General terms of the WordPress malware removal service

This English version is a courtesy translation. In case of any discrepancy, the Italian version prevails. This page can be reached from the “Terms” link in the order form and from the footer of the Site. The Terms, with Annex A, are accepted in the order form and sent to the Customer with the order confirmation email, in the version accepted. Each version shows its number and effective date.

1. Provider, contact details and scope of application

1.1. These general terms (“Terms”) govern the purchase of the WordPress malware removal service offered through the websites rimozionemalware.com and malwarecleanup.com, its English-language version (each a “Site”), by:

Item	Details
Company name	Managed Server S.r.l. (“Managed Server” or “Provider”)
VAT number	IT02085220438
Tax code	02085220438
Registered office	Via Flavio Gioia, 6 — 62012 Civitanova Marche (MC), Italy
Operating office	Via Enzo Ferrari, 9 — 62012 Civitanova Marche (MC), Italy
Business register	Register of Companies of Macerata, registration number 02085220438
REA number	MC – 282554
Share capital	€ 10.000,00
SDI recipient code	M5UXCR1
Telephone	02 56.56.9681
Email for orders, support, complaints and withdrawal	info@rimozionemalware.com; for orders placed on malwarecleanup.com also info@malwarecleanup.com
PEC (certified email)	managedserversrl@pec.it

1.2. The Terms apply both to the Consumer, an individual who purchases for purposes outside any entrepreneurial, commercial, craft or professional activity of his or hers, and to the business Customer, who purchases in the course of such an activity. Both are referred to as “Customer”.

1.3. Consumer status depends on the actual purpose of the purchase. Selecting a category in the order form, the name on the invoice or holding a VAT number do not entail a waiver of any mandatory protections that may be due.

1.4. The contract consists of the order, these Terms and Annex A. Individual terms prevail only if expressly agreed, without prejudice to mandatory rules. Advertising statements and pre-contractual information that form part of the contract are not eliminated by a generic reference to the Terms.

2. Nature of the service and installation concerned

2.1. The service (“Service”) consists of a technical intervention, carried out mainly through professional human activity, of analysis, cleanup and securing of a single WordPress installation, identified in the order by its URL and, where necessary, the file path and database.

2.2. Aliases and domains pointing to the same installation do not constitute additional installations. Independent copies, separate staging sites, other installations present in the same account and WordPress multisite networks require a specific agreement, unless expressly included in the order.

2.3. The Service is a one-off performance. It does not include a subscription, automatic renewal, ongoing hosting management or permanent monitoring. The obligations that follow the cleanup, the commercial guarantee and the responsibilities provided for by the contract and by law remain in force.

3. Included activities and outcome of the intervention

3.1. The price includes, for the installation covered by the order:

• technical analysis of the infection and of the available elements, including relevant files, database, users, configurations and logs;
• removal or neutralization of malicious code, backdoors, unauthorized users and alterations attributable to the infection;
• checking and cleanup of cron jobs, processes and system configurations directly connected to the installation, within the limits of the available permissions and the agreed perimeter;
• search for the attack vector or vectors, correction of the vulnerabilities identified and correctable within the perimeter of the Service, or application of technically adequate mitigation measures;
• updates and hardening interventions necessary for the cleanup, within the limits of the compatibility and authorizations governed by art. 9;
• reasonable and documentable final checks on the effectiveness of the cleanup and on the main accessible functionalities;
• final technical report, with the information indicated in art. 10.5.

3.2. Managed Server performs the Service with the professional diligence required by the nature of the activity. The search for the cause of the infection may be limited by missing, overwritten or altered logs and by other gaps in the evidence. In these cases the report distinguishes established facts from hypotheses and describes the measures taken; a cause that has not been demonstrated is not certified as certain.

3.3. The impossibility of historically identifying the vector does not in itself preclude an effective cleanup. However, it is not sufficient to declare the intervention complete if a known infection remains or an identified route of reinfection remains that needs to be fixed and has not been adequately neutralized within the perimeter of the Service. In that situation art. 12 applies.

3.4. The cleanup does not constitute a certification of invulnerability, a full security audit, an attestation of regulatory compliance or a guarantee against any future attack. This clarification does not reduce the obligations to perform the promised activities correctly, to meet the guaranteed times and to remedy breaches attributable to the Provider.

4. Excluded activities and changes to the perimeter

4.1. Unless expressly included in the order, the following are excluded:

• the cleanup of additional installations, multisite networks or other sites present in the account;
• the complete rebuilding of servers or operating systems, the cleanup of compromises of the hypervisor or of infrastructure unrelated to the installation, migrations and reinstallations of the operating system;
• the development of new features, the redesign of the site and the substantial rewriting of obsolete or custom components;
• the purchase or renewal of licenses, services and components of third parties;
• the recovery of data that has been permanently deleted, encrypted or corrupted when no usable copies exist;
• expert reports, forensic acquisitions with chain of custody, investigation or legal advisory activities and the handling of notifications to the authorities;
• SEO activities, rebuilding of search rankings, compensation for commercial losses and management of advertising campaigns;
• submission of review requests to Google, security vendors or blacklists, unless expressly included. The timing and decisions of those parties remain in any case outside Managed Server’s control.

4.2. Ordinary difficulties of the cleanup included in the order do not entail price increases. No surcharge may be imposed once the intervention has started for activities already included.

4.3. If the need for further activities emerges, Managed Server explains the reasons, the cost and the consequences on timing and outcome, asking for an express agreement on a durable medium before performing them. The Customer’s silence does not amount to acceptance.

4.4. If the Customer does not purchase the additional activities, the Provider performs those originally agreed when technically possible and useful; otherwise art. 12 applies. The mere issuing of an additional quote does not automatically suspend the entire guaranteed time limit.

5. Plans, prices and absence of renewals

5.1. The prices per single installation are:

Plan	Price excl. VAT	Total with Italian VAT at 22%	Counting of the time limit
Within 24 hours	€ 199,00	€ 242,78	24 service hours: Monday to Friday, 09:00 to 19:00, excluding public holidays
Within 12 hours	€ 299,00	€ 364,78	Consecutive hours, 24 hours a day, 7 days a week, public holidays included
Within 6 hours	€ 399,00	€ 486,78	Consecutive hours, 24 hours a day, 7 days a week, public holidays included

5.2. The actual total, determined according to art. 7, is shown before the order is submitted. In offers addressed to Consumers the price inclusive of applicable taxes is clearly indicated. There are no delivery costs or periodic fees for the Service.

5.3. The price includes all the included activities and any intervention covered by the guarantee referred to in art. 13. Additional costs require prior express acceptance.

