Intuendi Data Processing Addendum

Effective date: August 2026

This Data Processing Addendum (“DPA”) forms part of the agreement governing the Customer’s use of the Intuendi services, including the applicable Order Form, business proposal and Terms of Service (collectively, the “Agreement”).

It is entered into between:

Customer: the entity identified as the customer in the applicable Order Form, business proposal or account (“Customer” or “Controller”); and

Intuendi S.r.l., Viale Mazzini 40, 50132 Florence, Italy, VAT IT06624070485 (“Intuendi” or “Processor”).

1. Scope and roles

1.1 The Intuendi Service is designed principally to process business and operational information, including product, sales, inventory, forecast and purchase-order data, which is not ordinarily Personal Data.

1.2 This DPA applies only to Personal Data contained in data submitted to the Service by or on behalf of Customer and processed by Intuendi on Customer’s behalf (“Customer Personal Data”).

1.3 For Customer Personal Data, Customer is the Controller and Intuendi is the Processor. Each party shall comply with the obligations applicable to it under the GDPR and other applicable data-protection laws.

1.4 Intuendi is an independent Controller for account administration, billing, business-contact, security, fraud-prevention and service-usage information for which Intuendi determines the purposes and means of processing. Such processing is governed by Intuendi’s Privacy Policy and is outside the scope of this DPA.

1.5 “Personal Data”, “Controller”, “Processor”, “Data Subject”, “processing”, “Personal Data Breach” and “Supervisory Authority” have the meanings assigned to them by the GDPR.

2. Customer instructions

2.1 Intuendi shall process Customer Personal Data only:

a. on Customer’s documented instructions;

b. as necessary to provide, secure and support the Service described in the Agreement; or

c. where required by applicable law.

2.2 The Agreement, Customer’s configuration and use of the Service, and Customer’s authorized support requests constitute documented instructions.

2.3 If applicable law requires Intuendi to process Customer Personal Data beyond Customer’s instructions, Intuendi shall inform Customer before such processing unless the applicable law prohibits notification.

2.4 Intuendi shall promptly inform Customer if, in its reasonable opinion, an instruction infringes applicable data-protection law.

3. Customer responsibilities

3.1 Customer is responsible for the lawfulness, accuracy and quality of Customer Personal Data and for providing all required notices and establishing an appropriate legal basis for its processing.

3.2 Customer shall not submit:

a. special-category data under Article 9 GDPR;

b. criminal-conviction or offence data;

c. medical or biometric data;

d. government-issued identity documents;

e. payment-card information; or

f. passwords, authentication credentials or other highly sensitive information,

unless Intuendi has expressly agreed in writing to such processing.

3.3 Customer shall use reasonable measures to avoid including unnecessary Personal Data in product, sales, inventory, purchase-order, support or AI inputs.

3.4 Customer shall ensure that its instructions comply with applicable data-protection law.

4. Confidentiality and security

4.1 Intuendi shall ensure that persons authorized to process Customer Personal Data are bound by confidentiality obligations and access Customer Personal Data only as necessary to perform their duties.

4.2 Intuendi shall maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

4.3 The technical and organizational measures maintained by Intuendi are summarized in Annex 2.

4.4 Intuendi may update its technical and organizational measures to reflect technical developments, changes to the Service or changes in applicable law, provided that the overall level of protection is not materially reduced.

5. Subprocessors

5.1 Customer grants Intuendi general authorization to engage subprocessors for the processing of Customer Personal Data in connection with the Service.

5.2 Intuendi shall maintain a current list of its subprocessors at:

https://www.intuendi.com/ai-services-subprocessors

The list shall identify each subprocessor’s name, service, processing purpose and primary processing region.

5.3 Before appointing a new subprocessor that will process Customer Personal Data, Intuendi shall provide at least fifteen days’ prior notice by email to Customer’s account administrator or other designated contact.

5.4 Intuendi shall enter into a written agreement with each subprocessor that imposes the applicable data-protection obligations required by Article 28(4) GDPR. A subprocessor’s standard data-processing addendum may satisfy this requirement.

5.5 Intuendi shall remain responsible to Customer for the performance of each subprocessor’s data-protection obligations, as required by applicable data-protection law.

5.6 Customer may object to a new subprocessor during the fifteen-day notice period where it has reasonable and documented data-protection grounds. The parties shall work in good faith to resolve the objection.

