Data processing agreement

1. Parties and subject matter

The customer that contracts for the SiteNorma service acts as the controller. Gassiot & Llobet, with tax ID (NIF) J66534553, acts as the processor and processes the data only to provide the contracted service, following the customer's documented instructions, which are these terms and the use the customer makes of the service.

2. Duration

This agreement lasts as long as the service contract. When it ends, the provisions of section 8 apply.

3. Nature and purpose of the processing

• Analysing the customer's public web pages. These pages may contain personal data, such as names, photographs or contact details published by the customer itself, which are captured in screenshots and code snippets.
• Storing the results, evidence and documents generated.
• Managing the users that the customer invites to its organisation.
• Once the Accessibility Centre exists, receiving and managing the reports sent by people who visit the customer's website.

4. Types of data and data subjects

Data processed on behalf of the customer

Data subjects	Data
People whose data appears on the scanned websites	The data the customer publishes on its website: names, images, contact details.
Users invited by the customer	Name, email, role and activity log.
People who report an accessibility problem (future)	Optional contact details and the content of the report.

5. Processor's obligations

• Process the data only in accordance with the customer's instructions and inform the customer if an instruction may infringe the applicable regulations.
• Ensure that the persons authorised to process the data have undertaken to respect its confidentiality.
• Apply the security measures of Article 32 of the GDPR: encryption in transit and at rest, access control, audit logging and encrypted backups with tested restoration.
• Assist the customer in responding to requests to exercise data subject rights and in meeting its obligations regarding security, breach notification and impact assessments.
• Notify the customer, without undue delay, of any personal data breach it becomes aware of.
• Make available to the customer the information necessary to demonstrate compliance, and allow reasonable audits.

6. Customer's obligations

• Only analyse its own websites or websites for which it has authorisation.
• Inform data subjects where applicable, for example in the Accessibility Centre form.
• Only invite users who need access, and review their permissions.

7. Sub-processors

The customer gives general authorisation for the engagement of the sub-processors needed to provide the service. We will give advance notice of any change to the list so that the customer can object. Each sub-processor assumes the same data protection obligations by contract.

Provisional list of sub-processors (to be confirmed)

Provider	Service	Data location
Hetzner Online GmbH	Servers and storage	Germany and Finland (EU)
Anthropic	AI suggestions, using only fragments of public HTML	[PENDIENTE DE CONFIRMAR] (to be confirmed)
Sentry	App error logging	European Union
[PROVEEDOR DE EMAIL]	Sending service emails	European Union
Stripe	Payments and subscriptions	[PENDIENTE DE CONFIRMAR]

8. End of the agreement

When the service ends, the customer can export its data. We will then delete it, unless a law requires us to retain some of it, in which case we will keep it blocked for the required period. [PLAZOS PENDIENTES] (periods pending)

9. International transfers

If a sub-processor processes data outside the European Economic Area, it will do so with the safeguards provided for in Chapter V of the GDPR, such as the European Commission's standard contractual clauses.