Data Processing Agreement (DPA)

Last updated: 25 April 2026

This Data Processing Agreement (“DPA”) forms part of the agreement between Pulsessivo.ai (“Processor”) and the customer identified in the applicable order or main agreement (“Controller”) regarding the use of Pulsessivo.ai (the “Service”). This DPA reflects the parties’ obligations under EU/UK GDPR.

1. Subject Matter and Duration

1.1. This DPA governs the Processor’s processing of Controller Personal Data on behalf of the Controller in connection with providing the Service.
1.2. This DPA is effective for the term of the main agreement and will automatically terminate upon deletion or return of Controller Personal Data in accordance with Section 11.

2. Nature and Purpose of Processing

2.1. The Processor will process Controller Personal Data solely to provide, secure, maintain, and improve the Service; to prevent or address service, security, or technical issues; and to comply with law.

2.2. Without limiting the foregoing, Processor may process Controller Personal Data to: (a) provide subscription management (including plan configuration and per-player counts); (b) calculate and apply taxes (including VAT/IVA, EU OSS destination VAT, and imposta di bollo eligibility for invoices issued without VAT); and (c) issue compliant invoices and SDI e-invoices under Italian law.

3. Categories of Data and Data Subjects

3.1. Categories of Personal Data: identification data (name, email), account data, usage data, support data, parent/guardian contact details and youth-program identifiers where Controller elects to provide them, and any other data submitted by Controller to the Service. 3.2. Billing & Tax Data: billing address, country, VAT/IVA number, plan and add-on selections, voucher usage, invoice totals and metadata, and flags required for tax determination (including OSS rate and imposta di bollo applicability), optional hardware purchases (including PULSESSIVO Smart Bracelets as discounted add-on at €39.99 per unit, available exclusively with yearly subscription plans, and associated shipping details). 3.3. Biometric & Health Data: where Controller uses PULSESSIVO Smart Bracelets, the Processor may process special categories of data (biometric and health data) such as heart rate, activity levels, and performance metrics. Controller warrants that it has obtained all necessary consents or has another lawful basis (GDPR Art. 9) for such processing and has informed data subjects accordingly. 3.4. Special Categories: Except as expressly provided in 3.3, Controller shall not submit special categories of data (GDPR Art. 9) or criminal data (Art. 10) unless agreed in writing.
3.5. Data Subjects: Controller's end users, employees, contractors, athletes/players (including minor athletes in organization-managed youth programs), parents/guardians where their contact details are submitted by Controller, and other individuals whose data Controller submits to the Service.

4. Controller Responsibilities

4.1. Controller shall ensure it has a lawful basis and provides all required notices to data subjects.
4.2. Controller is responsible for its instructions, configuration, and use of the Service. 4.3. Biometric Data Consent: Where Controller uses hardware devices (e.g., PULSESSIVO Smart Bracelets) to collect biometric or health data, Controller warrants that it has: (a) informed data subjects about the nature and purposes of biometric data processing; (b) obtained explicit consent where required under GDPR Art. 9; or (c) relies on another lawful basis under Art. 9(2) (e.g., health monitoring with appropriate safeguards); and (d) complied with all applicable laws regarding biometric data processing. 4.4. Youth Athlete Programs: Where Controller uses the Service for athletes under 18, Controller warrants that it: (a) is authorized by the relevant club, academy, school, federation, or other responsible organization to manage the youth program; (b) has provided age-appropriate notices to players and parents/guardians; (c) has obtained parent/guardian consent and player assent where required by Applicable Law; (d) restricts access to Controller Personal Data to authorized adults and appropriately trained staff; and (e) does not use the Service for medical diagnosis or unlawful health surveillance.

