Data Processing Agreement

This Data Processing Agreement (“DPA”) is concluded between the Customer and Software Vision AG, Löwenstrasse 11, 8001 Zürich, Switzerland, UID CHE-264.410.040 (“Provider”). It governs the processing of personal data that Provider carries out on the Customer’s behalf when it provides the Services.

This DPA forms part of the Agreement (Section 10.1 of the Terms and Conditions). It becomes binding when the Customer accepts the Terms and Conditions, including through its first Organisation Administrator, or signs an Order Form. No separate signature is needed. On request, the parties sign a copy of the version in force; the signed copy has the same content as this page and is not a separate version.

This DPA supplements the Terms and Conditions. Under Section 1.5 of the Terms and Conditions, it prevails over the other documents of the Agreement for the processing of personal data. It does not change the provisions of the Terms and Conditions on liability, fees or term (Sections 16 and 17 of this DPA).

1.Definitions

1.1 Terms such as personal data, processing, controller, processor, data subject, disclosure abroad and breach of data security have the meaning given to them in the Swiss Federal Act on Data Protection (“FADP”) and, where it applies, the EU General Data Protection Regulation (“GDPR”). A breach of data security under the FADP corresponds to a personal data breach under the GDPR. Sensitive personal data under the FADP includes the special categories of personal data under the GDPR.

1.2 Capitalised terms that are defined in the Terms and Conditions, such as Agreement, AI Features, Authorised Users, Customer, Customer Data, Documentation, Guests, Order Form, Organisation Administrators and Services, have the same meaning in this DPA. In addition:

Applicable Data Protection Law: the FADP and the Swiss Data Protection Ordinance (“DPO”) and, where they apply to the processing, the GDPR and the data protection laws of the member states of the EU and the EEA.

Customer Personal Data: personal data contained in Customer Data that Provider processes on the Customer’s behalf.

Sub-processor: a third party that Provider engages to process Customer Personal Data on the Customer’s behalf.

Sub-processor List: the list of Sub-processors described in Section 6.2.

SCCs: the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021.

FDPIC: the Swiss Federal Data Protection and Information Commissioner.

1.3 References to the GDPR apply only where the GDPR applies to the processing. Mandatory provisions of Applicable Data Protection Law remain unaffected.

2.Subject matter, roles and scope

2.1 Provider processes Customer Personal Data to provide, secure and support the Services under the Agreement. Annex 1 sets out the subject matter, nature and purpose of the processing, the categories of personal data and data subjects, the duration and the locations.

2.2 The Customer is the controller and Provider the processor within the meaning of Art. 9 FADP and Art. 28 GDPR.

2.3 Where the Customer itself processes the data as processor for a third party, for example for a group company or for a client of a company secretarial firm, Provider acts as its sub-processor. The Customer warrants that the controller has authorised its instructions and the conclusion of this DPA. Provider follows the Customer’s instructions only and deals with the Customer only. The Customer passes on to the controller the information it receives under this DPA.

2.4 This DPA does not apply to personal data that Provider processes as controller for its own purposes, such as user accounts, sign-in and two-factor authentication, Provider’s own security logs, billing, communication with the Customer and Usage Data (Section 10.2 of the Terms and Conditions). The Privacy Policy describes that processing. The activity records of the Customer’s organisation, which Organisation Administrators can view and export, are Customer Data and fall under this DPA.

2.5 Provider does not process Customer Personal Data for its own purposes. It does not sell it, does not use it for advertising and does not use it to train AI models, its own or third parties’.

3.Instructions

3.1 Provider processes Customer Personal Data only on the Customer’s documented instructions, including with regard to disclosures abroad. This does not apply where Swiss law, or the law of an EU or EEA member state to which Provider is subject, requires the processing. In that case, Provider informs the Customer of that legal requirement before the processing, unless that law prohibits this on important grounds of public interest.

3.2 The Customer’s instructions are:

• the Agreement, including this DPA;
• the configuration and use of the functions of the Services by the Customer and its Authorised Users, for example inviting persons, assigning roles and restrictions, sending notifications, activating integrations and using AI Features;
• further instructions that Organisation Administrators or other authorised representatives of the Customer give in writing; e-mail to info@softwarevision.ch is sufficient.

