in, also with the help of delegated consultancy firms.

B. To prepare the dossier the Customer may upload personal data of other people, in particular of its own workers. For this data the Customer is the controller and CircularWare processes it on its behalf.

C. As Art. 28 GDPR requires, this agreement sets out the instructions, obligations and safeguards of this processing. It is part of the SCDD Terms of Service; as regards data protection, it prevails over them.

1. Definitions

1.1 Terms defined in the GDPR, such as “personal data”, “processing”, “controller”, “processor”, “personal data breach” and “data subject”, have the meaning the GDPR gives them; capitalised terms are defined in this article.

1.2 Customer Data: the personal data that the Customer, its Users or the firms it has delegated enter or upload in the Customer's area on SCDD, and that CircularWare processes on behalf of the Customer. They are described in Annex A.

1.3 Users: the people who work on SCDD for the Customer, as its members or as members of a Delegated Firm.

1.4 Delegated Firm: the consultancy firm to which the Customer has given an open delegation on SCDD.

1.5 Recipient Customer: the organisation with which the Customer, as a supplier, has shared its dossier.

1.6 Sub-processor: a supplier of CircularWare that processes Customer Data (Annex C).

2. Subject matter, roles and scope

2.1 CircularWare processes Customer Data as processor, solely to provide SCDD to the Customer: to store it, organise it, show it to authorised Users, disclose it to the Recipient Customers and the Delegated Firms chosen by the Customer, produce PDF reports, and delete it. The nature, purposes, duration, categories of data and of data subjects are set out in Annex A.

2.2 CircularWare is instead an independent controller of the data it processes to run the service and the contract, described in the SCDD Privacy Policy: Users' account data, invitations, billing and payment data, the log of Recipient Customers' access to shared dossiers, security data, site statistics. This agreement does not cover them. [[TO BE DECIDED: role for the access log, item 2]]

2.3 The Customer may itself be a processor on behalf of another controller (for example a consultancy firm that uses SCDD for its own clients). In that case the Customer declares that it has the controller's written authorisation to use CircularWare as a further processor, on the terms of this agreement, and CircularWare acts as the Customer's sub-processor.

2.4 CircularWare does not process Customer Data for its own purposes. It may use aggregated data on the use of the service (for example how many organisations, invitations or delegations there are) that contain neither dossier content nor data identifying data subjects. [[TO BE DECIDED: item 13]]

3. Customer's instructions

3.1 CircularWare processes Customer Data only on documented instructions from the Customer, including with regard to transfers outside the European Economic Area (EEA), unless required to do so by Union or Member State law; in that case it informs the Customer beforehand, unless the law prohibits this.

3.2 The Customer's documented instructions are: the Terms of Service and this agreement; the choices made by Users with SCDD's functions, such as uploading or deleting a document, choosing “available during audit”, granting or revoking sharing, showing or hiding the load of the production lines, inviting people, giving, changing or revoking a delegation, submitting a checklist requested by a client; the Customer's written requests to CircularWare, within the limits of the service's functions.

3.3 CircularWare informs the Customer immediately if it considers that an instruction infringes the GDPR or other data protection rules.

4. Customer's obligations

4.1 The Customer warrants that it has a legal basis for uploading Customer Data and, for special categories of data (Art. 9 GDPR), one of the conditions of Art. 9(2), such as obligations under employment law and occupational health and safety law.

4.2 The Customer informs data subjects of the processing (Arts. 13 and 14 GDPR), including by naming CircularWare as processor and the Recipient Customers to which it discloses the dossier.

4.3 The Customer uploads only the data that is necessary. For document types containing workers' personal data, SCDD proposes “available during audit” (the document is declared and shown to the auditor, without being uploaded); if the Customer chooses to upload them, it does so under its own responsibility. In particular, the Customer does not upload:

• occupational health and risk records or other clinical documentation of workers: of medical examinations, upload at most the fitness-for-work assessments;
• data relating to criminal convictions and offences (Art. 10 GDPR);
• the identity of anyone who has made a report protected by Legislative Decree 24/2023, or other data that would allow them to be identified: SCDD is not a whistleblowing channel;
• data of persons not connected with supply chain due diligence.

