This document in other languages: Italiano Español Français Deutsch Português Română Polski Nederlands

Data Processing Agreement (DPA)

Under Article 28 of Regulation (EU) 2016/679 (GDPR) · version of 16 October 2026

This agreement forms part of the PCO Suite Terms of Service and applies to the personal data the Customer enters into the Service. The parties are:

• the Customer, the company using PCO Suite, acting as controller;
• ComputerLab di Spoltore Fabio, Via Floraspe Renzetti 31, 66034 Lanciano (CH), Italy, VAT no. IT02841650696 ("ComputerLab"), acting as processor.

Terms used have the meaning given in the GDPR. The Customer accepts this agreement by ticking the box at registration or at re-acceptance in the Service.

1. Subject matter and instructions

1.1. ComputerLab processes personal data on behalf of the Customer solely to provide the Service described in the Terms, in accordance with the Customer's documented instructions. The Terms, this agreement and the Customer's use of the functions of the Service (for example entering, changing, exporting or deleting data) constitute instructions.

1.2. ComputerLab immediately informs the Customer if it considers that an instruction infringes the GDPR or other data protection rules, and may suspend its execution until the Customer confirms or changes it.

1.3. ComputerLab does not process the data for its own purposes, does not sell it and does not use it for advertising or to train artificial intelligence models.

2. Nature, purpose and duration of processing

The description of the processing (categories of data subjects and data, purposes, duration) is in Annex I. Processing lasts as long as the contract and, afterwards, for the time needed for deletion under Article 9.

3. Confidentiality

ComputerLab ensures that persons authorised to process the data are bound by confidentiality and access the data only when necessary to provide the Service, for support requested by the Customer or for legal obligations.

4. Security

4.1. ComputerLab implements the technical and organisational measures appropriate to the risk set out in Annex II (Article 32 GDPR) and keeps them up to date. It may replace them with equivalent or more effective measures without reducing the overall level of protection.

4.2. The Customer remains responsible for the security of its devices, of its users' credentials and of the configurations it chooses in the Service.

5. Sub-processors

5.1. The Customer gives ComputerLab general authorisation to engage the sub-processors listed in Annex III.

5.2. ComputerLab informs the Customer at least 30 days in advance (by a notice in the Service or to the administrator's email and by updating this page) of the addition or replacement of a sub-processor. The Customer may object on reasonable data protection grounds; if the parties do not find a solution, the Customer may terminate the contract and request deletion of its data.

5.3. ComputerLab imposes on sub-processors, by contract, data protection obligations substantially equivalent to those of this agreement and remains liable to the Customer for their performance.

6. Transfers outside the European Economic Area

The main database and the files of the Service are located in the European Union. Where a sub-processor processes data outside the European Economic Area, the transfer takes place only on the basis of a European Commission adequacy decision (including the EU-US Data Privacy Framework for participating companies) or the standard contractual clauses approved by the Commission (Decision (EU) 2021/914), with any supplementary measures required.

7. Assistance to the Customer

7.1. Taking into account the nature of the processing, ComputerLab assists the Customer in responding to data subject requests (access, rectification, erasure, restriction, portability, objection), primarily through the functions of the Service with which the Customer can view, correct, download and delete data. If a data subject contacts ComputerLab directly, ComputerLab forwards the request to the Customer without responding on the merits, unless instructed otherwise.

7.2. On request, ComputerLab provides the Customer with the information in its possession that is useful for a data protection impact assessment and prior consultation of the supervisory authority (Articles 35 and 36 GDPR).

8. Personal data breaches

ComputerLab notifies the Customer without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting the Customer's data, at the administrator's email. The notice describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken or proposed. ComputerLab cooperates with the Customer on notifications to the authority and to data subjects, which remain the Customer's responsibility as controller.

9. Return and deletion of data

9.1. During the contract the Customer can view and download reports and documents with the functions of the Service and request from support a complete copy of the data in a structured, commonly used format.

9.2. The Customer can request from the Service the deletion of the company and all data: deletion takes place 30 days after the request (during which the Customer can cancel it or request a copy of the data). ComputerLab then deletes accounts, data and files from the Cloud; backups are overwritten within the following 7 days.

9.3. When the contract expires without renewal, the data remains available in read-only mode so that the Customer can view and download it; if the licence remains expired for more than 24 months, ComputerLab may delete it with at least 30 days' notice.

9.4. Only the data ComputerLab must keep by law as controller (invoices and accounting data, the log of acceptances) is retained. Data already downloaded to the Customer's devices is removed by uninstalling the app or clearing its data, at the Customer's care.