3.3 Further instructions must be consistent with the Agreement. Instructions that require changes to the Services or effort beyond the Agreement are treated as a request for additional services; Section 15 applies.

3.4 The use of AI Features forms part of the Customer’s instructions. AI Features are switched on by default. The Customer can have them switched off for its organisation at any time by request to Provider. Content of the organisation is then no longer sent to AI model providers.

3.5 If Provider considers that an instruction infringes Applicable Data Protection Law, it informs the Customer without undue delay. Provider may suspend carrying out that instruction until the Customer confirms or changes it. Provider is not obliged to review instructions for their lawfulness.

4.Confidentiality and access by Provider’s staff

4.1 Provider ensures that all persons it authorises to process Customer Personal Data are bound by a contractual or statutory duty of confidentiality that continues after their engagement ends, and that they are informed of the data protection obligations relevant to their work.

4.2 Provider’s staff access Customer Data only where needed to operate the Services, to handle a support request at the Customer’s instruction, to protect the security of the Services, or where the law requires it.

5.Security of processing

5.1 Provider implements the technical and organisational measures described in Annex 2. They are designed to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing and the sensitivity of board materials (Art. 8 FADP, Art. 1 to 6 DPO, Art. 32 GDPR).

5.2 Provider may change the measures to keep pace with technical progress or new risks, as long as the overall level of protection is not reduced. On request, Provider provides the current description of the measures.

5.3 Some measures depend on settings that the Customer controls, such as roles, restrictions, document security levels, guest rules, the idle-session timeout and two-factor authentication for its users. The Customer is responsible for choosing settings that suit the sensitivity of its data.

6.Sub-processors

6.1 The Customer gives Provider general written authorisation to engage Sub-processors. The Sub-processors on the Sub-processor List when this DPA is concluded are approved.

6.2 The Sub-processor List names each Sub-processor, its service, the country where it processes Customer Personal Data and the safeguard for any disclosure abroad. Provider sends it to the first Organisation Administrator when it sets up the Customer’s organisation, and to the Customer at any time on request to info@softwarevision.ch. The categories of Sub-processors and their countries are shown in Annex 3 and on the Sub-processors page.

6.3 Provider informs the Organisation Administrators by e-mail at least 14 days before a new or replacement Sub-processor starts processing Customer Personal Data. The notice names the Sub-processor, its service and its country. In an emergency, for example when a Sub-processor fails or poses a security risk, Provider may engage a replacement at once and informs the Organisation Administrators without delay; the Customer may then object under Section 6.4 within 14 days of the notice. Providers that do not process Customer Personal Data are not Sub-processors and are not announced.

6.4 Within that period, the Customer may object to the change in writing on reasonable data protection grounds, stating its reasons; e-mail is sufficient. The parties then look for a solution in good faith. If they find none, the Customer may terminate the affected Services with effect from the date on which the new Sub-processor starts processing; prepaid fees are refunded under Section 13.7 of the Terms and Conditions. If the Customer does not object within the period, the change is approved.

6.5 Provider engages a Sub-processor only under a written contract, which may be in electronic form, that imposes on it the same data protection obligations as this DPA, to the extent they are relevant to its service, in particular sufficient guarantees for appropriate technical and organisational measures. Provider selects its Sub-processors with care.

6.6 Provider remains liable to the Customer for the performance of its Sub-processors’ obligations as for its own, subject to Section 16.

6.7 Third-party services that the Customer chooses to connect, such as its Microsoft account for sign-in, calendar applications or video-conferencing services, are not Sub-processors of Provider. Their use is governed by the Customer’s own agreements with those third parties and by Section 12 of the Terms and Conditions.

7.Locations and disclosure abroad

7.1 Customer Data is stored in data centres in Switzerland (Zurich). The application that processes it runs on servers in the EU (Germany). Backup copies are kept in Switzerland or in the EU. AI model providers process content submitted to AI Features in the EU; they do not retain it after the response and do not use it for training. Error monitoring takes place in the EU (Germany).

