Languages: English · Čeština · Deutsch · Español · Français · Italiano · Nederlands · Polski · Português · Română
This document exists in ten languages. The English version is the reference one.

cosmetiFULL Data Processing Agreement

Last updated: 3 October 2026

The English version is the reference version and prevails in the event of any discrepancy between the versions, as provided in clause 18.2.

1. Parties, definitions and roles

1.1 The Provider. "Provider" means the company identified in the box below, which operates the cosmetiFULL platform under Article 1 of the cosmetiFULL Terms of Service.

Box 1. Identification of the Provider

Nicodemo & Signa Company Srl, a company incorporated under Romanian law

Registered office: Strada Lucian Blaga nr. 21, ap. 16, 310023 Arad, Romania

Trade Register number: J02/809/2003

Unique registration code / VAT number: RO15617609

Email for any communication relating to this Agreement: info@cosmetifull.com

1.2 The Customer. "Customer" means the business customer (manufacturer, consultant or independent safety assessor) that has concluded with the Provider the contract governed by the cosmetiFULL Terms of Service.

1.3 The Platform. "Platform" means the cosmetiFULL platform described in Article 2 of the Terms of Service: today LabelCheck (review of cosmetic labels against EU rules) and ExpertDesk (professional guidance produced by an artificial intelligence system), and the services that will be made available, including PIFBuilder and FormulaArchive. This Agreement applies to each service of the Platform from the day it becomes available for purchase.

1.4 Roles under the GDPR. For the personal data contained in the materials the Customer uploads to or saves in the Platform, the Customer is the controller and the Provider is the processor, within the meaning of Art. 4(7), Art. 4(8) and Art. 28 of Regulation (EU) 2016/679 ("GDPR"). This Agreement governs that relationship only.

1.5 Processing for which the Provider is an independent controller. The Provider is an independent controller, and this Agreement does not apply, for: account, authentication and access data; prepaid credit, purchase and billing data; technical and security logs; communications with the Customer, including feedback messages and the short excerpt of the analysis a feedback refers to; the content of ExpertDesk conversations, which is governed by that service's own privacy policy. This processing is described in the cosmetiFULL Privacy Policy.

1.6 Definitions. The terms "personal data", "processing", "data subject", "personal data breach" and similar terms have the meaning given to them by the GDPR.

2. Subject matter and acceptance

2.1 Subject matter. This Agreement governs the processing of personal data that the Provider carries out on behalf of the Customer in providing the Platform, in accordance with Art. 28(3) GDPR.

2.2 Acceptance. This Agreement is Annex 2 to the cosmetiFULL Terms of Service and forms part of them for business customers (Article 26). The Customer accepts it together with the Terms of Service when it sends the request for access to the Platform: the request form states that sending it means accepting the Terms of Service. When a new version of this Agreement is published, including this version for a Customer that was already using the services before its publication, the Customer accepts it by continuing to use the services after publication, in accordance with Article 17 of the Terms of Service and with the rights that Article gives it. Conclusion in electronic form is permitted by Art. 28(9) GDPR.

2.3 Precedence. In the event of a conflict between this Agreement and the Terms of Service, this Agreement prevails on matters of data protection.

3. Duration

This Agreement applies for the whole duration of the contractual relationship concerning the Platform and ends when that relationship ends, without prejudice to the obligations which by their nature survive, in particular the deletion or return of data under clause 13, confidentiality and clause 17.

4. Nature and purpose of the processing

4.1 The Provider processes personal data on behalf of the Customer in order to provide the functions of the Platform: storage of the analyses, documents and attachments the Customer saves in its account; artificial intelligence assisted analysis of the uploaded content (the images uploaded for an analysis are processed to produce the result and are not stored); generation of drafts and reports; management of the access of the members of the Customer's organisation according to the roles the Customer assigns; sending of transactional service emails and, within the limits of clause 17, the derived knowledge.

4.2 The detailed description of the processing (subject matter, nature, purpose, categories of data and of data subjects) is set out in Annex A, which forms an integral part of this Agreement.

4.3 The system assists, it does not decide. The services of the Platform are assistance tools. Professional conclusions, in particular the safety assessment of a cosmetic product, remain the competence and responsibility of the Customer's qualified professional, for example the safety assessor. The software is designed not to reach conclusions in place of the assessor.

5. Instructions of the Customer

5.1 The Provider processes personal data only on documented instructions from the Customer (Art. 28(3)(a) GDPR). The following are documented instructions: (a) this Agreement; (b) the Terms of Service; (c) the use of the functions of the Platform by the Customer and its authorised users, for example uploading a document, starting an analysis or inviting a member of its own organisation.

5.2 This also applies to transfers of data to third countries, which take place as described in clause 9 and in Annex C and which the Customer authorises by accepting this Agreement.

