Data processing agreement.

Between

Edelweiss Creation SA, CHE-107.431.117, Rue des Frères-Lumière 6, 1723 Marly, Switzerland, provider of the Jenialo service,

hereinafter the processor,

and

the client organisation named at the time of subscription,

hereinafter the controller.

1. Purpose and term

This agreement governs the processing of personal data that the processor carries out on behalf of the controller as part of the Jenialo service.

It takes effect on subscription and ends with it. The obligations of confidentiality and return of data survive it.

2. Roles

The controller determines the purposes and means of the processing of the data of its volunteers, participants and donors. It is responsible for compliance with applicable law, in particular the duty to inform data subjects and to have a legal basis.

The processor processes this data only on documented instructions, within the meaning of Art. 9 FADP.

The processor is, however, the controller for its own client data: administrator accounts, invoicing, support. This data is not covered by this agreement but by the Jenialo privacy policy.

3. Nature of the processing

4. Sensitive data

The service allows the controller to create its own fields. Depending on their content, for example dietary restrictions, medical skills or health information, these fields may reveal sensitive data within the meaning of Art. 5 let. c FADP, in particular data on health or on religious beliefs.

The controller acknowledges that:

• it alone decides to create such fields and to collect such data;
• if it does so, the consent of the data subjects must be explicit, within the meaning of Art. 6 para. 7 let. a FADP.

By default, the service creates no field likely to reveal sensitive data.

The processor provides a space for the controller's privacy notice and an explicit consent checkbox on the public form, and records the date and time of this consent.

5. Instructions

The processor processes the data only on the instructions of the controller. The following constitute documented instructions: this agreement, the terms and conditions, and the use of the service by the controller's accounts.

The processor informs the controller if it considers that an instruction infringes applicable law.

The processor never uses the controller's data to demonstrate, improve or train anything. The service's demo organisation is filled with generated data, never with a client's real data.

6. Confidentiality

Every person authorised to process this data is bound by confidentiality, through an employment contract or a separate undertaking, and this obligation survives the end of their work with the processor.

Access by the processor's staff to an organisation's data is limited to what support requires. In particular, the platform's administration screen gives access to organisations and their subscription status only, not to volunteers, donors or documents. Each access is logged, and this log is made available to the controller on request.

7. Security measures

The measures below are in place and verified. They may change, but never in a way that lowers the level of protection.

Separation. Each organisation is isolated by row-level security policies, active on all tables. This isolation is verified by a set of tests run again after every change to the database schema: cross-organisation reading, writing and inserting, with a positive control.

Hosting in Switzerland. Application and server at Infomaniak, in Swiss data centres. Database, authentication and files at Supabase, Zurich region.

Encryption. End-to-end HTTPS transport. Account passwords hashed by the authentication provider. Organisations' email login details encrypted in the database.

Access. Administration accounts are protected by a password; passwords known to have been exposed in a data leak are refused. The account giving access to the production infrastructure is protected by two-factor authentication.

Backups. The database is backed up daily by the hosting provider. Files, that is certificates, reports, donation receipts, documents and signatures, are backed up every night with a second Swiss provider, independent of the database hosting provider, with overwritten or deleted versions kept for ninety days. Restoration is tested periodically.

Erasure. The service allows a volunteer record to be permanently deleted, with no residual copy kept.

Data availability in the event of non-payment. In the event of non-payment or termination, access becomes read-only before any suspension. Reading, filtering, exporting and downloading remain possible. An organisation can therefore always retrieve its data, even when it stops paying.

8. Subprocessors

The controller authorises the use of the following subprocessors:

Stripe does not process any volunteer data. It processes the organisation's billing data and the payment details of the person who subscribes.

The processor keeps this list up to date on a public page. It informs the controller of any addition or replacement at least thirty days in advance. The controller may object for a serious reason relating to data protection; if no agreement is reached, it may terminate free of charge, with a pro rata refund of the period already paid for.

The processor imposes on each subprocessor obligations equivalent to those of this agreement and is liable for their breaches as for its own.

9. Transfers outside Switzerland

Volunteer data remains hosted in Switzerland.

Supabase Inc. is a company governed by United States law, although the data is hosted in Switzerland: Supabase's data processing agreement and its standard contractual clauses apply. Stripe, for billing data, operates from Ireland and the United States, on the basis of an adequacy decision or standard contractual clauses depending on the contracting entity.