5. Processor Obligations

The Processor shall:

• Process only on documented instructions from Controller, including with respect to transfers.
• Ensure persons authorized to process data are bound by confidentiality.
• Implement appropriate technical and organizational measures (TOMs) to ensure a level of security appropriate to the risk (e.g., encryption in transit, logical separation, access controls, logging, backups, incident response).
• Assist Controller with data subject requests, security, breach notifications, DPIAs, and consultations with supervisory authorities, taking into account the nature of processing. Target response to Controller requests related to data subject rights: 10 business days.
• Notify Controller without undue delay after becoming aware of a personal data breach affecting Controller Personal Data.
• Delete or return all Controller Personal Data at the end of the provision of the Services, unless retention is required by law, as described in Section 11.
• Make available information necessary to demonstrate compliance and allow for and contribute to audits, including inspections, conducted by Controller or an auditor mandated by Controller, subject to reasonable advance notice, frequency, confidentiality, and safety requirements.

6. Subprocessors

6.1. Controller authorizes Processor to engage Subprocessors to support the Service. Processor will impose on Subprocessors data protection obligations substantially similar to this DPA.

6.2. Processor will maintain a list of current Subprocessors and provide notice of changes, allowing Controller to object on reasonable grounds. If Controller objects, the parties will work in good faith to find a solution; if none is found, Controller may suspend the affected Service.

6.3. Payment processing and tax/invoicing providers (e.g., payment gateways, VAT/OSS calculation tools, and SDI e-invoicing intermediaries) to process payments, compute applicable taxes, and generate compliant invoices. Shipping carriers (e.g., for delivery of optional PULSESSIVO Smart Bracelets as discounted add-on at €39.99 per unit, available only with yearly plans, and other hardware) to fulfill hardware orders; shipping data is limited to name, address, and contact details necessary for delivery. Processor shall ensure such Sub-processors are bound by obligations no less protective than those in this DPA.

6.3. Current Subprocessors

(Support conversations processed via the AI Chat Bot are sent to OpenAI API for natural language understanding and response generation. OpenAI processes conversation data in accordance with their data processing terms and applicable data protection agreements.)

7. International Transfers

7.1. Where processing involves a transfer outside the EEA/UK, Processor will ensure appropriate safeguards, including Standard Contractual Clauses or another valid transfer mechanism, and implement supplementary measures where necessary.

8. Security Measures

8.1. A description of our current TOMs is available upon request and may be updated from time to time without materially reducing protection. Measures include: encryption in transit; network segmentation; role‑based access control; MFA for administrative access; security logging/monitoring; vulnerability management; backups and disaster recovery; employee confidentiality and security training; vendor risk management; and incident response procedures. 8.2. Biometric Data Security: Where biometric or health data is processed (e.g., from PULSESSIVO Smart Bracelets), Processor implements additional safeguards including: (a) end-to-end encryption for data transmission from devices to the Platform; (b) logical separation of biometric data from other data categories; (c) restricted access limited to personnel with a need-to-know; and (d) enhanced monitoring and audit logging for access to biometric datasets.

9. Records and Cooperation

9.1. Processor will maintain records of processing activities and cooperate with competent supervisory authorities upon request.

10. Audits

10.1. Upon reasonable written notice, no more than once every 12 months, Controller (or an independent auditor) may audit Processor’s compliance. Audits will first rely on available documentation, certifications, and reports; on‑site audits may be conducted where reasonably necessary and will minimize disruption. Each party bears its own costs.

11. Return or Deletion of Data

11.1. Following termination or expiry of the Services, Processor will, at Controller’s choice, return or delete (or anonymize) Controller Personal Data, unless retention is required by law.
11.2. Processor will complete deletion or anonymization within 60 days of termination, subject to backup cycles (up to 90 days). 11.3. Notwithstanding the foregoing, Processor may retain copies of invoices and tax records to the extent and for the duration required by applicable law (e.g., accounting, VAT/OSS, and imposta di bollo record-keeping), after which they will be securely deleted or anonymized.

12. Liability

12.1. Each party’s liability under this DPA is subject to the limitations and exclusions set out in the main agreement, except to the extent prohibited by applicable law.

13. Governing Law and Jurisdiction

13.1. This DPA is governed by the laws of Italy, and disputes shall be subject to the exclusive jurisdiction of the courts of Turin, Italy, unless otherwise required by GDPR.

14. Contact

For DPA matters, contact privacy@pulsessivo.ai.