5.4. Each plan has a maximum time limit for completing the initial intervention, calculated from the start provided for in art. 10 (“maximum time limit”): 24 consecutive hours for the “Within 6 hours” and “Within 12 hours” plans; 24 service hours, as defined in art. 10.3, for the “Within 24 hours” plan. If the Service is not completed within the maximum time limit, the automatic termination and the refund of art. 11 apply. The 24-working-hour period provided for ordering the refund (art. 11.8) is distinct from the cleanup time limit.

5.5. The Provider may, at its discretion, apply prices lower than those of art. 5.1. Each reduction is indicated before the order is submitted together with the previous price, determined according to art. 17-bis of the Italian Consumer Code (Legislative Decree 206/2005). The price agreed for the order is the one shown before submission and stated in the confirmation: for an order at a reduced price it is the reduced price in force at the time of purchase. The full refunds provided for by these Terms, including those of arts. 11, 12 and 15, and the reference consideration of art. 14.3 are calculated on that agreed price, that is, on the amount actually paid, and not on the full price, the struck-through price or the price applied before or after the purchase. The fixed-amount partial refunds of art. 11.1 remain unchanged. In no case do the sums returned for the same order exceed the amount actually paid.

5.6. On malwarecleanup.com the plans are also offered in US dollars (USD), at the Customer’s choice in the order form, at the following prices per single installation, excluding any VAT: Within 24 hours USD 249.00; Within 12 hours USD 349.00; Within 6 hours USD 449.00. Dollar prices are prices in their own right, are not derived from converting the euro prices and apply to orders paid in dollars. For such orders, the fixed amounts stated in euros in these Terms, including the partial refunds of art. 11.1, are understood as the same numerical value in dollars (USD 100.00 and USD 200.00, plus the VAT actually applied).

6. Order, conclusion of the contract and payment

6.1. The Customer selects the plan, identifies the installation, enters the required data, reviews the contractual documents through the “Terms” link in the order form, which refers to this page, and may correct errors before submission. The language of the contract is Italian. On malwarecleanup.com a courtesy translation of the Terms into English is available; in case of any discrepancy, the Italian text prevails.

6.2. Acceptance of the Terms and of Annex A takes place by selecting, in the order form, the box “I accept the terms”, which is not pre-selected. The final button bears the wording “Order with obligation to pay” or an equivalent unambiguous expression. The Terms can be consulted on this page before the order is submitted; each version shows its number and effective date.

6.3. The contract is concluded when the Customer receives the order confirmation and acceptance email and the related payment is credited. Any message of mere technical receipt or the payment service provider’s receipt, if distinct from the contractual confirmation, clearly indicates that difference. Before conclusion the Provider may request necessary clarifications on the perimeter or on the entitlement to authorize the intervention; any sums collected for an order that is not accepted are returned without delay and in any case within 14 days.

6.4. The confirmation contains the identifier, date and time, plan, installation, price, the Provider’s details, information on withdrawal and the declarations made in the order form, each with the date and time of the selection. The text of the Terms and of Annex A in the version accepted is included in the confirmation or attached to it. The confirmation is sent by email, before the start of performance. The Customer may request a copy through the contact details in art. 1, without the need for an account.

6.5. Payment is made in advance and may be made by:

• payment card via Stripe: Managed Server does not store the full card number or the security code; the data necessary for managing the transaction and invoicing may be processed;
• ordinary or instant bank transfer, for orders in euros only, to the following details, also shown on the payment page and in the order confirmation email; orders in dollars are paid by card through Stripe:

Item	Details
Bank	Intesa Sanpaolo S.p.A.
Beneficiary	MANAGED SERVER S.R.L.
IBAN	IT25E0306913408100000010481
BIC	BCITITMMXXX
Currency	EUR
Payment reference	Order reference

Managed Server communicates any changes to the bank details only through this page and the official addresses of art. 1; the Customer checks that the IBAN matches before making the payment.

6.6. For bank transfers, the actual crediting counts, not merely the transfer receipt. Banking times preceding the crediting are not part of the cleanup time limit. For cards, the payment service provider’s positive confirmation of payment counts.

6.7. No prohibited fees for the use of the payment instrument are charged to the Consumer. Bank dispute procedures do not preclude the parties’ rights, nor do they authorize the automatic charging of penalties or costs that are not due.

7. VAT and invoicing

7.1. The tax treatment is determined on the basis of the actual nature of the Service, the place of establishment and the capacity in which the customer acts, applying the legislation in force at the time of the transaction.

7.2. For the Service described in art. 2, characterized by substantial human intervention and not by an essentially automated performance:

• to Customers established in Italy and to Consumers resident in other EU States, Italian VAT, currently at 22%, applies as a general rule, subject to specific applicable provisions;
• for customers who are taxable persons established in another EU State, who purchase in the course of their business and meet the relevant conditions, the B2B place-of-supply rules and the reverse charge in the customer’s country apply, without Italian VAT;
• for customers established outside the European Union the transaction is not subject to VAT in Italy: for taxable persons under art. 7-ter and for Consumers under art. 7-septies of Italian Presidential Decree (DPR) 633/1972, unless specific provisions apply; the regime and the total to be paid are shown in the order form before submission.

7.3. The Customer provides truthful tax data and any EU VAT number. Managed Server verifies the status through VIES and, when necessary, further documentation. A negative result or unavailability of the system requires a check: in no case does it constitute definitive proof that the customer is a Consumer or that Italian VAT must apply.

7.4. The Provider issues an invoice and fulfills the electronic invoicing and SDI transmission obligations in the cases provided for by law, sending a copy to the Customer. Any refunds are accompanied by the required tax documents. Errors in the data are rectified according to the procedures provided by law, without excluding the Provider’s own responsibilities.

8. Entitlement, access and cooperation of the Customer

8.1. The Customer declares to be the owner or lawful manager of the installation, or to have the necessary authorization of the person entitled. If purchasing on behalf of a third party, the Customer identifies the person represented and ensures that he or she has the relevant powers, including for the processing of data.

8.2. The Customer authorizes only the access and operations necessary for the Service, on the environments identified in the order. The availability of credentials with broader privileges does not extend the engagement to other sites, accounts or data.

8.3. Before the intervention the Customer provides:

• working and sufficient access to files, database and WordPress administration, via SSH/SFTP, hosting panel or other agreed tools;
• any authorizations from the provider, temporary codes, firewall enablements and cooperation with MFA;
• information on known anomalies, previous interventions, custom components, critical data, available backups and technical limitations;
• a reachable contact person for the necessary decisions and a contact for reports concerning personal data.

8.4. Credentials are transmitted through the protected channel indicated by the Provider. Where possible, named temporary accounts with limited privileges are used. The Customer avoids unsolicited sending of complete databases, plaintext passwords or irrelevant data.

