Data processing agreement

1. Parties and scope

This data processing agreement (“DPA”) is concluded between the customer that uses SchweizerIMG for business purposes (“controller”) and SchweizerIMG, operated by the sole proprietorship named at the end of this DPA (“processor”). It forms part of the terms of use and governs processing on behalf of the controller under Art. 9 of the Swiss Federal Act on Data Protection (FADP) and, where applicable, Art. 28 GDPR. On data protection, it takes precedence over the terms of use.

2. Subject matter of the processing

The image tools run in the browser of the controller's users. Images, their content and metadata, file names and results are processed on the users' devices and are not transmitted to the processor; they are not covered by this DPA. Per tool run, the processor receives only the tool and the outcome of the run.

3. Instructions

The processor processes the personal data only on documented instructions of the controller. These instructions are the terms of use, this DPA and the settings and functions of the service (for example deleting an account). The processor informs the controller if it considers an instruction to infringe data protection law.

4. Confidentiality

The processor ensures that the persons authorised to process the personal data are bound to confidentiality. Administrative access is limited to the persons who need it to operate the service.

5. Technical and organisational measures

The processor takes appropriate technical and organisational measures, in particular:

• image processing in the browser, and a website configured to connect only to the processor's own server;
• encrypted connections (HTTPS);
• passwords stored only as hashes, short-lived sign-in codes, session expiry and a confirmation step for sensitive actions;
• protection against cross-site request forgery, limits on repeated requests and blocking of abusive IP addresses;
• a record of security-relevant actions, with IP addresses removed after 90 days;
• hosting in Switzerland and regular database backups kept for a limited time.

6. Data security breaches

The processor informs the controller without undue delay after becoming aware of a data security breach affecting the controller's personal data, with the information available at that time.

7. Assistance

As far as reasonable, the processor assists the controller in answering requests from data subjects and in meeting its obligations regarding data security, breach notifications and data protection impact assessments. Many requests can be handled directly in the service, for example by deleting an account. The processor may charge for effort beyond the ordinary.

8. Sub-processors

The controller gives a general authorisation for the use of sub-processors. The processor uses the following:

The processor announces changes on this page before they take effect. If the controller does not agree with a change, it may end the contract before the change takes effect.

Payments by Stripe concern only the customer's own billing data, which the processor processes as controller; they are described in the privacy policy and are not part of this DPA.

9. Transfers abroad

The personal data is processed in Switzerland and, for e-mail delivery, in Norway, Germany and Finland, which the Federal Council recognises as providing adequate data protection. Any other transfer abroad requires the safeguards of the FADP.

10. Information and audits

On request, the processor demonstrates compliance with this DPA by written information, such as a description of its measures and the list of sub-processors. On-site audits take place only where the law or an authority requires them, with reasonable notice and at the controller's expense.

11. Deletion

When a user account is deleted, its account data, sessions, usage records and subscription records are deleted. The other data is deleted after the periods in the privacy policy, in particular e-mail logs and IP addresses in security records after 90 days, usage records after 13 months and backups after 14 days. Data subject to statutory retention, such as invoices, is kept as long as the law requires. At the end of the contract, the controller deletes its users' accounts or has them deleted.

12. Liability

Liability under this DPA is governed by the terms of use, including their exclusions and their limit; that limit applies to claims under the terms of use and this DPA together.

13. Term

This DPA applies for as long as the processor processes personal data on behalf of the controller, and ends with the contract under the terms of use.

14. Changes

The processor may change this DPA by publishing a new, dated edition. Material changes are announced at least 30 days before they take effect. Earlier editions remain available in the archive.

15. Applicable law and jurisdiction

This DPA is governed by Swiss law. The exclusive place of jurisdiction is Pfäffikon SZ, Switzerland, subject to mandatory places of jurisdiction.