Terms and Conditions of Service

This document ("Terms") governs the contractual relationship between:

• "Provider": Studio Cravero Consulting, VAT IT03059830905, based in Sassari (SS), certified email info.studiocravero@pec.it, hereinafter also "we", "Studio Cravero" or "DPO Workspace";
• "User": the natural or legal person who registers on the platform and uses its services, hereinafter also "you" or "Client";
• "Platform" or "Service": the software-as-a-service provided through www.dpoworkspace.eu, including its APIs, interfaces and connected features;
• "Workspace": the User's dedicated working environment within the Platform, containing their data and that of their End Clients;
• "End Client": the organisations (companies, bodies, professionals) managed by the User through the Platform as Data Protection Officer (DPO), privacy consultant or equivalent;
• "GDPR": Regulation (EU) 2016/679 on the protection of personal data.

DPO Workspace is a SaaS platform for Data Protection Officers, privacy consultants, lawyers, accountants and compliance professionals, aimed at the operational management of their End Clients' GDPR obligations.

The main features offered include:

• Document storage and classification by regulatory area (notices, appointments, Art. 30 register, Art. 28 DPA, DPIA, data breach, cookies, CCTV, geolocation, training, data subject requests, audit, AI Act);
• Document deadline system anchored to the law with automatic alerts;
• "Event reporting link" feature to collect communications from End Clients;
• Guided workflows for handling privacy-relevant events;
• Urgency and operational priority dashboard;
• Append-only audit trail for accountability purposes (Art. 5(2) GDPR);
• Public DPO profile (optional) and connected features.

The specific features of each subscription plan are described in the Plans section of the site.

To use the Platform you must register by creating an account. The User warrants that:

• The data provided at registration is truthful, accurate, current and complete;
• They will keep such data updated for the entire duration of the contractual relationship;
• They are of legal age and have the legal capacity to enter into this contract;
• If acting on behalf of an organisation (company, professional firm, body), they have the power to bind it contractually;
• They will safeguard their access credentials with the diligence required of a data protection professional;
• They are responsible for all activity carried out through their account.

The Provider reserves the right to suspend or close accounts in case of breach of these obligations or other provisions of these Terms.

The Platform offers a free trial period of 30 (thirty) days upon first registration, with no credit card required.

During the trial:

• The User has access to all features of the chosen plan;
• They can activate a paid plan at any time;
• At the end of the trial, if no plan is activated, write access is suspended until a plan is activated or the account is deleted;
• Data uploaded during the trial is retained for 90 days after expiry, after which it is permanently deleted, unless the contractual relationship is reactivated.

The plans currently available are Solo (€19/month), Pro (€39/month) and Studio (€79/month). Prices are stated net of VAT where applicable. They are published on the pricing page and may change with 30 days' notice.

Billing and payments:

• Payment is made monthly in advance, via Stripe (see Section 13);
• The User authorises recurring charges to the payment method provided;
• Invoices are issued electronically via the Italian Interchange System (SdI) and are also available in the Stripe customer area;
• Failure to pay by the due date results in suspension of the service after 7 days of non-payment and termination of the contract after 30 days;
• The Provider may change prices with at least 30 days' written notice. The User may withdraw before the new price takes effect.

Cancellation by the User: the User may cancel the subscription at any time from the "Subscription" section of the Platform or the Stripe portal. Cancellation takes effect at the end of the period already paid; no pro-rata refunds are provided for the unused period, except where required by law.

Right of withdrawal (Art. 52 Italian Consumer Code): if the User is a consumer (a natural person acting for purposes outside their business, commercial or professional activity), they may exercise the right of withdrawal within 14 days of subscribing, save for the exclusions under Art. 59 of the Consumer Code (in particular, if the service has already been provided with the User's express consent).

Termination by the Provider: the Provider may terminate the contract with immediate effect in case of:

• Non-payment after 30 days of default;
• Serious or repeated breach of these Terms;
• Unlawful use of the Platform (see Section 8);
• Unauthorised transfer of the account to third parties;
• Attempt to compromise the security of the Platform.

