Data Processing Agreement
Art. 28 of Regulation (EU) 2016/679 · Part of the General Terms of Sale (card purchase) · Version of 28 September 2026 · English translation of 28 September 2026
In case of discrepancy the Italian version prevails. This page is the English translation of Accordo sul trattamento dei dati personali, the Italian text that governs the contract. Article numbers are the same in both versions.
Glossary (Italian → English). The terms below are translated the same way in all Arenia contract documents in English.
| Italian | English |
|---|---|
| Accordo sul trattamento dei dati personali | Data Processing Agreement |
| Condizioni generali di vendita («Condizioni») | General Terms of Sale («Terms») |
| Acquirente | Buyer |
| titolare del trattamento | controller |
| titolare autonomo | independent controller |
| responsabile del trattamento | processor |
| sub-responsabile | sub-processor |
| interessati | data subjects |
| Garante | Italian Data Protection Authority (Garante) |
| Partecipante | Participant |
| Utenza | User Account |
| Situazione professionale | Professional Situation |
| Simulazione | Simulation |
| Riscontro della Simulazione | Simulation Feedback |
| Scheda individuale | Individual Sheet |
| Periodo di accesso | Access Period |
| copie di sicurezza | backups |
In short. Whoever buys Arenia on the website is the controller of its Participants' data; Synergix processes that data on the Buyer's behalf, only to make the practice work. The Buyer does not see the Simulations, the transcripts, the feedback or the Individual Sheets. Arenia does not keep audio recordings of the Simulation. The database is in Italy; some technical suppliers are in the United States (Art. 8). Off-site backups are encrypted and kept on Google Workspace (Art. 8). This agreement forms part of the General Terms of Sale (Art. 12) and is accepted with the order.
1. Parties and subject matter
1.1 The controller is the business or professional that buys Arenia on the website (the «Buyer», as defined in the General Terms of Sale).
1.2 The processor is Synergix di Petterlini Michele, sole proprietorship, Via Don C. Biasi 73 int. 2, 37029 San Pietro in Cariano (VR), VAT number 05110780235 («Synergix»), within the meaning of Art. 28 of Regulation (EU) 2016/679 («GDPR»).
1.3 This agreement governs the personal data that Synergix processes on behalf of the Buyer in providing the Arenia service purchased. It applies from the sending of the access link until the deletion provided for in Art. 11.
1.4 The Buyer's data for the order and invoicing, and the technical and security logs, fall outside this agreement: for those, Synergix is an independent controller, as described in the Privacy Policy (Italian version).
2. Purpose and nature of the processing
2.1 Purpose. To enable the Participants designated by the Buyer to practise by voice with the AI-Trainer on Professional Situations, and to give each Participant the structured feedback on the behaviours practised and their own Individual Sheet.
2.2 Operations. Collection, recording of the transcript, organisation, storage, consultation, processing with automated artificial intelligence systems, disclosure to the sub-processors in Art. 8, erasure.
2.3 What the processing is not. The service does not express judgements on the person and does not take automated decisions that produce legal effects on the Participant or similarly significantly affect them (Art. 22 GDPR). The feedback concerns the behaviours practised in the Simulation.
2.4 Synergix does not use the Participants' data for its own purposes, with only three exceptions needed to enforce the Terms, for which it is an independent controller and which it describes in its Privacy Policy (Italian version): the record of acceptance of the Standard Annex — User Accounts and Use, the count of Simulations for the monthly maximum, the check on credential sharing. Synergix does not sell the data, does not use it for commercial profiling and does not use it to train its own models.
2.5 Synergix does not produce league tables or leaderboards of Participants, not even on request.
3. Data subjects and categories of data
3.1 Data subjects: the Participants designated by the Buyer and the individuals acting for the Buyer who manage the order.
| Category | What it contains |
|---|---|
| Identifiers | first name, surname, email address, internal identifier of the User Account |
| Voice | the Participant's voice during the Simulation, processed in real time for the conversation. Arenia does not keep audio or video recordings of the Simulation. The voice is not used to identify the person. |
| Transcript | the text of the conversation. It may contain anything the Participant says. |
| Feedback | the structured feedback and the Individual Sheet, generated automatically from the transcript |
| Dates and durations | date and duration of each Simulation, without its content |
| Technical data | technical events, application logs, IP addresses |
3.2 Special categories of data and data of minors: excluded. The service is not designed for health data, judicial data or other special categories of data (Arts. 9 and 10 GDPR), nor for minors. No technical filter prevents a Participant from saying them: for this reason the Buyer asks the Participants not to do so and to use fictitious names when they mention real people (Art. 10.2 of the Terms).
4. The Buyer's instructions and obligations
4.1 Synergix processes the data only on documented instructions from the Buyer. The following are documented instructions: the General Terms of Sale, this agreement, the order and the written requests sent to info@arenia.it. If an instruction appears to it to be contrary to the law, Synergix reports it immediately.
4.2 What the Buyer sees. The Buyer manages its Participants' email addresses and the number of User Accounts still unassigned. It has no access to the Simulations, the transcripts, the feedback or the Individual Sheets, which remain reserved to the Participant. A request to access them is not a permitted instruction.
4.3 Privacy notice and legal basis. It is for the Buyer to choose the legal basis of the processing, to inform the Participants before they start practising and to check that it can do so in compliance with employment law. Synergix provides a privacy notice text for Participants (in Italian) that the Buyer can complete and use.
4.4 The Buyer does not use data relating to an individual Participant to compile league tables, to monitor their work activity or to take decisions on the employment relationship.
