Data Processing Agreement

Version 1.0, effective 11 November 2026. This Data Processing Agreement ("DPA") is the Data Processing Amendment referred to in Omnidea's Terms of Service. It applies to every customer that installs General Caster, without the need to sign it. A copy signed by both parties is available on request.

1. Parties and scope

1. Processor: Omnidea S.r.l., Via Niccolò Tommaseo 94, 35131 Padova, Italy, VAT IT03683000271 ("Omnidea"), developer of General Caster, an app for monday.com (app ID 8031) ("General Caster" or the "Service").
2. Controller: the organisation that installs and uses General Caster on its monday.com account ("Customer").
3. This DPA governs the processing of personal data by Omnidea on behalf of Customer when providing the Service, as required by Article 28 of Regulation (EU) 2016/679 ("GDPR"). The terms "personal data", "processing", "controller", "processor", "data subject", "sub-processor" and "personal data breach" have the meaning given in the GDPR.
4. Where this DPA and the Terms of Service conflict on the protection of personal data, this DPA prevails.
5. General Caster is an app that runs inside Customer's monday.com account. monday.com Ltd. is Customer's own provider and is not a sub-processor of Omnidea for the data stored in Customer's boards.

2. Details of the processing

The subject matter, nature, purpose, duration, types of personal data, categories of data subjects and retention periods are described in Annex 1.

3. Customer's instructions

1. Omnidea processes personal data only on Customer's documented instructions. These are: this DPA and the Terms of Service; the automations, formulas and settings that Customer configures in General Caster; and Customer's requests to support.
2. Omnidea informs Customer without delay if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection law.
3. Omnidea does not use Customer's personal data for its own purposes, does not sell it and does not use it for advertising or to train artificial intelligence models.
4. Customer is responsible for the lawfulness of the processing it instructs, including the legal basis and the information given to data subjects.

4. Confidentiality

Access to personal data is limited to the members of the General Caster team who need it to run and support the Service. They are bound by confidentiality obligations that continue after their engagement ends.

5. Security

Omnidea implements and maintains the technical and organisational measures described in Annex 2, appropriate to the risk of the processing (Article 32 GDPR). Omnidea may update them, provided that the overall level of protection is not reduced.

6. Sub-processors

1. Customer gives Omnidea a general authorisation to engage the sub-processors listed in Annex 3.
2. Omnidea imposes on each sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, and remains liable to Customer for their performance.
3. Omnidea announces any intended addition or replacement of a sub-processor at least 30 days in advance, by updating Annex 3 on this page and by email to customers who ask to be notified at [email protected]. Customer may object on reasonable data protection grounds within that period. If the parties cannot agree on a solution, Customer may stop using the Service and terminate its subscription; fees already paid for the current period are refunded pro rata.

7. Location of the data and international transfers

1. General Caster's servers and databases are hosted in the European Union (Frankfurt, Germany).
2. Where a sub-processor processes personal data outside the European Economic Area, the transfer is based on an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework for certified recipients) or on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, with supplementary measures where needed.

8. Assistance to Customer

1. Taking into account the nature of the processing, Omnidea assists Customer with appropriate technical and organisational measures in responding to requests from data subjects exercising their rights under Chapter III GDPR. Omnidea forwards to Customer, without undue delay, any such request it receives directly and does not answer it without Customer's authorisation.
2. Omnidea provides reasonable assistance with Customer's obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), considering the information available to Omnidea.

9. Personal data breaches

Omnidea notifies Customer of a personal data breach affecting Customer's personal data without undue delay and in any case within 48 hours after becoming aware of it. The notification describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Omnidea provides further information as it becomes available and takes reasonable steps to contain the breach and mitigate its effects.

10. Deletion and return of data

1. Board content read to calculate is not stored: it is processed in memory for the duration of the calculation. Other data is deleted at the end of the retention periods in Annex 1.
2. When Customer uninstalls General Caster, or on Customer's written request, Omnidea deletes Customer's personal data within 90 days. It keeps only the records it must keep by law (for example invoices and payment records) for the period required by law. Copies in backups are overwritten in the normal backup cycle.
3. Before deletion, Customer may ask for a copy of its account data and usage records in a common machine-readable format.

11. Information and audits

1. Omnidea makes available to Customer the information necessary to demonstrate compliance with Article 28 GDPR, in particular this DPA, its annexes and Omnidea's Privacy and Security Policy, and answers Customer's reasonable written questionnaires.
2. Where this information is not sufficient, Customer may carry out an audit, itself or through an independent auditor bound by confidentiality, not more than once a year (unless required by a supervisory authority or after a personal data breach), with at least 30 days' written notice, during business hours and without disrupting Omnidea's operations or accessing other customers' data. Each party bears its own costs.
3. For the infrastructure operated by sub-processors, Customer accepts their independent certifications and audit reports (for example ISO/IEC 27001 and SOC 2) in place of an on-site audit.

12. Liability, term and law

1. Each party's liability under this DPA is subject to the limitations of the Terms of Service, except where the GDPR does not allow them.
2. This DPA applies for as long as Omnidea processes personal data on behalf of Customer, and its obligations on deletion and confidentiality survive the end of the Service.
3. This DPA is governed by Italian law. The courts of Padova, Italy, have exclusive jurisdiction, without prejudice to data subjects' rights and to the competence of supervisory authorities.
4. Contact for data protection and notices under this DPA: [email protected].

Annex 1: Description of the processing

Annex 2: Technical and organisational measures

• Data minimisation: board content is read only for the items and columns a formula needs, processed in memory and not stored. General Caster does not keep monday.com access tokens: each request from monday.com carries a short-lived, signed token.
• Authenticity of requests: every request and event from monday.com is verified with its signature (JWT) before it is processed; requests that fail the check are rejected.
• Encryption in transit: all traffic uses HTTPS/TLS; administration uses encrypted SSH connections.
• Hosting: servers and databases in the European Union on DigitalOcean, whose data centres are certified ISO/IEC 27001 and SOC 2 Type II; managed databases are encrypted at rest by the provider.
• Access control: access to production systems and data is limited to the General Caster team, according to the principle of least privilege, with multi-factor authentication on company accounts, personal credentials and logged administrative access. Servers are protected by a firewall and by automatic blocking of repeated failed sign-ins.
• Separation: production, test and development environments are separate; each customer's records are linked to its monday.com account ID and are only shown to that account.
• Availability: scheduled backups of the databases; monitoring of errors and of service availability, with a public status page.
• Retention: automatic deletion of the stored data at the end of the periods in Annex 1.
• Development: code changes are reviewed and tested before release; dependencies are kept up to date; security fixes are applied with priority.
• Organisation: confidentiality obligations for the team; company devices with encrypted storage, managed centrally, with remote wipe; incident and breach procedure as described in Omnidea's Privacy and Security Policy.

Annex 3: Sub-processors

Payments are handled by monday.com (purchases in the monday.com Apps Marketplace) or by Paddle.com Market Limited (purchases from Omnidea) as independent controllers: General Caster never receives card details. Currency exchange rates are obtained from public rate services without sending any personal data.