If the objection cannot reasonably be resolved, Intuendi may choose not to use the subprocessor for Customer, where technically and commercially feasible. Otherwise, either party may terminate the affected feature or Service in accordance with the Agreement.

5.7 Where an immediate subprocessor change is reasonably necessary to protect the security, availability or integrity of the Service, Intuendi may make the change before the notice period expires. Intuendi shall notify Customer without undue delay and explain the reason for the accelerated change.

6. Data-subject requests

6.1 Taking into account the nature of the processing, Intuendi shall provide reasonable assistance to Customer, through appropriate technical and organizational measures, in responding to requests by Data Subjects exercising their rights under applicable data-protection law.

6.2 If Intuendi receives a request from a Data Subject relating to Customer Personal Data, Intuendi shall refer the request to Customer and shall not respond on Customer’s behalf unless authorized by Customer or legally required to do so.

6.3 Customer is responsible for determining how to respond to a Data Subject request and for verifying the identity and authority of the person making the request.

7. Personal Data Breaches

7.1 Intuendi shall notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

7.2 The notification shall include, to the extent reasonably available:

a. a description of the nature of the Personal Data Breach;

b. the categories and approximate number of affected Data Subjects;

c. the categories and approximate number of affected Personal Data records;

d. the likely consequences of the Personal Data Breach;

e. the measures taken or proposed to address and mitigate the Personal Data Breach; and

f. an appropriate contact from whom further information may be obtained.

7.3 Where it is not possible to provide all information at the same time, Intuendi may provide it in stages as it becomes reasonably available.

7.4 Intuendi’s notification of a Personal Data Breach does not constitute an admission of fault or liability.

7.5 Customer is responsible for determining whether notification to a Supervisory Authority, Data Subjects or another party is required.

8. Compliance assistance

8.1 Taking into account the nature of the processing and the information available to Intuendi, Intuendi shall provide reasonable assistance to Customer concerning:

a. Customer’s security obligations;

b. legally required Personal Data Breach notifications;

c. data-protection impact assessments; and

d. prior consultations with Supervisory Authorities.

8.2 Intuendi may charge reasonable fees for exceptional or excessive assistance that is not caused by Intuendi’s breach of this DPA. Intuendi shall inform Customer of any expected fees before providing such assistance.

9. Return and deletion

9.1 During the Agreement and for sixty days following termination, Customer may request an available export of Customer Personal Data.

9.2 Following termination, or earlier upon Customer’s written request, Intuendi shall delete or return Customer Personal Data and delete remaining copies, unless applicable law requires its retention.

9.3 Customer must request the return or export of Customer Personal Data before the expiration of the sixty-day period. After that period, Intuendi may permanently delete Customer Personal Data without further notice.

9.4 Customer Personal Data contained in backups shall be isolated from ordinary use and deleted through Intuendi’s normal backup-expiration cycle. Until deletion, such data shall remain protected by this DPA.

9.5 Intuendi may retain information that has been irreversibly anonymized so that neither a Data Subject nor Customer can reasonably be identified or re-identified.

9.6 Upon Customer’s reasonable written request, Intuendi shall confirm the deletion of Customer Personal Data, except for information retained as required by law or temporarily retained in protected backups.

10. Information and audits

10.1 Intuendi shall make available information reasonably necessary to demonstrate compliance with this DPA, including relevant security documentation and independent certifications or audit reports, where available.

10.2 If the information provided under Section 10.1 is reasonably insufficient to demonstrate compliance, Customer may conduct an audit no more than once in any twelve-month period, unless:

a. a Personal Data Breach affecting Customer Personal Data has occurred;

b. a Supervisory Authority requires an audit; or

c. Customer has reasonable grounds to believe that Intuendi is materially in breach of this DPA.

10.3 Audits must:

a. be conducted upon reasonable prior written notice;

b. occur during normal business hours;

c. avoid unreasonable disruption to Intuendi’s operations;

d. protect the confidentiality and security of Intuendi and its other customers;

e. be limited to systems and information relevant to the processing of Customer Personal Data; and

f. be conducted by Customer or an independent auditor that is not a competitor of Intuendi and is bound by appropriate confidentiality obligations.

10.4 Customer shall bear its audit costs unless the audit identifies a material breach of this DPA by Intuendi.

10.5 Nothing in this Section requires Intuendi to disclose information that would compromise the security of its systems, violate confidentiality obligations owed to another party or disclose another customer’s information.

11. International transfers

11.1 Intuendi shall process Customer Personal Data within the European Economic Area where stated in the Agreement or applicable subprocessor documentation.

