DEMAND LOCATOR — DATA PROCESSING AGREEMENT
Version 2026-09-11 | Contract annex for completion and signature

This document becomes binding only when incorporated into a signed service agreement.
It is not evidence that a customer has appointed a processor or approved any monitoring.

1. Parties and documented instructions
Processor: SYNAPTICA CONSULTING DI GIUSTACCHINI MICHELE, sole proprietorship,
VAT IT04696650987, Via Benaco 103, 25080 Puegnago del Garda (BS), Italy.
Privacy/security contact: michele.g@synapticacnsltg.com.
Controller: identify the contracting customer, address and privacy contact in Annex A.
The controller determines purpose and lawful instructions; the processor acts only on
those documented instructions, including transfers, unless law requires otherwise.
The processor informs the controller if an instruction appears unlawful.
Independent-controller activities, including Synaptica's own website enquiries, are
outside this processor appointment and must be described separately.

2. Processing description (Annex A — complete before activation)
Specify: service and duration; authorised sources and access methods; operations;
data subjects; exact categories of data; recipients; matching criteria; retention;
territories; controller's lawful basis, Article 14 procedure and LIA/DPIA decisions.
Purpose: qualify explicit rental demand and provide property/area-fit context to the
customer. No unsolicited autonomous messaging or automated tenancy decisions.
Exclude minors, special-category data and sensitive inferences. Document handling
of uncertainty, opt-out suppression and source-access restrictions.

3. Confidentiality and security
Access is restricted to authorised personnel subject to confidentiality duties.
Annex B records technical and organisational measures, evidence and residual gaps:
access controls, MFA, session revocation, encryption, segregation, input validation,
logging without content, vulnerability handling, backup and restoration, deletion,
incident response and approved human-review gates. Security is risk-based; no
certification or independent test pass is implied by this annex.

4. Subprocessors and transfers
Annex C names each approved provider, legal entity, purpose, region and safeguards.
No unspecified fallback provider is automatically authorised. Agree a written
advance-notice period and objection route before appointing or replacing a provider.
Apply equivalent data-protection obligations and remain responsible for the
subprocessor's performance as required. Transfers outside the EEA require the
applicable Chapter V mechanism and any necessary supplementary assessment/measures.

5. Assistance and incidents
Assist the controller with rights requests, security, breach response, DPIAs and
consultation obligations, considering the nature of processing and available data.
Notify the controller without undue delay after becoming aware of a personal-data
breach; provide known facts, affected categories, likely impact, containment and
contact point, with updates as the investigation proceeds. Do not postpone notice
until all facts are known. The controller assesses notifications to authorities and
people; any contractual response target must be specified in Annex B.

6. Return, deletion and audit
At the controller's choice on termination, return or delete personal data and delete
copies unless law requires retention. Define active-store, export, log and backup
periods and reconciliation after restoration. Retain minimal proof of lawful deletion
and suppression under a documented basis. Make necessary information available to
demonstrate compliance and support proportionate audits, including inspections by
the controller or its mandated auditor, subject to confidentiality and other tenants'
security. Agreement on costs must not obstruct mandatory rights.

ANNEX A — Controller, scope, data, duration, lawful instructions and rights process:
To be completed and approved by the contracting parties before processing.
ANNEX B — Measures, evidence, retention per system, RPO/RTO and incident contacts:
To be completed using the current verified security register, not proposed controls.
ANNEX C — Approved subprocessors, regions, transfers and change-notice period:
To be completed for the actual production configuration.

Controller name / representative / signature / date: ___________________________
Processor representative / signature / date: __________________________________