# Data Processing Agreement (DPA) — Studio ↔ InkConscious

*Version 1.0 — May 2026*

Between the **Studio** (Controller) and **Valerio Zanzarelli / InkConscious** (Processor).

## 1. Subject and duration

Processing of **end-customer** personal data required to provide IC Studio / IC Design / APIs for the term of the service agreement.

## 2. Nature and purpose

Hosting, messaging, calendar, media storage, AI per studio instructions, consent forms, backups.

## 3. Data types and subjects

Subjects: studio clients and studio staff. Data: contact details, messages, images, appointments, consents, technical metadata.

## 4. Instructions

Processor processes data **only on documented instructions** from the studio (app settings, deletes, exports) and applicable law.

## 5. Confidentiality

Authorized personnel bound by confidentiality.

## 6. Sub-processors

Those listed in `subprocessors`, bound by equivalent obligations. Studio notified of material changes via documentation or email.

## 7. International transfers

Per Privacy Policy and sub-processor SCCs (Meta, OpenAI, Stripe, etc.).

## 8. Security (GDPR Art. 32)

Appropriate technical and organizational measures: encryption in transit, encrypted channel secrets, access control, backups.

## 9. Assistance

Reasonable assistance for DPIAs, data subject requests, and breach notifications.

## 10. Deletion and return

On termination, delete or return per studio instructions, subject to legal retention.

## 11. Audits

Studio may request reasonable compliance information with prior notice.

## 12. Breaches

Notify studio without undue delay to allow Art. 33 GDPR compliance by the studio where applicable.

## 13. Liability

Per Terms of Service and applicable law.

## 14. Acceptance

Using IC Studio with third-party data, the studio confirms lawful basis and accepts this DPA.

**Contact:** valerio.zanzarelli@gmail.com