Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Hasijew Applications, c/o Wladimir Hasijew, Terrassenweg 4, 5507 Mellingen, Switzerland ("Processor", "we") and the business customer ("Controller", "you").

It applies only to the extent you use the Service to process personal data for which you are the controller — for example, personal data of your own end users or employees. If you do not upload such data, this DPA does not apply.

This DPA is designed to satisfy Art. 9 of the Swiss Federal Act on Data Protection (revFADP) and, where applicable, Art. 28 of the EU General Data Protection Regulation (GDPR). For customers subject to U.S. state privacy laws, the U.S. Addendum in Section 13 applies.

1. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in the revFADP and the GDPR. "Applicable Data Protection Law" means the revFADP and, where it applies to a given processing activity, the GDPR/UK GDPR and applicable U.S. state privacy laws.

2. Roles and Scope

You are the controller and we are the processor with respect to the personal data you submit to the Service ("Customer Personal Data"). We process Customer Personal Data only to provide and support the Service and only on your documented instructions, including those set out in this DPA and the Terms of Service. The subject matter, duration, nature, purpose, data categories and data subjects are described in Annex I.

3. Processor Obligations

We will:

• process Customer Personal Data only on your documented instructions, unless required otherwise by law (in which case we will inform you, unless legally prohibited);
• ensure persons authorised to process the data are bound by confidentiality;
• implement the technical and organisational measures set out in Annex II;
• assist you, taking into account the nature of processing, in responding to data subject requests and in meeting your security, breach-notification and impact-assessment obligations;
• make available the information necessary to demonstrate compliance and allow for audits as set out in Section 8;
• not process the data for our own purposes and never sell it.

4. Confidentiality

We treat Customer Personal Data as confidential and limit access to personnel who need it to provide the Service, each under a duty of confidentiality.

5. Security

We maintain appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, as described in Annex II. We may update these measures provided the level of protection is not reduced.

6. Subprocessors

You grant general authorisation for us to engage the subprocessors listed in Annex III. We impose data protection obligations on each subprocessor that are no less protective than those in this DPA, and we remain responsible for their performance.

We will inform you of any intended addition or replacement of a subprocessor with at least 30 days' notice (e.g. by email or in-product notice), giving you the opportunity to object on reasonable data protection grounds. If you object and we cannot offer a reasonable alternative, you may terminate the affected part of the Service.

7. Data Subject Requests

Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, insofar as possible, in fulfilling your obligation to respond to requests from data subjects exercising their rights. If a data subject contacts us directly, we will forward the request to you and not respond ourselves unless legally required or instructed by you.

8. Audits

We will make available information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate. To minimise disruption, audits take place on reasonable prior notice, no more than once per year (unless required by a supervisory authority or following a breach), during business hours, and subject to confidentiality. We may satisfy audit requests by providing relevant certifications or third-party reports where available.

9. Personal Data Breach

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provide information reasonably available to help you meet your own notification obligations to authorities and data subjects.

10. International Transfers

Our hosting (Hetzner and OVHcloud) is located in the EU/EEA. Some Customer Personal Data is also stored with or routed through U.S.-based subprocessors (Cloudflare, including object storage, and Google). Where Customer Personal Data is transferred to a country without an adequacy decision, the transfer is safeguarded by the EU Standard Contractual Clauses (Module Two, controller-to-processor), the Swiss addendum recognised by the FDPIC, the UK International Data Transfer Addendum where the UK GDPR applies, and/or the relevant provider's certification under the EU-US / Swiss-US Data Privacy Framework. The applicable Standard Contractual Clauses are hereby incorporated by reference; where they conflict with this DPA, the Clauses prevail in respect of the transfer they govern.

11. Deletion and Return

On termination of the Service, we will, at your choice, delete or return all Customer Personal Data and delete existing copies within 30 days, unless storage is required by applicable law. Backup copies are deleted in the ordinary course of our backup cycle.

12. Liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service, to the extent permitted by Applicable Data Protection Law.

13. U.S. Addendum (CCPA and similar state laws)

Where you are subject to U.S. state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA), we act as your "service provider" / "processor". We will: (a) process personal information only for the limited purpose of providing the Service and the business purposes set out in this DPA; (b) not sell or share personal information, and not retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Service; (c) not combine it with personal information from other sources except as permitted by law; and (d) notify you if we determine we can no longer meet our obligations. You may take reasonable steps to ensure we use the personal information consistently with your obligations.

14. Governing Law

This DPA is governed by Swiss law, consistent with the Terms of Service, without prejudice to the governing-law provisions of any incorporated Standard Contractual Clauses.

Annex I — Details of Processing

• Subject matter: provision of the Service (software-as-a-service) to the Controller.
• Duration: for the term of the Terms of Service plus the deletion period in Section 11.
• Nature and purpose: hosting, storage, transmission and processing of Customer Personal Data as necessary to operate, secure and support the Service on the Controller's instructions.
• Categories of data subjects: the Controller's end users, employees, contacts and any individuals whose data the Controller chooses to submit.
• Categories of personal data: as determined and controlled by the Controller — typically identification and contact data, account credentials, usage data, and any content the Controller uploads. The Controller is responsible for not submitting special categories of data unless agreed in writing.

Annex II — Technical and Organisational Measures (TOMs)

• Encryption in transit: all data transmitted over TLS (HTTPS).
• Credentials: passwords stored as salted bcrypt hashes; no plaintext storage.
• Access control: role-based access on a need-to-know basis; individual accounts; least-privilege principle.
• Hosting: EU/EEA data centres (Hetzner and OVHcloud) with physical and environmental security maintained by the hosting providers.
• Object storage: Cloudflare; storage region configurable, with EU jurisdiction restriction available.
• Network security: reverse proxy, DDoS protection and bot management (Cloudflare).
• Backups: regular backups with defined retention and tested restore procedures.
• Separation: logical separation of customer data within multi-tenant infrastructure.
• Logging & monitoring: security-relevant events logged and monitored.
• Confidentiality: personnel bound by confidentiality obligations.
• Incident response: documented process for detecting, handling and notifying breaches.

Annex III — Approved Subprocessors