Data Processing Agreement

Last updated: October 2026 · Version 1.0

This Data Processing Agreement ("DPA") forms part of the agreement between the customer ("you", the "Controller") and Aretè Tecnologia di Antonio Sambataro ("PlanMesh", "we", the "Processor"), VAT IT05945010873, Belpasso (CT) 95032, Italy, and governs our processing of personal data contained in your Customer Data on your behalf. It reflects the requirements of Article 28 of the GDPR. Where this DPA conflicts with the Terms of Service on data-protection matters, this DPA prevails. Capitalised terms not defined here have the meaning given in the Terms or the GDPR.

1. Roles of the parties

For Customer Data processed through the Service, you are the controller (or a processor acting on behalf of your own controllers) and we are the processor. Each party will comply with its obligations under the GDPR. For your account and invoicing data, we act as an independent controller, as described in our Privacy Policy; that processing is outside the scope of this DPA.

2. Subject matter, duration, nature and purpose (Annex I)

  • Subject matter: our processing of personal data contained in Customer Data to provide PlanMesh.
  • Duration: for the term of your subscription plus the return/deletion period in Section 10.
  • Nature and purpose: read-only querying of the warehouses and databases you connect; describing their structure (table and column names, types and small samples); showing, storing and sharing the results in answers and dashboards as you instruct, including public links, embeds, PDF exports and scheduled emails; sending your questions and the context they need to the AI model provider; and back-up of what PlanMesh stores, strictly to provide and support the Service on your instructions.

3. Categories of data subjects and personal data

Because you control what PlanMesh reads, the categories of data subjects and personal data are determined by you. They may include, for example, your employees, customers, suppliers and end users, and any personal data present in the warehouses and databases you connect. You are responsible for not sending us special categories of data (Article 9) unless you have a lawful basis and have configured appropriate protections, and for ensuring you have a valid legal basis for the processing you instruct.

4. Our obligations as processor (Article 28)

  • Instructions: we process Customer Data only on your documented instructions (including as set out in the Terms and this DPA), unless required by EU or Member State law, in which case we will inform you unless that law prohibits it.
  • Confidentiality: persons authorised to process Customer Data are bound by appropriate confidentiality obligations.
  • Security: we implement the technical and organisational measures described in Section 6.
  • Sub-processing: we engage sub-processors only under the conditions in Section 5.
  • Assistance: we assist you, taking into account the nature of processing, in responding to data-subject requests (Section 7) and in meeting your obligations under Articles 32 to 36 (security, breach notification, impact assessments and prior consultation).
  • Deletion / return: on termination we return or delete Customer Data as set out in Section 10.
  • Demonstrating compliance: we make available the information necessary to demonstrate compliance and allow for audits under Section 9.

We will not sell Customer Data or use it for our own purposes, including to train AI models.

5. Sub-processors

You give general authorisation for us to engage the sub-processors listed below to help provide the Service, each under a written contract imposing data-protection obligations no less protective than this DPA. Our current sub-processors (Annex II) are:

  • Resend: transactional email delivery.
  • OpenRouter: AI model routing to answer questions and generate SQL in the hosted service. Installations in your own cloud account or on your own servers use the model endpoint you configure, in which case no Customer Data reaches OpenRouter.
  • Cloud / VPS hosting provider: infrastructure hosting for the hosted service (EU region).

We will inform you of any intended addition or replacement of a sub-processor with reasonable prior notice (by email and/or an in-product or website notice), giving you the opportunity to object on reasonable data-protection grounds. If you run PlanMesh in your own cloud account or on your own servers, you control your own infrastructure and most of these sub-processors do not apply to your Customer Data.

6. Security measures (Article 32)

We maintain technical and organisational measures appropriate to the risk, including:

  • Encryption in transit (TLS) for all connections to the Service.
  • Encryption at rest for sensitive secrets: connection credentials are encrypted with AES-256-GCM; passwords are stored only as salted hashes.
  • Read-only access to your warehouses and databases, with the credentials you provide.
  • Strict per-tenant isolation and role-based access controls, on a least-privilege, need-to-know basis.
  • Audit logging of activity in the Service.
  • Regular backups and tested recovery procedures.
  • Monitoring and anti-abuse controls, and processes to review and improve these measures over time.

7. Assisting with data-subject requests

Taking into account the nature of the processing, we will provide reasonable assistance, including appropriate technical and organisational measures and self-service tooling in the Service, to help you respond to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability, objection). If we receive a request directly relating to your Customer Data, we will refer the data subject to you rather than respond ourselves, unless legally required to act.

8. Personal data breach notification

We will notify you without undue delay after becoming aware of a personal data breach affecting your Customer Data, and provide the information reasonably available to help you meet your own notification obligations under Articles 33 and 34. Our notification is not an acknowledgement of fault or liability.

9. Audits

We will make available information reasonably necessary to demonstrate compliance with Article 28 and this DPA, and allow for and contribute to audits, including inspections, conducted by you or an independent auditor mandated by you. Audits are subject to reasonable prior notice, confidentiality obligations, and a frequency and scope that do not disrupt our operations; we may satisfy audit requests by providing existing documentation or summaries of measures where appropriate.

10. Return and deletion on termination

PlanMesh does not move the Customer Data held in your own warehouses and databases. On termination or expiry of the Service, and at your choice, we will return or delete the Customer Data PlanMesh stores (saved results, answers, dashboards and table metadata) and existing copies within a reasonable period, unless EU or Member State law requires storage. Residual data in routine backups is deleted in the ordinary backup-rotation cycle.

11. International transfers

We host the hosted Service in the European Union and prioritise EU data residency. Where a sub-processor processes personal data outside the EEA, the transfer is protected by an appropriate Chapter V safeguard, typically the European Commission's Standard Contractual Clauses (SCCs), supplemented by additional safeguards, or an adequacy decision. Installations in your own cloud account or on your own servers keep Customer Data on your infrastructure, so no transfer to us occurs for that data.

12. General

This DPA takes effect for the duration of the Service. In case of conflict, the SCCs (where they apply) prevail over this DPA, and this DPA prevails over the Terms on data-protection matters. Liability under this DPA is subject to the limitations in the Terms of Service. For DPA questions or to exercise rights under it, contact privacy@planmesh.io.