DATA PROCESSING AGREEMENT (Art. 28 GDPR)
IKFace · INFOKRAUSE S.R.L. · v1.1 (2026-10-24) · In vigore dall'accettazione del Cliente / Vigente desde la aceptación del Cliente / Effective upon the Customer's acceptance
Parties. The Customer named in the Order, as controller (the «Controller»), and INFOKRAUSE S.R.L., tax/VAT no. 04126260928, Via delle Speronelle 15, 09045 Quartu Sant'Elena (CA), Italy, as processor (the «Processor»).
1. Scope. This agreement applies where the Processor processes personal data on behalf of the Controller in connection with the IKFace Managed service, remote support or synchronisation with the Processor's services. The subject matter, nature, purposes, types of data and categories of data subjects are described in Annex 1.
2. Instructions. The Processor processes the data only on the Controller's documented instructions, which are this agreement, the IKFace configuration chosen by the Controller and its written requests, unless required by law. If it considers an instruction unlawful, it informs the Controller.
3. Confidentiality and security. The Processor ensures that persons authorised to process the data are bound by confidentiality and implements the technical and organisational measures in Annex 2 (Art. 32 GDPR).
4. Sub-processors. The Controller gives general authorisation for the sub-processors in Annex 3. The Processor gives 30 days' notice of any addition or replacement; the Controller may object on reasonable grounds. The Processor imposes the same obligations on sub-processors and remains liable for them.
5. Transfers. The data are not transferred outside the European Economic Area, except to countries with an adequacy decision or under the European Commission's standard contractual clauses or another Art. 46 GDPR safeguard.
6. Assistance to the Controller. Taking into account the nature of the processing, the Processor assists the Controller in responding to data subject requests and with the obligations under Arts. 32–36 GDPR (security, breaches, impact assessment, prior consultation).
7. Personal data breaches. The Processor notifies the Controller without undue delay, and in any event within 48 hours of becoming aware, of any personal data breach, providing the information available.
8. End of processing. On termination of the service, the Processor, at the Controller's choice, returns or deletes the personal data and copies in its possession within 30 days, unless retention is required by law.
9. Audits. The Processor makes available the information needed to demonstrate compliance with this agreement and allows audits by the Controller or an auditor it appoints, on 30 days' notice and no more than once a year, except after a breach.
10. Term, law and language. This agreement lasts as long as the service and prevails over any other agreement on personal data. Italian law; Cagliari courts. Drawn up in Italian, Spanish and English; in case of discrepancy the Italian text prevails.
Annex 1 — Description of the processing. Subject matter and nature: administration, maintenance, updating and support of IKFace, with possible access to the stored data. Purpose: providing the contracted service. Types of data: identification data of enrolled persons (name, identifier, category), facial images, biometric templates (embeddings), recognition and access events with date, time and camera, aggregate demographic data, IKFace user data and audit logs. Special categories: biometric data (Art. 9 GDPR). Data subjects: employees, visitors, customers and other persons captured or enrolled by the Controller; IKFace users. Duration: that of the service.
Annex 2 — Security measures. Remote access restricted to the Processor's authorised staff, with credentials held in a centralised secrets management system and logged access; role- and scope-based access control; user passwords stored with a strong algorithm (scrypt); logical per-customer data separation; security updates managed by the Processor; audit logs of operations; staff bound by confidentiality. Data location: data remain on the Controller's appliance; synchronisation with a server is disabled by default and, if enabled by the Controller, uses TLS towards the server it designates. Backups: the appliance creates local database copies before each update, kept on the appliance itself; they are not encrypted by the application. Encryption at rest: not provided by the application; the Controller may apply disk or volume encryption.
Annex 3 — Authorised sub-processors. Tecnologías IP Limitada, RUT 76.013.135-0, Santiago (Chile): first-level support to customers in Chile, under the European Commission's standard contractual clauses (transfer to Chile). Google Ireland Ltd / Google LLC: e-mail (Google Workspace) and AI-based automatic replies in the support chat (Google Gemini API); transfers to the US under the EU-US Data Privacy Framework or standard contractual clauses. The chat and ticketing platforms (Chatwoot, chat.infokrause.cl and soporte.infokrause.cl) are run by INFOKRAUSE on its own servers located in Chile; the transfer to Chile is covered by the standard contractual clauses signed with Tecnologías IP Limitada.