Navigation menu

Data Processing Agreement

This DPA is intended to form an integral part of the Terms of Use of the Basebear Service. It does not require the completion of individual Customer identification details and becomes binding in the contractual relationship with each Customer upon valid and documentable contractual acceptance.

1. Parties, Applicability and Definitions

1.1. This Data Processing Agreement (hereinafter referred to as the “DPA”) governs the processing of personal data carried out by Basebear S.r.l., with its registered office at Via Olindo Guerrini 21, 00137 Rome, Italy, VAT No. 10663631009, contact email support@basebear.com, acting as Data Processor on behalf of the Customer, who generally acts as Data Controller, except as provided for in Section 1.5.

1.2. “Customer” means the natural or legal person who has subscribed to the Basebear Service, identifiable through the information associated with the relevant account and, where applicable, billing details.

1.3. This DPA forms an integral part of the Terms and Conditions of Use of the Basebear Service, available at https://basebear.com/it/Terms.aspx, which govern the contractual relationship between Basebear S.r.l. and the Customer.

1.4. This DPA applies to the processing of personal data carried out by Basebear S.r.l. on behalf of the Customer in connection with the provision of the Service, in accordance with Regulation (EU) 2016/679.

1.5. The “Customer” is the party that determines the purposes and essential means of processing the “Customer Data” in its capacity as Data Controller. Where the Customer acts as a Data Processor on behalf of another Data Controller, the Customer represents that it is authorized to engage Basebear as a Sub-processor. The provisions of this DPA shall apply, to the extent compatible, throughout the relevant chain of processing arrangements.

1.6. “Customer Data” means the personal data stored in databases, fields, records, and attachments uploaded to or processed through the Service on behalf of the Customer. “Service” means the Basebear SaaS platform, accessible at basebear.com. All other terms shall have the meanings assigned to them under the GDPR.

1.7. Basebear acts as an independent Data Controller with respect to personal data processed for its own purposes (such as account management, marketing communications, and payment administration), as described in the Privacy Policy. This DPA does not govern such independent processing activities.

2. Description of Processing

2.1. Basebear processes personal data on behalf of the Customer for the purpose of providing, managing, securing, and maintaining the Service for creating, managing, and sharing online databases, including technical support and security activities.

2.2. Processing includes the operations necessary for the provision of the Service, including recording, storage, retrieval, modification, export, backup, and deletion of data.

2.3. The data processed may include identification, contact, professional, and other personal information independently entered by the Customer, including, where applicable, special categories of personal data pursuant to Article 9 of the GDPR and personal data relating to criminal convictions and offences pursuant to Article 10 of the GDPR. Data subjects may include customers, employees, collaborators, users, and other individuals whose data is managed by the Customer.

2.4. Processing shall take place for the duration of the contractual relationship, without prejudice to any subsequent retention periods provided for in this DPA and applicable law.

2.5. The Customer determines the purposes of the processing and retains the rights and obligations of the Data Controller under the GDPR, as governed by this DPA.

3. Documented Instructions and Customer Obligations

3.1. Basebear processes Customer Data exclusively on the basis of documented instructions provided through the use and configuration of the Service, the Terms of Use, and any written requests from the Customer, in compliance with applicable law.

3.2. Where Union or national law to which Basebear is subject requires processing that has not been instructed by the Customer, Basebear shall inform the Customer before carrying out such processing, unless prohibited by law on important grounds of public interest. Basebear shall immediately inform the Customer if it considers that an instruction from the Customer infringes the GDPR or other data protection laws.

3.3. The Customer determines the purposes and legal basis of the processing activities, provides the necessary privacy notices, handles data subject requests, and verifies the lawfulness of the data entered. The Customer manages access permissions, authorized users, database sharing, and the security of its own credentials.

3.4. The Customer, acting as Data Controller, is responsible for assessing the suitability of the Service in relation to the nature of the personal data processed, the purposes of the processing, and the associated risks, taking into account the technical and organizational measures implemented by Basebear and described in Annex A. The Service is provided with the standard security measures adopted by Basebear, without any obligation to agree upon additional or customized measures with individual Customers, without prejudice to any mandatory obligations under applicable law.

4. Confidentiality and Authorized Personnel

4.1. Basebear ensures that persons authorized to process Customer Data are bound by confidentiality obligations under law or contract and are granted access only to the data necessary to perform their assigned duties.

4.2. Basebear may access databases and the personal data contained therein to provide technical support to Customers, perform maintenance activities, and ensure the security and proper functioning of the Service. Such access is restricted to authorized personnel and to activities necessary for the aforementioned purposes, in compliance with confidentiality obligations and applicable law.

5. Security of Processing

5.1. Basebear implements and maintains technical and organizational measures appropriate to the risk pursuant to Article 32 of the GDPR, taking into account the state of the art, implementation costs, and the nature, context, and purposes of the processing. The measures currently in place are summarized in Annex A.

5.2. Basebear may update its technical measures during the provision of the Service, while maintaining an overall level of security that is not lower than the existing level and communicating significant changes in accordance with the contractually agreed procedures.

