Version 5.0, 02 October 2023
This Interacta Agreement (the ‘Agreement’) is entered into by and between Injenia S.r.l., with offices at Via dei Lapidari 12, 40129 Bologna, Italy and the entity agreeing to these terms (‘the Customer’) for use of the Interacta software solutions Services (“the Services”). This Agreement is effective as of the date that the Customer subscribes an offline commercial proposal provided by Injenia or an Authorized Reseller, or provides an equivalent offline purchase order.
Services.
1. Provision of the Services.
1.1 Services use. During the Term, Injenia will provide the Services in accordance with the Agreement. Customer may use the Services ordered in the applicable Order Form or Reseller Order in accordance with this Agreement.
2. Modifications.
(a) To the Services. Injenia may make commercially reasonable changes to the Services from time to time. Injenia will inform Customer if Injenia makes a material change to the Services that has a material impact on Customer’s use of the Services.
(b) To the Agreement. Injenia may make commercially reasonable changes to this Agreement from time to time. If Injenia makes a material change to the Agreement, Injenia will inform the Customer by either sending an email to the Notification Email Address or alerting the Customer through the Admin Console. Material changes to the Agreement will become effective thirty days after the notice is given, except if the changes apply to new functionality in which case the changes will be effective immediately. If the change has a material adverse impact on the Customer, and the change is not a result of Injenia complying with a court order or applicable law, the Customer may notify Injenia within thirty days after being informed of the change that the Customer does not agree with the change. If the Customer notifies Injenia as required, then the Customer will remain governed by the terms in effect immediately prior to the change until the earlier of: (i) the end of the then-current Agreement or (ii) 12 months after Injenia informs the Customer of the change, unless the modification to the Agreement is in response to a court order or to comply with applicable law. If the Agreement renews, it will do so under the updated Agreement.
(c) Discontinuation of Services. Injenia can discontinue any Services or any portion or feature for any reason at any time without liability to the Customer.
(d) Deprecation Policy. Injenia will notify the Customer if it intends to make a Significant Deprecation in the Services. Injenia will use commercially reasonable efforts to continue to provide the Services without a Significant Deprecation for at least one year after that notification, unless (as Injenia determines in its reasonable good faith judgement): (i) otherwise required by law or by contract (including if there is a change in applicable law or contract), or (ii) doing so could create a security risk or a substantial economic or technical burden. This policy is the ‘Deprecation Policy’.
3. Customer Obligations.
3.1 Compliance. The Customer must ensure that all use of the Services by the Customer and its End Users complies with this Agreement.
3.2 Privacy. Customer is responsible for any consents and notices required to permit (a) Customer’s use and receipt of the Services, and (b) Injenia’s accessing, storing, and processing of data provided by Customer (including Customer Data) under the Agreement.
3.3 Customer Administration of the Services. Customer may specify one or more Administrators through the Admin Console who will have the rights to access Admin Account(s) and to administer the End-User Accounts. The Customer is responsible for: (a) maintaining the confidentiality of the password and Admin Account(s); (b) designating those individuals who are authorised to access the Admin Account(s); and (c) ensuring that all activities that occur in connection with the Admin Account(s) comply with the Agreement. The Customer agrees that Injenia’s responsibilities do not extend to the internal management or administration of the Services for the Customer and that Injenia is merely a data processor.
3.4 Administrator Access; End-User Consent.
(a) Administrator Access. Administrators will have the ability to access all the Customer’s End-User Accounts, including the ability to access, monitor, use, modify, withhold or disclose any data available to End Users associated with their End-User Accounts.
(b) End-User Consent. the Customer will obtain and maintain all required consents from End Users to allow: (i) Administrators to have the access described in this Agreement; and (ii) Injenia’s provision of the Services to Administrators and End Users.
3.5 Unauthorised Use. the Customer will use commercially reasonable efforts to prevent unauthorised use of the Services and to terminate any unauthorised use. The Customer will promptly notify Injenia of any unauthorised use of, or access to, the Services of which it becomes aware.
3.6 Restrictions. Customer will not, and will not allow End Users to, (a) copy, modify, or create a derivative work of the Services; (b) reverse engineer, decompile, translate, disassemble, or otherwise attempt to extract any or all of the source code of, the Services (except to the extent such restriction is expressly prohibited by applicable law); (c) sell, resell, sublicense, transfer, or distribute any or all of the Services; or (d) access or use the Services (i) for High Risk Activities; (ii) in violation of the AUP; (iii) to place or receive emergency service calls.
