DPA - Data Processing Agreement

The nature of the Data, the categories of data subjects and the duration and purposes of the processing are as follows, unless otherwise expressly provided for in the Framework Agreement:

This DPA applies exclusively to the processing of Data by the Processor and its subcontractors. If the Customer commissions the Processor to process Data on infrastructure or with software of third parties, the Customer is responsible for compliance with the data protection regulations by this third party.

Within the scope of this contract, the Controller is solely responsible for compliance with the legal provisions of the data protection laws, in particular for the legality of the data transfer to the Processor and for the legality of the data processing and the instructions ('Controller' in the sense of Art. 4 Nr. 7 GDPR and Art. 5 lit f) FADP respectively).

The Processor processes the Data exclusively for the purposes of the Framework Agreement and in accordance with the documented instructions of the Controller. Instructions must always be given in writing or in electronic form. Oral instructions must be confirmed immediately in writing or in text form.

The Processor shall inform the Controller without delay if it considers that an instruction violates applicable laws. The Processor may suspend the implementation of the instruction until it has been confirmed or amended by the Controller.

Where Data are processed pursuant to legal provisions and contrary to the instructions of the Controller, the Processor is obliged to inform the controller in advance of the processing operation concerned and of the lawfulness of the processing, unless this is contrary to an important public interest.

The Controller is responsible for assessing the permissibility of the data processing and for safeguarding the rights of the data subjects. The Controller guarantees that the processing of the Data by the Processor in accordance with this DPA and the instructions does not violate any applicable legal provisions.

The Controller shall inform the Processor without delay if it discovers errors or irregularities when examining the order processing.

The Controller is obliged to treat as confidential all knowledge of business secrets of the Processor obtained within the scope of the contractual relationship.

The Controller is obliged to document his instructions to the Processor.

The Processor shall ensure that the persons authorised to process the Data (e.g. employees, subcontractors, etc.) have contractually undertaken to maintain confidentiality and security or are subject to an appropriate legal obligation of confidentiality and security.

Within his area of responsibility, the Processor will design the internal organisation in such a way that it meets the special requirements of data protection. The Processor shall take appropriate technical and organisational measures to ensure the confidentiality, integrity, availability and capacity of the systems and services in connection with the processing in the long term and which meet the requirements of the GDPR and the FADP.

The current technical and organisational measures and the procedure for reviewing, assessing and evaluating their effectiveness are described in Appendix 1. The Controller is aware of these technical and organisational measures and is responsible for ensuring that they provide an adequate level of protection for the risks of the Data to be processed.

The Processor may adapt the measures in the course of the contractual relationship to technical and organisational developments - but these must not fall below the agreed standards.

Contracts with subcontractors for the processing of the Personal Data covered by the contract may only be awarded with the prior written consent (including text form) of the Controller.

The Controller hereby grants the Processor general authorization to use subcontractors in accordance with the provisions of this DPA. The Processor’s existing subcontractors can be found under www.vshn.ch/en/partners/technology-partners/. The Processor shall inform the Controller of any intended change with respect to the use or replacement of other subcontractors in an appropriate manner and within a reasonable period of time. The Controller may object to the change for good cause within 30 days. The objection must be made in writing and must include the specific reasons for the objection and, if applicable, opportunities for compromise. Any further outsourcing by the subcontractor requires the express consent of the person responsible (at least in text form).

The Processor is obliged to impose on authorized subcontractors data protection obligations fundamentally comparable to those contained in this Agreement before Personal Data of the Controller are processed by the subcontractor.

For the purposes of this provision, subcontractors are those service providers whose services are directly related to the provision of the main service under the Framework Agreement and concern the processing of Data. This does not include ancillary services which the Processor uses, e.g. as telecommunications services, postal/transport services, maintenance and user service or the disposal of data carriers as well as other measures to ensure the confidentiality, availability, integrity and resilience of the hardware and software of data processing systems. However, in order to guarantee the data protection and data security of the Data of the data controller, the Processor is obliged to take appropriate and legally compliant contractual agreements and control measures to ensure that the Data of the Controller is protected, even in the case of outsourced ancillary services.

The Processor or its subcontractors process the data primarily in Switzerland, Canada (British Columbia) and the European Economic Area. The Controller agrees that the data may also be processed outside of Switzerland, Canada and the European Economic Area, provided that the Processor ensures that the conditions for transferring the data to third countries in accordance with the DPA are met and the Controller is informed in advance of the export of data. The Processor shall provide proof of compliance on request.

Employees of the Processor may also process the data in private homes as part of teleworking, provided that appropriate measures have been taken. The Controller authorises the processing of such Data only if the necessary data protection and data security measures are in place. If Data of the Controller are processed in a private apartment, access to the apartment for the purpose of order control must be agreed with the Controller in advance. The Processor assures that all residents of these private apartments agree with this provision.

The Processor shall provide appropriate support to the Controller in fulfilling the requests and claims of affected persons in accordance with Chapter III of the GDPR and Chapter IV and V of the FADP respectively and in complying with the obligations set out in Art. 33 to 36 GDPR and Art. 19 to 24 FADP respectively. In principle, the Controller is responsible for implementing the rights of data subjects. The Processor implements the documented instructions of the Controller with regard to the deletion concept, the rights to be forgotten, correction, data portability and information. The Controller shall pay the processor a reasonable fee for the implementation, unless this is expressly included in the services under the Framework Agreement.

The Processor shall forward any requests from data subjects to the Controller if the request can be attributed to the Controller.

The Processor shall immediately inform the Controller if it becomes aware of any breaches of the protection of the Controller’s Data.

The Processor shall provide the Controller with appropriate evidence of compliance with the obligations laid down in this contract by any appropriate means.

If, in individual cases, inspections by the Controller or an auditor appointed by him are necessary, these will be carried out during normal business hours without disrupting operations after notification, subject to an appropriate lead time. The inspection must take appropriate account of justified confidentiality interests and legal and contractual confidentiality obligations. Prior to the audit, the auditing persons must sign a confidentiality agreement with regard to the data of the Processor as well as other customers and the technical and organisational measures set up.

All costs of the Processor (including those for the employee to be provided) are to be borne by the Controller.

The Controller and the Processor are liable to the data subjects in accordance with the provisions of Art. 82 GDPR and the FADP respectively. However, in the internal relationship between the Parties, the Processor shall be liable for the damage caused by a processing operation only if (i) he has not complied with its obligations specifically imposed on it by the DPA, or (ii) it has acted in breach of or contrary to the lawful instructions of the Controller.

Furthermore, the limitations of liability according to the Framework Agreement shall apply.

VSHN reserves the right to adapt this DPA at any time and will inform the customers in advance of the changes in a suitable manner (also in electronic form). Amendments or additions to this DPA shall become an integral part of the contract if the Customer does not object within 30 days of becoming aware of the amended provisions.

Should one or more provisions of this DPA or the remaining contract be or become invalid, ineffective or void, such provision shall be replaced by a valid and effective provision that comes closest to the meaning of the original provision and corresponds to the economic balance of the Parties.

The present contract and all disputes arising from it are subject exclusively to substantive Swiss law, excluding the conflict of laws provisions and the UN Convention on Contracts for the International Sale of Goods. Exclusive place of jurisdiction is Zurich.