4.4 SCDD keeps away from Recipient Customers only the files of the document types that the catalogue marks as containing workers' personal data (Annex A). A document uploaded under another type can be viewed and downloaded by Recipient Customers: the Customer does not enter in it personal data that it does not want to disclose, or redacts it before uploading.

4.5 The Customer chooses and manages its own Users, roles, delegations to Delegated Firms and shares, and is responsible for them.

4.6 The Customer's instructions comply with the GDPR. The Customer is responsible for the Customer Data disclosed, at its choice, to Recipient Customers and Delegated Firms.

5. Authorised persons and confidentiality

5.1 CircularWare allows access to Customer Data only to persons who need it to operate, maintain and support the service, who are authorised in writing and bound to confidentiality or subject to a statutory duty of confidentiality.

5.2 The SCDD platform administrators, within the application's functions, do not enter organisations' areas: they see only payments, billing data, scoring rules and aggregate statistics. Direct access to servers, databases and the file archive is restricted to the persons who manage the infrastructure [[TO BE COMPLETED: list of roles]].

5.3 CircularWare accesses an organisation's content only when this is needed for support requested by the Customer, for the security of the service or to comply with the law.

6. Security

6.1 CircularWare applies the technical and organisational measures in Annex B, appropriate to the risk as Art. 32 GDPR requires.

6.2 CircularWare may change the measures over time without lowering the overall level of security. Annex B also states which measures are currently missing: CircularWare updates them and informs the Customer.

7. Sub-processors

7.1 The Customer gives CircularWare a general authorisation to use the Sub-processors in Annex C.

7.2 CircularWare informs the Customer of the addition or replacement of a Sub-processor at least 30 days in advance, by email to the Customer's administrators and by updating the list on the site. An example: an artificial intelligence service to recognise documents, should one be introduced.

7.3 Within those 30 days the Customer may object on reasonable grounds relating to data protection. If no solution is found, the Customer may terminate the contract before the change takes effect, with a refund of the unused part of the periods paid.

7.4 CircularWare imposes on each Sub-processor, by contract, data protection obligations no less strict than those of this agreement, and remains liable to the Customer for the Sub-processors' performance (Art. 28(4) GDPR).

8. Transfers outside the European Economic Area

8.1 CircularWare transfers Customer Data outside the EEA only with one of the safeguards of Chapter V GDPR (adequacy decision, standard contractual clauses with any supplementary measures, or another permitted safeguard). Current transfers are in Annex C.

8.2 When the Customer shares the dossier with a Recipient Customer or delegates a firm established outside the EEA, the transfer is decided by the Customer, who checks its conditions. [[TO BE DECIDED: item 4]]

9. Assistance to the Customer

9.1 Data subjects' rights. Taking into account the nature of the processing, CircularWare helps the Customer to respond to data subjects' requests (Arts. 15-22 GDPR): through the service's functions (viewing, correcting, deleting documents, downloading files) and, where these are not enough, through interventions on written request within 10 working days. CircularWare does not respond directly to data subjects about Customer Data: it forwards to the Customer, within 5 working days, the requests it receives.

9.2 Security, impact assessments, consultations. CircularWare helps the Customer to comply with Arts. 32-36 GDPR, by providing the information it holds on the service, including for an impact assessment (DPIA). [[TO BE COMPLETED: a model DPIA of the service, item 12]]

10. Personal data breaches

10.1 CircularWare notifies the Customer of any personal data breach affecting Customer Data without undue delay and in any event within 48 hours of becoming aware of it, following the procedure in Annex D.

10.2 The notification contains, to the extent known, the information in Art. 33(3) GDPR; any missing information is provided as soon as it becomes available.

10.3 CircularWare immediately takes reasonable measures to contain the breach and mitigate its effects, and cooperates with the Customer. Notifying the supervisory authority and communicating the breach to data subjects (Arts. 33 and 34) is for the Customer; CircularWare does not do so in its place, unless agreed in writing or required by law.