6. Engagement of Sub-processors

6.1. By accepting this DPA, the Customer authorizes Basebear to engage the Sub-processors listed in Annex B and to modify the list in accordance with the procedures set out in this Article. Basebear shall keep the list of Sub-processors updated and accessible to the Customer.

6.2. Basebear shall notify the Customer in advance, via the email address associated with the contractual relationship, of any intended changes concerning the addition or replacement of Sub-processors, in compliance with Article 28(2) of the GDPR.

6.3. In the event of a reasoned objection by the Customer, Basebear shall not be obliged to identify or implement alternative or customized solutions. If the objection prevents the engagement of a Sub-processor necessary for the provision of the Service, the parties may terminate the contractual relationship concerning the affected Service, in compliance with the data return and deletion obligations set out in this DPA.

6.4. Basebear engages Sub-processors under contractual agreements, including standard-form agreements, which provide for data protection obligations in accordance with Article 28(4) of the GDPR.

6.5. Basebear remains responsible to the Customer for the fulfillment of the Sub-processors' obligations, in accordance with the provisions of applicable law.

7. International Data Transfers and Access

7.1. Basebear carries out any transfers of personal data to countries outside the European Economic Area in accordance with the Customer's documented instructions and the provisions of Chapter V of the GDPR, applying the safeguards required by applicable law.

8. Exercise of Data Subject Rights and Assistance to the Customer

8.1. Taking into account the nature of the processing, Basebear shall assist the Customer, insofar as possible, through appropriate technical and organizational measures, in responding to data subject requests pursuant to Chapter III of the GDPR. The Customer may use the Service's data retrieval, rectification, export, and deletion features in accordance with their respective functionalities.

8.2. If Basebear receives a request directly concerning Customer Data, it shall forward the request to the Customer without undue delay, unless otherwise required by law, without making decisions regarding the purposes of the processing.

8.3. Taking into account the nature of the processing and the information available, Basebear shall provide reasonable assistance with security, personal data breach management, data protection impact assessments, and prior consultation with the supervisory authority, pursuant to Articles 32–36 of the GDPR.

9. Personal Data Breaches

9.1. Basebear shall inform the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data. Notifications shall be sent to the contact details provided by the Customer, using methods appropriate to the severity of the incident.

9.2. Basebear shall progressively provide reasonably available information regarding the nature of the incident, the categories of data and data subjects affected, the likely consequences, the measures taken or planned, and the relevant contact details for coordination. Basebear shall cooperate with the Customer in fulfilling any notification and communication obligations pursuant to Articles 33 and 34 of the GDPR.

10. Data Return, Export and Deletion

10.1. The Customer may export their data using the features available within the Service. Upon termination of the Service, in the absence of other documented instructions from the Customer, Basebear shall delete the personal data processed on the Customer's behalf and any related copies, unless retention is required by law, in accordance with Article 28(3)(g) of the GDPR.

10.2. The deletion of remaining copies, including those stored in backup systems, shall be carried out in accordance with Basebear's technical procedures and standard retention cycles, ensuring that the data remains protected in the meantime.

10.3. Data whose retention is required by applicable law shall be excluded from deletion, solely for the purposes and periods prescribed by law.

11. Information and Audits

11.1. Basebear shall make available to the Customer, upon written request, the information necessary to demonstrate compliance with the obligations set out in Article 28 of the GDPR, including documentation relating to the technical and organizational measures implemented.

11.2. Basebear shall allow for and contribute to audits as provided for in Article 28(3)(h) of the GDPR, in a proportionate manner, giving preference, where appropriate, to documentary reviews while safeguarding the security of the Service, the confidentiality of other customers' data, and business continuity.

12. Relationship with Other Contractual Documents

12.1. This DPA forms an integral part of the Main Agreement with respect to the processing of personal data carried out by Basebear on behalf of the Customer. In the event of any conflict, this DPA shall prevail in matters relating to data protection, solely to the extent necessary to ensure compliance with mandatory legal provisions.

12.2. Each party retains its responsibilities under the GDPR. No provision shall limit the rights of data subjects or exclude any mandatory obligations and liabilities established, in particular, by Articles 28, 82, and 83 of the GDPR.

12.3. This DPA shall be governed by Italian law, without prejudice to directly applicable provisions of European Union law.

13. Electronic Acceptance, Effectiveness and Amendments

13.1. This DPA applies to the Customer identified in the Main Agreement following valid acceptance of the Terms of Use that expressly reference it, or through another form of express and recordable contractual consent. The conclusion of the agreement in electronic form is permitted under Article 28(9) of the GDPR and does not necessarily require a handwritten signature on this document.

13.2. This DPA forms an integral part of the Terms of Use of the Basebear Service and applies in accordance with the contractual acceptance and amendment procedures set out therein.

13.3. Material amendments to this DPA shall be communicated to the Customer and shall become binding through a valid and documentable contractual mechanism.

Annex A — Technical and Organizational Measures

Basebear implements the following technical and organizational measures to ensure the security of personal data processed as part of the Service:

Annex B — Sub-processors

Provider: AMAZON WEB SERVICES EMEA SARL
Services: Cloud infrastructure for hosting, processing, storing, and backing up data within the Basebear Service.
Location: Infrastructure located in Europe, according to the configuration of the services used by Basebear.