3.7 Support. The Customer will, at its own expense, respond to questions and complaints from End Users or third parties relating to the Customer’s or End Users’ use of the Services. The Customer will use commercially reasonable efforts to resolve support issues before escalating them to Injenia.
4.1 Of End User Accounts by Injenia. If Injenia becomes aware of an End User’s violation of the Agreement, then Injenia may specifically request that Customer Suspend the applicable End User Account. If Customer fails to comply with Injenia’s request to Suspend an End-User Account, then Injenia may do so. The duration of any Suspension by Injenia will be until the applicable End User has cured the breach which caused the Suspension.
4.2 Emergency Security Issues. Notwithstanding the foregoing, if there is an Emergency Security Issue, then Injenia may automatically Suspend the offending use. Suspension will be to the minimum extent and of the minimum duration required to prevent or terminate the Emergency Security Issue. If Injenia Suspends an End-User Account for any reason without prior notice to Customer, at Customer’s request, Injenia will provide Customer with the reason for the Suspension as soon as is reasonably possible.
4.3 Suspension to Comply with Laws. Injenia may at its sole discretion Suspend the provision of any Services at any time if required to comply with any applicable law.
5. Intellectual Property Rights.
5.1 Intellectual Property Rights. Except as expressly set forth herein, this Agreement does not grant either party any rights, implied or otherwise, to the other’s content or any of the other’s intellectual property. Injenia owns all Intellectual Property Rights in the Services and Software.
5.2 Protection of Customer Data. Injenia will only access, use, or otherwise process Customer Data in accordance with the Data Processing Addendum and will not access, use, or process Customer Data for any other purpose. Injenia has implemented and will maintain technical, organizational, and physical safeguards to protect Customer Data, as further described in the Data Processing Addendum.
6. Confidential Information.
6.1 Obligations. The recipient will only use the disclosing party’s Confidential Information to exercise the recipient’s rights and fulfill its obligations under the Agreement, and will use reasonable care to protect against the disclosure of the disclosing party’s Confidential Information. The recipient may disclose Confidential Information only to its Affiliates, employees, agents, or professional advisors (“Delegates”) who need to know it and who have agreed in writing (or in the case of professional advisors are otherwise bound) to keep it confidential. The recipient will ensure that its Delegates use the received Confidential Information only to exercise rights and fulfill obligations under this Agreement.
6.2 Required Disclosure. Notwithstanding any provision to the contrary in this Agreement, the recipient or its Affiliate may also disclose Confidential Information to the extent required by applicable Legal Process; provided that the recipient or its Affiliate uses commercially reasonable efforts to (a) promptly notify the other party before any such disclosure of its Confidential Information, and (b) comply with the other party’s reasonable requests regarding its efforts to oppose the disclosure. Notwithstanding the foregoing, subsections (a) and (b) above will not apply if the recipient determines that complying with (a) and (b) could (i) result in a violation of Legal Process; (ii) obstruct a governmental investigation; or (iii) lead to death or serious physical harm to an individual.
7. Term and Termination.
7.1 Agreement Term. The term of this Agreement (the “Term”) is defined in the Order Form or similar document subscribed by Injenia, or an Authorized Reseller, and the Customer.
7.2 Termination for Breach. To the extent permitted by applicable law, either party may terminate this Agreement immediately on written notice if (a) the other party is in material breach of the Agreement and fails to cure that breach within 30 days after receipt of written notice of the breach, or (b) the other party ceases its business operations or becomes subject to insolvency proceedings and the proceedings are not dismissed within 90 days.
7.3 Termination for Convenience. Customer may stop using the Services at any time. Subject to Customer fulfilling all its financial commitments under the applicable Order Form or otherwise under this Agreement (including payment of all Fees for the Order Term), Customer may also terminate this Agreement for its convenience at any time on prior 30 days written notice.
7.4 Termination Due to Applicable Law; Violation of Laws. Injenia may terminate this Agreement and/or any applicable Order Form immediately on written notice if Injenia reasonably believes thatcontinued provision of any Service used by Customer would violate applicable law(s).
7.5 Effect of Termination or Non-Renewal. If the Agreement is terminated or not renewed, then (a) all rights and access to the Services will cease (including access to Customer Data), unless otherwise described in this Agreement, and (b) all Fees owed by Customer to Injenia are immediately due upon Customer’s receipt of the final electronic bill or as stated in the final invoice.