11.2 Where Customer Personal Data is transferred to a country outside the European Economic Area that has not received an adequacy decision from the European Commission, Intuendi shall implement a lawful transfer mechanism.

11.3 The lawful transfer mechanism may include the applicable European Commission Standard Contractual Clauses, together with supplementary safeguards where required by applicable data-protection law.

11.4 Upon Customer’s reasonable request, Intuendi shall provide information concerning the transfer mechanism applicable to Customer Personal Data.

11.5 This DPA does not, by itself, constitute the European Commission Standard Contractual Clauses governing international transfers.

12. Government and legal requests

12.1 Unless prohibited by applicable law, Intuendi shall notify Customer if it receives a legally binding request from a public authority requiring disclosure of Customer Personal Data.

12.2 Intuendi shall review such requests and, where reasonable and legally permitted, challenge requests that are unlawful, excessive or disproportionate.

12.3 Intuendi shall disclose only the Customer Personal Data that it is legally required to disclose.

13. Term and precedence

13.1 This DPA becomes effective when Customer enters into the Agreement and remains effective for as long as Intuendi processes Customer Personal Data on Customer’s behalf.

13.2 If this DPA conflicts with the Agreement regarding the processing or protection of Customer Personal Data, this DPA shall prevail.

13.3 Liability arising under this DPA is subject to the liability provisions of the Agreement, without limiting any rights of Data Subjects or powers of Supervisory Authorities that cannot lawfully be restricted.

13.4 The governing-law and jurisdiction provisions of the Agreement apply to this DPA.

13.5 If any provision of this DPA is found to be invalid or unenforceable, the remaining provisions shall remain in effect. The invalid provision shall be replaced with a valid provision that most closely reflects its purpose.

Annex 1 — Processing details

Subject matter

Provision, operation, security and support of Intuendi’s demand-planning, forecasting, inventory-optimization, purchase-order, integration and optional AI functionality.

Duration

The duration of the Customer’s subscription and the deletion period described in Section 9.

Nature and purpose

Collection, import, organization, storage, analysis, forecasting, retrieval, consultation, transmission, support, export and deletion as necessary to provide and secure the Service.

Potential categories of Data Subjects

  • Customer employees, authorized users and contractors;
  • supplier and business-partner representatives;
  • customers or other individuals incidentally included in Customer-provided data;
  • individuals identified in support communications or attachments; and
  • individuals identified in optional AI inputs.

Potential categories of Personal Data

  • business contact information;
  • names, professional roles and business email addresses;
  • user, employee, supplier or customer identifiers;
  • application activity and audit information;
  • Personal Data incidentally included in purchase orders, imports, integrations or free-text fields;
  • support communications and attachments; and
  • prompts and responses submitted through optional AI features.

Special-category data

Special-category data is not intended or permitted to be processed unless Intuendi expressly agrees to such processing in writing and the parties implement appropriate additional safeguards.

Processing frequency

Continuous or as initiated by Customer during the Agreement.

Annex 2 — Technical and organizational measures

Intuendi shall maintain technical and organizational measures appropriate to the nature and risks of the processing, including, as applicable:

Access control

  • role-based access controls;
  • least-privilege access;
  • authentication controls for administrative and privileged access;
  • procedures for granting, reviewing and revoking access; and
  • confidentiality obligations for authorized personnel.

Data protection

  • encryption of Customer Personal Data in transit;
  • encryption of stored Customer Personal Data where appropriate;
  • logical separation of customer environments or data;
  • controls intended to prevent unauthorized disclosure or alteration; and
  • secure deletion or anonymization procedures.

System security

  • logging and monitoring;
  • vulnerability and security-patch management;
  • malware protection where appropriate;
  • change-management procedures; and
  • periodic review of security controls.

Availability and recovery

  • backup procedures;
  • service-recovery and business-continuity measures;
  • measures designed to restore availability following an incident; and
  • periodic testing or review of recovery procedures.

Incident management

  • procedures for detecting, assessing and responding to security incidents;
  • internal escalation procedures;
  • documentation of material incidents; and
  • procedures for notifying affected customers where required.

Personnel and suppliers

  • personnel security awareness;
  • confidentiality commitments;
  • assessment of material service providers;
  • written data-protection obligations for subprocessors; and
  • periodic review of the subprocessor list.

More detailed security information may be provided to Customer under appropriate confidentiality obligations.