Data processing agreement (DPA)

This Data Processing Agreement (“DPA”) supplements the Terms of Service between info@cursusoffice.com, VAT 04018830135 (the “Processor”) and the Customer named in the account (the “Controller”), pursuant to Article 28 of Regulation (EU) 2016/679 (“GDPR”). It applies to the personal data that the Controller enters into the Service and that the Processor processes on its behalf.

1. Subject matter, nature and purpose

The Processor provides the Controller with an online business management service. To do so it stores, organises, processes, displays, exports and deletes the data entered by the Controller and its users, and transmits it to the third-party services that the Controller connects to its account (e.g. email, e-signature, payments, e-invoicing). The purpose is solely to deliver the Service under the Terms and the Controller's documented instructions.

2. Duration

The DPA lasts as long as the service contract and continues to apply for as long as the Processor holds the Controller's data (section 9).

3. Categories of data and data subjects

• Data subjects: the Controller's customers, prospects, suppliers, collaborators and employees, customer portal users, contact persons, account users.
• Data: identification and contact details, tax codes and VAT numbers, addresses, commercial and accounting document data (quotes, invoices, payments, expenses, contracts), messages and attachments, hours worked, users' sign-in data. The Controller must not enter special categories of data (Art. 9 GDPR) or data on criminal convictions unless strictly necessary, and is responsible if it does.

4. Processor's obligations

1. Processes the data only on the Controller's documented instructions; the Terms, this DPA and the Service settings are the complete instructions. If it believes an instruction infringes the law it informs the Controller.
2. Ensures that persons authorised to process the data are bound by confidentiality.
3. Applies the security measures in Annex A.
4. Respects the conditions of section 5 for sub-processors.
5. Assists the Controller, by appropriate technical and organisational measures, in responding to data-subject requests: the Service lets the Controller access, rectify, export and delete data; where this cannot be done independently the Processor cooperates on request.
6. Assists the Controller with security, breach notification, impact assessments and prior consultation, taking into account the nature of the processing and the information available to it.
7. Notifies the Controller of personal data breaches without undue delay and in any case within [48] hours of becoming aware, with the information available.
8. On request makes available the information necessary to demonstrate compliance with the DPA and allows reasonable audits, on at least [30] days' notice, during business hours and without compromising security or other customers' data; the audit may also be carried out through documentation or third-party reports.

5. Sub-processors

The Controller gives general authorisation to use sub-processors. Those in use are listed in Annex B. The Processor informs the Controller of additions or replacements with at least [30] days' notice (email or notice in the account); the Controller may object on reasonable data-protection grounds and, if no solution is found, may terminate the contract with a refund of the unused part of the paid period. The Processor imposes on sub-processors obligations equivalent to this DPA and remains liable to the Controller for their performance.

Services that the Controller chooses and connects itself (e.g. its own Stripe account, an e-signature service, e-invoicing software, cloud storage) are not sub-processors of the Processor: the Controller engages them directly and decides which data to send them.

6. Transfers outside the EEA

The Processor does not transfer data outside the European Economic Area except on the basis of an adequacy decision or standard contractual clauses, with supplementary measures where needed. The list of transfers is in Annex B.

7. Controller's obligations

The Controller warrants that it has a legal basis for the data it enters, has informed the data subjects, uses the Service in compliance with the law and manages users' credentials securely. It remains responsible for the accuracy of the data and for the choice of third-party services it connects.

8. Export and return

The Controller can export all data (tables, issued documents, attachments) at any time from the Account and data area. At the end of the contract the export-only period provided in the Terms applies.

9. Deletion

After the account is closed and at the end of the retention period stated in the Terms (10 days) the Processor deletes or anonymises the Controller's data and its copies, unless Union or national law requires retention. On request it confirms deletion in writing.

10. Liability

Each party is liable under the GDPR. As between the parties the limitations of liability in the Terms apply, except for liabilities that the law does not allow to be limited.

11. Governing law

The DPA is governed by Italian law; the jurisdiction provided in the Terms applies.

Annex A — Technical and organisational security measures

• Data separation: a dedicated database for each account; no tables shared between customers; the Service resolves the account from the domain and not from client-supplied data.
• Access control: roles and permissions per action; hashed passwords; two-step verification (authenticator app) and passkeys; one-time recovery codes; two-step verification required for administrators under the account policy; recorded, visible and revocable sessions with a maximum lifetime; rate limits on sign-in attempts.
• Encryption: secrets of connected services (API keys, SMTP passwords, tokens) are encrypted in the database with an authenticated algorithm (AES-256-GCM); encrypted connections (HTTPS/TLS) with a protected session cookie.
• Logging and monitoring: account security event log (sign-ins, security changes, exports) with configurable retention; log of operations on documents.
• Document integrity: issued tax documents are immutable; corrections are made with traceable credit notes.
• Application: protection against forged requests (CSRF tokens), file-type checks on the real content, output escaping, checks on destinations of outgoing links (webhooks) against access to internal networks.
• Export and deletion: full data export from the Service; two-step closure; deletion under section 9.
• Organisation: staff access to customer data limited to what is necessary for support and maintenance, with confidentiality obligations.

Annex B — Sub-processors and transfers

Sub-processor	Service	Location / safeguards
Hosting provider, IONOS SE	Servers and infrastructure hosting the Service and databases	Data Center Country — Germany
Cloudflare, Inc.	Anti-bot check (Turnstile) on the sign-up form	Standard contractual clauses / DPF
Stripe Payments Europe Ltd.	Collection of the Service's fees (data of the Controller only as the Provider's customer)	EU; transfers under Stripe's safeguards