5.3 Instructions beyond the standard functions may be agreed in writing, where reasonable and technically feasible; any additional costs are quoted in advance.

5.4 If the Provider considers that an instruction from the Customer infringes the GDPR or other data protection provisions, it immediately informs the Customer, as provided in the second subparagraph of Art. 28(3) GDPR, and may suspend the execution of the instruction until it is clarified.

6. Confidentiality of authorised persons

The Provider ensures that the persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that their access to the data is limited to what is necessary to provide the service (Art. 28(3)(b) GDPR).

7. Security of processing

7.1 The Provider implements the technical and organisational measures described in Annex B (Art. 28(3)(c) and Art. 32 GDPR), taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing and the risks to the rights and freedoms of data subjects.

7.2 The measures in Annex B may evolve over time, provided that the overall level of security is not reduced.

7.3 The Provider takes into account the particular commercial sensitivity of the content processed, such as formulations and product documentation: the measures in Annex B apply to the whole of the content uploaded by the Customer, not only to personal data in the strict sense.

8. Sub processors

8.1 General written authorisation. The Customer gives the Provider a general written authorisation to engage sub processors, under Art. 28(2) GDPR. The list of current sub processors, with their role, country, place of processing and the safeguard applied, is set out in Annex C.

8.2 Notice of changes. The Provider informs the Customer of any intended addition or replacement of a sub processor before the new sub processor starts processing Customer data. The notice is sent by email to the Customer's account email address and to the other addresses the Customer has asked to add by writing to info@cosmetifull.com, and it is accompanied by the publication of the updated version of Annex C. When the change is decided by the Provider, the notice is sent at least 30 days in advance. When the change is decided by a sub processor, the Provider gives notice within 5 working days of being informed, and the Customer receives all the remaining notice period; the notice states how many days that is and why. A shorter notice period is possible only when the replacement is necessary and cannot be postponed for reasons of security or continuity of the service: in that case the notice is sent without undue delay and states the reason.

8.3 Right to object. Within the notice period stated in the notice, the Customer may object by writing to info@cosmetifull.com, on reasonable and documented grounds relating to data protection. The period for objecting runs in any case from the notice. The parties seek a solution in good faith, for example a configuration that avoids the new sub processor. If no practicable solution exists, the Customer may withdraw from the service concerned without penalty, and the Provider refunds the unused prepaid credits in accordance with Article 11.3 of the Terms of Service.

8.4 Obligations passed down. With each sub processor the Provider has in place a data processing agreement imposing data protection obligations consistent with Art. 28(4) GDPR. The Provider remains fully liable to the Customer for the performance of the obligations of its sub processors.

9. Transfers outside the European Economic Area

9.1 Some sub processors process data outside the European Economic Area (EEA) or belong to groups established outside the EEA. Every transfer to a third country takes place on the basis of an adequacy decision of the European Commission (Art. 45 GDPR) or of the Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR), incorporated in the sub processor's data processing agreement, as stated for each sub processor in Annex C, together with the additional safeguards stated there.

9.2 Annex C states, for each sub processor, the service performed, the country of the provider, the place where the data are processed and the safeguard applied, with the same content as Article 16 of the Privacy Policy.

10. Assistance with data subject rights

10.1 Taking into account the nature of the processing, the Provider assists the Customer by appropriate technical and organisational measures in responding to requests from data subjects under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection), as provided in Art. 28(3)(e) GDPR.

10.2 In practice: from its account the Customer views, saves as PDF and deletes its own analyses and declarations; the full export of the data, in a structured, machine readable format, is delivered free of charge on written request to info@cosmetifull.com, as provided in Article 21a.7 of the Terms of Service. For anything the Customer does not carry out itself, the Provider acts on its written request without undue delay.

10.3 If a data subject contacts the Provider directly about processing for which the Customer is the controller, the Provider forwards the request to the Customer without undue delay and does not answer it on the merits, unless instructed by the Customer or required by law.

11. Personal data breaches

11.1 The Provider notifies the Customer of any personal data breach affecting data processed on its behalf without undue delay, and in any case within 24 hours of becoming aware of it, at the Customer's account email address (Art. 28(3)(f) and Art. 33(2) GDPR).

11.2 The notification contains, to the extent the information is available: the nature of the breach, the categories and approximate number of data subjects and of records concerned, the likely consequences, and the measures taken or proposed. The information may be provided in phases.

11.3 The assessment of the obligation to notify the supervisory authority (Art. 33 GDPR) and to communicate the breach to data subjects (Art. 34 GDPR) lies with the Customer as controller; the Provider gives the cooperation reasonably necessary.

