Data Processing Agreement

1. Parties

Controller: you, the account holder.
Processor: NICOLASAGLIANO.COM di Nicola Sagliano, Via Paracelso 6, 42122 Reggio Emilia (RE), Italy, P.IVA IT02887470348.

2. Subject matter and duration

We process personal data on your behalf in order to redirect visitors who click your short links and to produce the click statistics we show you. The processing lasts as long as your account exists, and ends when you delete the link, delete the account, or the contract terminates.

3. Nature of the data

Categories of data subjects: people who click a short link you created.

Categories of personal data: approximate location (country, region, city) derived from the IP address; device type, operating system, browser and CPU architecture; browser language; referring domain; time of the click; and a per-day pseudonymous visitor hash used to count unique visitors.

No special categories of data (art. 9 GDPR) are processed, and no full IP address is stored: it is truncated, salted and hashed, and the hash is deleted after 48 hours. Everything else is stored as daily counters per link, not as individual click records.

4. Our obligations

• We process the data only on your documented instructions — which, in practice, are the actions you take in the app — unless EU or member state law requires otherwise.
• Everyone with access is bound by confidentiality.
• We apply the technical and organisational measures listed in section 11 of our Privacy Policy, appropriate to the risk (art. 32).
• We assist you, as far as we reasonably can, in responding to requests from data subjects and in your obligations under articles 32 to 36.
• We notify you without undue delay after becoming aware of a personal data breach affecting your data.
• At the end of the processing we delete the data; deleting a link or your account removes its statistics immediately.
• We make available the information needed to demonstrate compliance and allow audits, which for a business of this size means answering your questions in writing and providing the evidence we hold.

5. Your obligations

• You confirm you have a lawful basis for measuring clicks on your links, and that your own privacy notice tells your audience about it.
• You must not use the service to process special categories of data, or to track individuals.
• You are responsible for the destinations you point links at, and for the affiliate programme rules that apply to them.

6. Sub-processors

You give us general authorisation to use the sub-processors below. We will announce changes by email at least 30 days in advance; if you object on reasonable data protection grounds, you may terminate and receive a refund of your unused credits.

7. International transfers

Where a sub-processor processes data outside the European Economic Area, the transfer relies on the European Commission's Standard Contractual Clauses or, where applicable, the EU–US Data Privacy Framework. Copies of the safeguards are available on request.

8. Liability and precedence

This agreement takes precedence over the Terms of Service on matters of data protection. Liability is governed by the Terms of Service, except where the GDPR provides otherwise. Italian law applies.