Data Processing Agreement - AIXEL CRM

1. Parties

Controller: the Customer, identified by the details entered at purchase. Processor:

Company

AIXEL Solutions S.r.l., limited liability company with a single member (società a responsabilità limitata a socio unico)

Registered office

Via Polidoro da Caravaggio 30B, 20156 Milano (MI), Italy

Tax code and VAT no.

14884460966 (EU VAT IT14884460966)

Companies Register

Milano Monza Brianza Lodi, no. 14884460966 - REA MI-2813180

Share capital

€1,000.00 fully paid in

Email

hello@aixel.solutions

PEC

aixel.solutions@pec.it

2. Subject matter, nature and purpose

We process the personal data that you, your Users or your AI assistant enter in the Instance only to provide AIXEL CRM: storing it, making it available to view and edit, backing it up, sending Users their sign-in emails and giving you support. The operations are collection, recording, organisation, storage, consultation, alteration, retrieval, erasure and destruction.

3. Duration

For the whole term of the contract and until the data is deleted as set out in section 13.

4. Categories of data subjects and data

• Data subjects: the Users; the Customer's contacts, customers, prospects, suppliers and partners and their contact persons; other people mentioned in notes and attachments.
• Data: identification and contact data (name, role, company, email, phone, address, social profiles); business data (deals, amounts, tasks, notes, attachments, tags); User data (name, email, protected credentials, settings, technical access logs).

The Service is not designed for special categories of data (article 9 GDPR) or data relating to criminal convictions and offences (article 10). If you decide to enter them, you assess the need and the appropriate measures.

5. Instructions

We process the data only on your documented instructions. The terms and this agreement, the settings and operations that you, your Users and your AI assistant carry out in the Instance, and the written requests you send us count as instructions. If we believe an instruction infringes the GDPR or other data protection rules, we tell you immediately. We process the data otherwise only if the law requires it, informing you first unless the law forbids it.

6. Staff confidentiality

Only AIXEL people who need it to provide the Service, support or security may access the data, and they are bound to confidentiality. We do not look at the Instance's content unless it is needed for your support request, for maintenance or for security.

7. Security

We apply the technical and organisational measures of article 32 GDPR described in the "Security measures" annex at the end of this agreement. We may update them over time without lowering the level of protection.

8. Subprocessors

You give us general authorisation to use the subprocessors listed on the Subprocessors page, AIXEL CRM section. We impose on each one data protection obligations equivalent to this agreement and remain responsible for their work.

We email you at least 30 days before adding or replacing a subprocessor that processes the Instance's data. You may object on reasonable data protection grounds; if we cannot find a solution, you may withdraw at no cost before the change takes effect, with a refund of the part already paid and not used.

The provider of the AI assistant you connect is not our subprocessor: you choose it, and the relationship with it is directly between you and that provider.

9. Transfers outside the European Economic Area

Each Instance's database is in the European Union (Frankfurt) and the web application runs on servers in Germany. If a subprocessor stores the data or can access it from outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework for certified recipients, or on the standard contractual clauses approved by the Commission.

10. Data subjects' rights

The Instance lets you view, correct, export and delete a person's data. If a data subject contacts us, we forward the request to you without delay and do not answer on the merits without your instruction. We help you, to a reasonable extent, with requests you cannot handle yourself.

11. Assistance to the controller

We give you the information reasonably needed for the security of processing, breach notifications, impact assessments and prior consultations (articles 32 to 36 GDPR).

12. Personal data breaches

If we become aware of a personal data breach affecting your Instance, we notify you by email without undue delay and in any case within 48 hours, with the information available: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed and a contact. We send further information as soon as we have it. As controller, you decide whether and how to notify the supervisory authority and the data subjects.

13. Return and deletion

When the contract ends you can ask us, within 30 days, for a complete copy of the data in a commonly used format; before deletion we remind you by email of the date. After 30 days we delete the Instance and the data; backup copies are deleted automatically within the following 30 days. On request we confirm the deletion in writing. We keep data only if the law requires it.

14. Audits

We make available the information needed to demonstrate compliance with this agreement and answer your written requests. You may carry out an audit, also through an auditor bound to confidentiality, with at least 30 days' notice, during working hours and no more than once a year, unless a supervisory authority requires it or following a data breach. Each party bears its own costs.

15. No other use of the data

We do not use the Instance's data for our own purposes, do not sell it and do not use it to train artificial intelligence models.

16. Governing law and contacts

This agreement is governed by the law and jurisdiction set out in article 21 of the terms. Data processing requests: hello@aixel.solutions or aixel.solutions@pec.it.

Annex: security measures

• Isolation: each Instance has its own database, separate from other customers'.
• Location: database in the European Union (Supabase, Frankfurt); web application and assistant connection on Hetzner servers in Germany (Falkenstein).
• Encryption: every connection uses HTTPS with HSTS; databases are encrypted at rest by the provider (AES-256).
• Access to the Instance: public sign-up is off; Users are created by the Customer's administrator; passwords of at least 12 characters; only administrators manage Users and settings; the number of active Users is limited to the Plan.
• Two-step sign-in: every User can turn on a second step with a code from an authenticator app; from then on, without the code, the database neither returns nor accepts data, in the CRM or through the AI assistant. An administrator can turn it off for a User who lost the phone.
• Access to data: the database's security rules (row-level security) let only the Instance's signed-in, active Users read and change CRM records. A disabled User loses access at once, also through the AI assistant. The server functions apply the same rules.
• Files: files attached to notes are private: they open only for the Instance's signed-in Users, through links that expire after one hour.
• AI assistant: it connects only with an authorisation the User grants on a consent screen; it acts with that User's permissions and can only read and change data, not the database structure. Each request runs for at most 15 seconds and returns at most 500 rows; technical logs do not contain the text of the requests.
• Application protection: Content Security Policy and security headers on every response; no third-party tracking or analytics tools in the CRM; CSV exports neutralise cells a spreadsheet would run as formulas.
• Releases: every new version is tested in a test environment, including automated sign-in tests, before it reaches customers' Instances; after every release we check the database's security configuration, and every release can be rolled back.
• Backups: every night we make an encrypted copy of each Instance's database and files, readable only by AIXEL, kept for 14 days; before every database update we make a further encrypted copy, kept for 7 days.
• Administrative access: only AIXEL's authorised people can manage the infrastructure, with access through cryptographic keys; the server management panel is not exposed to the internet.
• Deletion: at the end of the contract the data is deleted as set out in section 13.