DATA PROCESSING AGREEMENT

Art. 1 Subject matter and roles

1. This Agreement governs the processing of Client Data within the meaning of the GTC — any information submitted in the Solution by the Client or its Users, as well as the answers generated — which the Provider processes on behalf of the Client. The obligations arising from the FADP apply to the personal data contained in Client Data.
2. The Client is the controller (Art. 5 let. j FADP); the Provider acts as processor (Art. 5 let. k and Art. 9 FADP).
3. For its own processing (account management, invoicing, support, website), in particular of data relating to the Client and its Users, the Provider acts as controller; such processing is described in the Privacy Notice published on its website and does not fall within the scope of this Agreement.
4. In the event of any inconsistency, the Contract prevails over this Agreement, which prevails over the GTC.
5. The terms “Solution” and “User” have the meaning given to them in the GTC.

Art. 2 Categories of data and of data subjects

1. Data processed: content of conversations (prompts and answers), uploaded documents, voice recordings submitted for transcription, technical metadata and access logs. Client Data may include sensitive personal data within the meaning of Art. 5 let. c FADP, in particular data relating to criminal and administrative proceedings or sanctions, to health or to views.
2. Data subjects: the Client’s employees and auxiliaries, its clients and principals, its business partners and suppliers, as well as the third parties appearing in the files and documents submitted (opposing parties, witnesses, experts and other persons mentioned). Only natural persons are data subjects within the meaning of the FADP (Art. 5 let. b FADP); information relating to legal entities is protected by the confidentiality undertakings of the Contract.
3. Purpose: the provision of the functions of the Solution (research, analysis, translation, transcription, assisted drafting, assistance with administrative tasks) and technical support. Any other purpose is excluded.

Art. 3 Instructions from the Client

1. The Provider processes Client Data exclusively on the documented instructions of the Client. The Contract, this Agreement and the use of the functions of the Solution by the Client’s Users constitute the documented instructions.
2. Any additional instruction is given in writing. If the Provider considers that an instruction infringes data protection law, it informs the Client without delay.

Art. 4 Location of processing

1. Client Data is hosted and processed exclusively in Switzerland, on infrastructure owned by the Provider and under its exclusive control. This exclusivity covers all stages of processing, in particular hosting and backups, AI model inference, the computation of vector representations (embeddings), the re-ordering of results (reranking), vector search, speech transcription and document analysis. No third-party provider, whether a cloud service or any other IT service, processes or has access to Client Data, subject to Art. 9 and to the transmissions under para. 2.
2. Only the following transmissions are reserved:
   1. the Internet searches that the Solution carries out to supplement its answers, unless disabled at the Client’s request (Art. 3 para. 3 GTC): only the search keywords are transmitted to public search engines, through a relay operated by the Provider that does not reveal to them who is carrying out the search, and the searches carried out are shown with the answer;
   2. the consultation of the official compilations of legislation (Fedlex and official cantonal compilations), which transmits only the reference of the legal text or of the article consulted, for example “FADP” or “Art. 321 SCC”, to the exclusion of any content submitted by the Client;
   3. the disclosures required by a legal obligation, under the conditions of Art. 12 of this Agreement.
3. Any disclosure of Client Data abroad, including in the case of para. 2 let. a, complies with Arts 16 and 17 FADP; outside the cases provided for in para. 2, it also requires the prior written agreement of the Client.

Art. 5 Confidentiality of staff

1. The Provider warrants that any person authorised to process Client Data is bound by a written and individual confidentiality undertaking, which survives the end of the employment or mandate relationship, and that this person is made aware of the professional duty of confidentiality under Art. 62 FADP, which carries criminal penalties.
2. Where the Client is subject to professional secrecy protected by Art. 321 SCC, the Provider’s staff act as auxiliaries within the meaning of that provision and are informed of the criminal consequences of a breach.

Art. 6 Access to Client Data

1. The Provider does not access the content of conversations or uploaded documents, subject to an express request from the User concerned, in particular for the purposes of technical assistance or the resolution of an incident, and to requests from authorities handled in accordance with Art. 12.
2. Any access is limited to what is strictly necessary for the purpose pursued, authorised by name and logged. The list of roles authorised to access Client Data is kept up to date by the Provider and communicated to the Client on request.

Art. 7 Security of processing

1. The Provider implements the appropriate technical and organisational measures within the meaning of Art. 8 FADP and Arts 1 to 3 DPO, in order to ensure the confidentiality, availability, integrity and traceability of Client Data.
2. These measures include in particular: encryption of data in transit and at rest; two-factor authentication; logical and physical access control; infrastructure monitoring and anomaly detection; regular backups; security updates of systems.
3. The measures are reassessed regularly and adapted to changing risks and to the state of the art.