7.2 E-mail delivery and SMS sign-in codes use providers established in the United States. The e-mail provider’s sending infrastructure is located in Ireland; SMS are processed in the United States. E-mails contain names, e-mail addresses, notification texts, meeting and agenda titles and messages that Authorised Users write, but no file attachments. SMS contain the phone number and the sign-in code.

7.3 Some Sub-processors that process Customer Personal Data in Switzerland or the EU are established in, or belong to groups based in, the United States and may access data from there for support or operations. Such access is a disclosure abroad and is covered by Section 7.4.

7.4 Provider discloses Customer Personal Data to a country whose legislation does not ensure adequate data protection, as determined by the Swiss Federal Council or, where the GDPR applies, the European Commission, only if:

• the recipient is certified under the Swiss-U.S. Data Privacy Framework and, where the GDPR applies, the EU-U.S. Data Privacy Framework; or
• Provider has concluded the SCCs with the recipient, Module 3 (processor to processor), with the adaptations for Switzerland in Section 7.5; or
• another safeguard or exception under Art. 16 and 17 FADP and Chapter V GDPR applies.

7.5 Where the SCCs cover disclosures governed by the FADP: (a) the FDPIC is the competent supervisory authority for those disclosures; (b) references to the GDPR are to be understood as references to the FADP for those disclosures; (c) the term “Member State” must not be interpreted so as to exclude data subjects in Switzerland from bringing claims for their rights at their place of habitual residence (Clause 18(c) SCCs); and (d) for disclosures governed exclusively by the FADP, the SCCs are governed by Swiss law and disputes are subject to the Swiss courts.

7.6 Switzerland is recognised by the European Commission as ensuring an adequate level of data protection. Disclosures from a Customer in the EU or EEA to Provider therefore need no further safeguards.

7.7 The Sub-processor List states the country and the safeguard for each Sub-processor. On request, Provider gives the Customer the information it needs to name the countries in its own privacy notice (Art. 19(4) FADP, Art. 13 and 14 GDPR) and a copy of the relevant safeguards; commercial terms may be redacted.

8.Requests from authorities

8.1 If a court or authority requests Customer Personal Data from Provider, Provider refers the authority to the Customer where possible and informs the Customer without undue delay, unless the law prohibits this. Provider discloses Customer Personal Data only where it is legally obliged to do so, and only to the extent required. It examines whether the request is lawful and challenges requests that it considers unlawful.

8.2 Provider does not give authorities access to Customer Personal Data voluntarily and has not built any interfaces that give authorities direct access to it.

9.Requests from data subjects

9.1 The Customer is responsible for responding to requests from data subjects. If a data subject contacts Provider directly about Customer Personal Data, Provider forwards the request to the Customer without undue delay and does not respond on the merits, other than to refer the data subject to the Customer, unless the Customer instructs otherwise.

9.2 Provider supports the Customer with appropriate technical and organisational measures, insofar as possible, in responding to requests for access, rectification, erasure, restriction, data portability and objection (Art. 25 to 32 FADP, Chapter III GDPR). Organisation Administrators can handle many requests with the functions of the Services, such as editing and deleting content, managing users and exporting registers and activity records. Where the Services offer no function for a request, for example erasing all personal data of an individual Authorised User, Provider carries it out on the Customer’s written instruction within a reasonable time.

10.Assistance with the Customer’s obligations

10.1 Taking into account the nature of the processing and the information available to it, Provider assists the Customer in meeting its obligations regarding:

• the security of processing (Art. 8 FADP, Art. 32 GDPR);
• reporting breaches of data security to the FDPIC or another supervisory authority and informing data subjects (Art. 24 FADP, Art. 33 and 34 GDPR);
• data protection impact assessments (Art. 22 FADP, Art. 35 GDPR);
• consulting the FDPIC or another supervisory authority before processing (Art. 23 FADP, Art. 36 GDPR).