8.5. The Customer coordinates other technicians and avoids simultaneous changes that interfere with the cleanup. The Provider may not impose a general ban on turning to other professionals; it must indicate the specific interferences to be avoided.

8.6. Upon completion of the intervention the Customer revokes temporary access and replaces the credentials reported as compromised. Managed Server removes the temporary accounts or tools created for its intervention, unless otherwise instructed in a documented manner for warranty needs.

9. Backups, technical changes and business continuity

9.1. Before the intervention starts, the Customer declares that it has a complete and up-to-date backup copy of the files, database and configurations necessary to restore its installation, stored separately from the environment concerned and whose readability and usability it has reasonably verified, to protect its own data and, for the business Customer, the continuity of its business. The Customer maintains that copy during the intervention and adopts business continuity measures proportionate to its business. It communicates the date of the backup, any limitations and subsequent data not covered. If this declaration is not true, the Customer must report it before the intervention, without making an inaccurate declaration: the parties assess and document the safeguards that can concretely be put in place. The mere acceptance of the Terms does not turn a missing backup into an existing one. A backup of an environment that is already compromised may contain malware and is not equivalent to an intact copy predating the attack.

9.2. Preparing, keeping and periodically verifying the business backup is the Customer’s responsibility. The Service does not include a managed backup system, disaster recovery or a guarantee of business continuity. Before destructive or hard-to-reverse operations, Managed Server obtains the necessary information on the available safeguards and takes the precautions that can be expected of a professional operator. Any precautionary technical copies made during the cleanup do not replace the Customer’s backup and do not constitute an attestation of the integrity of the pre-existing data. The precautions provided for in the following paragraphs and in Annex A remain applicable.

9.3. If no adequate safeguard is available, the Provider informs the Customer of the specific risk and agrees the subsequent operations before making destructive changes. The authorization to proceed concerns only the technical risks specifically explained. Liability remains governed by art. 14: the authorization does not cure willful misconduct, gross negligence, breaches of mandatory obligations or unfair terms with respect to the Consumer.

9.4. Changes that are necessary and proportionate to the cleanup are authorized, including removal of malicious files, disabling of unauthorized users, correction of permissions, rotation of compromised keys and quarantine of infected components. Reversible methods compatible with security are preferred.

9.5. Major updates with a significant risk of incompatibility, deletions of legitimate content, restorations that would eliminate orders or data subsequent to the backup, lasting deactivation of essential functionalities and infrastructure changes require prior specific authorization, with an explanation of the reasonable alternatives.

9.6. In the presence of an active attack requiring immediate containment, Managed Server may take the strictly necessary temporary measures within the authorized perimeter, including by restricting access to compromised components. It informs the Customer without delay, describing the reasons, the impacts and the expected restoration. This power does not justify changes unrelated to the engagement.

9.7. The Service may require short maintenance periods, temporary limitations of functionality or restarts. The Provider reduces them to what is necessary and communicates them in advance when possible. No absence of downtime is promised, nor the preservation of data already destroyed before the intervention.

9.8. On sites with transactions, the parties agree when necessary on a temporary write freeze or another measure to avoid loss or duplication of orders. The Provider does not carry out a full restoration of the production database ignoring the transactions that occurred in the meantime.

9.9. If the Customer requests the preservation of evidence for judicial purposes, it must report this before the changes are made. Managed Server preserves the relevant available evidence in accordance with the lawful instructions received and flags any need for a separate forensic engagement. Legal obligations remain unaffected.

10. Start, counting and completion of the guaranteed times

10.1. The time limit starts from the moment the following objective conditions are all met at the same time:

• the contract is concluded and payment is received;
• the actually working and necessary access and the relevant authorizations already clearly requested have been received through the channel indicated by the Provider;
• the environment is technically accessible for the intervention;
• for the Consumer, the request for immediate performance and the acknowledgment provided for in art. 15.2 have been given.

10.2. Managed Server promptly communicates the start time and the expected deadline. The communication is declaratory in nature: an internal delay in taking charge or in sending the email does not move a start that has already occurred. Further access that is not really necessary may not be requested in order to defer the time limit.

10.3. Time is measured in hours actually elapsed; communications show the date, time and the Europe/Rome time zone. The counting depends on the plan purchased:

• “Within 6 hours” and “Within 12 hours” plans: given the urgent nature, work is carried out 24 hours a day and time is counted in consecutive hours, including nights, Saturdays, Sundays and public holidays. The maximum time limit is 24 consecutive hours: for a start on Friday at 18:00 the maximum deadline is Saturday at 18:00, subject to the different civil time resulting from any change of the clock, it being understood that the effective time remains 24 hours;
• “Within 24 hours” plan: time is counted only in service hours, that is, the hours between 09:00 and 19:00 on Monday to Friday, excluding Italian national public holidays. The guaranteed time and the maximum time limit coincide at 24 service hours: for a start on Friday at 18:00 the deadline is Wednesday at 12:00 (one hour on Friday, ten on Monday, ten on Tuesday and three on Wednesday), provided that none of those days is a public holiday. If the start falls outside those time slots, the counting begins with the first following service hour.

The suspensions of art. 12 may affect the intermediate thresholds of the 6-hour and 12-hour plans, but do not extend the maximum time limit.

10.4. Completion requires the actual performance of the included activities, the final check and the sending to the Customer of the concluding communication with the report. An email sent when the due activities are not finished does not determine completion. Any impediment to delivery attributable to the recipient’s system is documented and the communication is made available by a reasonable alternative means.

10.5. The report indicates at least: the environment examined, the activities carried out, the results of the checks, the causes established or hypothesized, the components removed or disabled, the relevant changes, the limits of the checks, residual risks and actions required of the Customer with the related urgency. It does not include passwords or unnecessary personal data.

10.6. The removal of warnings or blacklistings by third parties or the recovery of traffic and rankings are not conditions of completion, if the agreed cleanup was correctly performed. The Customer’s silence after the report does not constitute a waiver of remedies for defects or breaches.

11. Guaranteed times, automatic termination at the maximum limit and refunds

11.1. The consequences of exceeding the time limits are as follows; the intermediate thresholds are calculated according to arts. 10 and 12, while the maximum time limit remains that of art. 5.4, calculated from the initial start:

Plan purchased	Relevant completion time	Refund
Within 24 hours	Failure to complete within the maximum time limit of 24 service hours	Automatic termination and refund of the entire price paid
Within 12 hours	Over 12 and up to 24 consecutive hours	€ 100,00, plus the VAT actually applied on that amount
Within 12 hours	Failure to complete within the maximum time limit of 24 consecutive hours	Automatic termination and refund of the entire price paid
Within 6 hours	Over 6 and up to 12 consecutive hours	€ 100,00, plus the VAT actually applied on that amount
Within 6 hours	Over 12 and up to 24 consecutive hours	€ 200,00, plus the VAT actually applied on that amount
Within 6 hours	Failure to complete within the maximum time limit of 24 consecutive hours	Automatic termination and refund of the entire price paid

11.2. The thresholds of the 6-hour and 12-hour plans are also counted on weekends, subject only to the documented suspensions allowed by art. 12. Partial refunds are not cumulative beyond the total amount due for the threshold reached. In case of termination, the sums already returned are deducted from the remaining full refund; no part of the price may be withheld for diagnosis, attempts or partial work on the terminated order.

