Data Processing Addendum (DPA)
For B2B customers · Swiss DPA (revDSG) Art. 9
When do you need a DPA?
If your organisation processes third-party personal data via the platform, Art. 9 revDSG (the Swiss DPA) requires a written DPA. Fines for non-compliance go up to CHF 250,000 under Swiss law. If you additionally process data of EU subjects, Art. 28 GDPR applies in parallel (fines up to EUR 20 million or 4 % of global annual turnover).
What the DPA covers (GDPR Art. 28(3))
- Subject matter and duration of processing
- Nature and purpose
- Categories of data subjects and data types
- Rights and obligations of controller and processor
- Technical and organisational measures (TOMs)
- Sub-processors
- Support for data-subject rights and breach notifications
- Return or deletion after end of processing
What the Provider commits to as Processor
- Processing only on documented instructions of the controller
- Confidentiality of all personnel and sub-contractors
- TOMs per GDPR Art. 32: industry-standard encryption in-transit and at-rest, strict tenant isolation at database level, audit logging, access controls, regular encrypted backups, server hardening (detailed technical specification available on request under NDA)
- Assistance with data-subject rights
- Breach notification within 72 hours (GDPR Art. 33)
- Deletion or return of all data at end of contract
- Assistance with DPIAs (GDPR Art. 35)
- Annual audit right with 14 days’ notice
Sub-processors
| Provider | Location | Purpose | Data types |
|---|---|---|---|
| Hetzner Online GmbH | Gunzenhausen, DE (data center Falkenstein, DE) | Server, DB and AI-model hosting | All data (encrypted at rest) |
| Cloudflare Inc. | San Francisco, US | DNS, CDN, DDoS protection | IP addresses, request headers, routing metadata only |
How to conclude a DPA
Email [email protected] with subject “DPA request” and your company details, contact person, data types, expected number of data subjects, and any sector-specific requirements (FINMA, HIPAA, ISO 27018, etc.). The Provider will send a DPA draft within 5 business days.
Template download
FAQ
Do small municipalities also need a DPA?
Yes. The Swiss DPA (revDSG) does not exempt small organisations. As soon as third-party personal data is processed (resident records, tax files, HR), a DPA with each processor is required.
Can I use my own DPA template?
Yes. The Provider will review your template and respond with any necessary annexes (in particular for sub-processors and TOMs).
Does the DPA satisfy GDPR as well?
Yes. Art. 9 revDSG is largely aligned with Art. 28 GDPR. The same DPA satisfies both regimes. For Swiss customers, revDSG is the primary basis.