10.2 Provider assists mainly by providing this DPA and its annexes and by answering the Customer’s questions. On request, it also provides the information the Customer needs for its record of processing activities and, where Art. 5 DPO applies, for its processing regulation. Annex 2 describes the activity records factually; the Customer assesses whether they meet its own logging obligations, for example under Art. 4 DPO.

11.Breaches of data security

11.1 Provider notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a breach of data security affecting Customer Personal Data processed by Provider or its Sub-processors. It sends the notice by e-mail to the Organisation Administrators and, where appropriate, also uses other means.

11.2 The notice describes, as far as known:

• the nature of the breach, including the categories and approximate number of data subjects and of personal data records concerned;
• the likely consequences of the breach;
• the measures taken or proposed to address the breach and to mitigate its possible adverse effects;
• a contact person for further information.

11.3 Where not all information is available at once, Provider provides it in stages without undue delay as it becomes available.

11.4 Provider takes the measures needed to contain the breach and to mitigate its consequences, documents the breach and supports the Customer in notifying the FDPIC or another supervisory authority and in informing data subjects. Provider does not notify authorities or data subjects on the Customer’s behalf unless the Customer instructs it to or the law requires it.

11.5 A notice under this Section is not an admission of fault or liability.

12.Return and deletion

12.1 During the term of the Agreement, the Customer can export Customer Data with the export functions described in the Documentation and delete content in the Services.

12.2 After the Agreement ends, Customer Data remains available to the Organisation Administrators for export for 14 days. Further help with exports beyond the standard functions is charged at Provider’s current rates (Section 18.2 of the Terms and Conditions). The Customer may instead instruct Provider in writing to delete Customer Data earlier.

12.3 After the export period, Provider deletes Customer Personal Data, including copies. Backups are deleted within a further 14 days. Until then, Provider uses backups only to restore data.

12.4 Where Swiss law, or the law of an EU or EEA member state to which Provider is subject, requires Provider to retain data, Provider restricts its processing to that purpose and deletes the data when the duty ends. This DPA continues to apply to such data.

12.5 On request, Provider confirms the deletion in writing.

13.Demonstrating compliance and audits

13.1 Provider makes available to the Customer the information necessary to demonstrate compliance with Art. 9 FADP, Art. 28 GDPR and this DPA, in particular this DPA and its annexes, the Sub-processor List and written answers to reasonable security questionnaires.

13.2 If this information is not sufficient to demonstrate compliance, after a breach of data security affecting Customer Personal Data, or where a competent supervisory authority requires it, the Customer, or an independent auditor it mandates, may carry out an audit, including an on-site or remote inspection.

13.3 The following conditions apply to audits under Section 13.2:

• at most once per contract year, except after a breach of data security affecting Customer Personal Data or where a supervisory authority requires it;
• written notice at least 30 days in advance, stating the proposed scope;
• during Provider’s business hours on Swiss business days and without unreasonable disruption of its operations;
• the auditor is bound to confidentiality, is independent and is not a competitor of Provider;
• no access to data of other customers, and access to Provider’s trade secrets only as far as necessary for the audit;
• Sub-processors are audited by means of the information and audit reports that they make available to Provider;
• the Customer gives Provider a copy of the audit report free of charge.

13.4 Each party bears its own costs of an audit. The Customer also reimburses Provider’s reasonable costs for effort beyond a standard effort, at Provider’s current rates. Provider bears its own costs in full if the audit reveals a material breach of this DPA by Provider.

13.5 Provider cooperates with supervisory authorities as required by law.

14.Customer’s responsibilities

14.1 As controller, the Customer is responsible for the lawfulness of the processing. In particular, the Customer:

• ensures that it has a legal basis for the processing, including for inviting persons to the Services and for uploading board materials;
• informs the data subjects, including Authorised Users and persons named in board materials, about the processing, including the activity records (Section 5.7 of the Terms and Conditions);
• gives only lawful instructions;
• decides whether to include sensitive personal data in Customer Data and configures roles, restrictions and document security levels accordingly;
• decides whether to use AI Features;
• keeps its accounts and devices secure and notifies Provider without undue delay if it detects errors or irregularities in the processing;
• meets its own obligations as controller, such as reporting breaches of data security to the authorities and carrying out data protection impact assessments.

