IT SBIT Services
Schneeberger
DEEN

This is a translation for convenience. The German version is legally binding: Auftragsverarbeitungsvertrag (Deutsch).

Data processing agreement (DPA)

between the customer of Easly (controller, hereinafter “Customer”) and IT Services Schneeberger, Kaffeestrasse 6a, 8180 Bülach (processor, hereinafter “Provider”). The agreement is concluded by confirmation when ordering and supplements the terms of use. It meets the requirements of Art. 9 of the Swiss Federal Act on Data Protection (FADP) and – where applicable – Art. 28 GDPR.

1. Subject matter, duration, purpose

The Provider processes personal data on behalf of the Customer in order to provide Easly to the Customer (hosting, operation, backup, maintenance and – upon the Customer's authorisation – support). The agreement applies for the duration of the subscription and until the data has been completely deleted.

2. Types of data and data subjects

  • Customers and contacts of the Customer: names, addresses, email addresses, telephone numbers, quotes, invoices, payment and dunning information, correspondence.
  • Suppliers: receipts, amounts, contact details.
  • Employees of the Customer: personal details, AHV number (Swiss social security number), salary and contract data, personnel documents (in part sensitive personal data).
  • Users of the instance: sign-in data, logs.

3. Instructions

The Provider processes the data only in the way the Customer itself would be permitted to, and exclusively in accordance with this agreement and the documented instructions of the Customer. The Customer's operation of the application is deemed an instruction. The Provider informs the Customer if it considers an instruction to be unlawful.

4. Confidentiality

The Provider obliges all persons who have access to the data to maintain confidentiality. It only accesses the content of an instance with a time-limited authorisation generated by the Customer in the application; every action is logged and can be viewed by the Customer. Exceptions apply only to avert an immediate danger to operations or due to a legal obligation; the Customer will be informed of this.

5. Technical and organisational measures

  • Operation on the Provider's servers in Switzerland; each instance with its own application, its own database and its own storage.
  • Encryption of the databases on the storage medium, encryption of the stored documents and of sensitive fields (e.g. AHV number) with one key per instance; transmission exclusively encrypted (HTTPS/TLS).
  • Sign-in with password and second factor (passkey or authenticator app), lock-out after repeated failed attempts, logging of sign-ins.
  • Daily encrypted backups per instance (retained: 14 days daily, 8 weeks weekly, 12 months monthly); restore at the Customer's request; recovery key kept outside the servers.
  • Access to the servers only for the Provider, with key-based sign-in; regular security updates.
  • Continuous monitoring of availability.

6. Sub-processors and third-party services

The Provider does not use any sub-processors for the operation, storage and backup of the Customer's data; the instances run on the Provider's own servers in Switzerland.

Individual convenience functions of the application – each triggered by an entry of the Customer – call public third-party services: the address search of the Federal Office of Topography swisstopo (geo.admin.ch) and of OpenStreetMap Nominatim (the address entered is transmitted), the distance calculation of OSRM/Project OSRM (coordinates are transmitted) and the exchange rate interface of the Federal Office for Customs and Border Security FOCBS for the daily VAT exchange rates (only currency and date are transmitted, no personal data). These services do not receive any further data of the instance.

If the Provider intends to use sub-processors in the future, it will inform the Customer at least 30 days in advance; the Customer may object and, in this case, terminate the agreement with effect from the change. Services that the Customer connects itself with its own accounts (e.g. Microsoft 365 or another email provider, Anthropic or OpenAI, Swiss Post) are not sub-processors of the Provider; the Customer is responsible for them. The payment processing of the subscription via PayPal only concerns the data of the Customer itself.

7. Support of the Customer

The Provider supports the Customer with appropriate means in fulfilling requests from data subjects for access, rectification and erasure as well as in data protection impact assessments. The Customer can fulfil most requests directly in the application (editing, deleting, export).

8. Data security breaches

The Provider reports a data security breach affecting the Customer's data to the Customer as quickly as possible, at the latest within 48 hours of becoming aware of it, with the available information on the nature, scope, consequences and measures taken.

9. Return and deletion

After the end of the agreement, the Customer can export its data for 30 days. Thereafter, the Provider deletes the instance and all data; backups are overwritten after a further 90 days at the latest, unless a statutory retention obligation prevents this.

10. Audits

Upon request, the Provider makes available to the Customer the information necessary to demonstrate compliance with this agreement. On-site audits are possible by prior arrangement; the effort involved may be charged.

11. Final provisions

In the event of contradictions, this agreement takes precedence over the terms of use insofar as the protection of personal data is concerned. Swiss law applies; the place of jurisdiction is Bülach (Canton of Zurich).

Last updated: October 2026, version 1.0