Data Processing Agreement

This is a courtesy translation. The Italian version of this document is the legally binding one; in the event of any discrepancy, the Italian text prevails.

This agreement forms part of the Terms of Use and applies whenever you upload personal data relating to other people to Balance: your clients, their guests, your suppliers and collaborators. In respect of that personal data, you are the controller: you decide why it is collected and how it is used. We process it on your behalf as your processor for the purposes of Article 28 of Regulation (EU) 2016/679.

1. Subject matter, duration and purpose

We process the data solely to provide the Balance service as described in the Terms: to store and organise it, make it available to you, generate the documents you request and send the communications you choose to send. Processing continues for the term of your subscription and for the time technically needed to return or delete the data.

2. Data and data subjects

The data you entrust to us typically relates to: your clients (names, contact details, billing data), their guests (names, attendance, seating, dietary requirements), your suppliers and collaborators (contact details, agreements, amounts), and the content of the messages you exchange with them within Balance.

Some of this information may fall within the special categories of personal data under Article 9: a food allergy is health data, and a dietary choice may reveal a religious belief. We protect it using the same measures as the rest of the data, but you choose the legal basis for collecting it and you must be able to demonstrate that basis.

3. We process only on your instructions

We process the data only on your documented instructions, which consist of your use of the service and the terms of this agreement. We do not use it for our own purposes, sell it, use it to train models or disclose it to third parties for their own purposes. If the law required us to process the data differently, we would tell you before doing so, unless that law prohibited us from telling you.

4. Confidentiality

Anyone who accesses the data on our behalf is contractually bound to confidentiality and may access it only to the extent needed to run the service or assist you when you ask us to.

5. Security measures

We apply the measures described in the privacy policy: encryption in transit and at rest, access limited to those who need it, multi-factor authentication available on request for administrative access, access logging and backups. The measures may evolve, but they will not fall below the level described there.

6. Sub-processors

To deliver the service we rely on other providers, who become our sub-processors. The current list is in the privacy policy. By accepting this agreement you authorise them in general terms. If we add or replace one, we will tell you at least thirty days in advance, and you may object during that period; if you object and we cannot find an alternative, you may cancel without penalty for the unused part of your subscription.

7. We help you with the requests you receive

If one of your clients or their guests exercises a right — access, rectification, erasure, restriction of processing, data portability or objection — it is for you to respond, because you are the controller. We give you the tools to do this inside Balance and, where those are not enough, we assist you on request. If a request comes directly to us, we will not respond on the substance: we will forward it to you without undue delay.

8. If something goes wrong

If we become aware of a personal data breach affecting your data, we will notify you without undue delay and in any event within 48 hours, providing the information available to us: what happened, which data is affected, how many people are involved and what we are doing about it. Where notification to the supervisory authority is required, that is your responsibility as controller, and we will provide the information you need to make it.

9. When it ends

When your subscription ends, you can export your data using the tools in Balance. Thirty days after closure we delete it from live systems, and from backups within a further ninety days, except for data we are required by law to retain. On request, we will confirm in writing that deletion has taken place.

10. Audits

On request, we make available the information needed to demonstrate compliance with these obligations. If you need a more detailed audit, we can agree on one, subject to reasonable notice and without interfering with the service provided to other users.

If you have any questions about this agreement, write to [email protected]. If this agreement conflicts with the Terms of Use, this agreement prevails in relation to data processing.

In force since 1 April 2025. Last revised: 24 August 2026.