15.Costs of assistance

15.1 Provider provides the assistance under Sections 9, 10 and 13.1 through the standard functions of the Services and the information it holds, without charge to a reasonable extent. Notices under Section 11 are always free of charge.

15.2 Provider may charge effort beyond the standard functions and beyond what is reasonable at its current rates, after informing the Customer in advance. It does not charge effort that is needed because Provider or its Sub-processors breached this DPA or Applicable Data Protection Law.

16.Liability

16.1 Liability under or in connection with this DPA is governed by Section 21 of the Terms and Conditions. Its limitations and exclusions apply to all claims under this DPA, including Provider’s liability for its Sub-processors under Section 6.6.

16.2 The precedence of this DPA under Section 1.5 of the Terms and Conditions applies to the processing of personal data only. It does not alter the limitations of liability in the Terms and Conditions and does not create a separate or unlimited liability.

16.3 Nothing in this DPA limits liability towards data subjects under mandatory law, such as Art. 82 GDPR, or liability that mandatory law does not allow to be limited.

17.Term and termination

17.1 This DPA starts with the Agreement and runs for as long as Provider processes Customer Personal Data, including the export and deletion periods under Section 12. It cannot be terminated separately from the Agreement.

17.2 Provisions that by their nature continue after this DPA ends survive it, in particular Sections 4, 12.4, 12.5, 16 and 19.

18.Changes to this DPA

18.1 Provider may amend this DPA for valid reasons, in particular changes in law, guidance from supervisory authorities, new or changed features, or security requirements. Sections 24.2 and 24.3 of the Terms and Conditions apply: Provider notifies the Customer at least 14 days before the amendment takes effect and shows what changes; the Customer may object before the effective date or terminate with effect from that date.

18.2 Amendments that reduce the protection of Customer Personal Data require the Customer’s express consent.

18.3 Changes of Sub-processors follow Section 6 and changes of the technical and organisational measures follow Section 5.2. Editorial corrections that do not affect the rights and obligations of the parties may be made without notice. On request, Provider provides earlier versions of this DPA.

19.Governing law, jurisdiction and language

19.1 This DPA is governed by Swiss substantive law, excluding its conflict-of-law rules and the United Nations Convention on Contracts for the International Sale of Goods (CISG). Mandatory provisions of the GDPR and other Applicable Data Protection Law remain unaffected.

19.2 The exclusive place of jurisdiction is Zurich, Switzerland. The rights of data subjects and the powers of supervisory authorities remain unaffected. SCCs that Provider concludes are governed by their own provisions on governing law and jurisdiction, subject to Section 7.5.

19.3 This DPA is available in English and German. If the versions differ, the German version prevails.

19.4 If a provision of this DPA is invalid or unenforceable, the rest of this DPA remains in force. The provision is replaced by a valid one that comes closest to its purpose.

20.Contact and notices

20.1 The Customer sends instructions, objections, requests and other notices under this DPA to info@softwarevision.ch.

20.2 Provider sends notices under this DPA, including notices of breaches of data security and of new Sub-processors, by e-mail to the Customer’s Organisation Administrators. The Customer ensures that at least one Organisation Administrator can be reached at all times and keeps their e-mail addresses up to date.

20.3 E-mail satisfies any form requirement under this DPA.

Annex 1Processing details

Annex 2Technical and organisational measures

Provider maintains the following measures. Only this annex describes the measures Provider commits to under this DPA; descriptions elsewhere, for example on the website, do not form part of it. Section 5.2 governs changes.

Annex 3Sub-processors

The Customer authorises Sub-processors in the following categories. The Sub-processor List names them (Section 6.2). The table shows the categories on the effective date of this version; later changes follow Section 6 and are shown on the Sub-processors page.

Some of these providers belong to groups based in the United States (Section 7.3). Disclosures to the United States are covered by the safeguards in Section 7.4.