Version 2026.1, effective from 7 November 2026. This Data Processing Agreement ("DPA") forms an appendix to the contract between amuseapp S.r.l. and the Client, made up of the Order Form and the General Terms and Conditions of Service ("T&C"), pursuant to article 11.2 of the T&C. Capitalised terms not defined here have the meaning given in the T&C or in Regulation (EU) 2016/679 ("GDPR").
1) Parties and scope
1.1 This DPA governs the processing of personal data that amuseapp S.r.l., with registered office at Via della Rivetta 32B, 32100 Belluno (BL), Italy, VAT no. IT01302450257 ("amuseapp"), carries out on behalf of the Client in order to provide the Service.
1.2 The Client acts as controller. If the Client itself acts as processor on behalf of a third-party controller (for example a museum managed on behalf of a public body), amuseapp acts as its sub-processor, and the Client warrants that it has the authorisations required to appoint amuseapp.
1.3 This DPA does not cover the data that amuseapp processes as an independent controller: data of the Client's contact persons for the management of the contractual relationship, invoicing and payments; data processed for amuseapp's own purposes as described in its privacy policy, such as security of the platform and diagnostics of errors; and data used in anonymous and aggregated form for statistics and improvement of the Service (art. 11.3 of the T&C).
1.4 In case of conflict between this DPA and the T&C on the protection of personal data, this DPA prevails. A different data processing agreement signed by the parties prevails over this DPA.
2) Description of the processing
2.1 The subject matter, nature and purpose of the processing, the categories of data subjects and of personal data, and the duration of the processing are described in Annex 1.
2.2 The Service is not designed to process special categories of personal data (art. 9 GDPR) or data relating to criminal convictions (art. 10 GDPR). The Client shall not configure the Service to collect them.
3) Instructions of the Client
3.1 amuseapp processes personal data only on the documented instructions of the Client. The contract, this DPA and the configuration that the Client chooses in the management console (for example enabling the collection of contacts, donations, ticketing or the chatbot) constitute the Client's complete instructions. Further instructions must be given in writing and, if they involve additional costs, are agreed in advance.
3.2 amuseapp informs the Client without delay if, in its opinion, an instruction infringes the GDPR or other data protection provisions, and may suspend its execution until the Client confirms or amends it.
3.3 amuseapp may process personal data otherwise only where required by EU or Member State law; in that case it informs the Client before the processing, unless the law prohibits it.
4) Confidentiality
4.1 amuseapp ensures that the persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they process the data only as needed to provide the Service.
5) Security
5.1 amuseapp implements the technical and organisational measures described in Annex 2, appropriate to the risk according to art. 32 GDPR. amuseapp may update these measures over time, provided the overall level of protection is not reduced.
6) Sub-processors
6.1 The Client grants amuseapp a general written authorisation to engage sub-processors. The sub-processors engaged on the effective date of this DPA are listed in Annex 3.
6.2 amuseapp informs the Client by email at least 30 days before adding or replacing a sub-processor. Within that period the Client may object in writing on reasonable grounds relating to data protection. If the parties do not find a solution, the Client may terminate the part of the Service affected by the change, with a refund of any prepaid amounts relating to the period after termination.
6.3 amuseapp imposes on each sub-processor, by contract, data protection obligations that are substantially equivalent to those of this DPA, and remains responsible towards the Client for the performance of the sub-processors' obligations.
7) Transfers outside the European Economic Area
7.1 Where a sub-processor processes personal data outside the European Economic Area, the transfer takes place on the basis of an adequacy decision of the European Commission (including, for certified US companies, the EU-US Data Privacy Framework) or of the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, together with any supplementary measures that may be required.
8) Assistance to the Client
8.1 Taking into account the nature of the processing, amuseapp assists the Client with appropriate technical and organisational measures in responding to requests from data subjects exercising their rights under Chapter III of the GDPR. If a data subject contacts amuseapp directly about data processed on behalf of the Client, amuseapp forwards the request to the Client without undue delay and does not reply on the merits unless instructed to do so.
8.2 amuseapp assists the Client in ensuring compliance with the obligations under articles 32 to 36 GDPR (security, notification of personal data breaches, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to amuseapp. Assistance that goes beyond providing the information already available may be charged at reasonable cost, agreed in advance.
9) Personal data breaches
9.1 amuseapp notifies the Client without undue delay, and in any case within 48 hours of becoming aware of it, of any personal data breach affecting data processed on behalf of the Client.
9.2 The notification describes, as far as available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Information not available at the time of the first notification is provided in phases, without undue further delay.
10) Return and deletion of data
10.1 At the end of the contract, the Client may request, within 30 days, the return of its personal data and of its original content in a commonly used electronic format, according to art. 14.3 of the T&C.
10.2 After that period, amuseapp deletes the personal data processed on behalf of the Client within the following 90 days, including copies held by its sub-processors, unless EU or Member State law requires their retention. Copies in backups are deleted according to the normal backup rotation cycle and remain protected in the meantime. On request, amuseapp confirms the deletion in writing.
11) Information and audits
11.1 amuseapp makes available to the Client the information necessary to demonstrate compliance with art. 28 GDPR, including, where available, the certifications and audit reports of its main sub-processors.
11.2 If that information is not sufficient, the Client may carry out an audit, directly or through an independent auditor bound by confidentiality, no more than once a year (except in case of a personal data breach or a request from a supervisory authority), with at least 30 days' written notice, during business hours and without compromising the security of the Service or the confidentiality of other clients' data. Each party bears its own costs of the audit.