7.6 No Refunds. Unless expressly stated otherwise in this Agreement, termination or non renewal under any section of this Agreement will not oblige Injenia to refund any Fees.
8. Representations and Warranties.
Each party represents and warrants that (a) it has full power and authority to enter into the Agreement, and (b) it will comply with all laws applicable to its provision, receipt, or use of the Services, as applicable
9. Disclaimer.
Except as expressly provided for in the Agreement, Injenia does not make and expressly disclaims to the fullest extent permitted by applicable law (a) any warranties of any kind, whether express, implied, statutory, or otherwise, including warranties of merchantability, fitness for a particular use, title, non-infringement, or error-free or uninterrupted use of the Services and (b) any representations about content or information accessible through the Services.
10. Limitation of Liability.
10.1 Limitation on Indirect Liability. To the extent permitted by applicable law and subject to Section 10.3 (Unlimited Liabilities), neither party will have any Liability arising out of or relating to the Agreement for any (a) indirect, consequential, special, incidental, or punitive damages or (b) lost revenues, profits, savings, or goodwill.
10.2 Limitation on Amount of Liability. Each party’s total aggregate Liability for damages arising out of or relating to the Agreement is limited to the Fees Customer paid during the 12 month period before the event giving rise to Liability.
10.3 Unlimited Liabilities. Nothing in the Agreement excludes or limits either party’s Liability for:
(a) its fraud or fraudulent misrepresentation;
(b) its infringement of the other party’s Intellectual Property Rights;
(c) its payment obligations under the Agreement; or
(d) matters for which liability cannot be excluded or limited under applicable law.
11. Miscellaneous.
11.1 Notices. Injenia may provide any notice to the Customer under this Agreement by: (a) sending an email to the Notification Email Address or by (b) posting a notice in the Admin Console. The Customer may provide notice to Injenia under this Agreement by sending an email to Injenia’s legal department at legal@injenia.it. Customer is responsible for keeping its Notification Email Address current throughout the Term.
11.2 Assignment. Neither party may assign or transfer any part of this Agreement without the written consent of the other party, except to an Affiliate, but only if: (a) the assignee agrees in writing to be bound by the terms of this Agreement; and (b) the assigning party remains liable for obligations incurred under the Agreement prior to the assignment. Any other attempt to transfer or assign is void.
11.3 Change of Control. Upon a change of control (for example, through a stock purchase or sale, merger, or other form of corporate transaction): (a) the party experiencing the change of control will provide written notice to the other party within thirty days after the change of control; and (b) the other party may immediately terminate this Agreement any time between the change of control and thirty days after it receives the written notice in subsection (a).
11.4 Force Majeure. Neither party will be liable for inadequate performance to the extent caused by a condition (for example, natural disaster, act of war or terrorism, riot, labour condition, governmental action and Internet disturbance) that was beyond the party’s reasonable control.
11.5 Severability. If any provision of this Agreement is found unenforceable, the balance of the Agreement will remain in full force and effect.
11.6 Governing Law. This Agreement is governed by Italy law. For any dispute arising out of or relating to this agreement, the parties consent to personal jurisdiction in, and the exclusive venue of, the courts in Bologna, Italy.
11.7 Amendments. Any amendment must be in writing and expressly state that it is amending this Agreement.
11.8 Survival. The following Sections will survive expiration or termination of this Agreement: Section 5 (Intellectual Property Rights), Section 6 (Confidential Information), Section 7.5 (Effect of Termination or Non-Renewal), Section 9 (Disclaimer), Section 10 (Limitation of Liability), and Section 11 (Miscellaneous).
11.9 Entire Agreement. This Agreement sets out all terms agreed between the parties and terminates and supersedes any and all other agreements between the parties relating to its subject matter, including any prior versions of this Agreement. In entering into this Agreement, neither party has relied on, and neither party will have any right or remedy based on, any statement, representation, or warranty (whether made negligently or innocently), except those expressly stated in this Agreement. The URL Terms are incorporated by reference into the Agreement. Injenia may provide an updated URL in place of any URL in this Agreement.
11.10 Conflicting Terms. If there is a conflict between the documents that make up this Agreement, the documents will control in the following order (of decreasing precedence): the Order Form or similar document subscribed by Injenia and the Customer, and the URL Terms.
11.10 Conflicting Languages. If this Agreement is translated into any language other than English, and there is a discrepancy between the English text and the translated text, the English text will govern unless expressly stated otherwise in the translation.