11.3. The partial refund accrues when the relevant threshold is exceeded, even if the cleanup is not yet finished. Managed Server orders it automatically, without requiring a request within forfeiture deadlines, within 14 days of accrual. If termination occurs for failure to complete within the maximum time limit, the shorter period of the following 24 working hours applies for ordering the return of the entire amount still due, in accordance with paragraphs 11.7 and 11.8.

11.4. The return is made by chargeback reversal, when technically possible, or by refund using the same payment method used for the order, without fees charged to the Customer and without conversion into vouchers or commercial credits. The return is made in the same currency as the payment and for the same nominal amount, without currency conversion by the Provider. Only if the original means is no longer usable does the Provider promptly inform the Customer and expressly agree an alternative means, at no cost; it may not substitute it unilaterally.

11.5. The maximum time limit of art. 5.4 is agreed as essential pursuant to art. 1457 of the Italian Civil Code, by reason of the urgent nature of the Service. If Managed Server has not completed the cleanup in accordance with art. 10 within that time limit, the contract is deemed automatically terminated for non-performance of the Service by the Provider within the agreed maximum time limit, without need for a formal notice, a request from the Customer or further acceptance. The parties expressly agree, within the limits permitted by law, that the termination takes effect immediately upon expiry and that the further three-day period for requesting late performance provided for by art. 1457, first paragraph, of the Italian Civil Code does not apply. The mandatory rights of the Consumer remain unaffected. Any subsequent continuation requires a new express agreement and does not cancel the right to the refund that has accrued.

11.6. Termination and refund do not in themselves entail an acknowledgment of willful misconduct, gross negligence or of a specific compensable damage. Nor do they constitute a waiver by the Customer of mandatory rights. For claims for damages art. 14 applies, with the exclusions and limitations permitted only in B2B relationships and the related exceptions. The refund of the same price is not due twice.

11.7. Managed Server orders the chargeback reversal or full refund within the 24 working hours following the moment of termination, without waiting for a request from the Customer. The time limit concerns the actual submission of the operation, correctly funded and accepted by the payment service provider, not the mere internal recording of the request or the issuing of the credit note. The Provider sends the Customer the confirmation of the operation and the related evidence or identifier. Further times for posting and availability on the account or card depend on the payment service provider; the Provider follows up any error outcomes and takes without delay the measures necessary to complete the return.

11.8. “24 working hours” means 24 actual hours counted on Monday to Friday, over the entire 00:00–24:00 time slot, excluding Saturdays, Sundays and Italian national public holidays, according to the Europe/Rome time zone. It does not mean three working days of eight hours. For example, if termination occurs on Friday at 18:00, the refund must be ordered by Monday at 18:00, provided that Monday is not a public holiday. The dies a quo is the termination, even if the confirmation email is sent later.

11.9. The termination notice is declaratory in nature and describes the activities carried out, the state of the installation, residual risks and the return due. From expiry the obligation to continue the original cleanup ceases; the obligations of safe closure, accounting, confidentiality, data protection and returns remain. Useful changes are not undone, nor is malware reintroduced in order to artificially restore the initial state. Operations strictly necessary to safely interrupt work already in progress do not constitute an extension of the cleanup and entail no additional costs.

11.10. The closure and return mechanism also operates if, after the start, technical impediments or impediments dependent on third parties or on the Customer arise: the Provider contractually assumes the economic risk of not retaining the price beyond the deadline without completion. This assumption is not equivalent to attributing to it the material cause of every impediment. Good faith and the remedies provided by law against fraudulent conduct remain, without the power to unilaterally withhold the refund in the face of disputed claims. The maximum time limit concerns the initial intervention; subsequent interventions under the guarantee follow art. 13.

12. Impediments, suspensions, impossibility and early termination

12.1. Only concrete obstacles that prevent the necessary activities may justify a suspension, such as revocation of access, failure of essential cooperation, unavailability of the external environment not attributable to the Provider, waiting for indispensable specific authorizations or a legal prohibition.

12.2. The Provider communicates without delay the impediment, the available evidence, the activities affected and what is needed to overcome it. Only the counting of the intermediate thresholds of the 6-hour and 12-hour plans may be suspended, for the duration and to the extent of the actual impediment; the counting continues if activities useful for completion remain feasible. Upon resumption the time already elapsed is preserved. Any delays in communication attributable to the Provider do not allow retroactive recovery of time. The maximum time limit is not suspended, is not reset and is not extended, and upon its expiry art. 11 applies.

12.3. Workload, staff shortages, internal organization, failures avoidable with adequate diligence and the normal complexity of the infections included in the engagement are not grounds for suspension. A cyber event is not automatically force majeure; what matters is its actual unavoidability, its impact on performance and the reasonable measures taken to prevent and contain it.

12.4. If the originally promised result cannot be achieved without excluded activities, the Provider documents this and proposes the available options. In the absence of a new agreement, if the original cleanup cannot be completed and the partial performance has no autonomous utility accepted by the Customer, the price of the Service is refunded in full. An initial diagnosis never purchased separately is not charged retroactively.

12.5. A limited solution, such as keeping the site running with an essential functionality disabled, may replace the original result only with an express agreement describing its limits, risks, price and timing. Without such an agreement it does not amount to completion of the original cleanup. The Provider may not unilaterally extend the maximum limit of the order; activities to be performed beyond that limit require a separate agreement, with closure and returns of the original order. Refunds already accrued and mandatory rights are not cancelled.

12.6. If the impossibility of completing the cleanup within the maximum time limit emerges before expiry, Managed Server communicates this without delay. The Customer may request early closure with a full refund; failing that, the remedies already exercisable by law and the termination at the maximum deadline remain. The impossibility of completion does not authorize withholding the price as compensation for the attempts made.

12.7. In case of serious breach by the Customer, Managed Server may avail itself of the remedies provided by law, including, when the conditions are met, a formal notice to perform with a time limit compliant with art. 1454 of the Italian Civil Code. There is no general power to arbitrarily interrupt an order already accepted or to automatically retain the entire consideration.