5. Confidentiality
5.1 The persons authorised by Synergix to process the data are bound by confidentiality.
5.2 Synergix is a sole proprietorship: at present, access to the production systems is reserved to the owner of Synergix.
6. Security measures
6.1 Measures in place.
- application and database on a server in Italy;
- traffic encrypted over HTTPS;
- personal User Accounts created by invitation only: open registration is not active;
- separation of data between customers at application level, with automated tests;
- statement to the Participant that they are conversing with an artificial intelligence system;
- automatic deletion of transcripts and technical data at the deadlines in Art. 11.
6.2 Stated limits. The service runs in an environment shared among customers: the separation is logical, not physical. There are no guaranteed minimum availability levels, no access with centralised company credentials and no independent security monitoring service. Synergix does not hold third-party security attestations (for example ISO/IEC 27001). Backups: every day a local copy of the database, kept for 30 days; every 4 hours an encrypted off-site copy. A deleted item leaves the backups within 6 months; off-site backups are encrypted.
7. Assistance to the Buyer
Within the limits of the information available to it, Synergix assists the Buyer with its obligations regarding security, notification of personal data breaches and data protection impact analysis (Arts. 32-36 GDPR), by providing the technical description of the processing, of the data flows to suppliers and of the limits in Art. 6.
8. Sub-processors and transfers outside the EU
8.1 The Buyer gives Synergix a general authorisation to engage sub-processors in the following categories:
| What it does | Which data | Where |
|---|---|---|
| Server hosting the application and the database | all the data in Art. 3 | Italy |
| Artificial intelligence services for the voice conversation (listening, reply, the AI-Trainer's voice) | voice and text of the conversation, in real time | United States |
| Artificial intelligence service for the feedback and the Individual Sheet | text of the transcript; no audio | United States |
| Off-site backups (Google Workspace, shared Drive), encrypted by Synergix before sending | encrypted copy of the data in Art. 3 | EU/EEA or Art. 46 GDPR safeguards under the Google Workspace terms (Data Processing Addendum; possible locations: Data regions, Google Workspace) |
| Sending of emails (Google) | name, email address, text of the service messages. The email announcing the Sheet does not contain the feedback. | EU and United States |
8.2 The up-to-date list of sub-processors by name can be requested at info@arenia.it. Synergix informs the Buyer of any addition or replacement without delay from when it becomes aware of it. The Buyer may object on reasonable grounds within 10 days. If the objection prevents the service from being provided, the Buyer may terminate the contract. Termination gives no right to a refund, except for the exception in Art. 9.3 of the Terms.
8.3 Synergix accepts the suppliers' standard terms, does not negotiate them, and remains liable to the Buyer for their performance.
8.4 Transfers to the United States take place on the basis of the safeguards declared by the suppliers (standard contractual clauses of the European Commission and, where applicable, the EU-U.S. Data Privacy Framework). The Buyer informs the Participants of this: the data do not all remain in the European Union.
9. Participants' rights
9.1 Participants' requests are for the Buyer to handle. If they reach Synergix, Synergix forwards them to the Buyer without delay and does not act on them itself.
9.2 Synergix helps the Buyer to respond, with operations carried out manually:
- access and rectification: extraction and correction of the data on written request;
- erasure: carried out by Synergix with a command that records what has been erased;
- restriction: deactivation of the User Account;
- portability: limited to identification and usage data. Transcripts cannot be exported.
9.3 There is no function in the service through which the Participant can exercise these rights directly.
10. Personal data breaches
10.1 Synergix informs the Buyer without undue delay after becoming aware of a breach concerning the data covered by this agreement, with the information available: nature, categories and approximate number of data subjects, likely consequences, measures taken.
10.2 The commitment concerns communication, not the ability to detect every breach: Synergix does not have independent security monitoring (Art. 6.2).
10.3 Notification to the Garante (the Italian Data Protection Authority) and to the data subjects remains the responsibility of the Buyer.
11. Retention and deletion
11.1 Content of the Simulations (transcript, messages, summary): deleted automatically 365 days after the Simulation.
11.2 Technical data (technical events, application logs, IP addresses): deleted automatically after 90 days. The date and duration of each Simulation are not technical data: they stay with the User Account, because they are needed for the Individual Sheet and the Simulation Feedback throughout the Access Period, and they follow Art. 11.3.
11.3 User Accounts, Simulation Feedback and Individual Sheets: kept for the Access Period and deleted within 90 days of its end, unless there is a new purchase for the same Participants. The record of the User Account's acceptance is deleted together with the User Account. Only a row of the User Account without name or email remains, to which the date, duration and count of its Simulations stay attached, without any content.
11.4 Individual content is not returned to the Buyer (Art. 4.2).
11.5 What is not deleted: the accounting and tax documents of the order, as required by law; the data in the backups, until they rotate: a deleted item leaves the backups within 6 months, and off-site backups are encrypted; the data held by the sub-processors, for which Synergix forwards the erasure request and reports the outcome, without being able to guarantee that it is carried out.
12. Audits
12.1 Synergix makes available the information needed to demonstrate compliance with Art. 28 GDPR: a written answer to a security questionnaire once a year and a remote meeting with the owner of Synergix.
12.2 No third-party audit reports or on-site inspections are available. Other audits are agreed in writing, at the Buyer's expense.
13. Contacts, governing law and jurisdiction
13.1 Communications to Synergix about this agreement are sent to info@arenia.it; those to the Buyer, to the email address given in the order. Neither party has designated a data protection officer.
13.2 Governing law and jurisdiction are those in Art. 17 of the General Terms of Sale.
13.3 On data protection matters, if this agreement and the General Terms of Sale say different things, this agreement prevails.