10. Audits

ComputerLab makes available to the Customer the information necessary to demonstrate compliance with this agreement. The Customer may carry out, at its own expense, an audit (including through an independent auditor bound by confidentiality) with at least 30 days' written notice, no more than once a year except in the event of a data breach or a request from the authority, in a way that does not compromise the security of other customers' data. For sub-processors, reliance is normally placed on the certifications and audit reports they publish.

11. Customer obligations

The Customer warrants that it has a valid legal basis for the data it enters, that it has provided notices to data subjects (its clients, technicians and employees) and that it complies with applicable rules, in particular those on remote monitoring and geolocation of workers (in Italy, Article 4 of Law 300/1970), before using the Attendance functions with GPS check and Campaign tracking. The Customer does not enter into the Service special categories of data (Article 9 GDPR) or data relating to criminal convictions, which the Service does not require.

12. Liability

Each party is liable in accordance with Article 82 GDPR. Between the parties, and to the extent permitted by law, the limitations of liability of the Terms of Service apply.

13. Provisions for Switzerland, the United Kingdom and the United States

• Switzerland: for data subject to the Federal Act on Data Protection (FADP), references to the GDPR are to be read as references to the corresponding provisions of the FADP, the supervisory authority is the FDPIC and the standard contractual clauses apply with the adaptations recognised by the FDPIC.
• United Kingdom: for data subject to the UK GDPR, references to the GDPR are to be read as references to the UK GDPR, the authority is the ICO and transfers are based on UK adequacy regulations or the International Data Transfer Addendum to the standard contractual clauses.
• United States: for data subject to the California Consumer Privacy Act and similar state laws, ComputerLab acts as a "service provider"/"processor": it processes personal information only for the business purposes set out in this agreement, does not sell or share it, does not retain, use or disclose it outside the direct business relationship with the Customer, does not combine it with other information except as permitted, and informs the Customer if it can no longer meet these obligations.

14. Precedence

In case of conflict between this agreement and the Terms of Service, this agreement prevails as regards data protection. The Italian text prevails over translations.

Annex I – Description of the processing

Categories of data subjects: the Customer's end clients and their contact persons; the Customer's technicians, employees and contractors; client portal users; company administrators.

Categories of personal data:

• records and contact details of clients and contact persons (name, company name, address, phone, email, GPS coordinates of the site, notes, document language);
• job data: date and time, technician, activities carried out, products used, notes, photos, station issues, technician and client signatures, PDF service reports;
• technician data: name, code, phone, hire date, credentials (password hash only);
• attendance: clock-in, clock-out and break times, GPS position at the time of clocking (if the Customer enables the check), declared expenses;
• GPS routes recorded during adulticide and larvicide campaigns;
• tickets and messages between the Customer and its end clients, uploaded documents (contracts, quotes, invoices, safety data sheets, floor plans);
• technical usage data necessary for operation and security (IP address, access logs).

Special categories of data: none expected.

Nature and purpose: collection, recording, storage, synchronisation between devices, consultation, processing (for example calculating hours and stock usage, generating reports), sending reminders initiated by the Customer, export and deletion, in order to provide the Service for managing the Customer's pest control business.

Duration: for the duration of the contract and until deletion under Article 9.

Annex II – Technical and organisational measures

• Encryption in transit: all communications between app, website and server use TLS.
• Encryption at rest: database volumes and file storage are encrypted by the infrastructure providers.
• Passwords: stored only as a PBKDF2-HMAC-SHA256 hash with a random per-user salt and 100,000 iterations; nobody, not even ComputerLab, can read them.
• Customer separation: each company's data is separated by Company Code both in the app's queries and by row-level security policies on the database; each role (Office, Technician, Client) sees only what concerns it.
• Authentication: Cloud access only with an authenticated session; credential checks on the server, limit on failed attempts, immediate expiry of sessions when the password, email or account status changes.
• Files: transferred only through signed URLs valid for a few minutes, decided by the server with the same access rules as the data.
• Availability and resilience: offline operation with a queue of changes, which are never lost; daily database backups kept for 7 days.
• Minimisation in logs: the app's technical log excludes passwords, keys and typed text and masks emails; it stays on the device and is sent only if the user submits a report.
• Staff access: limited to ComputerLab, with personal authentication and only when needed for the service or support.
• Vulnerability and update management: components are kept up to date and reported security defects are fixed promptly.

Annex III – Authorised sub-processors

Back to the website