12. Assistance with security, impact assessment and prior consultation

Taking into account the nature of processing and the information available to it, the Provider assists the Customer in meeting the obligations under Articles 32 to 36 GDPR (security, notification and communication of breaches, data protection impact assessment, prior consultation), in particular by making available the information in Annex B and Annex C.

13. Deletion or return of data

13.1 When the service ends, at the Customer's choice, the Provider deletes or returns all the personal data processed on its behalf and deletes existing copies, unless Union law or Romanian law requires their storage (Art. 28(3)(g) GDPR).

13.2 From the closure of the account the content remains available for download for 30 days and is then deleted within the following 60 days, or earlier at the Customer's request (Article 21 of the Terms of Service and Article 17 of the Privacy Policy). During that window, and at any earlier time, the Customer may ask for the return of the data in the format described in Article 21a.7 of the Terms of Service. If the Customer asks to switch to another provider or only for erasure, the timetable of Article 21a applies.

13.3 Backup copies that still contain deleted data are overwritten within 30 days of the deletion. At the artificial intelligence provider, the content transmitted and the results are retained for no longer than 30 days from receipt or generation, except for the longer period the provider applies to cases where its usage policy has been breached (Article 8 of the Privacy Policy).

14. Audits and information

14.1 The Provider makes available to the Customer all information necessary to demonstrate compliance with the obligations of Art. 28 GDPR, primarily through this Agreement and its Annexes and by answering reasonable requests for information in writing.

14.2 The Provider allows for and contributes to audits, including inspections, conducted by the Customer or by another auditor mandated by the Customer (Art. 28(3)(h) GDPR), on the following conditions: written notice of at least 30 days, except where a breach is ongoing; no more than once per calendar year, except where required by law or after an established breach; during business hours; a duty of confidentiality on the auditor; no access to data of other customers of the Provider; costs borne by the Customer. For sub processors, audits are as a rule carried out through the documentation and certifications they make available.

14.3 The Provider immediately informs the Customer if, in its opinion, an audit request infringes the GDPR or other applicable provisions.

15. Access by persons outside the Customer's organisation

Today the services of the Platform give access to the Customer's content only to the users of its own organisation. If access for brand owners or for professionals outside the Customer's organisation is introduced, this Agreement will be updated before that access is offered.

16. Liability

The liability of the parties for the processing governed by this Agreement follows Article 24 of the Terms of Service. The liability of each party towards data subjects under Art. 82 GDPR is not affected.

17. Derived knowledge

17.1 The Customer instructs the Provider to derive from the data processed on its behalf aggregated, de-identified information about how the checks perform (the "derived knowledge", described in Article 20 of the Terms of Service and Article 19 of the Privacy Policy) and to keep it in order to improve the services and the Provider's knowledge base, including after this Agreement ends.

17.2 Safeguards: (a) a data point is used only within an aggregate covering at least 20 events from at least 5 different accounts; (b) accounts are counted with one way codes, never by name or email address; (c) for this purpose only metadata of the checks and closed codes are kept, not the text of documents; (d) original documents, formulas, compositions from which a product could be recognised and the names of products, companies and people are left out; (e) the Provider does not attempt to identify the Customer, its products or a person again, and prohibits recipients of aggregates from doing so; (f) aggregates are disclosed to third parties only in a form that identifies neither the Customer, nor its products, nor a person.

17.3 The Customer may revoke this instruction at any time, with effect for the future, by switching off the "Contribute to cosmetiFULL's knowledge" switch in the account preferences or by writing to info@cosmetifull.com. Revocation has no cost and no effect on the service.

17.4 Complete cases. An extract of a product information file enters the Provider's case library only with the express approval, extract by extract, of the safety assessor acting for the Customer, after names, contact details and anything that allows the product to be recognised have been removed, and after review by an independent expert. Each approval is a specific documented instruction.

17.5 This clause applies to data generated from 3 October 2026. Earlier processing to improve the knowledge base rests on the written consents collected during the beta.

18. Final provisions

18.1 Changes. The Provider may update this Agreement to reflect changes in the law or in the service. Material changes are communicated to the Customer on a durable medium with at least 30 days' notice, with the same rights as provided in Article 17 of the Terms of Service. For sub processors, clause 8 applies.

18.2 Languages. This Agreement is published in the same languages as the Terms of Service: Italian, English, Romanian, Polish, Spanish, French, German, Dutch, Portuguese and Czech. The English version is the reference version and prevails in the event of any discrepancy between the versions (Article 30 of the Terms of Service).

18.3 Governing law and courts. This Agreement is governed by Romanian law. The courts of Arad, Romania, have exclusive jurisdiction over any dispute arising from it (Articles 28 and 29 of the Terms of Service).

