PrenotaTU

Data Processing Agreement

This document governs personal data processing carried out by PrenotaTU on behalf of Business Customers/Merchants when providing the SaaS platform.

Version 1.1 — last updated: July 23, 2026. This DPA supplements the signed SaaS contract and prevails over the General Conditions on personal data protection matters.

1. Roles

The Business Customer/Merchant is normally the controller of personal data relating to its end users, staff, employees and collaborators entered or managed through PrenotaTU. PrenotaTU, operated by Mancuso Milite Francesco, sole trader, VAT no. 06449790655, tax code MNCFNC96D18C361C, REA SA-524255, acts as processor under Article 28 GDPR for such data.

2. Subject matter and duration

Processing covers data required for accounts, services, staff, schedules, calendars, bookings, notifications, public profiles, support, security, diagnostics, backup and export. The duration matches the contractual relationship and the following periods needed for deletion, return, backups, legal obligations or protection of rights.

3. Security and subprocessors

PrenotaTU applies technical and organizational measures proportionate to risk and may use subprocessors for hosting, databases, queues, storage, email, notifications, authentication, analytics, diagnostics, support, payments, maps, geocoding, security and AI features where included. The list is available on theSubprocessors page.

4. Data breach and assistance

If a personal data breach affects data processed on behalf of the Business Customer/Merchant, PrenotaTU informs the Merchant without undue delay and, where reasonably possible, within 48 hours after confirming it, progressively providing the available information needed for the required assessments and notices.

5. Return, deletion and AI content

Within 30 days after termination, the Customer may request an export followed by deletion. Active data is deleted or anonymized within 60 days and encrypted backups are overwritten within a maximum 90-day cycle. AI prompts and responses are processed transiently with Zero Data Retention and are not stored in the PrenotaTU database or used for training.