Data Processing Agreement (Article 28 GDPR)

Last updated: 9 September 2026 · Version 1.0

Annex to the Terms of Service, accepted by the Customer at registration. Enterprise customers may sign it separately with amendments.

The Carbonvia service (provisional name) is provided by Pipex Energy S.r.l.; inside the application the service is called CBAM Calculator. The texts below are the same as those published in the application.

This is a courtesy translation. The Italian version prevails for legal purposes.

1. Parties and roles

Controller: the Customer, as identified at registration (company name and VAT number recorded in the tenant).

Processor: Pipex Energy S.r.l., Viale Gian Galeazzo 15, 20136 Milan (MI), Italy, VAT 11674300964, email privacy@pipexenergy.it ("Pipex").

This agreement governs the processing Pipex carries out on behalf of the Customer in providing CBAM Calculator. It does not cover data Pipex processes as an independent controller (User accounts, billing, security), which is governed by the privacy notice.

2. Description of the processing (Art. 28(3))

Element	Description
Subject matter	Storage, processing, display, calculation, export and backup of Customer Data in the application
Duration	Term of the contract, plus the transition period provided by the Terms (Art. 13), then deletion
Nature and purpose	Providing the Customer with a tool to manage CBAM obligations: recording imports, foreign supplier records, calculation of embedded emissions, simulations, reports, preparation of declarations; at the Customer's choice, automatic extraction of data from uploaded documents with human confirmation
Categories of data subjects	Contact persons and employees of the Customer's foreign suppliers, producers and installation operators; employees and collaborators of the Customer mentioned in documents (signatories, customs contacts); the Customer's customs representatives
Categories of data	Identification and contact data (name, email, phone, role), business and tax data (company name, tax identifier, addresses, geographic coordinates of installations), content of customs declarations and uploaded documents (including data possibly present in extracted text), emissions data and certificates. No special categories (Art. 9) or criminal conviction data (Art. 10) are foreseen: the Customer undertakes not to upload any

3. Pipex's obligations

Pipex:

a) processes data only on the Customer's documented instructions, consisting of the Terms, this agreement and the use of the application's features by the Customer's Users; informs the Customer if it considers an instruction to infringe the law;
b) does not transfer data outside the European Union, except as provided in Art. 6;
c) ensures that persons authorised to process data are bound by confidentiality and trained;
d) implements the security measures of Annex 1 (Art. 32 GDPR);
e) complies with the conditions of Art. 4 for engaging sub-processors;
f) assists the Customer in responding to data subjects' requests (access, rectification, erasure, portability, objection): the application's features allow the Customer to search, edit, export and delete its suppliers' data on its own; otherwise Pipex replies within 10 working days. If a data subject contacts Pipex directly, Pipex refers them to the Customer and informs it;
g) assists the Customer in complying with Arts. 32-36 (security, breach notification, impact assessment), taking into account the information available to it;
h) notifies the Customer of any personal data breach without undue delay and in any case within 48 hours of becoming aware of it, at the tenant administrators' email, providing the information of Art. 33(3) as it becomes available, so that the Customer can meet the 72-hour deadline towards the authority;
i) at the end of the contract returns the data through the export features in the formats indicated in the Terms (Art. 13.3) and then deletes all copies within the periods indicated in the Terms (Art. 13.5), except for retention obligations under EU or Italian law;
j) makes available to the Customer the information necessary to demonstrate compliance with this agreement and allows audits under Art. 5.

4. Sub-processors

4.1. The Customer gives general authorisation to engage the sub-processors listed in Annex 2. Pipex imposes on them by contract obligations equivalent to those of this agreement and remains liable to the Customer for their performance.

4.2. Pipex notifies the tenant administrators by email of any addition or replacement at least 30 days in advance, updating the list published on this page. The Customer may object on reasonable, documented grounds within that period; if no solution is found, the Customer may withdraw from the contract free of charge with a refund of the unused period.

5. Verification and audits

5.1. On request Pipex provides: the description of security measures, the report of the most recent security review, the sub-processors' certifications (Microsoft: ISO 27001, ISO 27018, SOC 2; Stripe: PCI DSS Level 1) and answers to reasonable security questionnaires, at most once a year except in case of incidents.

5.2. The Customer, or an independent auditor appointed by it and bound by confidentiality, may carry out an on-site or remote audit at most once a year, with 30 days' notice, on working days, without compromising the security of other Customers. Audit costs are borne by the Customer, unless substantial breaches emerge. Access to sub-processors' systems is not permitted: their certification reports apply.