10.4 CircularWare documents every breach affecting Customer Data: the facts, effects and measures taken.

11. Information and audits

11.1 CircularWare makes available to the Customer the information necessary to demonstrate compliance with Art. 28 GDPR: this agreement, the list of Sub-processors, the description of the measures and, on request, answers to a security questionnaire.

11.2 If the information is not enough, the Customer may have an audit carried out, including on site, by an independent auditor bound by confidentiality: at most once a year, with at least 30 days' written notice, during working hours, without access to the data of other organisations and at the Customer's expense. The annual limit and the Customer's bearing of the costs do not apply after a personal data breach affecting the Customer or if a supervisory authority so requests. [[TO BE DECIDED: item 9]]

12. Consultancy firms and delegations

12.1 A delegation is an instruction from the Customer to let the people of the Delegated Firm work in its area, with the role the Customer chooses and until expiry or revocation. The Delegated Firm's people see everything that a member of the Customer with the same role sees, including the files of documents containing workers' personal data.

12.2 The relationship between the Customer and the Delegated Firm, including as regards data protection (for example, appointing the Delegated Firm as processor), is a matter between them: CircularWare is not a party to it and is not responsible for the Delegated Firm's processing.

12.3 When a consultancy firm creates on SCDD the company of one of its clients, the firm declares that it has been instructed by the client to do so and that it accepts the Terms of Service and this agreement on the client's behalf. The client becomes the Customer under this agreement and may at any time enter with its own people and change or revoke the delegation. [[TO BE DECIDED: item 1 and item 3]]

12.4 The Customer may revoke the delegation at any time: the Delegated Firm loses access immediately.

13. Sharing the dossier with Recipient Customers

13.1 Sharing is an instruction from the Customer to disclose to a Recipient Customer: the statuses and expiry dates of documents, the files of the document types without workers' personal data, the result of the latest submitted self-assessment and, only if the Customer chooses this separately, the weekly load of the production lines, without orders, client names or notes. Document notes, sites, the improvement plan and drafts are not disclosed. Of the checklists the Recipient Customer has requested from the Customer, sharing discloses to that Recipient Customer only the result of the latest submitted self-assessment, with the notes on “no” and “partly” answers and the answers to the questions, except those to common library questions marked as containing personal data; the name of the person who submitted it is not disclosed.

13.2 Of documents containing workers' personal data, the Recipient Customer sees only their existence, status and dates, never the files.

13.3 The Recipient Customer processes what it sees or downloads, including PDF reports, as an independent controller. CircularWare logs every opening of the dossier or of the result of a checklist and every download of a file or report by the Recipient Customer, and the Customer can consult the log.

13.4 Revoking sharing takes effect immediately for subsequent accesses; it does not affect copies already downloaded.

14. Term, deletion and return

14.1 This agreement lasts as long as the contract between the Customer and CircularWare for the use of SCDD and, thereafter, for as long as CircularWare processes Customer Data.

14.2 During the contract, data that the Customer deletes using the service's functions is deleted immediately from the database and the file archive, and from backups within their rotation period.

14.3 At the end of the contract CircularWare, at the Customer's choice, returns and then deletes the Customer Data, following the procedure in Annex E, unless Union or Member State law requires it to be retained.

15. Liability

15.1 Each party is liable to data subjects as provided in Art. 82 GDPR. As between the parties, what is laid down in the Terms of Service applies. [[TO BE DECIDED: item 10]]

16. Final provisions

16.1 As regards data protection, this agreement prevails over the Terms of Service; for the rest the latter apply, including governing law and jurisdiction.

16.2 CircularWare may update this agreement and its annexes to bring them into line with the law, with the guidance of the authorities or with the service, under the same rules as changes to the Terms of Service; the list of Sub-processors changes under the procedure in article 7.

16.3 The agreement is written in Italian and translated into English and French: if the versions differ, the Italian version prevails.