12. Definitions.
“Admin Account(s)” means the administrative account(s) provided to Customer by Injenia for the purpose of administering the Services. The use of the Admin Account(s) requires a password, which Injenia will provide to Customer.
“Admin Console” means the online tool provided by Injenia to Customer for use in reporting and certain other administration functions.
‘Administrators’ mean the Customer-designated technical personnel who administer the Services to End Users on the Customer’s behalf.
“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with a party.
“Customer Data” means data, including email, provided, generated, transmitted or displayed via the Services by Customer or End Users.
‘Emergency Security Issue’ means either: (a) the Customer’s or End Users’ use of the Services in violation of the Acceptable Use Policy, in a way that disrupts: (i) the Services; (ii) other the Customers’ use of the Services; or (iii) to prevent unauthorised third-party access to the Services or data within the Services.
“End Users” means the individuals Customer permits to use the Services.
“End User Account” means a Interacta account established by Customer through the Services for an End User.
“High Risk Activities” means uses such as the operation of nuclear facilities, air traffic control or life-support systems, where the use or failure of the Services could lead to death, personal injury or environmental damage.
‘Services’ means the applicable Services provided by Injenia and used by the Customer under this Agreement.
‘Significant Deprecation’ means to discontinue or to make backwards-incompatible changes to the Services that results in Injenia no longer providing to its customer base the substantial ability to carry out activities and workflows with the Services.
“Suspend” means the immediate disabling of access to the Services, or components of the Services, as applicable, to prevent further use of the Services.
Use of the Services is subject to this acceptable use policy (“AUP”).
If not defined here, capitalized terms have the meaning stated in the applicable contract (“Agreement”) between customer or other authorized user (“You”) and Injenia S.r.l..
You agree not to, and not to allow third parties or Your End Users, to use the Services:
to violate, or encourage the violation of, the legal rights of others;
for any illegal, unlawful, invasive, infringing, defamatory, or fraudulent purpose;
to intentionally distribute viruses, worms, Trojan horses, corrupted files, or other items of a destructive or deceptive nature;
to use hate speech, a content that promotes or condones violence against or has the primary purpose of inciting hatred against an individual or group on the basis of their race or ethnic origin, religion, disability, age, nationality, sexual orientation, gender or any other characteristic that is associated with systemic discrimination or marginalization;
to engage in harassing, bullying, or threatening behavior, and do not incite others to engage in these activities.
to distribute people’s personal and confidential information, such as credit card numbers, confidential national ID numbers, or account passwords, without their explicit permission.
to upload or share content that exploits or abuses children.
to distribute sexually explicit or pornographic material, violent content, terrorism that’s primarily intended to be shocking, sensational, or gratuitous.
to spam including by sending unwanted promotional or commercial content, or unwanted or mass solicitation.
to alter, disable, interfere with or circumvent any aspect of the Services;
to test or reverse-engineer the Services in order to find limitations, vulnerabilities or evade filtering capabilities;
to grant multiple individuals access to an individual End User Account;
to record audio or video communications without consent if such consent is required by applicable laws and regulations (You are solely responsible for ensuring compliance with all applicable laws and regulations in the relevant jurisdiction(s)).
Your failure to comply with the AUP may result in:
removal of objectionable contents; and/or
suspension or termination, or both, of the Services pursuant to the Agreement.
To report any potential policy violation to Injenia please contact legal@injenia.it
After Injenia is notified of a potential policy violation, Injenia may review the content and take action, including restricting access to the content, removing the content, and limiting or terminating a user’s access to Interacta.
The customer agreeing to these terms (“Customer”), and Injenia S.r.l., have entered into one Interacta Agreement (as defined below).
1. Definitions
1.1 Capitalized terms defined in the applicable Agreement apply to this Data Processing Amendment. In addition, in this Data Processing Addendum:
“Customer Data” means data submitted, stored, sent or received via the Services by Customer or End Users.
“Customer Personal Data” means the personal data contained within the Customer Data.
“Data Incident” means a breach of Injenia’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data on systems managed by or otherwise controlled by Injenia.
“EEA” means the European Economic Area.
“EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
“European Data Protection Law” means the GDPR.
“European or Italian Law” means EU or Italian State law
“Interacta Agreement” means an Interacta Agreement under which Injenia agrees to provide Interacta services to Customer.