6. Transfers outside the EU

Data is stored and processed in the European Union. Any access from third countries by sub-processors (technical support, security operations) is covered by the Standard Contractual Clauses (Decision (EU) 2021/914) included in the respective contracts and, where applicable, by the EU-US Data Privacy Framework. Pipex will not transfer data outside the EU for other reasons without the Customer's prior written authorisation, except where required by EU or Italian law, in which case it informs the Customer before processing if the law allows.

7. Customer's obligations

The Customer warrants that it has a legal basis for processing the data it uploads, that it has provided data subjects with the required information (Arts. 13-14 GDPR) and that it does not upload data unnecessary for the purposes of the Service, in particular special categories of data. The Customer is responsible for managing the Users of its tenant (assigning roles, promptly removing those who leave), API keys and the Partners to whom it grants access.

8. Liability

The parties are liable in accordance with Art. 82 GDPR. Towards the Customer, the limitation of liability provided by the Terms of Service (Art. 11) applies, but it does not apply to compensation owed to data subjects under Art. 82.

9. Term and precedence

This agreement lasts for the term of the contract and survives until the data is deleted. In case of conflict with the Terms, this agreement prevails as regards the processing of personal data. Italian law applies; jurisdiction as per the Terms.

Annex 1 – Technical and organisational measures (Art. 32)

Infrastructure: Microsoft Azure, Sweden Central region; Container Apps environment in a virtual network; backend not exposed to the Internet, reachable only from the frontend through an internal ingress; PostgreSQL database accessible only through a private endpoint; file storage on Blob Storage accessed via managed identity, shared keys disabled.
Encryption: TLS 1.2 or higher in transit; encryption at rest of database, storage and backups; application secrets in Azure Key Vault with restricted network and purge protection; two-factor secrets encrypted at application level with a dedicated key.
Tenant isolation: PostgreSQL Row-Level Security enforced on all tables holding Customer data; application role without bypass privilege; every request is bound to the authenticated User's tenant.
Access control: authentication by password (bcrypt hash, complexity policy) or email code; two-factor authentication optional for Users and mandatory for Pipex staff with administrative access; roles (Administrator, Accounting, Sales); progressive lockout after 5 failed attempts; 12-hour sessions with global revocation; per-IP rate limiting; API keys with HMAC hash, mandatory expiry and optional IP allowlist.
Traceability: log of create, update, delete and export operations with user, IP and data difference, kept 24 months; centralised technical logs for 90 days with pseudonymised identifiers.
Continuity: automatic daily database backups kept 7 days; availability monitoring from three points in Europe with alerts to staff; documented incident management procedure.
Secure development: dependencies pinned to fixed versions and updated with automated checks; vulnerability scanning of images at every build; code review and automated test suite before every release; documented infrastructure security review (latest: September 2026).
Staff: access to production systems limited to named persons, with individual identities and two-factor authentication; confidentiality obligation; training on data protection and on the use of artificial intelligence features.
Sub-processors: selected among ISO 27001 certified suppliers; data kept in the EU.

Annex 2 – List of sub-processors

Sub-processor	Location	Activity	Place of processing	Safeguards
Microsoft Ireland Operations Ltd (Microsoft Corporation group)	Dublin, Ireland	Application hosting, database, file storage, secret management, logs and monitoring (Azure); data extraction from documents (Azure AI Document Intelligence); language model for document reading (Azure OpenAI). Microsoft does not use the data to train models; it may retain prompts and outputs for up to 30 days for abuse monitoring	Azure Sweden Central region (Sweden)	Microsoft Products and Services Data Protection Addendum, Standard Contractual Clauses, EU Data Boundary, ISO 27001/27018, SOC 2, Data Privacy Framework
Brevo (Sendinblue SAS)	Paris, France	Delivery of transactional emails (invitations, notifications, alerts) containing recipients' name and email	European Union	Brevo Data Processing Agreement, ISO 27001
Stripe Payments Europe Ltd	Dublin, Ireland	Payment and subscription management. Receives the Customer's billing data (controller: Pipex), not the Customer's suppliers' data. Listed for transparency: it acts mainly as an independent controller	European Union, with transfers to Stripe Inc. (USA) covered by Standard Contractual Clauses and Data Privacy Framework	PCI DSS Level 1, Stripe Data Processing Agreement

No other party receives Customer Data. No analytics, tracking or advertising services are used.