Annex A. Description of the processing

A.1 Nature and purposes. Storage, organisation, consultation and display to authorised Users; disclosure to Recipient Customers and to Delegated Firms chosen by the Customer; production on request of PDF reports (which are not saved); deletion. The processing is automated and continuous for the whole term of the contract. Purpose: to enable the Customer to prepare, keep up to date and show its supply chain due diligence dossier.

A.2 Categories of data subjects:

• the Customer's workers, current and former: employees, temporary and agency workers, interns and apprentices, including those at production sites;
• persons who have submitted complaints or reports through the Customer's grievance mechanism;
• persons named in the documents of the dossier: for example safety managers, the occupational physician, auditors, consultants, signatories;
• contacts and other individuals at clients, suppliers and subcontractors named in orders, notes, documents or answers to checklists;
• the Customer's Users, for the data the Customer enters about them in its area (for example the person responsible for an improvement plan action or the author of a justification). Their account data is processed by CircularWare as controller.

A.3 Categories of data. They depend on the documents that the Customer chooses to upload. The framework catalogue marks these 11 document types as containing workers' personal data; their files are never disclosed to Recipient Customers and by default they are “available during audit”:

• HS-P-12, medical examinations and health surveillance: health data (Art. 9), fitness-for-work assessments;
• SOC-P-07, payslips for the last 12 months and proof of payment: pay, bank details; possible health data (sickness) and data on trade union membership (deductions) (Art. 9);
• SOC-P-09, traceable salary payments over the last six months: pay, bank details;
• SOC-P-10, details of temporary workers: identity, agency, periods of work;
• SOC-P-11, list of employees by nationality, gender, age, seniority, contract and pay: personal and employment-relationship data, nationality;
• SOC-O-02, logs of the grievance reporting mechanism: identity and content of complaints;
• SOC-O-03, internship and apprenticeship contracts: employment-relationship data, age;
• SOC-O-06, ID documents, work permits and renewals: ID documents with photograph, residence permits, nationality;
• SOC-O-07, records of disciplinary measures and dismissals: disciplinary data;
• SOC-O-08, employment contracts: employment-relationship data;
• SOC-O-09, attendance and working-time records: attendance, working hours, absences.

The other documents, notes, orders and answers may contain identification and contact data of persons (name, role, signature, email address or telephone number). No data relating to criminal convictions and offences (Art. 10) is envisaged, nor any clinical documents (article 4.3).

A.4 Duration. For the whole term of the contract, then in accordance with Annex E.

A.5 Location. Application and database on a server of Aruba S.p.A., in a data centre in [[TO BE CONFIRMED: data centre location]]. File archive on Microsoft Azure, in a data centre in the region [[TO BE CONFIRMED: Azure region, in the EEA]]. Service emails via Twilio SendGrid (United States), Annex C.

Annex B. Technical and organisational measures

B.1 Measures applied.

Separation between organisations and access control:

• every item of an organisation's data is tagged with the organisation and is subject to a filter in the database: without a current organisation nothing is visible;
• who works in an organisation, and with which role (Reader, Editor, Administrator), is decided by a single check: active member, or active member of a firm with an open, unexpired delegation, with the lower of the delegation's and the firm's role. Every save re-reads roles and delegations from the database before proceeding; the rules are tested by automated tests;
• the data of another organisation can be read only with an open share, checked on every access; revocation applies from the next request;
• the files of the types with personal data, document notes, sites, the improvement plan, drafts and answers to questions marked as containing personal data never reach Recipient Customers; of the checklists, a Recipient Customer sees only those it requested;
• a log of every opening of a dossier or of a checklist result and every download of a file or PDF by Recipient Customers, which cannot be modified and which the supplier can consult;
• platform administrators are a closed list in the configuration, with a confirmed email, re-read from the database on every request; they do not enter organisations.

Authentication and sessions:

• passwords of at least 10 characters, stored only as a salted hash; a confirmed email is required to sign in; lockout for 15 minutes after 5 wrong attempts;
• session cookies not readable by JavaScript, SameSite=Lax, sent only over HTTPS, expiring 8 hours after the last activity; the user's status is re-checked every 30 minutes while a session is open; protection of forms against forged submissions;
• a limit of 10 submissions per minute per IP address on anonymous forms (sign-in, sign-up, password, invitations, free test), with the same message in every case so as not to reveal who is registered;
• invitation codes stored only as a SHA-256 hash, valid for 7 days and for a single use; a cap on invitations per organisation.

