Personal Data Processing Addendum — DPA

Preamble, nature and effect of this document

Niltech Europe S.r.l., with registered office at Via Calmaggiore 5, 31100 Treviso (TV), Italia, VAT No. IT 05614380268 (“Niltech”), adopts this document in order to establish GDPR Article 28 conditions for processing performed by Niltech for the customer.

These provisions become binding to the extent accepted, incorporated into an order or made part of the applicable agreement. In case of conflict, mandatory law, the DPA for processing matters, the executed order, special terms and these general terms prevail in that order.

This addendum governs processing carried out by Niltech on behalf of the customer under Article 28 GDPR and supplements the principal agreement. Mandatory GDPR provisions, the controller’s lawful documented instructions and the processing annexes prevail over inconsistent wording.

Personal and material scope

The objective scope includes Andrea AI, its public interfaces and processing strictly connected with the described functions. The commercial website and document library are published on andreaaiagent.com and use Bluehost infrastructure, MySQL and server mail transport. The application is made available through the separate andreaai.net domain on Hetzner infrastructure; Pinecone, Cloudflare, OpenAI and Google Gemini are involved only within the functions and agreements applicable to them.

The relevant operations concern document and image intake and analysis, policy-reading support, estimates and report drafts, case-file organisation, and ESG indicators only where supported by verifiable data. Potential information categories are: contact and prospect data on the website; in the application, case data, documents, images, notes, technical metadata and AI-assisted outputs according to configuration and contract. The actual privacy role, lawful basis and extent of processing depend on the contractual relationship and the lawful instructions of the party determining purposes and essential means.

Definitions and interpretation

• “Service” means the Andrea AI functions made available under the agreement.
• “Customer” means the legal person or professional entering into the agreement with Niltech.
• “Authorised User” means an individual enabled by the Customer to use the Service under its responsibility.
• “Customer Data” means data, documents, images, instructions and other content submitted or generated on the Customer’s behalf.
• “Assisted Output” means a result produced through automated rules or artificial-intelligence components and subject to the stated controls.
• “Further Supplier” means a third party providing Niltech with a technical service relevant to the documented scope.
• “Incident” means an event compromising or capable of compromising confidentiality, integrity, availability, authenticity or resilience.
• “Business Day” means a day other than Saturday, Sunday or an Italian national public holiday.

Specific duties and safeguards

1. Within its assigned role and without prejudice to the Customer’s responsibilities, Niltech shall attach subject, duration, nature, purpose, data and data-subject details. The applicable file identifies the owner, scope, dependencies, acceptance criterion and evidence; absent those elements, the safeguard is not treated as demonstrated.

2. Within its assigned role and without prejudice to the Customer’s responsibilities, Niltech shall accept and trace only documented authorised instructions. The applicable file identifies the owner, scope, dependencies, acceptance criterion and evidence; absent those elements, the safeguard is not treated as demonstrated.

3. Within its assigned role and without prejudice to the Customer’s responsibilities, Niltech shall bind authorised persons to confidentiality and training. The applicable file identifies the owner, scope, dependencies, acceptance criterion and evidence; absent those elements, the safeguard is not treated as demonstrated.

4. Within its assigned role and without prejudice to the Customer’s responsibilities, Niltech shall govern subprocessors, objections and transfers. The applicable file identifies the owner, scope, dependencies, acceptance criterion and evidence; absent those elements, the safeguard is not treated as demonstrated.

5. Within its assigned role and without prejudice to the Customer’s responsibilities, Niltech shall assist with rights, security, incidents, DPIAs and authorities. The applicable file identifies the owner, scope, dependencies, acceptance criterion and evidence; absent those elements, the safeguard is not treated as demonstrated.

6. Within its assigned role and without prejudice to the Customer’s responsibilities, Niltech shall define return, deletion, audit and demonstrative information. The applicable file identifies the owner, scope, dependencies, acceptance criterion and evidence; absent those elements, the safeguard is not treated as demonstrated.

Subject and duration

The DPA applies where Niltech processes personal data for the customer. Subject, duration, nature, purposes, data categories and data subjects are defined in the order and processing annex.

Instructions and confidentiality

Niltech processes data on documented instructions, flags manifestly unlawful instructions, binds authorised people to confidentiality and applies risk-proportionate measures.

Subprocessors and transfers

Current register: Bluehost, Hetzner, Pinecone, Cloudflare, OpenAI, Google Gemini, MySQL, Exim/sendmail.

Contracting entities, functions, locations, transfer mechanisms and supplementary measures are confirmed in the controlled register and contracts, not inferred from the provider brand alone.

Assistance, deletion and audit

Niltech assists with rights, security, incidents and impact assessments; on termination it returns or deletes according to instructions and legal constraints. Audits follow a proportionate, protected and non-destructive process.

Scope, audience and status of this document

This document is intended for customers, prospects, authorised users, advisers and control functions needing to understand the Andrea AI scope. Its specific objective is to establish GDPR Article 28 conditions for processing performed by Niltech for the customer. It applies to the stated document revision and date and must be read with the applicable agreement, order, DPA, technical specifications and controlled procedures.

The commercial website and document library are published on andreaaiagent.com and use Bluehost infrastructure, MySQL and server mail transport. The application is made available through the separate andreaai.net domain on Hetzner infrastructure; Pinecone, Cloudflare, OpenAI and Google Gemini are involved only within the functions and agreements applicable to them.

