Data Processing Agreement
Between ImprimeBay and registered print shops
Last updated: September 2026
1. Subject and parties
This agreement governs the processing of end customers' personal data in connection with orders placed through the ImprimeBay platform, operated by Factory of Code - FCO SRL (ImprimeBay), and the registered print shop (the Print Shop). It applies from the moment the Print Shop registers on the platform.
2. Data transmitted
For each order, ImprimeBay transmits to the Print Shop the data required to fulfil it: the customer's name or company name, email address, delivery and billing address, phone number where provided, VAT or tax identification number where provided, order details and print files uploaded by the customer.
3. Role of the parties
ImprimeBay and the Print Shop act as separate and independent controllers within the meaning of Article 4 of Regulation (EU) 2016/679. Each party independently determines the purposes and means of processing the data in its possession and is accountable for its own conduct. This agreement does not establish joint controllership or a processor relationship.
4. Permitted purposes
The Print Shop processes the data received solely to fulfil the order, produce and deliver the goods, provide customer support and comply with tax and accounting obligations. Any use for direct marketing, profiling or disclosure to third parties is prohibited in the absence of an independent legal basis and appropriate privacy notice provided to the customer by the Print Shop itself.
5. Retention and erasure
Each party retains the data for as long as necessary for its own purposes and in compliance with legal obligations, including the ten-year retention of tax records. Print files are retained by ImprimeBay for the period necessary to manage the order and any disputes; the Print Shop shall erase the files from its systems once the production and support purposes have been fulfilled.
6. Data subject requests
Each party independently handles requests to exercise rights received directly from data subjects. Where a request concerns data held by the other party, that party shall provide the necessary cooperation without undue delay, and in any event within a timeframe allowing statutory deadlines to be met.
7. Personal data breaches
Each party shall notify the other, without undue delay and in any event within forty-eight hours of becoming aware, of any personal data breach involving data covered by this agreement, providing the information needed for each party to carry out its own assessments and obligations.
8. Security
Each party implements appropriate technical and organisational measures pursuant to Article 32 of the Regulation. The Print Shop shall in particular safeguard the print files received with measures suitable to prevent unauthorised access, disclosure and use for purposes other than performing the order.
9. Duration
This agreement remains in effect for the entire duration of the Print Shop's registration on the platform. Obligations of confidentiality, security and retention survive termination for as long as the data remains in the parties' possession.