12) Liability and duration
12.1 The liability of each party under this DPA is subject to the limitations set out in art. 13 of the T&C, except where mandatory law provides otherwise.
12.2 This DPA remains in force for as long as amuseapp processes personal data on behalf of the Client. The obligations that by their nature survive termination (in particular confidentiality, deletion and return of data) remain in force afterwards.
13) Governing law and contacts
13.1 This DPA is governed by Italian law. The jurisdiction is the one set out in art. 17 of the T&C.
13.2 Communications concerning this DPA, including the exercise of data subjects' rights forwarded by the Client, are sent to help@amuseapp.it or to the PEC address indicated in the Order Form.
Annex 1: Description of the processing
Subject matter and purpose. Provision of the Service to the Client: audioguides and digital itineraries for Visitors, chatbot, analytics in the management console, and, where activated by the Client, collection of Visitors' contacts, donations, ticketing and indoor positioning.
Nature of the processing. Collection, recording, storage, organisation, consultation, analysis, transmission to the Client, and deletion, by automated means.
Duration. The duration of the contract, plus the period for return and deletion set out in section 10.
Categories of data subjects.
- Visitors of the Client who use the Service.
- Staff and collaborators of the Client who use the management console.
Categories of personal data.
- Technical and device data: IP address, device type and model, operating system, browser, app version, language.
- Usage data of the experience: content and stops viewed, listening time, session duration, answers to questionnaires and quizzes, feedback, badges, associated with pseudonymous session identifiers.
- Chatbot conversations: questions written by Visitors and the answers generated, where the Client activates the chatbot.
- Contact data and consent records: email address and any other data that the Client chooses to request, with the date, the text shown and the version of the privacy notice accepted, and the IP address stored in encrypted form, where the Client activates the collection of contacts.
- Purchase and donation data: amount, date, product, and payer email and name where provided. Payment card data is processed directly by the payment provider and is not stored by amuseapp.
- Indoor positioning data: Bluetooth beacon signal strength, barometric pressure and motion sensor data, associated with a random session identifier, where the Client activates indoor positioning. GPS location is not collected.
- Diagnostic data: sequence of screens and actions with texts and images masked, technical events and device information, associated with a pseudonymous identifier.
- Console users: name, email address, login credentials and activity logs.
Retention. Contact data and consent records, chatbot conversations and usage data are kept for the duration of the contract, unless the Client deletes them earlier or asks amuseapp to delete them. Diagnostic data is kept for up to 90 days. Analytics data held by the analytics provider is kept according to the retention settings of that service.
Annex 2: Technical and organisational measures
- Encryption in transit of all communications between apps, browsers and servers (HTTPS/TLS).
- IP addresses linked to consent records stored in encrypted form.
- Access to the management console only with personal credentials; each user sees only the data of the venues to which they have been granted access.
- Access to production systems restricted to authorised amuseapp personnel, with personal accounts at the infrastructure providers.
- Pseudonymous session identifiers for usage, positioning and diagnostic data; masking of texts and images in diagnostic session recordings.
- Payment card data handled exclusively by the payment provider, which is certified to PCI DSS.
- Hosting and databases at providers that maintain recognised security certifications (for example ISO/IEC 27001 or SOC 2) and provide backups and physical security of data centres.
- Error and availability monitoring, so that anomalies are detected and handled promptly.
- Confidentiality obligations for personnel and collaborators; data minimisation by design (Visitors use the Service without creating an account).
Annex 3: Sub-processors
- Xano, Inc. (USA): application backend and database of the Service. Location: EU or USA, with standard contractual clauses.
- Supabase, Inc. (USA): database for analytics, consent records, chatbot conversations and console data. Location: EU (Sweden).
- Vercel Inc. (USA): hosting of the visitor web app, management console and totem. Location: EU and USA, with standard contractual clauses.
- Amazon Web Services EMEA SARL (Luxembourg): artificial intelligence models through Amazon Bedrock (chatbot, translations, content generation) and cloud services. Location: EU (Ireland, Italy, Germany).
- Anthropic, PBC (USA): alternative artificial intelligence model provider for content generation in the console. Location: USA, with standard contractual clauses.
- OpenAI, L.L.C. (USA): alternative artificial intelligence provider for content generation and search in the console. Location: USA, with standard contractual clauses.
- Google Ireland Limited / Google LLC: usage analytics (Google Analytics 4) and maps. Location: EU and USA, EU-US Data Privacy Framework.
- Stripe Payments Europe, Limited (Ireland): payments for donations and ticketing. Location: EU and USA, EU-US Data Privacy Framework.
- Functional Software, Inc. (Sentry) (USA): error monitoring and diagnostic session recordings. Location: EU (Germany).
- PostHog, Inc. (USA): usage analytics of the management console. Location: EU.
- Twilio Inc. (SendGrid) (USA): sending of transactional emails, such as reports to console users. Location: USA, EU-US Data Privacy Framework.
- GetResponse S.A. (Poland): email marketing tool, only if the Client chooses to send the collected contacts to it. Location: EU and USA, with standard contractual clauses.
- ElevenLabs Inc. (USA) and AssemblyAI, Inc. (USA): speech synthesis and transcription of the Client's content (texts and audio uploaded by the Client), not of Visitors' data. Location: USA, with standard contractual clauses.