18.4 Severability. If a clause is invalid, the remaining clauses are not affected; the invalid clause is replaced by a valid one whose effect is as close as possible to it.

Annex A. Description of the processing

A.1 Subject matter of the processing. Provision of the services of the Platform on behalf of the Customer: storage, organisation and artificial intelligence assisted analysis of the content relating to cosmetic products that the Customer uploads or saves.

A.2 Duration. For the whole duration of the contractual relationship, plus the deletion or return period under clause 13.

A.3 Nature and purpose. Storage of the analyses, documents and attachments saved in the account; processing of content through artificial intelligence models to produce analyses, findings and drafts (the images uploaded for an analysis are not stored); management of the access of members according to the roles assigned by the Customer; sending of transactional emails; logging of activity for security purposes. The system assists the professional and does not take decisions in their place (clause 4.3).

A.4 Types of personal data.

• Identification and professional contact data of natural persons: names, business email addresses, roles or functions.
• Personal data that may be contained in the materials uploaded by the Customer, for example the Responsible Person stated on a label, a technical contact, or names and signatures in attached documents.
• Special categories of data (Art. 9 GDPR) are neither requested by nor intended for the Platform; the Customer undertakes not to upload them.

A.5 Content processed. Label artwork, texts, formulations and product documentation, the analyses and documents saved in the account, and the messages in the clarification chat. This is mainly confidential business information of the Customer rather than personal data; it is in any case protected by the same measures as in Annex B.

A.6 Categories of data subjects.

• Staff and collaborators of the Customer who use the Platform.
• Named contacts of the Customer's own clients (brand owners) whom the Customer records or who appear in documents.
• Safety assessors, internal to the Customer or named in the uploaded documents.
• Natural persons mentioned in the uploaded documents, for example the signatories of test reports.

A.7 Organisation of the data. Each item of content is linked to the account and to the organisation of the Customer that created it, and among the users of the Platform only the members of that organisation can access it, according to the role assigned by the Customer.

Annex B. Technical and organisational measures

The measures listed describe the Platform as it works today. They may evolve without any reduction in the level of protection (clause 7.2).

B.1 Separation between customers. Every read and write of content is filtered on the account and on the organisation it belongs to, and one customer cannot reach the content of another. The separation is verified by automated tests.

B.2 Minimal storage. The images uploaded for an analysis are processed to produce the result and are not stored. The attachments to a declaration are also processed to produce the result and are not stored today: they will be kept only from the moment the attachment function is active in the service. The files the Customer attaches and keeps are stored in a file store separate from the database, which holds only their reference and metadata.

B.3 Administrative access. Access to the Provider's administration console requires, in addition to the credentials, a second factor (a time based code), whose secret is stored encrypted. Administrative access is restricted to the persons who need it.

B.4 User authentication. Users sign in with an email address and a password. Passwords are never stored in clear: they are stored as a PBKDF2-SHA256 derivation with a per user salt and 100.000 iterations.

B.5 Revocation of access. Blocking a person and changing that person's password invalidate the sessions already issued, including in the services of the Platform, without waiting for them to expire naturally.

B.6 Log of actions. The actions taken by the Provider's administrators on accounts, organisations, credits and access are recorded with the author, the date, the previous value and the new value, in a log that the database allows only to grow, never to be modified or deleted. Security logs are kept for 12 months.

B.7 Encryption. Communications between the user and the Platform run over HTTPS (TLS). The databases and the file store are encrypted at rest with AES-256 by the infrastructure provider, automatically.

B.8 Organisational measures. Staff access to data is limited to what is necessary and subject to confidentiality obligations (clause 6). Technical secrets, such as keys and service credentials, are managed outside the source code, through the encrypted tools of the hosting platform.

Annex C. Authorised sub processors

List updated on 3 October 2026. Changes follow clause 8.

All accounts with the sub processors are held in the name of the Provider. The Customer may ask for a copy of the safeguards by writing to info@cosmetifull.com.

Other processors of the Provider. Article 11.1 of the Privacy Policy also lists Proton AG (company email), SmartBill of Intelligent IT SRL (issuing invoices) and Airtable (internal customer relationship records). They process data for which the Provider is the controller (clause 1.5) and do not receive the content the Customer uploads to the Platform, so they are not sub processors under this Agreement. The safeguards applied to their transfers are stated in Article 16 of the Privacy Policy.

Independent controllers. Stripe, which has a mixed role, and the recipients that act as independent controllers do not receive the Customer's content and are not sub processors (Articles 11.3 and 12 of the Privacy Policy).

Internal alerts. The internal alert channel on Telegram, since 16 September 2026, receives only fixed texts without personal data or Customer content, and for this reason it is not a sub processor (Article 11.2 of the Privacy Policy).

End of the published text.

Privacy policy

Terms of service