The User undertakes to:

• Use the Platform solely for lawful purposes and in compliance with applicable law, in particular GDPR, Legislative Decree 196/2003 and Italian DPA measures;
• Upload to their workspaces ONLY data for which they have a suitable legal basis under the GDPR;
• Properly inform their End Clients and data subjects that documentation and reports pass through the Platform;
• Not upload malware, viruses, unlawful content, minors' data without an adequate legal basis, or data relating to judicial proceedings in breach of the limits of Art. 10 GDPR;
• Generate event reporting links only for End Clients with whom they have an active mandate, and revoke them when the relationship ends;
• Safeguard credentials with professional diligence and enable two-factor authentication where available;
• Immediately notify the Provider of any account compromise or suspected security breach;
• Comply with the usage limits (storage, number of clients, number of users) of the subscribed plan.

The User is the sole controller of the personal data uploaded to their workspaces (their own professional data and their End Clients' data, for which they are normally the "Processor" towards the End Client controller). The Provider acts as sub-processor or processor depending on the relationship, as governed by the Art. 28 DPA.

The Event reporting link feature (public form at /segnala-evento/<token>) is a supporting tool that facilitates the structured collection of communications from the End Client to the DPO. It does not constitute:

• A formal notification to the Italian Data Protection Authority under Art. 33 GDPR (notification remains the responsibility of the DPO User or the Controller);
• A formal communication to data subjects under Art. 34 GDPR (communication remains the responsibility of the Controller);
• A certified notification system (PEC) or one of equivalent evidentiary value;
• A substitute for the direct DPO-Client communication channel (phone, certified email, meeting) for urgent events.

DPO User obligations:

• Inform the End Client in writing that the Link is an OPERATIONAL support channel and NOT a formal notification to the authority or to data subjects;
• ALWAYS keep an alternative channel active (phone, certified email, direct email) for urgent events (high-risk data breaches, authority inspections, data subject requests with short deadlines);
• Check their Urgency dashboard daily - the Provider does NOT guarantee instant push notifications;
• Configure and keep monitored the email address associated with the account to receive automatic deadline alerts;
• Educate the End Client on correct use of the Link: for emergencies (e.g. an ongoing data breach) they must contact the DPO via the fastest channel available, NOT through the form;
• Keep an independent internal breach register (Art. 33(5) GDPR) that does NOT depend on Platform availability.

Business continuity in case of Platform disruption: in case of Platform unavailability (see SLA Sec. 10), the DPO User remains FULLY responsible for their End Client's GDPR obligations. It is their responsibility to set up business continuity procedures that allow them to meet their obligations even without access to the Platform (in particular: 72h breach notification under Art. 33 GDPR, 30-day response to data subject requests under Art. 12(3) GDPR).

Receipt confirmation: the public form shows the submitter a confirmation message that the submission was sent. This confirmation certifies that the data was received by the Provider's systems at the time of submission. It does NOT certify that the DPO has read the report or handled it promptly. The DPO commits to reading/handling times towards their own End Client through their professional service contract (not through these Terms).

It is prohibited to use the Platform for:

• Unlawful activities under Italian or European law;
• Processing of personal data without a suitable legal basis;
• Uploading content that infringes third parties' intellectual property rights;
• Attempts at unauthorised access to others' accounts, other Users' data or the Provider's systems;
• Automated scraping, reverse engineering or decompilation of the software;
• Generating mass reporting links without a real contractual relationship with the End Client;
• Sending spam, phishing or unsolicited commercial communications via the Platform;
• Any activity that may harm the reputation of the Provider or other Users.

The Platform, including source code, design, trademarks, editorial content (excluding the regulatory pages that cite public sources), document templates and marketing texts, is the exclusive property of the Provider or its licensors.

The User acquires a non-exclusive, non-transferable and revocable right to use the Platform for the duration of the subscription, limited to the purposes described in these Terms.

