Data Processing Addendum (DPA)

Data controller

OnlyScreenshot is operated by Alberto Lopez, trading as Alcybercloud.it. Privacy and support contact: support@alcybercloud.it. WhatsApp contact: +39 3773094661.

When it applies

This addendum applies when a customer uses OnlyScreenshot to process personal data for its own operational or professional purposes and OnlyScreenshot acts as processor under Article 28 GDPR.

This text is intended as an informative and operational summary. In enterprise contexts or upon request, a separate contractual appointment may also be appropriate.

Roles of the parties

• Customer: data controller for the personal data collected through its website or support workflows.
• OnlyScreenshot: data processor for platform delivery, technical collection of reports and activities strictly connected to the service.
• OnlyScreenshot infrastructure providers: sub-processors where required and appointed for service delivery.

Subject matter, duration and nature of processing

• Subject matter: collection, transmission, organisation, storage and display of bug reports and related technical data.
• Duration: for the period during which the customer uses the service and any additional technical or legal retention period that may apply afterwards.
• Nature: electronic processing of voluntarily submitted data, technical metadata, screenshots and logs used to diagnose the reported issue.

Categories of data and data subjects

• Data subjects: end users of the customer website, customer operators, authorised collaborators and technical contacts.
• Data processed: URL, screenshots, messages, browser, operating system, user agent, resolution, viewport, IP address, console logs and customer account data.

Customer instructions

OnlyScreenshot processes personal data on the basis of the customer’s documented instructions, as reflected in use of the platform, project configuration and any applicable agreements.

The customer remains responsible for the lawfulness of the instructions it gives and for the adequacy of the information provided to data subjects.

Technical and organisational measures

• Authentication and authorisation controls.
• Rate limiting, input validation, image checks and security logging.
• Logical separation of projects and restricted access to reports for authorised users.
• Reasonable measures for integrity, availability, confidentiality and resilience, taking into account the state of the art and the nature of the service.

Sub-processors

OnlyScreenshot may rely on third-party providers for hosting, storage, email, security, maintenance and business continuity. Where those parties process personal data on behalf of OnlyScreenshot, they are bound by appropriate contractual obligations under Article 28 GDPR.

Assistance to the customer

• Reasonable support for data subject rights requests, to the extent dependent on the service.
• Reasonable support in relation to security of processing, data breaches, impact assessments or prior consultations, within the limits of the service nature and available information.

Personal data breaches

In the event of a personal data breach affecting the service and reasonably known to OnlyScreenshot, reasonable measures will be taken to contain, analyse and notify the customer without undue delay, within the limits of available information and as required by Articles 33 and 34 GDPR where applicable.

Deletion or return of data

Upon termination of the relationship, OnlyScreenshot may delete or make inaccessible the personal data processed on behalf of the customer, subject to retention obligations, security needs, technical backups or defence of legal rights under applicable law.

Audit and requests

Reasonable requests for information about security or processing may be sent to support@alcybercloud.it. Any need for a formal audit must be agreed taking into account the nature of the service, confidentiality, the security of other customers and proportionality.