“Notification Email Address” means the email address(es) designated by Customer in the Admin Console, or in Ordering Documents or communicated to Injenia (as applicable), to receive certain notifications from Injenia. Customer is responsible for using to ensure that its Notification Email Address remains current and valid.
“Subprocessor” means a third party authorized as another processor under this Data Processing Amendment to have logical access to and process Customer Data in order to provide parts of the Services.
“Supervisory Authority” means a “supervisory authority” as defined in the EU GDPR.
“Term” means the period from the Addendum Effective Date until the end of Injenia’s provision of the Services under the applicable Agreement, including, if applicable, any period during which provision of the Services may be suspended and any post-termination period during which Injenia may continue providing the Services for transitional purposes.
1.2. The terms “personal data”, “data subject”, “processing”, “controller” and “processor” as used in this Data Processing Addendum have the meanings given in the GDPR.
2. Duration.
This Data Processing Addendum will, notwithstanding expiry of the Term, remain in effect until, and automatically expire upon, deletion of all Customer Data by Injenia as described in this Data Processing Addendum.
3. Scope of Data Protection Law.
3.1 Application of European Law. The parties acknowledge that European and Italian Data Protection Law will apply to the processing of Customer Personal Data.
4. Processing of Data.
4.1 Roles and Regulatory Compliance; Authorization.
4.1.1. Processor and Controller Responsibilities:
The applicable Term plus the period from the expiry of such Term until deletion of all Customer Data by Injenia in accordance with the Data Processing Addendum.
Nature and Purpose of the Processing: Injenia will process Customer Personal Data for the purposes of providing the Services to Customer in accordance with the Data Processing Addendum.
Categories of Data: Data relating to individuals provided to Injenia via the Services, by (or at the direction of) Customer or End Users.
Data Subjects: Data subjects include the individuals about whom data is provided to Injenia via the Services by (or at the direction of) Customer or End Users.
Injenia is a processor of that Customer Personal Data under European and Italian Data Protection Law;
Customer is a controller or processor, as applicable, of that Customer Personal Data under European and Italian Data Protection Law;
each party will comply with the obligations applicable to it under European Data Protection Law with respect to the processing of that Customer Personal Data.
4.1.2. Authorization by Third Party Controller. Customer warrants that its instructions and actions with respect to that Customer Personal Data, including its appointment of Injenia as another processor, have been authorized by the relevant controller.
4.2 Scope of Processing.
4.2.1 Customer’s Instructions. Customer instructs Injenia to process Customer Personal Data only in accordance with applicable law: (a) to provide the Services; (b) as further specified via Customer’s and End Users’ use of the Services (including the Admin Console and other functionality of the Services); (c) as documented in the form of the applicable Agreement, including this Data Processing Addendum; and (d) as further documented in any other written instructions given by Customer and acknowledged by Injenia as constituting instructions for purposes of this Data Processing Amendment.
4.2.2 Injenia’s Compliance with Instructions. Injenia will comply with the instructions described in Section 4.2.1 (Customer’s Instructions) (including with regard to data transfers) unless European or Italian Law to which Injenia is subject requires other processing of Customer Personal Data by Injenia, in which case Injenia will notify Customer (unless that law prohibits Injenia from doing so on important grounds of public interest) before such other processing.
5. Data Deletion
5.1 Deletion During Term. Injenia will enable Customer and End Users to delete Customer Data during the applicable Term in a manner consistent with the functionality of the Services. If Customer or an End User uses the Services to delete any Customer Data during the applicable Term and that Customer Data cannot be recovered by Customer or an End User, this use will constitute an instruction to Injenia to delete the relevant Customer Data from Injenia’s systems in accordance with applicable law. Injenia will comply with this instruction as soon as reasonably practicable and within a maximum period of 180 days, unless European or Italian Law requires storage.
5.2 Deletion on Term Expiry. Subject to Section 5.3 (Deferred Deletion Instruction), on expiry of the applicable Term, Customer instructs Injenia to delete all Customer Data (including existing copies) from Injenia’s systems in accordance with applicable law. Injenia will comply with this instruction as soon as reasonably practicable and within a maximum period of 180 days, unless European or Italian Law requires storage. Customer is responsible for exporting, before the applicable Term expires, any Customer Data it wishes to retain.
5.3 Deferred Deletion Instruction. To the extent any Customer Data covered by the deletion instruction described in Section 5.2 (Deletion on Term Expiry) is also processed, when the applicable Term under Section 5.2 expires, in relation to an Agreement with a continuing Term, such deletion instruction will only take effect with respect to such Customer Data when the continuing Term expires. For clarity, this Data Processing Amendment will continue to apply to such Customer Data until its deletion by Injenia.
