Sinapsi by Celebron · Article 28 GDPR
Data Processing Agreement
The agreement by which each client company, as data controller, entrusts Celebron S.r.l., as data processor, with the management, control and custody of the data processed in Sinapsi. It forms part of the Sinapsi contract.
Last updated: 13 October 2026 · Translation for convenience: the Italian text prevails
I read your data only to provide the service. Here is how Celebron keeps it safe.
1Parties and roles
The Client is the controller of the personal data contained in the documents it sends to Sinapsi. Celebron S.r.l. is the processor under Article 28 of Regulation (EU) 2016/679 (GDPR) and processes those data only on the Client’s behalf. For the data of the Client’s contacts and Dashboard users, processed to manage the contract, and for the data processed to meet anti-money-laundering obligations, such as due diligence and ten-year retention, Celebron is an independent controller under its own privacy notice.
This agreement forms part of the Sinapsi contract and follows its term. Capitalised terms have the meaning given in the Sinapsi Terms of Service.
2Subject matter, nature and purpose
Celebron collects, records, organises, stores, consults and processes the data, including with artificial intelligence systems, presents them in the Dashboard and finally returns and deletes them, for the sole purpose of providing Sinapsi: Dashboard, Vedi prima, litigation folder and service hours.
3Data subjects and types of data
| Who | What data |
|---|---|
| Shareholders, directors, beneficial owners and guarantors | identification and contact data, offices, holdings, guarantees, positions in the Central Credit Register and credit databases |
| Employees and collaborators | identification, pay and social security data from payslips and F24 forms; payslips may contain special categories of data, such as sick leave or union deductions |
| Individual customers and suppliers | identification and tax data, amounts and due dates of invoices and contracts, payment data |
| Counterparties and other people named in documents | identification data, amounts and content of judicial, tax and administrative documents |
| Client contacts and users | name, role, email, telephone, access logs |
Sinapsi processes special categories of data only if they appear in the documents needed for the service and only for that purpose. It does not process data relating to criminal convictions and offences (Article 10 GDPR): the Client does not send criminal documents and, if they arrive by mistake, Celebron deletes them and informs the Client.
4The Client’s instructions
Celebron processes the data only on the Client’s documented instructions: the contract, the Dashboard settings and the written requests of its contacts. If an instruction appears to infringe the law, Celebron reports it immediately and may suspend its execution. Data leave the European Economic Area only in the cases set out in section 9.
5Authorised persons
Only Celebron people who need the data for the service have access, authorised in writing, bound by confidentiality and trained in data protection and in the use of artificial intelligence. Access is personal and logged.
6Management, control and custody of the data
The management, control and custody of the data are Celebron’s responsibility, and Celebron is accountable for them to the Client.
- Where. On protected servers of a leading cloud provider, such as Amazon Web Services, managed by the provider itself or by one of its official partners, with data centres in the European Union, ISO/IEC 27001 certification and a data processing agreement under Article 28 of Regulation (EU) 2016/679.
- Separation. Each Client’s data are kept separate and tagged with its Client code.
- Entry. The mailbox sinapsi@celebron.it accepts documents only from authorised addresses and with the Client code. It is a transit point: documents are moved into the protected environment and removed from the mailbox within thirty days.
- Control. Every access and every operation is logged; logs are kept for at least twelve months and reviewed periodically.
- Growth. As the number of clients grows, Celebron scales storage, servers and security measures, including with dedicated environments, keeping the safeguards of this agreement, and informs the Client of changes affecting providers.
7Security measures
Celebron adopts the measures of Article 32 GDPR appropriate to the risks, including:
- encryption of data in transit and at rest;
- multi-factor authentication for staff and personal codes for Dashboard users;
- least privilege: everyone sees only what they need;
- encrypted backups, at least daily, kept separately in the European Union, with restore tests;
- security updates and vulnerability management;
- a written procedure for incidents and data breaches;
- a review of the measures at least once a year and at every significant change.
8Sub-processors
The Client gives Celebron general authorisation to engage sub-processors. Celebron imposes on them by contract the same obligations as this agreement, chooses them among providers offering adequate guarantees and remains liable to the Client for their performance (Article 28(4) GDPR). Celebron notifies by email any new or replacement sub-processor at least thirty days in advance; the Client may object on reasonable grounds and, if no solution is found, may withdraw at no cost.
| Service | Provider | Where the data are | Safeguards |
|---|---|---|---|
| Cloud infrastructure and storage | a leading cloud provider, such as Amazon Web Services, or one of its official partners; named in the individual contract | European Union | Article 28 GDPR, ISO/IEC 27001 |
| Email and website of the celebron.it domain | hosting and email provider of the domain | European Union | Article 28 GDPR |
| Artificial intelligence models | leading providers, such as Anthropic, whose commercial terms exclude training on customer data | European Union or United States | Article 28 GDPR; for the United States, EU-U.S. Data Privacy Framework or standard contractual clauses |
| Professionals for litigation | lawyers, accountants and tax advisers chosen by the Client or under agreement | Italy | act only on the Client’s instructions, as independent controllers |
The up-to-date list with names is attached to the individual contract and may be requested at any time from sinapsi@celebron.it.
9Transfers outside the European Union
The data are stored in the European Union. A provider may process them outside the European Economic Area only with the safeguards of Articles 44–49 GDPR: an adequacy decision, such as the EU-U.S. Data Privacy Framework for participating US companies, or the European Commission’s standard contractual clauses, with a risk assessment and supplementary measures where needed.
10Assistance to the Client
- Celebron forwards to the Client within five working days any data subject requests it receives and helps it respond (Articles 15–22 GDPR).
- It provides the information needed for the data protection impact assessment and any prior consultation (Articles 35–36).
- It assists with security and with the handling of breaches (Articles 32–34).
11Data breaches
If it discovers a personal data breach, Celebron notifies the Client without undue delay and in any event within forty-eight hours. It states what happened, which data and how many people are involved, the likely consequences and the measures taken or proposed, so that the Client can notify the Italian Data Protection Authority within the seventy-two hours set by Article 33 GDPR. Celebron documents every breach and cooperates with communications to data subjects.
12Artificial intelligence
The data are also processed with artificial intelligence systems, solely to provide the service. In the app the artificial intelligence system appears under the trade name «Calypso». Celebron chooses providers whose terms exclude the use of customer data to train their models and limit retention; it does not use the data to train third-party models; it takes no decisions based solely on automated processing that produce legal or similarly significant effects on individuals (Article 22 GDPR). Every output intended for the Client is checked by a person on the Celebron team. More details on the page How we use artificial intelligence and in the Artificial Intelligence Terms.
13Audits
Celebron makes available to the Client the information needed to demonstrate compliance with this agreement, including providers’ certifications, and allows audits by the Client or by an auditor it appoints who is bound by confidentiality, with thirty days’ notice, no more than once a year unless there is a breach, at the Client’s expense.
14Return and deletion
On termination of the contract Celebron returns the data to the Client, on request and free of charge, in a structured, commonly used and machine-readable format. It then deletes them within sixty days, including copies, except those the law requires to be kept, such as anti-money-laundering due diligence records (ten years, Article 31 of Legislative Decree 231/2007), and issues a written certificate. Backups are deleted as they rotate, within ninety days.
15Records and liability
Celebron keeps the record of processing activities carried out on behalf of clients (Article 30(2) GDPR). Each party is liable under Article 82 GDPR and the contract.