Legal

Data Processing Agreement (DPA)

Note. The legally binding DPA is the Italian text, signed within your subscription agreement. Read the Italian version →

Parties

Controller: you, the Verto AI customer.
Processor: Diciassette Srls, VAT IT04131570360, Modena, Italy (operator of Verto AI).

Subject and duration

This DPA governs the processing of personal data that Diciassette Srls performs on behalf of the Customer to provide the Verto AI service. It applies for the duration of the subscription.

Nature and purpose of processing

Processing is strictly necessary to provide conversational AI concierge services, respond to guest messages on behalf of the Customer, and maintain the Customer's account and knowledge base.

Categories of data subjects and personal data

Data subjects: the Customer's employees, guests of Customer's apartments.
Categories of personal data: names, contact details, booking data, message content, IP addresses, device identifiers.

Sub-processors

The Processor engages sub-processors strictly necessary to deliver the service (cloud hosting, LLM providers, analytics, monitoring). A current list is maintained on our sub-processors page. The Processor notifies the Customer at least 30 days before adding or replacing a sub-processor.

Security measures

Encryption in transit (TLS 1.3) and at rest (AES-256)
Access control with principle of least privilege
Regular penetration testing and security audits
Incident response plan with 72-hour breach notification
EU-only data storage

Controller's rights

The Customer may audit the Processor's compliance with this DPA with 30 days' notice, no more than once per year except for cause. The Processor will provide all information reasonably necessary to demonstrate compliance.

Data subject rights

The Processor will assist the Customer in responding to data subject requests (access, rectification, deletion, portability) within the timeframes required by GDPR Art. 15–22.

Termination

Upon termination of the subscription, the Processor will delete or return all personal data within 30 days, unless EU or national law requires retention.

To request a signed copy of the full DPA, contact privacy@vertoai.it. Last updated: April 2026.