English translation of the Italian document. This translation does not change the service conditions.
SERVICE DOCUMENTS · VERSION 2026-09-12
Data processing agreement
Version dated 12 September 2026 · agreement under Article 28 GDPR, linked to the CronoVent terms.
1. Parties and scope
The customer is the organisation identified in the account and any order, represented by the authorised user accepting the agreement. The processor is REC Eventi di Andrea Matteo Bassi · Via Dumas 12, 42123 Reggio Emilia, Italy · VAT no. 02472790357, contact info@cronovent.it. If the customer acts as processor for an organiser, it warrants authorisation to appoint REC Eventi as sub-processor and provides applicable instructions.
Processing covers hosting, organising, displaying, updating, exporting, backing up and deleting production schedules and documents uploaded by the customer. It lasts for the service relationship and final return/deletion. It concerns technicians, speakers, artists, contacts and collaborators; ordinary data includes names, roles, professional contact details, timings and operational documents. Uploading special categories of data or criminal records is not authorised.
2. Instructions and confidentiality
The processor handles data only to provide the service and under the customer’s documented instructions, including transfer instructions. It does not use it for advertising, data sales or model training. If a legal obligation requires other processing, it informs the customer beforehand unless prohibited by law. It immediately informs the customer if it considers an instruction to breach the law.
Authorised persons must be bound by confidentiality and act according to instructions and the principle of minimum necessary access.
3. Technical and organisational measures
Applied measures: HTTPS; passwords stored as salted PBKDF2 derivatives, not plain text; limited and revocable sessions; server checks on customer ownership of schedules; attachment protection; login-attempt limits; random single-use email tokens; separation of viewing and editing; contact details not shared by default; operational backups with restricted access and limited retention; updates and recovery procedures.
Shared event passwords do not identify individual users: the customer must distribute them to authorised recipients and rotate them when the crew changes. Future individual-role features are not treated as already available. Measures must be reassessed according to risks and service developments.
4. Sub-processors
The customer authorises Hetzner Online GmbH for app infrastructure and operational backups in the Falkenstein area, Germany. The provider’s appointment must be governed by an Article 28-compliant agreement; REC Eventi remains responsible to the customer for obligations entrusted to the sub-processor.
New sub-processors will be communicated at least 15 days in advance, stating their role and location. The customer may object on documented data-protection grounds; the parties will seek an alternative and, if impossible, arrange termination of the affected processing. Account emails are sent through Aruba’s email service; they do not contain event schedules or attachments.
5. Assistance and breaches
The processor assists the customer with rights requests, impact assessments and obligations under Articles 32–36, taking account of the nature of processing and available information. Requests received directly concerning customer data are forwarded without delay; data is not disclosed or deleted beyond authorised instructions.
In a personal data breach, the processor informs the customer without undue delay after becoming aware, providing available information on its nature, data/person categories, likely consequences and measures taken, with updates as available. The controller assesses notifications to authorities and individuals, assisted by the processor.
6. Audits and information
The processor provides information needed to demonstrate compliance and allows audits and inspections by the customer or an appointed auditor, in a proportionate manner respecting security and other customers’ data. Any extraordinary activity costs are agreed without preventing exercise of GDPR audit rights.
7. Return and deletion
On termination, at the customer’s choice, the processor returns or deletes data and copies, subject to legal obligations. The procedure starts after instruction verification, normally within 30 days. Backup copies are not used for ordinary processing and expire under the privacy policy timeframes; deletions are reapplied on restoration. Temporary working copies must be included. The processor documents fulfilment of the request.
8. Transfers and precedence
No new transfer outside the EEA is activated without documenting the instructions and safeguards required by Chapter V GDPR. For data-protection obligations, this agreement takes precedence over conflicting service terms. The privacy policy does not replace this agreement.
Operational annex — Backups, recovery and security monitoring
Updated 1 October 2026. To protect data availability and integrity, CronoVent backs up its database hourly and the application, data and attachments daily, with an additional monthly copy. Backups may contain the personal data present in the service when the copy was created. They are used only for business continuity and recovery after faults, data loss or incidents, not for marketing or profiling.
In addition to local copies on Hetzner, off-site copies are stored in a private Backblaze B2 bucket in the EU Central region (European Union). They are encrypted before upload; REC Eventi manages the private decryption key and does not send it to Backblaze. Storage encryption, encrypted connections, restricted access and integrity checks are also used. Copies are protected against early deletion for 30 days (hourly/daily) and 185 days (monthly).
Off-site retention: automatic rules expire hourly/daily copies after 31 days and monthly copies after 186 days, then delete noncurrent versions after one additional day, subject to the provider’s processing time. Backups are not accessed in ordinary use. Deletion from the active service does not immediately remove previously locked copies: residual data remains isolated until expiry. Accepted deletion and restriction requests must be reapplied before restored data is put back into use.
For data controlled by REC Eventi, security and continuity rely on legitimate interests (Article 6(1)(f) GDPR), with security measures under Article 32. For event data processed on behalf of organisations, backup and recovery are part of the service and the instructions governed by the Article 28 data processing agreement. Backblaze provides storage and acts as a sub-processor for data entrusted by organisations.
The EU region determines where backup copies are stored; it does not guarantee that all provider processing takes place exclusively within the EEA. Backblaze is headquartered in the United States. Its data processing agreement includes standard contractual clauses for applicable transfers. Information about relevant safeguards can be requested from info@cronovent.it.
External monitoring: Healthchecks.io, operated by SIA Monkey See Monkey Do (Latvia), receives technical backup completion signals from the server and sends alerts to the operator. It receives the server IP address, check timestamps and status, and the operator’s alert contact. It does not receive databases, attachments, event content, user credentials or visitors’ browsing data. It is not loaded in users’ browsers and adds no cookies. The current plan retains the latest 100 monitoring events per check; further technical processing and providers are described in the Healthchecks.io privacy policy.
This operational information does not replace existing contractual terms, notice requirements or customers’ rights to object.