12.8. Termination of the contract entails an accounting of the activities, the returns due and secure management of access and data. For closure due to failure to complete, including early closure under paragraph 12.6, the full refund is ordered within the following 24 working hours in the manner provided by art. 11. For other cases of termination, the specific time limits provided by the contract and by law remain, without delays in returning undisputed sums.

12.9. The Service is a tailor-made performance, customized to the Customer’s installation and carried out immediately after the conclusion of the contract. For this reason the business Customer may not withdraw from the contract once concluded with the related payment pursuant to art. 6.3: the parties expressly exclude the customer’s right of withdrawal provided for by arts. 1671 and 2227 of the Italian Civil Code. The automatic termination and the refunds of art. 11, the other remedies for the Provider’s breach and the rights that cannot validly be excluded remain unaffected.

13. Commercial guarantee of renewed cleanup for 30 days

13.1. Managed Server, as guarantor, offers a free commercial guarantee on the same installation for 30 calendar days from completion: if the malware reappears within the perimeter of the intervention, it performs the new cleanup at no cost.

13.2. The report may be sent to the contact details in art. 1, indicating the order, URL and symptoms, with no obligation to use any particular wording. The reappearance must occur during the covered period; the Customer is invited to report it promptly and to preserve the available evidence. This recommendation does not introduce a forfeiture deadline for statutory rights.

13.3. The guarantee does not cover a new, independent intrusion causally attributable, for example, to:

• subsequent installation of malicious, altered or unreliably sourced components;
• subsequent restoration of an already infected copy, contrary to the warnings communicated;
• credentials stolen again through devices or systems outside the cleaned perimeter;
• failure to implement a necessary measure, clearly indicated in the report with a reasonable deadline, when that omission caused the new intrusion;
• a new attack on infrastructure unrelated to the engagement or a supervening vulnerability not covered by obligations already assumed by the Provider.

13.4. The exclusion must be justified by the Provider with technical evidence and a plausible, documented causal link. The mere existence of an outdated plugin, of external hosting or of subsequent changes is not enough if it is unrelated to the reinfection. Reappearances due to incomplete cleanup or to errors of the Provider are not excluded.

13.5. The check needed to establish whether the guarantee applies does not entail automatic charges. An intervention not covered requires a quote and express acceptance. If covered, the Provider promptly communicates the intervention plan and proceeds without unjustified delay; the commercial time limits of the initial plan are not automatically renewed, unless otherwise agreed and without prejudice to remedies for inexact performance.

13.6. The guarantee can be used remotely for accepted orders. Its expiry does not extinguish rights for defects, inexact performance, damages or lack of conformity that may be due under the applicable rules. For Consumers, no mandatory protection is replaced or reduced by the 30-day guarantee.

14. Allocation of risk, exclusions and limits of liability

14.1. Managed Server intervenes on an environment that is already compromised or suspected, and does not assume the general risk of the Customer’s economic activity. It is not liable for pre-existing damage, for the effects of the attack already produced before the engagement or for supervening events that cannot be causally attributed to its own breach. In the absence of its own attributable concurrent conduct, it is not liable for the consequences of erroneous instructions, omitted information, changes by other operators, newly compromised credentials, failure to implement the measures communicated or malfunctions of infrastructure outside the engagement. Any contribution by the Provider remains governed by the following paragraphs and by law; the mere pre-existing or supervening nature of a damage is not enough to exclude it.

14.2. Exclusively in relations with business Customers and for acts attributable to slight negligence, within the limits permitted by law and with all the exceptions of paragraph 14.5, the exclusion of Managed Server’s liability for damages arising from the performance, delay, inexact or non-performance and termination of the Service is agreed. The exclusion concerns direct and indirect pecuniary damages, immediate or manifested later, including loss or alteration of data, reconstruction costs, unavailability of the site, business downtime, lost orders, loss of turnover, profits, opportunities, traffic or rankings and financial claims of third parties against the Customer. The clause does not bind third parties nor eliminate their independent rights. It does not release from completion until termination, from returns, from interventions due under the guarantee or from the obligations of safe closure, and does not authorize the Provider to knowingly omit the professional precautions due.

14.3. Exclusively in relations with business Customers, as an autonomous and subordinate agreement for the cases in which the exclusion of paragraph 14.2 does not apply but a quantitative limitation is permitted, the total compensation for slight negligence arising from the single order is limited to the consideration originally agreed for the Service, net of VAT, without reduction of that limit by reason of any refunds. Where the exclusion is independently valid, the items of loss of profit, loss of revenue, opportunities, traffic and rankings remain excluded. The exceptions of paragraph 14.5 apply in any case. This provision does not replace a clause that is void for breach of mandatory rules with an equally prohibited limit.

14.4. The Customer is responsible for fulfilling the backup and continuity obligations of art. 9. The absence, inadequacy or unusability of the backup, when attributable to the Customer, is relevant under art. 1227 of the Italian Civil Code to the extent that it caused or aggravated the damage or prevented its reasonable limitation. It is not presumed that any damage would have been avoided by the backup. The Customer’s declaration does not exclude the Provider’s mandatory liabilities, does not reverse the burden of proof and does not transfer to the Customer damages with no causal link to its conduct.

14.5. The exclusions and limitations of paragraphs 14.2 and 14.3 do not apply:

• to willful misconduct or gross negligence of the Provider or of the persons for whom it must answer;
• to breaches of obligations arising from public policy rules and to the other cases prohibited by art. 1229 of the Italian Civil Code;
• to death or personal injury;
• to the obligations to return the price, to commercial refunds and to the renewed cleanup due under the guarantee;
• to liabilities that the personal data protection legislation or other mandatory provisions do not allow to be excluded or limited;
• to relationships with Consumers, governed by paragraph 14.7.

14.6. No contractual limit restricts the rights of data subjects, the powers of the authorities or mandatory liabilities under the GDPR. Liability for staff, collaborators and sub-processors follows the law and Annex A.

14.7. In relationships with Consumers the limits and exclusions of paragraphs 14.2 and 14.3 do not apply. The protections provided by the Italian Consumer Code (Legislative Decree 206/2005) and by other mandatory rules remain in full. No burden of proof other than the statutory one and no tacit acceptance of defects are provided for.

14.8. The return of the price provided for in art. 11 extinguishes the restitution debt to the extent paid; it does not constitute a settlement, a general release or an automatic waiver of claims that cannot validly be excluded. The clauses of this article operate only to the extent that they are valid and effective, also for the purposes of their specific approval.

15. Immediate performance and withdrawal

15.1. The Service is an urgent intervention, tailor-made to the Customer’s installation, the performance of which begins immediately after the conclusion of the contract with the related payment (art. 6.3) and receipt of the access (art. 10). For the business Customer, withdrawal is excluded pursuant to art. 12.9. For the Consumer, the following paragraphs apply.

