Annex A to the DPA — Description of Processing

Detailed description of the processing of personal data carried out by TAGMOOD S.R.L. on behalf of the Customer within the scope of the Webmaster360 services.

Last updated: July 21, 2026

1. Subject Matter

Processing of personal data necessary for the provision, maintenance, protection and support of the Webmaster360 services.

2. Services Covered

Depending on the features activated by the Customer, processing may relate to:

Editorial CMS and admin panel;
front-end of the Customer’s websites;
hosting of the application, databases and content;
storage and distribution of images, videos, documents and other media;
management of accounts, roles and permissions;
recording of technical, administrative and security logs;
backup, restore and operational continuity;
maintenance, updating, monitoring and protection of the infrastructure;
technical support;
migration, import and export of content and data;
feeds, APIs and integrations configured by the Customer;
artificial intelligence and editorial automation features;
newsletters, push notifications and automated communications;
multisite management and cross-posting;
modules, forms, comments, quizzes, surveys and engagement tools;
technical management of advertising spaces.

Processing carried out by advertising networks, advertising platforms or other operators for their own purposes does not fall within the scope of this DPA, unless TAGMOOD specifically processes such data on behalf of the Customer.

For the providers processing data within the scope of these services, please refer to the Sub-processor List.

3. Nature and Purposes

Purposes may include:

provision of the CMS and admin panel;
management of accounts and permissions;
hosting and publishing of websites;
storage and distribution of content;
management of editorial workflows;
import, migration, synchronization and export;
management of feeds, APIs and integrations;
newsletters, notifications, forms, comments, quizzes and surveys;
processing through AI features activated by the Customer;
backup, restore and return;
monitoring, security and prevention of unauthorized access;
maintenance and technical support.

4. Processing Operations

Operations may include:

collection and receipt;
recording;
organization and structuring;
storage;
consultation;
use;
modification and updating;
indexing and internal search;
import and synchronization;
transmission and technical distribution;
publication in accordance with the Customer’s instructions;
automated or AI-based processing;
creation and storage of backups;
recovery and restoration;
export and return;
restriction;
erasure and destruction.

5. Categories of Data Subjects

Platform Users

administrators;
publishers;
editorial directors and managers;
journalists;
authors;
contributors;
moderators;
authorized technical or commercial personnel;
other users to whom the Customer assigns an account or a role.

Users and Visitors of the Customer’s Websites

visitors;
registered users;
newsletter subscribers;
push notification recipients or subscribers;
participants in quizzes, surveys, leaderboards, contests or engagement initiatives;
commenters;
individuals submitting requests through forms;
subscribers or paying users, where the relevant features are activated.

Individuals Appearing in Editorial Content

individuals named, described or cited in articles;
individuals portrayed in photographs or videos;
individuals to whom documents, press releases, interviews or statements refer;
subjects present in content acquired through feeds, APIs, archives or other sources.

Other Categories

contacts of advertisers, sponsors and partners;
suppliers and collaborators of the Customer;
individuals communicating with the editorial team;
participants or beneficiaries of initiatives organized by the Customer;
further individuals whose data is lawfully processed by the Customer through the Services.

6. Categories of Personal Data

Platform User Data

first and last name;
display name, pseudonym or byline;
email address;
photograph, avatar and profile information;
organization or publication affiliation;
role, function and permissions;
username and account identifiers;
authentication data protected by hashing and MFA-related data;
account preferences and settings.

Technical and Usage Data

IP address;
access date and time;
user agent, browser, operating system and device;
session identifiers;
authentication logs;
administrative and editorial activity logs;
operation history;
diagnostic information, errors and security data.

Editorial and Multimedia Content

articles, pages, drafts, releases and documents;
names and other personal information contained in the materials;
photographs, images, audio, video and metadata;
interviews, statements, quotes and attachments;
data imported through feeds, APIs, archives or migrations;
author data and publication history.

Reader and Website User Data

Where the relevant features are activated:

first name, last name, username or pseudonym;
email address;
data entered in forms;
comments and submitted content;
newsletter and communication preferences;
data necessary for push notifications;
quiz and survey responses;
scores, leaderboards, levels and badges;
registered account data;
subscription status.

identification and contact data;
content of requests;
communications;
files and screenshots;
technical data necessary for diagnosis.

AI-Processed Data

prompts and instructions entered by authorized users;
selected texts, drafts, articles or excerpts;
contextual information added by Webmaster360;
outputs, summaries, translations, rewrites and suggestions;
technical metadata of the request.

subscriber identifier;
plan, status and duration of the subscription;
activation, renewal, suspension or termination dates;
transaction identifiers provided by the payment processor.

Webmaster360 does not directly process full payment card numbers, CVV codes or banking credentials.

7. Special Categories, Criminal Offence Data and Minors

Webmaster360 does not require, as an ordinary feature, the structured collection of special categories of data or data relating to criminal convictions and offences.

Such data may however be present in content, documents or materials entered, imported or published by the Customer and may relate to:

racial or ethnic origin;
political opinions;
religious or philosophical beliefs;
trade union membership;
health;
sex life or sexual orientation;
genetic data;
biometric data used to uniquely identify a person;
criminal convictions, proceedings, offences or related security measures.

The Service is not specifically intended for direct use by minors and does not normally provide for the structured collection of date of birth or age. Data relating to minors may be present in editorial content or in features activated by the Customer.

The Customer must not submit special categories of data, criminal offence data or data relating to minors to the AI features, unless strictly necessary, lawful and consistent with the purpose pursued.

For the security measures relating to AI features, please refer to Annex B — Section 9.

8. Frequency and Duration

Processing is continuous for the duration of the Services and may continue, limited to return, deletion and backups, in accordance with Article 13 of the DPA.