Legal

Data Processing / GDPR

ITYES IT FACTORY S.R.L. · Last updated: July 6, 2026

1. Controller and Processor Roles

For website inquiries, ITYES normally acts as controller. For client projects, the role depends on the project. In many delivery contexts, the client determines the purpose and means of processing and ITYES acts as processor or sub-processor. The project contract or DPA should define the actual role.

2. When a DPA Is Needed

A Data Processing Agreement is appropriate when ITYES processes personal data on behalf of a client, especially for systems involving CRM records, support conversations, internal databases, employee data, customer data, AI knowledge bases or operational logs.

3. Typical Project Data

• Customer or lead records from CRM, ERP, Salesforce, Dynamics or other business systems.
• Conversation data from websites, WhatsApp, Messenger, Instagram or support channels.
• Documents, procedures, product catalogues and internal knowledge base content used for RAG.
• Audit logs, approval history, workflow status and integration events.
• Technical credentials, API tokens or connection details when needed for integration work.

4. Processing Instructions

For processor work, ITYES processes personal data based on documented client instructions, agreed scope, security constraints and implementation requirements. Production data should not be shared until the purpose, access level and environment are agreed.

5. Enterprise AI and RAG

AI systems may use client-approved documents, databases and tools to answer questions or support workflows. ITYES designs these systems with retrieval boundaries, source references where feasible, tool access controls, human approval points and logging appropriate to the project.

6. Sub-processors and Providers

Depending on project scope, ITYES may use hosting, database, analytics, observability, messaging, AI model, email, storage, CI/CD or security providers. The client can request a project-specific list of relevant providers before production deployment.

7. Transfers

Where data may be processed outside the European Economic Area, the transfer mechanism, provider, region and client constraints should be reviewed before production use. Some clients may require EU-only hosting, local models or restricted provider options.

8. Security Measures

• Access limited to people and systems that need it for the project.
• Environment separation where appropriate: development, staging and production.
• Credential handling through approved secret-management practices.
• Logging, monitoring and audit trails when relevant to the workflow.
• Human approval for important AI-generated actions.
• Deletion or return of data according to contract or client instruction.

9. Client Responsibilities

Clients should identify the data categories involved, confirm lawful basis and user notices, define retention rules, approve integrations, classify sensitive data, and decide which systems or providers may be used.

10. Contact

For project-specific data processing questions, contact contact@ityes.eu.