Data Processing Agreement

Last updated: 5 August 2026

1. Parties and roles

The Customer acts as Data Controller, since it determines the purposes and means of the processing of the data held in its own systems and in the software activated.

NRC Company SRL
TechCorp is a brand of NRC Company SRL
Registered office: Via degli Ottoboni 16, Milan, Italy
TechCorp operational office: Rome, Italy
VAT number: IT14804430966
General email: info@techcorp.it
Requests concerning personal data: privacy@techcorp.it

The Supplier acts as Data Processor pursuant to Article 28 of Regulation EU 2016/679, limited to the activities described below. The Manufacturer of the software, where it hosts the data, acts as an independent Data Processor or as a sub processor in accordance with its own contract with the Customer.

2. Subject matter, nature and purposes of the processing

3. Categories of data and of data subjects

The processing may concern identification and contact data, contractual and administrative data, accounting data, software usage data and the content of the documents uploaded by the Data Controller. The data subjects may be customers, suppliers, employees and collaborators of the Data Controller, as well as condominium owners, guests, event participants and other individuals depending on the solution used.

The Data Controller undertakes not to make accessible to the Data Processor special categories of data within the meaning of Article 9 of the GDPR, or data relating to criminal convictions and offences, unless this is strictly necessary and has been agreed in writing together with appropriate measures.

4. Documented instructions

The Data Processor processes personal data only on documented instructions from the Data Controller, including the accepted Proposal, this agreement and the support requests submitted through the agreed channels. The Data Processor immediately informs the Data Controller where it considers that an instruction infringes the GDPR or other applicable provisions.

The Data Processor does not use the data for its own purposes, does not disclose it to third parties and does not use it to train automated systems.

5. Confidentiality of authorised persons

The Data Processor ensures that the persons authorised to carry out the processing are designated in writing pursuant to Article 29 of the GDPR, are instructed on the manner of the processing and have undertaken to maintain confidentiality or are subject to an appropriate statutory obligation of confidentiality. Access is restricted to the personnel who genuinely need to know the content.

6. Security measures

The Data Processor implements technical and organisational measures appropriate to the risk pursuant to Article 32 of the GDPR, including:

• individual credentials and multi factor authentication on remote access;
• assignment of permissions according to the principle of least privilege;
• encryption of the transmission channels and of the media containing data of the Data Controller;
• exclusive use of the agreed support channels for sending documents and screenshots;
• updating of the systems and protection of the workstations;
• logging of access to the Data Controller’s systems;
• deletion of the working copies upon completion of the intervention.

7. Sub processors

The Data Controller grants general authorisation for the engagement of sub processors. The Data Processor imposes on each sub processor data protection obligations no less onerous than those set out in this agreement and remains fully liable to the Data Controller for their performance.

The Data Processor shall give written notice of any intention to add or replace a sub processor with at least 30 days of prior notice. Within that period the Data Controller may object on reasonable grounds relating to data protection. If the objection cannot be resolved, the Data Controller may withdraw from the services concerned without penalty.

The updated list of sub processors may be requested from privacy@techcorp.it.

8. Assistance with data subject rights

Taking into account the nature of the processing, the Data Processor assists the Data Controller by appropriate technical and organisational measures in responding to requests to exercise the rights laid down in Articles 15 to 22 of the GDPR. Where a request is addressed directly to the Data Processor, the Data Processor forwards it to the Data Controller without delay and does not act on it independently.

9. Assistance with impact assessments and security

The Data Processor assists the Data Controller, within the limits of the information available to it, in complying with the obligations laid down in Articles 32 to 36 of the GDPR, including data protection impact assessments and any prior consultations with the supervisory authority.

10. Personal data breaches

The Data Processor informs the Data Controller without undue delay and in any event within 24 hours from the moment it becomes aware of a personal data breach affecting the data processed on its behalf. The notice contains, to the extent available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed.

The Data Processor cooperates with the Data Controller and documents the incident. Notification to the supervisory authority and communication to the data subjects remain the responsibility of the Data Controller.

11. Deletion or return of the data

Upon completion of the provision of the services the Data Processor, at the Data Controller’s choice, deletes or returns all personal data processed on its behalf and deletes the existing copies, unless retention is required by Union or Member State law. That choice must be notified within 30 days of termination, after which the Data Processor proceeds with deletion.

12. Audits and demonstration of compliance

The Data Processor makes available to the Data Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allows for and contributes to audits, including inspections, conducted by the Data Controller or by another auditor mandated by the Data Controller who is not a competitor of the Data Processor.

Audits are agreed with at least 15 days’ notice, take place during working hours, no more than once a year save in the event of established breaches or of a request from the authority, and are subject to confidentiality obligations. The reasonable costs of any further audits are borne by the Data Controller.

13. Transfers outside the European Economic Area

The Data Processor does not transfer personal data outside the European Economic Area without instruction or authorisation from the Data Controller. Where a transfer is necessary, it takes place on the basis of an adequacy decision of the European Commission or of the standard contractual clauses adopted pursuant to Article 46 of the GDPR, supplemented where necessary by additional measures following an assessment of the destination context.

14. Record of processing activities

The Data Processor maintains a record of all categories of processing activities carried out on behalf of the Data Controller pursuant to Article 30(2) of the GDPR and makes it available to the supervisory authority upon request.

15. Liability and duration

The liability of the parties is governed by Article 82 of the GDPR and, for matters not regulated therein, by the General Terms of Supply. This agreement enters into force upon acceptance of the Proposal and remains effective for the entire duration of the relationship and, for those obligations that so require, thereafter.

16. Governing law

This agreement is governed by Italian law and by Regulation EU 2016/679. In the event of any conflict with the General Terms of Supply, this agreement shall prevail in respect of matters relating to the protection of personal data.