itinovo CRM

Data Processing Agreement

(Article 28 of Regulation (EU) 2016/679 — GDPR)

Annex to the General Terms of Use — itinovo CRM, version 2.9 of 14 October 2026
Document version 1.3

This Agreement supplements and forms part of the General Terms of Use of the itinovo CRM service. By accepting the General Terms of Use, the Customer also accepts this Agreement, which is concluded in writing within the meaning of Article 28(9) GDPR ("including in electronic form"). On request, itinovo provides a PDF copy already signed on its side, which the Customer may countersign and retain.

1. The parties

Controller: the Customer, that is, the legal entity subscribing to itinovo CRM.

Processor: Itinovo S.r.l., via Lelli 3/13, 40065 Pianoro (BO), Italy — VAT no. IT04383971209 — certified email (PEC) itinovo@namirialpec.it — privacy contact: privacy@itinovo.com.

The Customer determines the purposes and means of the processing of personal data entered into the platform. itinovo processes such data solely on behalf of the Customer and on its documented instructions.

2. Subject matter, nature and purpose of the processing

itinovo provides the Customer with a SaaS software platform for managing the business of travel agencies and tour operators. The processing consists of the collection, recording, organisation, storage, retrieval, alteration, disclosure to recipients designated by the Customer, and erasure of the personal data entered by the Customer or by its end clients through the functions of the platform.

The sole purpose is the provision of the service requested by the Customer. itinovo does not use Customer data for its own purposes, does not disclose it to third parties other than as set out in this Agreement, and does not use it to train artificial intelligence models.

3. Duration

Processing begins when the service is activated and ends upon termination of the contract, subject to Clause 11 on return and erasure.

4. Categories of data subjects and types of personal data

Categories of data subjects: the Customer's users (agency staff); the Customer's clients and prospective clients; participants in trips organised by the Customer; contact persons at the Customer's suppliers and partners.

Ordinary categories of data:

  • identification and contact data: first name, surname, email address, telephone number, address, city, nationality, date of birth;
  • travel document data: document type (identity card, passport, driving licence), document number and expiry date;
  • contractual and financial data: quotations, bookings, amounts, invoices, payments, commissions;
  • travel data: destinations, dates, booked services, room allocation, sub-group membership, generated travel documents;
  • professional data of participants, where entered by the Customer: company and job title;
  • documents uploaded by the Customer and free-text notes;
  • access data, activity records and technical logs.

Special categories of data (Article 9 GDPR). The platform provides the Customer with fields which, depending on how they are used, may contain special categories of personal data:

  • dietary requirements of participants (including the halal and kosher options, from which religious beliefs may be inferred);
  • accessibility requirements of participants, from which health data may be inferred.

Entering such data is at the Customer's discretion. As controller, the Customer is responsible for identifying an appropriate legal basis under Article 9(2) GDPR — as a rule, the data subject's explicit consent — and for providing the required information notice. itinovo processes such data solely on behalf of the Customer, applying the same security measures as to all other data and carrying out no further processing.

Automated extraction from documents. At the Customer's request, the platform can automatically extract data from an uploaded identity document in order to pre-fill the participant's fields. Processing is carried out using artificial intelligence models operated by Amazon Web Services in regions located within the European Union, as set out in Annex A. The result of the extraction always remains editable by the operator and produces no automated decision within the meaning of Article 22 GDPR.

5. Instructions of the Controller

itinovo processes personal data solely on the Customer's documented instructions. The General Terms of Use, this Agreement and the Customer's use of the platform's functions constitute such instructions.

Where itinovo is required to process data by Union or Member State law to which it is subject, it shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

itinovo shall immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

6. Confidentiality

itinovo ensures that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. The register of authorised persons is kept up to date and limited to the necessary minimum.

7. Security of processing

itinovo implements appropriate technical and organisational measures pursuant to Article 32 GDPR, described in Annex B — Technical and Organisational Measures, which forms an integral part of this Agreement.

itinovo reserves the right to update those measures in line with technological developments, provided that the level of security is not reduced below that described.