6. Data Security.
6.1 Injenia’’s Security Measures, Controls and Assistance.
6.1.1 Injenia’s Security Measures. Injenia will implement and maintain reasonable technical and organizational measures to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access (the “Security Measures”). Since Interacta is built on and delivered through Google Cloud Platform (GCP), GCP’s security measures are also applicable.
6.1.2 Security Compliance. Injenia will: (a) take appropriate steps to ensure compliance with the Security Measures by its employees, contractors and Subprocessors to the extent applicable to their scope of performance, and (b) ensure that all persons authorized to process Customer Personal Data are under an obligation of confidentiality.
6.1.3 Injenia’s Security Assistance. Injenia will assist Customer in ensuring compliance with its obligations pursuant to Articles 32 to 34 of the GDPR, by:
a. implementing and maintaining the Security Measures in accordance with Section 6.1.1 (Injenia’s Security Measures);
b. complying with the terms of Section 6.2 (Data Incidents);
c. if subsections (a)-(b) above are insufficient for Customer to comply with such obligations, upon Customer’s request, providing additional reasonable assistance.
6.2 Data Incidents.
6.2.1 Incident Notification. Injenia will notify Customer promptly and without undue delay after becoming aware of a Data Incident, and promptly take reasonable steps to minimize harm and secure Customer Data.
6.2.2 Details of Data Incident. Injenia’s notification of a Data Incident will describe, to the extent possible, the nature of the Data Incident, the measures taken to mitigate the potential risks and the measures Injenia recommends Customer take to address the Data Incident.
6.2.3 Delivery of Notification. Notification(s) of any Data Incident(s) will be delivered to the Notification Email Address or, at Injenia’s discretion, by direct communication (for example, phone call or an in-person meeting).
6.2.4 No Assessment of Customer Data by Injenia. Injenia has no obligation to assess Customer Data in order to identify information subject to any specific legal requirements.
6.2.5 No Acknowledgement of Fault by Injenia. Injenia’s notification of or response to a Data Incident under this Section 6.2 (Data Incidents) will not be construed as an acknowledgement by Injenia of any fault or liability with respect to the Data Incident.
6.3. Customer’s Security Responsibilities and Assessment.
6.3.1 Customer’s Security Responsibilities. Without prejudice to Injenia’s obligations under Sections 6.1 (Injenia’s Security Measures, Controls and Assistance) and 6.2 (Data Incidents), and elsewhere in the applicable Agreement, Customer is responsible for its use of the Services and its storage of any copies of Customer Data outside Injenia’s or Injenia’s Subprocessors’ systems, including:
a. using the Services and Additional Security Controls to ensure a level of security appropriate to the risk in respect of the Customer Data;
b. securing the account authentication credentials, systems and devices Customer uses to access the Services; and
c. retaining copies of its Customer Data as appropriate.
6.3.2 Customer’s Security Assessment. Customer agrees, based on its current and intended use of the Services, that the Services, Security Measures, and Injenia’s commitments under this Section 7 (Data Security): (a) meet Customer’s needs, including with respect to any security obligations of Customer under European and Italian Data Protection Law, and (b) provide a level of security appropriate to the risk in respect of the Customer Data.
6.4 Cloud Infrastructure compliance Certifications and SOC Reports. Interacta is built on and delivered through Google Cloud Platform (GCP) as technical cloud infrastructure. Injenia guarantees that Interacta will be delivered on a cloud platform (such as GCP) that maintains at least the following for the Audited Services in order to evaluate the continued effectiveness of the Security Measures:
a. certificates for ISO 27001, ISO 27017 and ISO 27018, and
b. SOC 2 and SOC 3 (or equivalent) reports produced by cloud provider’s Third Party Auditor and updated annually based on an audit performed at least once every 12 months (the “SOC Reports”).
7. Access; Data Subject Rights; Data Export.
7.1 Access; Rectification; Restricted Processing; Portability. During the applicable Term, Injenia will enable Customer, in a manner consistent with the functionality of the Services, to access, rectify and restrict processing of Customer Data, including via the deletion functionality provided by Injenia as described in Section 5.1 (Deletion During Term), and to export Customer Data.