Data uploaded by the User (documents, records, configurations) remains the property of the User or their End Clients. The Provider claims no property right over such content.

The Provider undertakes to guarantee Platform availability of at least 99% on a monthly basis, calculated as actual uptime excluding:

• Scheduled maintenance (announced with at least 48h notice);
• Force majeure events (cloud provider outages, DDoS attacks, disasters);
• Interruptions caused by the User (e.g. misuse, compromised credentials);
• Third-party services (Stripe, Google Cloud, Brevo, OCR provider).

In case of unavailability exceeding the threshold, the User may request a proportional credit on the monthly fee, up to a maximum of 10% of the fee. The request must be received within 30 days of the event.

The Platform is provided "as is" and supports the User in their compliance activities. It does not replace the professional judgement of the DPO or the controller. Ultimate responsibility for GDPR obligations remains with the User and the controllers of the data managed.

The Provider is not liable for:

• Operational decisions made by the User based on the Platform's suggestions (workflows, deadlines, regulatory suggestions);
• Any errors in the regulatory content shown, save for wilful misconduct or gross negligence;
• Data loss resulting from malfunctions of the User's browser or device;
• Indirect damages, loss of profit, lost savings, loss of business opportunities;
• Damages resulting from force majeure or events beyond the Provider's reasonable control;
• Fines from the supervisory authority imposed on the controller, save for proof of the Provider's direct liability.

Quantitative limit: where the Provider's liability is established, the maximum compensation due is limited to the amount actually paid by the User in the 12 months preceding the damaging event, save for mandatory legal limits.

The regulatory content in the Platform (GDPR references, supervisory-authority measures, EDPB guidelines) are supporting operational tools and do not constitute legal advice.

The processing of personal data is governed by the Privacy Notice and, as regards the data the User uploads to their workspaces, by the Data Processing Agreement (Art. 28 DPA) which is an integral part of these Terms.

To deliver the service the Provider uses sub-processors listed and kept updated on the public page Sub-processor list. The main ones are:

• Google Ireland Ltd (Firebase/Google Cloud): hosting, authentication, database, storage - region europe-west1 (Belgium)
• Stripe Payments Europe Ltd: payment management
• Sendinblue SAS (Brevo): transactional email sending
• Cloudflare Inc.: DNS and protection

The Provider will give prior notice of any new sub-processors or changes with at least 30 days' notice, giving the User the right to withdraw from the contract if they do not agree with the new configuration.

The Provider reserves the right to amend these Terms. Substantial changes will be communicated to the User by email with at least 30 days' notice. Minor changes (corrections, clarifications, technical updates) are effective from publication on the site.

If the User does not accept substantial changes, they may withdraw from the contract within 30 days of notice without penalty.

This contract is governed by Italian law. Any dispute that may arise falls under the exclusive jurisdiction of the Court of Sassari, unless the law imposes a different mandatory jurisdiction (in particular, for consumers, under Art. 33 of the Italian Consumer Code, the court of the consumer's place of residence or domicile has jurisdiction).

Before going to court, the parties undertake to attempt an amicable settlement of the dispute. It is also possible to use the European Commission's ODR (Online Dispute Resolution) platform at ec.europa.eu/consumers/odr.

Pursuant to and for the purposes of Articles 1341 and 1342 of the Italian Civil Code, the User declares that they have read and expressly accept the following clauses:

Sec. 5 (Plans, pricing and billing - price changes), Sec. 6 (Termination by the Provider), Sec. 8 (Prohibited uses), Sec. 10 (Limited SLA), Sec. 11 (Limitation of liability - including quantitative limit), Sec. 14 (Unilateral changes to the Terms), Sec. 15 (Exclusive jurisdiction of Sassari save for consumers).

For any request relating to these Terms:

• Email: info@studiocravero.eu
• Certified email (PEC): info.studiocravero@pec.it
• Address: Studio Cravero Consulting - Sassari (SS)
• VAT: IT03059830905