Push notifications are routed through the notification service of the browser or operating system of the data subject's device, in particular Apple, Google or Mozilla. Their content is end-to-end encrypted and cannot be read by these services.

10. Assistance

The processor assists the controller, to a reasonable extent and taking into account the nature of the processing, in:

• responding to requests for access, rectification, erasure and handover of data;
• carrying out an impact assessment where one is required;
• demonstrating compliance with its obligations.

The service provides the export functions needed to respond to these requests without involving the processor.

11. Data security breach

The processor notifies the controller of any data security breach as soon as possible and no later than forty-eight hours after becoming aware of it.

The notification describes the nature of the breach, the categories and approximate number of data subjects, the likely consequences and the measures taken.

Notification to the Federal Data Protection and Information Commissioner (FDPIC), within the meaning of Art. 24 FADP, is the responsibility of the controller, with the assistance of the processor.

12. Retention periods

Unless otherwise instructed by the controller:

13. End of the agreement

At the end of the agreement, the controller has ninety days to export its data, during which read access remains open.

At the end of this period, the processor erases the data, unless there is a legal obligation to retain it. Backups follow their own cycle and are erased no later than ninety days afterwards.

The processor confirms the erasure in writing on request.

14. Audit

The controller may request, once a year and with thirty days' notice, the information needed to verify compliance with this agreement.

An on-site audit is possible if justified by a serious reason, at the expense of the requesting party, without disrupting the service and without access to other organisations' data.

15. Liability

15.1 Each party is liable to the other for the damage it causes by breaching this agreement.

15.2 The processor's liability is limited to direct damage actually suffered. To the extent permitted by law, the following are excluded: loss of profit, damage to reputation, indirect or consequential damage, and loss of data that the controller could have restored from the exports made available to it.

15.3 The processor's liability is also capped, per calendar year and for all claims combined, at the higher of the following two amounts: the total sums paid by the controller in the twelve months preceding the event giving rise to the claim, or CHF 1’000.

15.4 Sections 15.2 and 15.3 do not apply to unlawful intent or gross negligence (Art. 100 para. 1 of the Swiss Code of Obligations).

15.5 This article governs the relationship between the parties. It restricts neither the rights of data subjects towards either party nor the powers of the Federal Data Protection and Information Commissioner (FDPIC). A controller that compensates a data subject for a breach attributable to the processor retains its right of recourse, within the limits of the preceding sections.

15.6 The controller is liable for the consequences of its own choices and indemnifies the processor against any third-party claim arising from them, in particular where:

• it processes data without a legal basis, or without having informed the data subjects;
• it collects, through the fields it has created, sensitive data within the meaning of Article 4 without having obtained the explicit consent required by Art. 6 para. 7 let. a FADP;
• it maintains an instruction that the processor has reported to it as unlawful under Article 5;
• it publishes or disseminates itself data to which the service gives it access.

15.7 The controller keeps its own exports. The processor backs up the data in accordance with Article 7, without this releasing the controller from its own duty of care.

16. Changes to this agreement

The processor may adapt this agreement, in particular to take account of changes in the law, in the security measures or in the list of subprocessors.

Any change is notified to the controller at least thirty days before it takes effect, by email to the billing address and by a notice in the service. A change may under no circumstances lower the agreed level of protection.

A controller that refuses a change may terminate its subscription up to the date the change takes effect, with a pro rata refund of the period already paid for. Continued use of the service after that date constitutes acceptance.

17. Conclusion and acceptance

This agreement is concluded electronically when a subscription is taken out. The controller accepts it by ticking a checkbox separate from the one for the terms and conditions. The date, time and version accepted are recorded, and the text of that version remains accessible from the service.

The processor keeps each published version for as long as an organisation remains bound by it, and for at least ten years after the end of the last subscription concluded under it.

A handwritten signature is not required. The parties may nevertheless agree on a signed copy; it then prevails over the electronic acceptance for the relationship concerned.

18. Governing law, jurisdiction and language

Swiss law. Place of jurisdiction at the processor's registered office, subject to mandatory places of jurisdiction.

This agreement exists in French, German and English. If they differ, the French version prevails.

A question about this agreement? Write to us.