Data Processing Agreement (DPA)

1. Parties, roles and scope

This Agreement is entered into between the Customer and the contracting entity identified in Clause 1 of the Terms of Use: ETIQUETACHEF DESENVOLVIMENTO DE SOFTWARE CUSTOMIZÁVEL LTDA (“EtiquetaChef Brasil”), for Customers established in Brazil, or EtiquetaChef WorldWide (“EtiquetaChef WorldWide”), for Customers established in any other country.

The Customer acts as controller of the personal data of its staff, users and other persons it registers or records on the platform, and EtiquetaChef acts as processor within the meaning of Article 28 of Regulation (EU) 2016/679 (GDPR), processing such data solely on behalf of the Customer. Data that EtiquetaChef processes for its own purposes — account, billing, support, security and fraud prevention — is governed by the Privacy Policy, not by this Agreement.

This Agreement applies together with the applicable data protection law, including the GDPR and Italian law for Customers of EtiquetaChef WorldWide and Brazilian Law No. 13,709/2018 (LGPD) for Customers of EtiquetaChef Brasil. Acceptance of the Terms implies acceptance of this Agreement. On matters of personal data protection, this Agreement prevails over the Terms.

2. Subject matter, duration, nature and purpose

• Subject matter: the provision of the EtiquetaChef services contracted by the Customer, in accordance with the Terms and the Commercial Proposal.
• Duration: the term of the subscription, plus the export and deletion period provided for in Clause 25 of the Terms.
• Nature: hosting, storage, organisation, consultation, transmission, synchronisation between devices, backup and deletion of data.
• Purpose: to provide, maintain, secure and support the platform for the Customer’s labelling, traceability and expiry control operations.

3. Data subjects and categories of data

Data subjects: staff, users, technical managers and other persons registered by the Customer or referred to in its operational records.

• identification and contact data: name, e-mail, telephone, role and access profile;
• credentials and access controls: user identifier, permissions and authorised devices;
• operational records: labels printed, consumption, discards and other actions, with author, date and time;
• location of the device at the moment of printing or NFC recording, in accordance with Clause 13 of the Terms;
• technical device identifiers and activity logs necessary for security and support.

The platform is not intended for processing special categories of personal data. The Customer must not enter them in free-text fields. The quick-access PIN is encrypted on the device only and is not sent to EtiquetaChef.

4. Customer instructions

EtiquetaChef processes the data only on the documented instructions of the Customer, which consist of the Terms, this Agreement, the Commercial Proposal and the settings and actions carried out by the Customer and its users on the platform, including with regard to international transfers, unless required to do so by law, in which case it will inform the Customer before processing, unless the law prohibits such information.

EtiquetaChef will inform the Customer if, in its opinion, an instruction infringes the applicable data protection law.

5. Customer obligations

The Customer is responsible for the lawfulness of the processing it determines, including the legal basis, informing data subjects — in particular informing staff of the location records under Clause 13 — and compliance with applicable labour law, as well as for the accuracy of the data it enters on the platform.

6. Confidentiality

EtiquetaChef ensures that persons authorised to process the data are bound by a contractual or statutory duty of confidentiality and access the data only to the extent necessary for the provision, security and support of the service.

7. Security measures

EtiquetaChef implements technical and organisational measures appropriate to the risk, in accordance with Article 32 GDPR and Article 46 LGPD, including:

• encryption of data in transit and at rest in the cloud infrastructure used;
• isolation of each Customer’s data and role-based access control, enforced on the server by security rules;
• user authentication and restriction of administrative access to the minimum necessary;
• activity and audit logs of relevant operations;
• backups and recovery procedures, in accordance with Clause 14 of the Terms.

8. Sub-processors

The Customer grants a general authorisation for the engagement of the sub-processors listed below and of the other EtiquetaChef entity identified in Clause 1 of the Terms, for technology, infrastructure, development and support services. EtiquetaChef imposes on each sub-processor data protection obligations equivalent to those of this Agreement and remains liable to the Customer for the performance of those obligations.

EtiquetaChef will give notice of the addition or replacement of sub-processors at least 30 (thirty) days in advance, by updating this page and informing the Customer’s account owner through the registered channels. The Customer may object on reasonable data protection grounds within that period; if no reasonable solution is possible, the Customer may cancel the affected subscription without penalty, in accordance with Clause 7.3.

The Licensed Partner serving the Customer accesses the data with the Customer’s authorisation, under Clause 6.6 of the Terms, and, when providing L1 support on behalf of EtiquetaChef, is bound by obligations equivalent to those of this Agreement. The table below lists all of EtiquetaChef’s providers; some of them — payment processors, app stores and campaign measurement — only process data that EtiquetaChef processes for its own purposes, under the Privacy Policy, and not data processed on behalf of the Customer.

9. International transfers

EtiquetaChef’s main infrastructure is located in Brazil, and some sub-processors process data in other countries, including the United States; for Customers established outside those countries, this involves an international transfer. Such transfers are based on an adequacy decision — such as the European Commission’s decision on Brazil and the ANPD’s decision on the European Union, both of January 2026 —, on standard contractual clauses approved by the European Commission or by the ANPD, or on another valid mechanism provided for by applicable law.

10. Assistance to the Customer and incidents

Taking into account the nature of the processing, EtiquetaChef will assist the Customer, through platform features or on request, in responding to data subject requests, in data protection impact assessments and in prior consultation with the supervisory authority, where applicable. Requests from data subjects received directly by EtiquetaChef concerning the Customer’s data will be forwarded to the Customer.

EtiquetaChef will notify the Customer without undue delay after becoming aware of a personal data breach affecting data processed on behalf of the Customer, with the information available to enable the Customer to meet its notification obligations.

11. Return and deletion on termination

On termination of the subscription, the Customer chooses between the return and the deletion of the data processed on its behalf. Return takes place by export, on request within 30 (thirty) days, in accordance with Clause 25 of the Terms. Deletion takes place on the Customer’s request, by deleting the account on the platform or through the contact channel of this Agreement, and is completed at the end of the 90 (ninety) day period during which the deletion can still be reversed, except where the law requires retention. Residual copies in backups are deleted according to internal retention cycles and remain protected until then.

12. Information and audits

EtiquetaChef will make available to the Customer the information reasonably necessary to demonstrate compliance with this Agreement. Additional audits or inspections, carried out by the Customer or by an independent auditor bound by confidentiality, will be scheduled with reasonable notice, limited to one per year except in the event of a significant incident or a requirement of an authority, and conducted so as not to compromise security or the data of other customers, at the Customer’s expense.

13. Contact

Questions about this Agreement, requests and notices: jonas@etiquetachef.com. EtiquetaChef WorldWide — PEC: jonasrgoes@pec.it.