Executed agreements and actually approved configurations prevail in case of inconsistency. Public information describes the control programme; it does not turn optional provider capabilities into Niltech controls or automatically attest legal applicability or satisfaction.

Exceptions, non-conformity and escalation

A deviation is not accepted by custom. The owner records the affected requirement, cause, impact, exposed data and persons, compensating measures, approver, expiry and closure criterion. The exception is reviewed if risk changes or a measure does not work as expected.

Incidents, possible unlawful processing, loss of data control, outputs with severe impact, contractual breaches, unapproved suppliers or unreliable evidence must be escalated without delay. Current Legal and functional scope: The documented scope includes the commercial website, the public library and, where expressly stated, processing connected with the application.

• contain risk and suspend the affected phase where needed
• preserve evidence, timing, decisions and communications
• involve privacy, security, product, legal or management owners as appropriate
• resume only after measure verification and documented authorisation

Review, change and improvement

The document is reviewed at least every six months and earlier when purpose, audience, data, GDPR or AI Act role, supplier, model, architecture, location, contractual terms or legal requirements change. Incidents, complaints, failed tests and new vulnerabilities trigger an extraordinary review.

Each review records inputs, participants, decision, changes, superseded evidence, remaining gaps and next date. Material corrections are published without retroactively altering the prior document revision. Contact and requests: info@nil-tech.net.

• check change register and related documents
• retest affected controls
• update manifest, PDF, HTML and hashes
• notify recipients where the change affects their rights or duties

Processing schedule under Article 28 GDPR

Subject matter: processing Customer data necessary to provide Andrea AI. Duration: the contractual relationship and the period strictly required for return, deletion, backups and legal duties. Nature and purpose: receipt, organisation, storage, consultation, assisted processing, support, security, export and deletion under instructions. Data and data-subject categories are described in the product notice and must be specified in the order where the use case expands them.

The Customer is responsible for lawful instructions, notices, lawful bases, Article 9 and 10 conditions, retention periods and rights handling. Niltech promptly informs the Customer where it considers an instruction to infringe the GDPR or other applicable law and may suspend execution only as necessary to obtain clarification.

Processor obligations

• process only on documented instructions, including transfers, unless legally required and, where permitted, notified in advance
• bind authorised persons to confidentiality and restrict access on a need-to-know basis
• implement Article 32 measures proportionate to risks, state of the art, cost, nature and context
• comply with subprocessor conditions and remain responsible to the Customer for their obligations
• assist with rights, security, breaches, DPIAs and prior consultation in light of information available
• delete or return data on termination, unless retention is legally required, and make available information necessary to demonstrate compliance

Subprocessors, transfers, audits and incidents

The Customer grants specific or general written authorisation as set out in the order. Under general authorisation, Niltech gives reasonable advance notice of additions or replacements and permits reasoned objection on data-protection grounds; where no reasonable alternative exists, the parties cooperate on modifying or orderly terminating the affected function.

Transfers outside the EEA require a valid Chapter V GDPR mechanism, assessment of circumstances and supplementary measures where necessary. A European contract or data-centre location alone does not demonstrate that all access or support remains in the EEA.

Niltech notifies the Customer of a personal-data breach without undue delay after becoming aware and progressively provides available information. Audits and inspections are proportionate, coordinated to avoid risk to other customers and, where appropriate, preceded by documentation, attestations and interviews; mandatory authority powers remain unaffected.

Allocation of responsibility and reliance limitations

Within its sphere of responsibility, the Customer warrants the lawfulness of submitted data and instructions, user authorisation, suitable lawful bases and notices, and professional verification of outputs. Niltech remains responsible for activities directly under its control and does not assume the Customer’s regulatory, professional or decision-making functions.

Outputs from Andrea AI are auxiliary. Unless expressly agreed and subject to mandatory law, they are not legal advice, an expert determination, insurance decision, liability finding, credit assessment or other reserved professional act. The recipient must examine sources, completeness, consistency and consequences before use.

Nothing excludes liability that cannot lawfully be excluded. Outside those cases, attribution, remedies, limitations and quantification principles follow the applicable agreement, taking account of contributory conduct, mitigation duties and foreseeability under the governing law.

Evidence, review, requests and governing law

Every material assertion must be traceable to a contract, approved configuration, register, minutes, test, log or other reliable evidence. Supplier statements and Niltech controls are kept distinct. Absence of incidents is not, by itself, proof that a measure is effective.

Revisions are dated, reasoned and approved. A later revision does not retroactively alter facts or commitments applicable to earlier periods. Published copies are identified by code, date and cryptographic digest; those elements evidence copy integrity, not the substantive effectiveness of described controls.

Reports, clarification requests, rights requests and complaints may be sent to info@nil-tech.net. Niltech verifies identity and authority where necessary, records the request, responds within applicable periods and communicates any reasoned extension or refusal.

Unless mandatory law or a written agreement provides otherwise, Italian law governs interpretation. The Italian text is controlling; the English translation is provided for convenience.

Official sources

• Regulation (EU) 2016/679 (GDPR)
• EDPB — Guidelines 07/2020 on controller and processor concepts
• Commission Implementing Decision (EU) 2021/914 — Standard Contractual Clauses