15.2. The Consumer may order the Service only with immediate start. In the order form, by a dedicated selection, not pre-selected and distinct from the acceptance of the Terms, the Consumer:

• expressly requests that performance of the Service begin immediately, during the 14-day withdrawal period (art. 51, paragraph 8, of the Italian Consumer Code);
• acknowledges that he or she will lose the right of withdrawal once the Service has been fully performed (art. 59, paragraph 1, letter a, of the Italian Consumer Code).

The request and the acknowledgment are reproduced with date and time in the order confirmation. Without that selection the order cannot be submitted.

15.3. Once the cleanup is completed pursuant to art. 10.4, including the sending of the report, the Consumer can no longer withdraw from the contract. Since performance begins immediately and ends within the maximum time limit of the plan (art. 5.4), this normally happens within a few hours of the start.

15.4. Until the Service is fully performed, the Consumer retains the right of withdrawal provided for by arts. 52 et seq. of the Italian Consumer Code, within 14 days of the conclusion of the contract. In that case:

• if he or she withdraws before performance has begun, he or she receives a full refund;
• if he or she withdraws after performance has begun, he or she is required to pay an amount proportionate to what has actually been provided up to the communication of withdrawal, calculated on the total agreed price; if the total price is excessive, the amount is calculated on the market value of what has been provided (art. 57, paragraph 3, of the Italian Consumer Code).

The Provider documents the activities carried out and the criterion of proportion and refunds the difference. It does not apply an hourly rate never agreed, a fixed minimum fee or the entire price for mere taking charge.

15.5. Withdrawal is exercised by sending, before expiry, an explicit statement to the contact details in art. 1, by email, PEC or post to the registered office, or through the “Withdraw from the contract here” function reachable from the footer of the Site, which allows the name, order reference and email address to be entered and the statement to be sent with “Confirm withdrawal”. The Provider confirms receipt without delay on a durable medium, with content, date and time. No reasons, particular forms or identity documents are required.

15.6. The sums due to the Consumer following withdrawal are refunded within 14 days of receipt of the communication, using the same payment method used for the order, unless otherwise expressly agreed at no cost (art. 56 of the Italian Consumer Code). Withdrawal does not prejudice the remedies for the Provider’s breach, nor the automatic termination and the refunds of art. 11.

16. Confidentiality and analysis tools

16.1. Managed Server keeps confidential the credentials, business information, code, content and data it comes to know during the Service and uses them only for performing the engagement and for the further legitimate purposes expressly provided for by law and by the contract.

16.2. Access is limited to authorized staff and to collaborators bound by confidentiality; for personal data, Annex A applies. Customer names, screenshots, case studies or details of vulnerabilities are not published without separate authorization.

16.3. The obligation persists after termination of the contract. It does not concern information that is lawfully public or lawfully obtained from independent sources. A disclosure required by law is limited to what is necessary, with notice to the Customer when permitted.

16.4. Any analyses assisted by artificial intelligence are performed with models on infrastructure under Managed Server’s control, without transmitting the Customer’s code, credentials, content or data to third-party AI services. Such elements are not used to train general-purpose models. The results are verified by technical staff.

16.5. Sending files, dumps or samples to external scanning services, public sandboxes or sharing platforms is not covered by the general authorization. It requires prior specific authorization and, if it involves personal data, compliance with Annex A. The mere indication “local analysis” does not allow ignoring any transmissions made by other tools.

17. Personal data and incident management

17.1. For the data necessary for quotes, orders, payments, invoicing and the defense of its rights, Managed Server operates according to the roles and legal bases described in the notice provided pursuant to arts. 13 and 14 GDPR, available at https://malwarecleanup.com/privacy/ and communicated before collection.

17.2. When the Service involves the processing of personal data on behalf of the Customer, Annex A — Agreement pursuant to art. 28 GDPR, forming part of the contract, applies. The customer privacy notice and any NDA do not replace that agreement.

17.3. The Customer indicates the categories of data present, the persons concerned, its own role and the necessary instructions in the activation form provided for by Annex A. The Provider flags any missing information before accessing the data. If the Customer is itself a processor, it must hold the necessary authorization to use Managed Server as sub-processor.

17.4. The presence of malware may entail unauthorized access, disclosure, alteration or loss of data. The Provider communicates to the Customer without undue delay the personal data breaches of which it becomes aware in the engagement and cooperates in accordance with Annex A. The controller assesses and fulfills the notification and communication obligations provided for by arts. 33 and 34 GDPR. The completion of the cleanup is not awaited before giving the first report.

18. Materials, licenses and report

18.1. The Customer’s data, content and materials remain at its disposal. The licenses of WordPress and of third-party components remain governed by their respective holders and are not transferred beyond the rights permitted.

18.2. The Customer ensures the availability of the necessary licenses and may not demand the use of counterfeit software. If security requires the replacement of an unlicensed or no longer maintained component, a solution compliant with art. 4 is agreed.

18.3. The Provider’s pre-existing tools and know-how remain its property, without prejudice to the applicable open source licenses. The Customer may keep and use the report and share it with its own consultants, providers and authorities for site management, security and protection of rights, in compliance with confidentiality towards third parties.

19. Complaints and alternative dispute resolution

19.1. Complaints and disputes may be sent to the contact details in art. 1. Managed Server provides an initial reply within five working days and a reasoned response within fifteen working days, or indicates the reasons for the further time needed and a reasonable deadline. These time limits do not suspend deadlines for withdrawal, refunds or other rights.

19.2. The Consumer may resort to the ADR bodies provided for by arts. 141 et seq. of the Italian Consumer Code. In case of an unresolved complaint, the Provider communicates on a durable medium the information required by art. 141-sexies, including the relevant body and whether it intends to avail itself of it. As of the date of this version, Managed Server does not adhere to any ADR body and is not obliged to do so; any adherence will be indicated on this page and in the pre-contractual information.

19.3. The European ODR platform provided for by Regulation (EU) No 524/2013 has been discontinued; it is not a usable channel for new complaints. For cross-border disputes the Consumer may also contact the network of European Consumer Centres.

19.4. The complaint or the ADR attempt are not mandatory contractual conditions for applying to a court. Any conditions of admissibility established by law remain unaffected.

20. Governing law and jurisdiction

20.1. The contract is governed by Italian law. For Consumers habitually resident in another country, this choice does not deprive them of the mandatory protections afforded by the law applicable pursuant to art. 6 of Regulation (EC) No 593/2008, when the conditions are met.

