Data Processing Agreement

Last updated: 2026-09-11 · version 1

Unexecuted template: this DPA applies only where a business customer acts as controller and RatioNest processes data solely on that customer's behalf. RatioNest is ordinarily controller of its direct consumer service. Complete it, obtain qualified legal counsel review, and accept it in writing before reliance.

Parties and term

Processor: [PROCESSOR LEGAL NAME], an individual entrepreneur trading as RatioNest, registered office [REGISTERED ADDRESS], Italy; VAT [VAT NUMBER]; REA [REA DETAILS]; PEC [PEC ADDRESS]. Controller: [CUSTOMER LEGAL NAME AND ADDRESS]. This DPA lasts while RatioNest processes personal data under the service agreement.

Documented instructions and controller obligations

RatioNest processes personal data only on documented instructions, including transfers, unless EU or Member State law requires otherwise; it will notify the controller where lawful and immediately flag an instruction it believes infringes data-protection law. The controller is responsible for lawful instructions, notices, legal bases, accuracy, and minimization.

Confidentiality and security

Authorized personnel are bound by confidentiality. RatioNest applies measures appropriate to risk, including tenant authorization, access controls, encrypted transport, protected credential and financial-data storage, logging minimization, tested deletion controls, and incident handling. Complete production measures in [SECURITY MEASURES ANNEX].

Sub-processors

The controller grants general written authorization for subprocessors in the Privacy Policy and [SUBPROCESSOR ANNEX]. RatioNest will give [NOTICE PERIOD] advance notice of changes so the controller can raise a reasonable data-protection objection. Equivalent obligations flow down, and RatioNest remains responsible as required by Article 28.

Data-subject and controller assistance

RatioNest will reasonably assist with data-subject rights and GDPR Articles 32–36, including security, breach notification, impact assessments, and supervisory-authority consultation.

Incidents

RatioNest will notify the controller without undue delay after becoming aware of a personal-data breach and provide reasonably available information.

International transfers

No restricted transfer may occur without a GDPR Chapter V mechanism. Complete [PROCESSING LOCATIONS AND TRANSFER MECHANISMS], including applicable adequacy decisions, EU Standard Contractual Clauses, transfer assessments, and supplementary safeguards. This DPA alone is not a transfer mechanism.

Deletion or return

At the controller's choice after services end, RatioNest will delete or return personal data and delete copies unless law requires retention. Active-system deletion and service-provider propagation follow the Privacy Policy. Inaccessible backups remain protected and are deleted under [BACKUP RETENTION PERIOD]; if restored for disaster recovery, the deletion instruction is reapplied.

Audit information

RatioNest will provide information reasonably necessary to demonstrate Article 28 compliance and allow proportionate audits, including inspections, on reasonable notice under [AUDIT PROCEDURE], without exposing other customers' data.

Processing schedule

• Subject matter and purpose: account, household-finance, receipt, support, notification, and service-diagnostic processing needed for the contracted service.
• Nature: collection, storage, retrieval, calculation, display, approved transmission, support, security, and deletion.
• Duration: the service term plus the completed deletion/backup period.
• Data subjects: controller-authorized users and persons whose data they lawfully submit.
• Data types: identifiers, contact and authentication metadata, household-finance records, receipt images/extractions, device/push identifiers, support content, and consented diagnostics.
• Special-category data: not intentionally requested; the controller must not submit it unless separately agreed with appropriate safeguards.

Execution and contact

Controller: [CONTROLLER SIGNATURE AND DATE]. Processor: [PROCESSOR SIGNATURE AND DATE]. Contact: privacy@rationest.com. The executed DPA controls conflicting personal-data processing terms.