Transmission and application:

• HTTPS with redirection and HSTS; security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy);
• the application's own cookie protection keys, separate from those of other applications on the same machine;
• secrets (database, email, payments) kept outside the source code; the application does not start if they are missing, and in development it rejects live payment keys.

Files:

• every upload goes through a single check: a closed list of extensions (pdf, jpg, png, docx, xlsx), content consistent with the extension, Office documents with macros rejected, 20 MB at most, SHA-256 hash;
• the archive is on Microsoft Azure, separate from the application server: a private container (the application does not start if it is public), reached only over HTTPS, with files encrypted at rest by Azure; paths are generated by the system and never by the user, nothing is overwritten;
• download only from addresses that check membership or sharing, without copies in the browser cache; PDF reports are generated on request, not saved, and only for those who have access;
• for the document types with workers' personal data, the proposed choice is “available during audit”, without upload.

Minimisation and external services:

• emails are sent with open and click tracking turned off;
• card data does not pass through SCDD: payment takes place on Stripe's pages. Stripe's notifications are accepted only with a verified signature and only once;
• the application's logs identify users and organisations by a numeric identifier, not by email;
• the site's free test does not save the answers; visit measurement saves no IP addresses or identifiers and uses no cookies.

B.2 Measures missing today [[TO BE DECIDED: which are needed before launch, item 11]]:

• encryption of files with our own keys: today Azure encrypts files at rest with Microsoft-managed keys; proposal: keys managed by CircularWare or application-level encryption, to be assessed for types containing personal data;
• encryption of the database at rest: today it depends on the server; proposal: database or disk encryption;
• protection of the cookie keys: today they are saved in an unencrypted folder; proposal: encrypt them and restrict the folder's permissions;
• backups: today no procedure is defined; proposal: encrypted backups of the database, kept for 30 days on a rotating basis in a place separate from the production server, soft delete of the files on Azure for the same period and a periodic restore test;
• deletion and return: today there is no function to close an account or a company or to export all of its data; individual files and PDFs can be downloaded. Until there is, the manual procedure in Annex E applies;
• automatic retention periods: today invitations and the access log remain without expiry; proposal: periodic deletions in accordance with the Privacy Policy;
• second authentication factor: absent today; proposal: at least for platform and organisation administrators;
• antivirus scanning of uploaded files: absent today (type and content are checked); proposal: scanning at upload;
• a log of downloads of files with personal data by members and firms: today only the accesses of Recipient Customers are logged;
• exclusion of files with personal data from delegations: today a Delegated Firm sees them with any role; proposal: allow the Customer to exclude them;
• a notice at upload that files of the types without personal data reach Recipient Customers;
• a named log of CircularWare personnel's access to servers and databases, and alerts on anomalous access or repeated errors;
• EU residency of email data: today emails pass through SendGrid's US region;
• security testing: dependency analysis and penetration testing before launch.

B.3 Organisational measures to be adopted:

• a list of the persons authorised to access the infrastructure, with a written confidentiality undertaking and access revoked at the end of the engagement;
• a procedure for personal data breaches (Annex D) and a register of breaches;
• a record of processing activities as controller and as processor (Art. 30 GDPR);
• Art. 28 contracts with the Sub-processors and verification of their safeguards;
• no real data in development and test environments;
• review of this annex at least once a year and on every major change to the service.

Annex C. Sub-processors

• Aruba S.p.A.: application server and database [[TO BE COMPLETED: and backups, if done with Aruba]]; processes all Customer Data; location: [[TO BE CONFIRMED: data centre location]]; no transfer safeguards if the data centre is in the EEA.
• Microsoft Ireland Operations Limited (Microsoft Azure) [[TO BE VERIFIED: contracting entity, Microsoft's DPA and safeguards for any access from the United States]]: archive of the files uploaded to the dossier; processes the files, which may contain personal data; location: [[TO BE CONFIRMED: Azure region, in the EEA]]; safeguards: Microsoft's Data Protection Addendum.
• Twilio Inc. (SendGrid) [[TO BE VERIFIED: the contracting entity for EU customers]]: sending of service emails; processes email addresses and the names of persons and companies in the text of emails (invitations); location: United States; safeguards: EU-US Data Privacy Framework and standard contractual clauses [[TO BE VERIFIED]].

