Data Processing Agreement (Article 28 GDPR)

1. Parties and scope

This agreement is between:

• the Controller: the shop or professional who uses Kairomi Pro for WordPress, “you”;
• the Processor: Valerio Rullo · Mokita Studio, sole proprietorship (ditta individuale), VAT number IT03321070801, Via Polistena I traversa privata 10, 89132 Reggio Calabria (RC), Italy, email info@mokita.studio, PEC (certified email) valerio.rullo@pec.it.

It is part of the Terms of sale and licence of Kairomi Pro for WordPress and you accept it together with them. If they conflict on personal data, this agreement prevails.

It covers the personal data of your customers and staff that the Processor processes on your behalf. It does not cover the data the Processor processes as a controller (for example the email you buy the subscription with): the Privacy notice applies to those.

The plugin stores data in your site's database, on the hosting you choose, and does not send them to the Processor. So, normally, the Processor processes no data of your customers. The agreement applies only when you give the Processor access to your site or data, for example for support or to move your data from Amelia, and only for those operations.

2. Subject matter, duration, nature and purpose

• Subject matter: the support you ask for with Kairomi Pro (management of bookings, calendar, customers, staff and notifications), including moving data from Amelia.
• Duration: the duration of the support work.
• Nature: consultation, export, import, correction and erasure, by electronic means.
• Purpose: only the purposes above. The Processor does not use the data for its own purposes, does not sell them and does not use them for advertising or to train artificial intelligence systems.

Categories of data and data subjects are in Annex 1.

3. Instructions

The Processor processes the data only on your documented instructions: this agreement, the Terms and what you ask for in the support work. You can give further instructions by email at info@mokita.studio.

If the Processor believes an instruction breaks data protection law, it tells you before carrying it out. If the law requires the Processor to process the data otherwise, it tells you first, unless the law forbids it.

4. Confidentiality

Only the Processor, who is bound by confidentiality, accesses the data. If collaborators join in the future, they will access the data only when needed for support, and only after committing to confidentiality in writing.

5. Security

The Processor applies the technical and organisational measures in Annex 2, appropriate to the risk, and updates them when Kairomi Pro or its providers change.

6. Sub-processors

You give the Processor general authorisation to use the sub-processors in Annex 3, for the roles stated. Each is bound by a contract with data protection obligations equivalent to these.

Before adding or replacing a sub-processor, the Processor tells you by email at least 15 days in advance. If you object on data protection grounds and no solution is found, you can cancel the subscription without penalty.

The Processor remains liable to you for the work of its sub-processors.

7. Transfers outside the European Economic Area

Some sub-processors are based in the United States or process data outside the European Economic Area. These transfers rely on the European Commission's adequacy decision for companies certified under the EU-U.S. Data Privacy Framework, or on the Standard Contractual Clauses adopted by the Commission.

8. Data subject rights

When one of your customers or staff members exercises their rights (access, rectification, erasure, restriction, portability, objection), you answer as the controller. The Processor helps you as follows:

• the plugin hooks into WordPress's privacy tools (Tools › Export Personal Data and Tools › Erase Personal Data; in Italian WordPress “Strumenti › Esporta i dati personali” and “Cancella i dati personali”), which cover customers, pets, bookings and sent emails;
• for other requests the Processor helps you on request, in time for you to meet the one-month deadline.

If a data subject writes to the Processor directly, the Processor forwards the request to you without delay and does not answer on the merits without your authorisation.

9. Personal data breaches

If it becomes aware of a personal data breach affecting your data, the Processor tells you without undue delay and, where possible, within 48 hours of becoming aware of it, at your registered email. As soon as it knows them, it gives you the nature of the breach, the categories and approximate number of people and records involved, the likely consequences and the measures taken or proposed. It then helps you notify the supervisory authority and the data subjects, where required.

10. Other assistance

On request, the Processor gives you the information needed for a data protection impact assessment (Art. 35 GDPR) and for any prior consultation with the supervisory authority (Art. 36), as far as Kairomi Pro is concerned.

11. End of processing

When the support work ends, the Processor deletes within 30 days every copy of your data it received (for example a database export) and closes the access you gave it, if you have not already closed it. The data on your site remain yours: you decide whether and when to delete them (Kairomi › Configurazione › Impostazioni › Disinstallazione). While another Kairomi plugin is still installed on the site, deleting one does not delete the data: for example, after moving to Pro you can delete the free version and your data stays, because Pro uses it.

Only data the law requires to be kept remain.

12. Audits

The Processor gives you the information needed to show compliance with this agreement. You can ask for an audit, also through an auditor bound by confidentiality, with at least 30 days' notice, no more than once a year except after a data breach, at your own cost. As a rule the audit is done in writing, with a questionnaire and documents.

13. Liability and governing law

The parties' liability follows Article 82 GDPR and, otherwise, the rules of the Terms of sale and licence. This agreement is governed by Italian law; jurisdiction is as stated in the Terms.

Annex 1: data and data subjects

Data subjects: the shop's customers who book; the shop's staff entered in the plugin.

Data the plugin stores on your site, which the Processor accesses only if you give it access:

• customers: name, phone number, email, consents;
• pets: name, species, size, breed, weight, health notes and allergies;
• bookings, notes, custom field, recorded payments, log of sent emails;
• staff: name, email, phone number, role, working hours, absences, locations.

Annex 2: security measures

Organisational

• Only the Processor accesses the Processor's systems.
• The production keys of the Licence service are stored as secrets of the hosting provider, not in code.
• Customer data are not used for testing or development: tests use sample data.
• Copies of data received for support are deleted within 30 days of the end of the work.

Technical

• Data stay in the shop's site database. The plugin sends the service that manages licences and payments only the key, the site address, the plugin version and, when you start a purchase or recover your key, your email: never customer data.
• Admin pages check WordPress permissions and use nonces against forged requests.
• The public form has a limit of 12 attempts per hour per IP address, a honeypot field against spam and, if you turn it on, Cloudflare Turnstile. Of visitors' IP addresses the plugin keeps only a fingerprint, for one hour.
• WordPress's privacy tools let you export and erase a customer's data.

Annex 3: sub-processors, by role