Processing data on behalf of customers

DITAP SpA · RUT 78.532.132-4 · Esmeralda 671, Puerto Natales, Chile · hola@ditap.io · +39 345 243 5103

When DITAP processes personal data on a customer’s behalf, DITAP is the processor and the customer is the controller. This page explains the framework; it does not certify a signed DPA or replace a service-specific annex. Before processing starts, both parties must document and accept the applicable instructions and obligations.

The annex must identify product, purposes, operations, duration, data subjects and categories, instructions, contacts and responsibilities. Health, employment, children’s and biometric data require prior assessment of lawful bases, access and additional measures. Commercial enquiry forms are not channels for those records. Current law applies: Chilean Law 19.628 and, from 1 December 2026, the amendments under Law 21.719; GDPR where applicable.

Processing must remain within lawful documented instructions and the contracted service. Access must be restricted to authorised personnel bound by confidentiality. The annex must describe implemented measures, access and incident management, backups, recovery and agreed testing; certifications, recovery deadlines and universal availability are not presumed. Unlawful instructions must be brought to the customer’s attention.

Before contracting, identify the providers that will actually process data, their roles, regions and transfer mechanisms. The annex must govern subprocessor authorisation, changes, objections and equivalent protection duties. A general ecosystem tool list neither establishes that every tool processes product data nor independently proves transfer safeguards.

Agree on assistance with rights requests, risk assessments and incident notification without undue delay and within statutory deadlines. The controller retains decisions on purposes and legally required communications. At termination, define return or deletion, export format, timing, backup copies and lawful retention exceptions. Compliance information and verification must also be addressed. Customers and affected individuals do not waive their statutory rights.

Email hola@ditap.io with the product, contracting entity and intended data categories. The DPA scope must be finalised with the product contract before personal data is uploaded.