20.2. For the Consumer resident or domiciled in Italy, the court of the place of residence or domicile has jurisdiction under art. 66-bis of the Italian Consumer Code. In international disputes the applicable protective rules remain unaffected, including those of arts. 17–19 of Regulation (EU) No 1215/2012.

20.3. Exclusively for business Customers, without prejudice to mandatory jurisdictions, the Court of Macerata has exclusive jurisdiction; in international relationships the related agreement operates within the limits of the validity and effectiveness requirements provided by the applicable rules.

21. Contract version, communications and retention

21.1. The version made available before submission and attached to the confirmation applies to each order. Subsequent updates apply to new orders; they do not unilaterally modify performances, guarantees or rights already agreed. Previous versions, with their effective dates, are retained by Managed Server and provided on request.

21.2. Additional agreements, specific authorizations and substantial changes are documented by email, a signed document including by electronic signature, a selection recorded in the order form or another suitable durable medium. Technical records and logs are items of evidence assessable according to law and are not unilaterally declared incontestable.

21.3. The Provider retains the contractual and tax documentation for the necessary periods provided by the applicable legislation. This retention does not authorize keeping entire copies of the sites or databases for the same time, which are governed by Annex A.

21.4. The invalidity of any clause does not affect the rest of the contract where it can subsist without it. It does not entail automatic replacement with an equally burdensome clause; the relevant statutory rules apply, including nullities of protection.

22. Acceptance and specific B2B approval

22.1. The general acceptance, given with the box “I accept the terms”, concerns the Terms and Annex A published on this page. The Consumer’s request for immediate performance (art. 15.2) and the specific approval of the B2B clauses are distinct selections in the order form, each not pre-selected.

22.2. Only the business Customer, pursuant to arts. 1341 and 1342 of the Italian Civil Code, is called upon to specifically approve, by a distinct and not pre-selected selection in the order form, bearing the declaration of paragraph 22.3, the following provisions:

• arts. 11.5 and 11.9: immediate termination at the maximum deadline without the further three-day period and exclusion of the obligation to continue the cleanup, without prejudice to the refund and safe closure;
• arts. 12.1 and 12.2: suspension of performance and of the intermediate thresholds only, in the presence of documented impediments, without extension of the maximum deadline;
• art. 12.9: exclusion of the business Customer’s withdrawal, including the right provided for by arts. 1671 and 2227 of the Italian Civil Code;
• art. 14.2: exclusion of liability for damages for slight negligence and for the categories of damage indicated, with the exceptions of art. 14.5;
• art. 14.3: subordinate limit of compensation for slight negligence to the consideration of the single Service net of VAT and further exclusions of damage, with the exceptions of art. 14.5;
• art. 20.3: exclusive jurisdiction of the Court of Macerata, without prejudice to mandatory jurisdictions.

22.3. Declaration of specific approval shown in the order form:

The business Customer declares to have read and to specifically approve, pursuant to arts. 1341 and 1342 of the Italian Civil Code, clauses 11.5 and 11.9 (immediate termination at the maximum time limit and cessation of the cleanup, without the further three-day period), 12.1 and 12.2 (suspension for documented impediments, without extension of the maximum deadline), 12.9 (exclusion of the business Customer’s withdrawal, also pursuant to arts. 1671 and 2227 of the Civil Code), 14.2 (exclusion of liability for damages for slight negligence), 14.3 (subordinate limit of compensation and further exclusions of damage), both with the exceptions of art. 14.5, and 20.3 (exclusive jurisdiction of the Court of Macerata).

Managed Server retains, together with the order, the evidence of the selection: date and time, version of the Terms, order identifier, company name and person who made the declaration, technical session data. At the request of either party the approval may be renewed by signing the order summary document with an electronic signature.

22.4. The specific approval does not cure void clauses nor demonstrate, by itself, an individual negotiation. The clauses reserved to business Customers do not extend to Consumers by effect of a selection.

Annex A — Agreement on the processing of personal data

Agreement pursuant to art. 28 of Regulation (EU) 2016/679, linked to the Service order and accepted with the Terms.

A.1. Parties, roles and processing sheet

The Customer identified in the order, as controller or as processor authorized by the controller, appoints Managed Server S.r.l., identified in art. 1 of the Terms, as processor or sub-processor limited to the Service. Roles and authorizations depend on the actual organization, not on the Customer’s commercial status alone.

The variable elements are indicated by the Customer in the activation form, which the Provider sends by email after the order confirmation and which the Customer returns completed before the access is handed over; the answers form part of this agreement.

Element	Specification
Order and installation	As identified in the order
Actual data controller	Indicated by the Customer in the activation form (identity and contact details)
Customer, if distinct from the controller	Indicated by the Customer in the activation form (role and basis of authorization)
Customer’s privacy contact / any DPO	Indicated by the Customer in the activation form (email and urgent contact)
Provider’s contact	info@malwarecleanup.com; managedserversrl@pec.it
Subject matter and purposes	Analysis of the infection, cleanup, protection of the installation, checks and strictly connected subsequent obligations
Authorized operations	Access, consultation, search, selective extraction, precautionary copy when necessary, analysis, correction, authorized restoration, quarantine, deletion of malicious elements and return/deletion of the copies
Ordinary categories of data	Only those actually present and necessary: identifiers, contact details, accounts, credentials or hashes, IP addresses and logs, content, requests, orders, billing data and transactions
Categories of data subjects	Selected by the Customer in the activation form from: users, customers, visitors, employees, collaborators, suppliers, others
Special-category data under art. 9, data under art. 10, data of minors	Presence or absence, categories and precautions indicated by the Customer in the activation form, without entering the data themselves
Places of processing	Customer’s environment: provider and countries indicated by the Customer in the activation form. Provider’s environments for access, analysis and copies: servers managed by Managed Server and located in the European Economic Area, with no access from non-EEA countries
Duration	Performance of the Service, guarantee activities actually requested and the time strictly necessary for return/deletion pursuant to A.8
Additional instructions	Indicated by the Customer in the activation form, or “none”

Where the actual categories exceed the form, the parties update it before carrying out the related processing. The Customer flags in particular health databases, identity documents, judicial data or other categories requiring further precautions. The accidental discovery of such data entails minimization of access and a request for instructions, without unnecessary disclosure.

A.2. Instructions and limits of the engagement

Managed Server processes the data only on documented instructions from the Customer, including those contained in the contract, unless required by applicable EU or national law. In the latter case it informs the Customer before the processing, if the law permits.

The instructions do not authorize marketing, profiling, sale of the data, publication of identifiable samples or training of general-purpose models. The Provider immediately informs the Customer if it considers that an instruction infringes data protection legislation and suspends only the operation concerned until its lawfulness is clarified.