8. Sub-processors

The Customer grants itinovo general authorisation to engage sub-processors. The current list is published at https://crm.itinovo.com/{language}/subprocessors and reproduced in Annex A.

itinovo shall inform the Customer of any intended addition or replacement of sub-processors with at least 30 days' notice, by notification to the account administrator's email address and by updating the public page. Within that period the Customer may object on reasonable and documented data protection grounds. In the event of an objection, the parties shall seek an alternative solution in good faith; if none can be found, the Customer may terminate the contract without penalty with effect from the date the new sub-processor is engaged.

itinovo imposes on each sub-processor, by contract, data protection obligations equivalent to those set out in this Agreement, and remains liable to the Customer for their performance.

Integrations activated by the Customer. When the Customer connects an external provider to the platform with its own account and credentials (for example the flight provider Duffel), itinovo transmits the necessary data to the provider on the Customer's instructions; connecting the account, with user and date, is the documented instruction. The provider processes the data on behalf of the Customer under the contract between them, including the safeguards for any transfer to third countries, and is not a sub-processor of itinovo; itinovo does not process such data for its own purposes. The name of each provider and a link to its data processing agreement are shown on the Settings › Integrations page.

8-bis. Recipients chosen by the Customer through connectors

When the Customer enables a connector to a third-party service (clause 19-bis of the Terms), the transmission of personal data to that service takes place on the Customer's documented instruction (Article 28(3)(a) GDPR), given by its administrator when enabling the connector and by its Users with each request. The third party is not a sub-processor of itinovo: it is a recipient chosen by the Customer, which is its controller or has appointed it as its own processor, and it does not appear in Annex A. The Customer warrants that it has a contract with the third party compliant with Article 28 GDPR, that it has a legal basis and has informed the data subjects, and that it has verified the transfer tool where the third party processes data outside the European Union (Article 44 et seq. GDPR). itinovo informs the Customer, on the enabling screen, of the cases in which in its opinion the instruction may infringe the GDPR (for example the use of a consumer account of the third party), and keeps the connector call log for 90 days as part of the processing on behalf of the Customer.

9. Transfers to third countries

Customer data is stored within the European Union, in the AWS region eu-central-1 (Frankfurt am Main, Germany). Artificial intelligence models are executed in AWS regions within the European Union, with eu-central-1 as the primary region, as set out in Annex A. In no case is data processed outside the territory of the European Union.

Transfers to third countries occur solely in the cases identified in Annex A and on the basis of the safeguards provided for in Chapter V GDPR, in particular the Standard Contractual Clauses adopted by the European Commission.

10. Assistance to the Controller

Taking into account the nature of the processing and the information available to it, itinovo assists the Customer:

  • in responding to requests from data subjects exercising their rights (Articles 15–22 GDPR). Where such a request is received directly by itinovo, it shall forward it to the Customer without undue delay and shall not act on it independently;
  • in ensuring compliance with the obligations relating to security, breach notification, communication to data subjects, data protection impact assessment and prior consultation (Articles 32–36 GDPR);
  • by making available all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR.

11. Personal data breaches

itinovo shall notify the Customer of any personal data breach without undue delay and in any event within 48 hours of becoming aware of it, providing: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address it, and a contact point for further information.

Where it is not possible to provide all the information at the same time, it shall be provided in phases without further undue delay.

12. Return and erasure of data

The Customer may export its data at any time using the platform's export functions.

Upon termination of the contract, the Customer has 30 days to complete the export. After that period, itinovo permanently erases the personal data processed on the Customer's behalf. Any copies present in backups are removed in line with the backup rotation cycle, in any event within 35 days.

This is without prejudice to the 10-year retention required by Italian law of the accounting and tax records of the contractual relationship between itinovo and the Customer alone (invoices, accounting books and related documentation). That retention concerns itinovo as an independent controller for the purpose of complying with legal obligations and does not extend to the personal data entered by the Customer into the platform.

13. Audits and inspections

Upon written request, and no more than once a year, itinovo makes available to the Customer the documentation necessary to demonstrate compliance with this Agreement, including the certifications and compliance reports of its infrastructure provider.

Where that documentation is not sufficient, the Customer may request an inspection, to be agreed with at least 30 days' notice, held during business hours, without prejudice to the operation of the service and respecting the confidentiality of other customers. The costs of the inspection are borne by the Customer, unless the inspection reveals material breaches on the part of itinovo.

14. Governing law

This Agreement is governed by Italian law and by Regulation (EU) 2016/679. In the event of conflict between this Agreement and the General Terms of Use, this Agreement prevails in so far as the processing of personal data is concerned.