7.2 Data Subject Requests.
7.2.1 Customer’s Responsibility for Requests. During the applicable Term, if Injenia’s Data Protection Team receives a request from a data subject in relation to Customer Personal Data, and the request identifies Customer, Injenia will advise the data subject to submit their request to Customer. Customer will be responsible for responding to any such request including, where necessary, by using the functionality of the Services.
7.2.2 Injenia’s Data Subject Request Assistance. Injenia will (taking into account the nature of the processing of Customer Personal Data) assist Customer in fulfilling its obligations under Chapter III of the GDPR to respond to requests for exercising the data subject’s rights.
8. Data Storage and processing
8.1 Data Storage and Processing Facilities. Injenia will store Customer Data inside of EEA.
8.3 Data Center Information. Information about the locations of Google Cloud Platform data centers is available at: https://www.google.com/about/datacenters/inside/locations/index.html (as may be updated by Google from time to time).
9. Subprocessors
9.1 Consent to Subprocessor Engagement. Customer specifically authorizes the engagement as Subprocessors of those entities listed as of the Appendix 1 (Information about Subprocessors). In addition, without prejudice to Section 9.3 (Opportunity to Object to Subprocessor Changes), Customer generally authorizes the engagement as Subprocessors of any other third parties (“New Third Party Subprocessors”).
9.2 Requirements for Subprocessor Engagement. When engaging any Subprocessor, Injenia will:
ensure via a written contract that the Subprocessor only accesses and uses Customer Data to the extent required to perform the obligations subcontracted to it, and does so in accordance with the Agreement (including this Data Processing Addendum); and
remain fully liable for all obligations subcontracted to, and all acts and omissions of, the Subprocessor.
9.3 Opportunity to Object to Subprocessors.
a. When Injenia engages any New Subprocessor during the Term, Injenia will, at least 30 days before the New Subprocessor starts processing any Customer Data, publish the engagement (including the name, location and activities of the New Subprocessor) in Appendix 1 (Information about Subprocessors).
b. Customer may, within 90 days after publishing, object by immediately terminating the applicable Agreement for convenience, in accordance with that Agreement’s termination for convenience provision.
Injenia’s Data Protection Team. Injenia’s Data Protection Team can be contacted by Customer’s Administrators at legal@injenia.it.
| Entity name | Service location (country where processing is performed) | Registered address | Country of registration | Company number | Task performed |
| Google Italy Srl | Italy, EU | Via Confalonieri Federico 4, 20124 Milano, Italy | Italy | 03660670963 | Provisioning of cloud infrastructure Google Cloud Platform |
| Mailjet SAS | France, EU | 4 rue Jules Lefebvre 75009 Paris | France | FR67 524536992 | Automated email notifications |
| Twilio Sendgrid Inc. | Colorado, US | 1801 California Street, Suite 500 | US | 27-0554600 | Automated email notifications |
Injenia provides the following specifications in relation to the technology platform adopted for Interacta Services and operational informations.
Interacta is implemented and delivered in SAAS or in managed solution mode (depending on the contractual arrangement) through Google Cloud Platform by Google, which Injenia is a certified Premier Partner and reseller.
Google Cloud Platform has been selected based on the availability of the best available state-of-the-art security and compliance features, technologies and guarantees:
2.1 Vulnerability management. Injenia has implemented policies and procedures designed to ensure that customers data are secure and availability guaranteed. Interacta’s team conducts continuous assessment of security threats and implements up-to-date countermeasures in order to prevent unauthorized access and service unavailability, taking advantage of Google Cloud Platform solutions for specific monitoring of vulnerabilities including also viruses, malware, other, identification, mitigation and removal. In the event of security incidents, including data breaches, Interacta’s technical team has a dedicated business operating procedure for management, which identifies actions, flows, roles and responsibilities. Interacta’s technical team is trained and periodically updated with specific reference to incident management. Access to Interacta production instances is allowed only to authorized members of Injenia’s Interacta technical team.
2.2 Access security. Authentication of users to the application is verified on server-side. If requested by the customer, authentication is delegated via OAuth 2.0 protocol to Google or Microsoft 365 identity credentials without having to provide Interacta with a username and password. The mobile application uses the same authentication system as the web application and the same RESTfull API and services environment exposed by the backend instance with encrypted calls via HTTPS protocol.
2.3 Perimeter security. Interacta implements a Web Application Firewall (WAF) belonging to Google Cloud Platform services that is responsible for protecting the customer’s production application instances and monitoring HTTP traffic. The managed rules – reclassified as follows – reflect the standards proposed by the OWASP publications Top 10 web application security risks. Expression: Network Scanning, SQL injection, Remote File Inclusion, Local File Inclusion, Protocol Attack, CVE Exploit (es. Log4j).