The Customer retains the decisions on purposes, legal bases, notices to data subjects, categories of data entrusted and lawfulness of its own instructions. The Provider retains autonomy in executive technical choices compatible with those instructions and with legal obligations. No declaration by the Customer excludes the Provider’s own autonomous obligations.

A.3. Authorized persons and confidentiality

Access is permitted only to persons who are instructed, authorized and subject to confidentiality obligations, to the extent necessary for the engagement. The Provider manages the assignment, review and revocation of privileges, avoiding shared credentials when individual accounts are available.

When the activities carried out and the role actually held make the provisions of the Italian Data Protection Authority on system administrators applicable, the Provider adopts the relevant measures, including identification of the designated persons, checks and access logging provided for by the applicable decision.

A.4. Minimization and use of tools

Checks are carried out, when possible, directly in the authorized environment or on minimized extracts. Full copies are made only when necessary for safeguarding or cleanup; extraneous data are not intentionally examined or used for other purposes.

Protected channels are used for credentials and transfers. Data or samples are not uploaded to unauthorized external services. AI tools and analysis tools comply with art. 16 of the Terms and the rules on sub-processors.

A.5. Technical and organizational measures

For the activities and environments under its control, Managed Server adopts measures appropriate to the risk pursuant to art. 32 GDPR, comprising at least:

• individual access limited to what is necessary; MFA for internal systems that hold Customers’ credentials or copies, when technically available;
• custody of credentials in protected tools, avoiding passwords in reports or in ordinary logs;
• encryption of transfers and of operational copies kept outside the Customer’s environment, with separate protection of the keys;
• logical separation of the data of different Customers and isolated environments for the analysis of potentially malicious code;
• updating and protection of the devices used, vulnerability management and limitation of the execution of samples;
• proportionate logging of access and relevant administrative operations, with protection against unauthorized access or alteration;
• precautions and safeguard copies for destructive changes, with reasonable checks of usability;
• procedures for incidents, revocation of access, return and deletion;
• periodic review of the effectiveness of the measures and training of the staff involved.

The pre-existing infection does not entail a declaration of compliance or security of the Customer’s environment. Limitations of that environment are documented and addressed with proportionate measures; they do not allow reducing without reason the protections of the Provider’s own environments.

Logs of access and operations on the Provider’s systems are kept for the time necessary for security and verification purposes, unless required by law. In the presence of special-category data under art. 9, data under art. 10 or data of minors, access is reserved to the technicians assigned to the engagement only and copies are reduced to the indispensable minimum.

A.6. Assistance, breaches and audits

The Provider assists the Customer, taking into account the nature of the processing and the information available, in data subjects’ requests and in the obligations relating to security, breaches, impact assessments and prior consultations. Requests received directly are forwarded without delay to the Customer, unless otherwise required by law.

If it becomes aware of a breach of the personal data processed in the engagement, including a pre-existing one, Managed Server informs the Customer without undue delay. The first notice contains the information already available and is supplemented progressively; a definitive diagnosis is not awaited. When available, the nature of the event, the data and data subjects involved, effects, measures, timing and operational contact are communicated.

The technical management of the Service is not equivalent to an engagement to represent the Customer before the Italian Data Protection Authority or data subjects. The controller retains the decisions and the obligations provided for by arts. 33 and 34 GDPR; Managed Server does not obstruct their fulfillment and promptly provides the necessary elements.

The Provider makes available the information necessary to demonstrate compliance with the agreement and allows and contributes to audits and inspections by the Customer or by an independent appointed party. Checks are organized with reasonable notice and with precautions for other Customers, secrets and security; in case of incident, urgency or request of the authority, notice may not prevent timely checks. An available report or certification does not exclude further necessary checks.

Ordinary cooperation inherent in the Service and the handling of breaches attributable to the Provider entail no surcharges. Extraordinary services requested by the Customer may be quoted separately, without making mandatory obligations or the urgent assistance due conditional on payment.

A.7. Sub-processors and international transfers

The Customer specifically authorizes only the parties listed in the following table, for the activities described, in the version in force at the date of the order and attached to the confirmation. If no third party processes data on behalf of the Provider, the table expressly declares so.

Company name and contact details	Activities and data accessible	Countries of processing/remote access	Any safeguard for non-EEA transfers
None: as of the date of this version no third party processes personal data on behalf of Managed Server in the context of the Service	—	—	Not applicable

The addition or replacement of a sub-processor requires the Customer’s prior written authorization, including electronic. The Provider imposes on the sub-processor data protection obligations substantially equivalent to the relevant ones of this agreement and remains liable to the Customer for the sub-processor’s performance pursuant to art. 28, paragraph 4, GDPR.

Providers used for hosting of copies, tickets containing data, storage of credentials or technical access are assessed on the basis of the actual activities. The provider already chosen by the Customer for its own site does not automatically become a sub-processor of Managed Server. Payment service providers and other parties involved in administrative management are qualified separately according to their respective actual roles.

No transfers or access from non-EEA countries are carried out without documented instructions and a valid basis pursuant to Chapter V GDPR. If necessary, the country, recipient, safeguards, assessments and relevant supplementary measures are indicated before the transfer. A generic acceptance of the Terms does not, by itself, constitute valid consent to derogations on international transfers.

A.8. Return, deletion and end of the engagement

The Customer chooses the return or deletion of the copies at the end of the activities. In the absence of different documented instructions, it orders that they be deleted as soon as they are no longer necessary. Only the elements actually necessary for managing the guarantee may be kept until the expiry of the 30-day guarantee; this provision does not authorize the automatic retention of entire databases for 30 days.

Within seven days of the end of the need, Managed Server deletes the residual operational copies, unless a legal obligation requires their retention. Copies possibly present in the Provider’s security backups remain protected, are not used for ordinary purposes and are deleted with the overwrite cycle, in any case within 90 days of the operational deletion. If restored for technical necessity, the deletions must be applied again.

On request the Provider confirms the deletion operations and any residual backup expiry. Returns of infected archives are carried out in a protected manner and with explicit warnings, to avoid unwitting restorations of the malware.

The Customer’s credentials are deleted from the Provider’s operating systems when no longer necessary; new access may be requested for subsequent interventions under the guarantee. Any extended retention for a legal obligation is limited to what is required, with notice to the Customer when permitted.

Administrative data processed by the Provider as an independent controller follow the relevant notice. Any retention for the defense of rights concerns only the strictly necessary elements, on an appropriate legal basis; it does not justify the indiscriminate retention of credentials, copies of sites or entire databases.

A.9. Precedence and duration of the obligations

In case of conflict on the manner of processing, this agreement prevails over the other commercial clauses. The rights of data subjects and the powers of the authority are not limited. The obligations of confidentiality, protection, return and deletion remain effective after termination as long as relevant.