Art. 8 Logging

1. The Provider logs the relevant operations on Client Data, including access, in accordance with Art. 4 DPO.
2. The log files are retained for at least twelve months, separately from the processing system. Extracts concerning Client Data are provided to the Client on request.

Art. 9 Sub-processing

1. The Provider does not currently use any sub-processor for the processing of Client Data.
2. The Provider may only use a sub-processor with the prior written authorisation of the Client (Art. 9 para. 3 FADP). It submits to the Client in writing, at least 30 days in advance, any plan to add or replace a sub-processor; failing authorisation, each Party may terminate the Contract with effect from the date on which the change takes effect.

Art. 10 Breaches of data security

1. The Provider notifies the Client of any breach of data security within the meaning of Art. 5 let. h FADP as quickly as possible, and at the latest 72 hours after its discovery.
2. The notification specifies at a minimum the nature of the breach, the categories of data and of data subjects concerned, its likely consequences and the measures taken or planned.
3. The Provider assists the Client in fulfilling its obligations to notify the FDPIC (Art. 24 FADP) and to inform the data subjects. It documents breaches and the measures taken.

Art. 11 Assistance to the Client

1. The Provider assists the Client, to a reasonable extent, in responding to requests from data subjects (Art. 25 et seq. FADP). It forwards to the Client without delay any request addressed directly to it, without responding to it on the merits.
2. The Provider provides the Client with the information necessary for carrying out a data protection impact assessment (Art. 22 FADP).

Art. 12 Requests from authorities

1. If an authority requires the Provider to grant access to Client Data or to hand it over, the Provider: (i) informs the Client immediately, unless prohibited by law; (ii) verifies the validity of the request and complies with it only to the extent strictly required by law; (iii) points out to the authority the protected secrets that apply, in particular where the data may fall under Art. 264 para. 1 CrimPC, and the fact that the Client is their proprietor; (iv) in the event of seizure of data covered by Art. 264 para. 1 CrimPC, points out to the Client that it may request sealing, either itself as proprietor, within the three-day time limit that the authority must grant it (Art. 248 para. 2 CrimPC), or through the Provider, which must request sealing as holder within three days of the items being secured (Art. 248 para. 1 CrimPC); (v) complies with the Client’s decision and, failing instructions from the Client before the time limit under Art. 248 para. 1 CrimPC expires, requests sealing itself in order to preserve the Client’s rights; (vi) does not hand over any data of its own accord.
2. The Provider supports the Client in exercising its legal remedies.

Art. 13 Retention, return and destruction

1. Client Data is retained for the term of the Contract. The User may delete their conversations and documents at any time; deletion is final, as the Provider does not restore deleted content, subject to its presence in backups until the expiry of the period provided for in para. 3.
2. At the end of the Contract, the Client has a 30-day read-only access window to export its Client Data in a structured and commonly used format.
3. At the end of this window, the Provider securely destroys all Client Data and provides a certificate of destruction on request. Client Data contained in backups is destroyed at the latest on expiry of the retention period of those backups, i.e. 30 days after their creation.
4. The retention of the Provider’s accounting vouchers (Art. 958f CO, ten years) is reserved, to the exclusion of any Client Data submitted in the Solution.
5. The log files (Art. 8) are retained for the period provided for in Art. 8 para. 2, then destroyed.

Art. 14 Verification

1. On written request from the Client, the Provider provides it with the information necessary to demonstrate compliance with this Agreement, in particular a description of the security measures provided for in Art. 7.
2. The Provider is not required to provide information the disclosure of which would compromise the security of the Solution or reveal its business secrets.
3. Any audit or inspection requires the prior written agreement of the Provider, which determines its arrangements.

Art. 15 Client’s warranties

1. The Client warrants that, for all of its Client Data, it has a sufficient ground for justification within the meaning of Art. 31 FADP or any other applicable legal basis, that it fulfils its duties to provide information (Art. 19 et seq. FADP) and that it assumes all of its obligations as controller.
2. The Client holds the Provider harmless against any third-party claim resulting from a breach by the Client of the warranties under this Article.

Art. 16 Final provisions

1. This Agreement takes effect with the Contract and remains in force for as long as the Provider processes Client Data.
2. The liability of the Parties is governed by the Contract and the GTC.
3. This Agreement is governed by Swiss law. Any dispute falls within the exclusive jurisdiction of the courts at the Provider’s registered office.