The following are not Sub-processors for Customer Data, because they do not process it, and are listed here for transparency:

• Stripe (Stripe Payments Europe, Limited, Ireland, with processing by Stripe, Inc. in the United States): payments and subscriptions. It processes the Customer's billing and payment data, of which CircularWare is controller, in part as an independent controller (fraud prevention, legal obligations);
• CircularWare's accountant [[TO BE COMPLETED]]: receives each month the list of payments with billing data in order to issue the electronic invoices.

Annex D. Personal data breaches: procedure

• Whom to alert. Anyone at CircularWare who notices a possible incident reports it immediately to [[TO BE COMPLETED: security contact and contact details]].
• First assessment, within 24 hours of the report: what happened, which organisations and which data are involved, whether the incident is still ongoing. Measures to stop it are taken immediately (for example revoking credentials, blocking an account, isolating a server).
• Notification to the Customer, within 48 hours of CircularWare becoming aware that there is a breach affecting Customer Data: email to the organisation's administrators and to any privacy contact indicated by the Customer [[TO BE COMPLETED: where the Customer indicates it]]. The notification states, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, a CircularWare contact point for further information, the likely consequences and the measures taken or proposed, including to mitigate its effects.
• Updates as more becomes known, until closure.
• The Customer decides whether to notify the supervisory authority (within 72 hours of becoming aware of the breach, Art. 33) and whether to communicate it to data subjects (Art. 34). CircularWare gives it the information it needs.
• Register and final report: every breach is recorded in CircularWare's register; within 30 days of closure the Customer concerned receives a report with the causes and the measures taken to prevent a recurrence.
• Breaches of data of which CircularWare is controller (accounts, billing) follow the same internal procedure, but the notification to the authority is made by CircularWare.

Today the service has no monitoring or alerts that help detect a breach (Annex B.2): until these exist, detection depends on the application and server logs and on users' reports.

Annex E. Deletion and return at the end of the contract

• When the contract ends: when the Customer closes its organisation, when either party terminates under the Terms of Service, or when CircularWare shuts down the service. Cancelling a paid plan does not end the contract: the organisation continues with the free functions. [[TO BE DECIDED: inactive free organisations, item 14]]
• Return. For 30 days from the end of the contract the Customer may request a complete copy of the Customer Data: the files with all their versions and the dossier data in a structured, commonly used format [[TO BE COMPLETED: format]], at no cost. During the contract it may do so at any time (Terms of Service, section 19).
• Deletion. After the 30 days, or earlier if the Customer asks in writing, CircularWare deletes the Customer Data within 30 days from the database and the file archive, and from backups within their rotation period [[TO BE COMPLETED: duration, proposal 30 days]]. On request it confirms the deletion in writing.
• What remains. What remains is the data that CircularWare processes as controller and must keep by law (for example the billing data of payments, 10 years) and, for as long as needed, the account data of Users who also work for other organisations. Copies already downloaded by Recipient Customers and Delegated Firms remain outside CircularWare's control.
• Companies created by a firm. If a company created by a consultancy firm is left without people of its own and without an open delegation, CircularWare notifies the firm and the known contacts of the company and, if nobody takes it over within [[TO BE DECIDED: number of days]] days, proceeds as for deletion.
• During the contract. A document that the Customer deletes is deleted immediately with all its versions and files; it leaves the backups as they rotate.
• State of the service. Today closing, complete export and deletion of an organisation do not exist as functions (Annex B.2): until they do, CircularWare carries them out manually on written request, under a documented internal procedure [[TO BE COMPLETED]], within the same timeframes.

Version 2026-10-16.