Data Processing Addendum

Effective 2026-10-14 · Last updated 2026-09-13

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Fratelli Platform Inc. ("Processor") and the customer ("Controller") and applies to the extent Fratelli processes personal data on the Controller's behalf that is subject to the GDPR, UK GDPR, Swiss FADP, CCPA/CPRA, or similar laws.

1. Roles and Scope

Controller determines the purposes and means of processing Customer Data (records about its customers, suppliers, employees, and contacts). Processor processes Customer Data only on Controller's documented instructions, which are: the Terms, this DPA, and Controller's use of the Service's features and settings. For account-holder information and platform telemetry, Fratelli is an independent controller as described in the Privacy Policy.

2. Details of Processing

• Subject matter: provision of the Fratelli business-management platform.
• Duration: the term of the Terms plus the deletion periods in Section 8.
• Nature and purpose: hosting, storage, backup, display, transmission (e.g., sending invoices and emails), computation (e.g., reports, payroll calculations, AI-assisted drafting), and support.
• Categories of data subjects: Controller's customers, prospects, suppliers, employees and contractors, and website/portal visitors.
• Categories of data: contact details, business and transaction records, payment status (masked card/bank details), payroll and HR data where Controller uses those features, communications content, and portal visitor analytics.
• Sensitive data: Controller must not upload special-category data (health, biometric, etc.) unless a feature is designed for it (e.g., payroll tax IDs, stored with last-4-only display) and Controller has a lawful basis.

3. Processor Obligations

Processor will: (a) process Customer Data only on documented instructions, including regarding international transfers, unless required by law (in which case Processor will inform Controller unless prohibited); (b) ensure personnel with access are bound by confidentiality and receive security training; (c) implement the technical and organizational measures in Section 6; (d) engage sub-processors only under Section 5; (e) assist Controller with data-subject requests, DPIAs, and consultations with supervisory authorities, taking into account the nature of processing; (f) delete or return Customer Data under Section 8; and (g) make available information necessary to demonstrate compliance and allow audits under Section 9.

4. Controller Obligations

Controller is responsible for the lawfulness of its instructions, for having a legal basis and providing notices to its data subjects, for the accuracy of Customer Data, for configuring access permissions for its team, and for responding to data-subject requests it receives (the Service provides export, correction, and deletion tools for this purpose).

5. Sub-processors

Controller provides general authorization for the following sub-processors. We will notify Controller (by email or in-app) at least 30 days before adding or replacing a sub-processor; Controller may object on reasonable data-protection grounds, and if we cannot address the objection, Controller may terminate the affected features with a prorated refund.

6. Security Measures

Encryption in transit (TLS 1.2+) and at rest (AES-256); logical tenant isolation enforced by database security rules; multi-factor authentication, passkeys, and device verification for users; role-based access with least privilege, mandatory re-authentication, written justification, and audit logging for all staff access to customer accounts (support access is read-only and time-limited); rate limiting and anomaly detection; continuous, geo-redundant backups; vulnerability management and dependency monitoring; incident response procedures. Full description: Security Policy.

7. Personal Data Breach

Processor will notify Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Data, providing information reasonably available to help Controller meet its own notification obligations, and will cooperate in investigation and remediation.

8. Deletion and Return

Controller may export Customer Data at any time. On account deletion or termination, Processor retains Customer Data in a 30-day recovery hold, then deletes or anonymizes it within 90 days, including from backups on their rolling cycle, except where retention is required by law (e.g., payment and tax records) — such retained data remains protected by this DPA.

9. Audits

Processor will make available its security documentation, sub-processor list, and summaries of third-party assessments. Where these do not reasonably satisfy Controller's legal obligations, Controller may conduct (or appoint an independent auditor bound by confidentiality to conduct) an audit no more than once per year, on 30 days' notice, during business hours, at Controller's expense, without disrupting the Service or exposing other customers' data.

10. International Transfers

Where transfers of personal data from the EEA, UK, or Switzerland to a country without an adequacy decision occur, the parties agree to the EU Standard Contractual Clauses (Module 2, Controller-to-Processor; Module 3 where applicable), the UK International Data Transfer Addendum, and the Swiss FADP amendments, which are incorporated by reference with Fratelli as data importer, Controller as data exporter, the processing details in Section 2, and the security measures in Section 6.

11. CCPA/CPRA Service Provider Terms

To the extent Customer Data includes personal information of California residents, Fratelli acts as a "service provider": it will not sell or share that personal information, will not retain, use, or disclose it outside the direct business relationship or for any purpose other than providing the Service, will comply with the CPRA's obligations and provide the same level of protection, will notify Controller if it can no longer meet its obligations, and will allow Controller to take reasonable steps to stop and remediate unauthorized use.

12. Liability and Order of Precedence

Each party's liability under this DPA is subject to the limitations in the Terms, except that those limitations do not apply to a party's breach of this DPA that results in regulatory fines imposed on the other party to the extent caused by the breaching party. In case of conflict, this DPA prevails over the Terms regarding processing of personal data.

13. Contact

Data Protection contact: privacy@fratelli-app.com — Fratelli Platform Inc., PO Box 2013, Rancho Mirage, CA 92270, USA.