2.4 Subprocessors security. Before proceeding to adopt subcontractors for the implementation, delivery, or management of the Interacta solution, Injenia performs an assessment of the security and privacy conditions proposed and operated by the subcontractors, verifying that they are strictly aligned with the security and privacy standards provided for Interacta.
3.1 Backup policies. Interacta operaties with a specific, dedicated instance per customer, with automatic data backup policies implemented.
3.2 Data encryption. Data are divided into subfile blocks for storage, and each individual block is encrypted at the storage level with an individual encryption key. All calls are encrypted using HTTPS protocol.
3.3 Data location. By default, Interacta instances (application and data) are created and operated on Google Cloud Platform services located in SEE area.
3.4 Data integrity. An internal operational procedure helps to protect the integrity of customer data by taking the following measures: data access to only specifically authorized users; validation of data at two levels (frontend and backend) to ensure that it is correct during both collection and use; data backup procedures; management of application logs to keep track of any additions, changes or deletions; management of regular internal audits; use of dedicated error detection software.
4.1 Administration access (Injenia). To keep data private and secure, Injenia isolates each customer’s data, which is still only accessed by a select group of Injenia employees. For Injenia employees, data access rights and levels are based on function and job role, using the concepts of “minor privilege” and “need-to-know” to match access privileges to defined responsibilities. Support services are provided only to authorized client administrators whose identity has been verified.
4.2 Administration access (Customer). Within customer organizations, Interacta’s administrative roles and privileges are configured and controlled by the customer. This means that individual customer users can manage certain services or perform specific administrative functions without access to all settings and data.
4.3 User access. Within customer organizations, Interacta’s users roles and privileges are configured and controlled by the customer. This means that individual customer users can manage certain services or perform specific operational functions without access to all settings and data.
4.4 Data request for legal motivations. The customer, being the owner of the data, is primarily responsible for responding to any data requests from authorities and government agencies. However, like other technology and communications companies, Injenia may receive direct requests from governments and courts about how a person has used the Injenia’s solutions. Injenia takes measures to protect customer privacy and limit such requests while complying with legal obligations. In the event of receiving this type of request, Injenia reviews it to ensure that it meets Injenia’s legal requirements and policies. It is Injenia’s policy to notify customers of data requests unless it is expressly prohibited by regulations or court orders.
Injenia has a Support service for Interacta dedicated to customers. Through the Support service, customer can forward us reports of anomalies and proposals for improvements.
All reports and proposals will be assigned a ticket prioritized according to severity (for anomalies) and relevance (for improvements), with the understanding that the possible inclusion of improvements in the product roadmap will remain at the sole discretion of Injenia.
Injenia is constantly working to release the product patches necessary to resolution of verified anomalies, so as to keep the application operational over time for the contractually considered functionality and utilities.
In summary, the Support service will deal with:
In order for Support to properly verify the severity of the anomaly, it is required that the following information be provided in the report:
Support service available channels are:
Support service operates on weekdays, Monday through Friday from 9 a.m. to 6 p.m., hours of Rome (Italy), excluding national holidays;
Support service is delivered in Italian and English language.
Service level objective
Timing of service implementation is defined on the basis of informations received at the reporting stage and level of severity verified by Support team.
Following service level objective (SLO) is applied:
Severity | Description | Taking charge |
|---|---|---|
S1: Critical | Daily operational functions are completely unavailable for at least one area or function business. No available workarounds to preserve substantial operability of the solution. | 2 working hours |
S2: High | Specific product features are blocked. No available workarounds to preserve substantial operability of the solution. | 4 working hours |
S3: Medium | Anomalies in the solution create issues to normal operations, without compromising substantial operability of the solution. | 8 working hours |
S4: Low | Minor anomalies in the solution are identified about specific functionalities and only affecting some users. Workarounds to preserve substantial operability of the solution are available. | 16 working hours |
Interacta
Chi siamo
Injenia S.r.l. – Via dei Lapidari, 12, 40129, Bologna – P.IVA: 03008670360
Design: Emmaboshi
L’ecosistema industriale del futuro tra cambiamento, efficientamento e miglioramento continuo. Un evento dedicato al mondo Manufacturing & Plant.
Unisciti a noi per scoprire come:
