Data Processing Agreement

Preamble

This Data Processing Agreement ("DPA") applies between Byteful GmbH, UID CHE-444.024.798 ("Klarino"), and the customer who uses Klarino's services under the General Terms and Conditions ("Terms") ("Customer").

The Customer is the controller of the personal data that the Customer records, imports, receives or sends in Klarino ("Customer Data"); Klarino processes it as a processor solely on the Customer's behalf. This DPA sets out the obligations under Art. 9 of the Swiss Federal Act on Data Protection ("FADP") and, where applicable, Art. 28 of the EU General Data Protection Regulation ("GDPR"). It forms part of the Terms and is agreed when the Terms are accepted. Data that Klarino processes for its own purposes (e.g. account, contract and billing data) is governed by the Privacy Policy. Terms have the meaning given in the FADP or the GDPR. The Customer sends data protection enquiries and instructions to [email protected].

1) Subject matter and purpose

1.1 Klarino processes Customer Data solely to provide the services under the Terms. The nature of the processing, the categories of data and the data subjects are set out in Annex 1; the data actually processed is determined by the Customer's use of the services.

1.2 Klarino does not process Customer Data for its own purposes. The Customer instructs Klarino to create anonymised or aggregated statistics from usage data that do not allow any conclusions to be drawn about customers or data subjects and that serve solely the operation, security and improvement of the services.

2) Instructions

2.1 Klarino processes Customer Data only on the Customer's documented instructions, including with regard to disclosures abroad. Instructions are the Terms, this DPA, and the configuration and use of the services by the Customer and its users. The Customer gives further instructions in text form; where an instruction goes beyond the agreed scope of services, Klarino may charge reasonable compensation.

2.2 If Klarino considers an instruction to infringe data protection law, Klarino informs the Customer without delay and may suspend its execution until the Customer confirms or changes it.

2.3 If Klarino is required by law to process Customer Data, Klarino informs the Customer in advance unless the law prohibits this.

3) Confidentiality and data security

3.1 Access to Customer Data is granted only to persons who need it to provide the services and who are bound to confidentiality by contract or by law, including after their engagement ends. Klarino accesses Customer Data only where necessary for operation, maintenance, security or support, or at the Customer's request.

3.2 Klarino implements the technical and organisational measures ("TOMs") set out in Annex 2 (Art. 8 FADP, Art. 32 GDPR) and may develop them further provided the level of protection does not decrease.

4) Sub-processors

4.1 The Customer gives general authorisation for the use of sub-processors. Those listed in Annex 3 are deemed authorised. The current list is available at klarino.app/en/privacy (section "Sub-processors for Customer Data").

4.2 Klarino informs the Customer of intended changes at least 30 days in advance by email to the owners of the workspace. If an immediate replacement is required for reasons of security or availability, Klarino informs the Customer without delay afterwards.

4.3 The Customer may object within 14 days of being informed for an important reason relating to data protection. If the parties cannot find a solution, the Customer may terminate the contract without notice; fees already paid for the period after termination are refunded pro rata.

4.4 Klarino contractually imposes on each sub-processor data protection obligations at least equivalent to those in this DPA and is liable for their compliance as for its own conduct.

5) Disclosure abroad

Klarino processes Customer Data in Switzerland and the EEA unless Annex 3 states otherwise. Customer Data is disclosed to a country without an adequate level of data protection (Annex 1 of the Swiss Data Protection Ordinance or an adequacy decision of the European Commission) only with appropriate safeguards, in particular the European Commission's Standard Contractual Clauses with the adaptations required for Switzerland, or certification under the Swiss-U.S. or EU-U.S. Data Privacy Framework. Annex 3 states the location and safeguard for each sub-processor.

6) Assistance to the Customer

6.1 Klarino assists the Customer with requests from data subjects through the functions of the services (e.g. export, rectification, erasure). If a data subject contacts Klarino directly, Klarino forwards the request to the Customer without delay.

6.2 Klarino notifies the Customer of a breach of data security affecting Customer Data without delay after becoming aware of it, provides the information needed for any notifications (and any missing details as soon as they become available), and takes measures without delay to remedy the breach and mitigate its effects.

6.3 Klarino assists the Customer to a reasonable extent with data protection impact assessments, prior consultations and notifications to the Federal Data Protection and Information Commissioner (FDPIC) or other supervisory authorities. Klarino may charge on a time-and-materials basis for assistance that goes beyond the functions of the services and is not caused by a breach of duty by Klarino.

7) Evidence and audits

7.1 On request, Klarino provides the Customer with the information needed to demonstrate compliance with this DPA, in particular a current description of the TOMs and any certificates or audit reports.

7.2 If this information is not sufficient, the Customer may have an audit carried out once per calendar year (more often after a breach of data security or when ordered by an authority) by an independent auditor bound to confidentiality. The audit must be announced at least 30 days in advance, must not disrupt operations disproportionately and does not cover other customers' data. Each party bears its own costs.

8) Deletion and return

8.1 The Customer can export and delete Customer Data at any time using the functions of the services. After the contract ends, Klarino deletes the Customer Data within 30 days unless a statutory retention obligation applies; until then, the Customer can export it. If the Customer deletes its workspace itself, deletion begins immediately.

8.2 Copies in backups are deleted after 30 days at the latest. Until then, they remain protected by the TOMs and are no longer actively processed. On request, Klarino confirms the deletion in text form.

9) Final provisions

9.1 This DPA applies for the term of the contract under the Terms. Confidentiality and deletion obligations continue after the contract ends.

9.2 Liability is governed by the Terms; mandatory statutory provisions, in particular Art. 82 GDPR, remain reserved.

9.3 Klarino may amend this DPA where required by changes in the law, requirements of authorities or the further development of the services, provided the level of protection does not decrease. Klarino informs the Customer at least 30 days before the amendment takes effect. Every version is available with its date.

9.4 In the event of conflict, this DPA takes precedence over the Terms with regard to the processing of Customer Data; an individually concluded DPA takes precedence over this one. Otherwise the Terms apply, including the choice of law, place of jurisdiction and severability clause.

Annex 1: Subject matter of the processing

The core functions apply to every customer; add-on functions apply only where they are included in the subscription and the Customer uses them.

Area	Scope	Nature of processing	Typical data categories
Databases and apps	Core function	Storing, querying, analysing, exporting	Fields defined by the Customer, e.g. name, contact details, company, notes, contract and transaction data
User management	Core function	Managing users and permissions	Name, email address, role, log data
Files	Core function	Storing and providing	Contents of uploaded files
Forms	Core function	Receiving submissions, bot protection	Form submissions, IP address, technical browser data
Newsletter and email sending	Add-on	Recipient management, sending, delivery and open statistics	Email address, name, language, proof of consent, unsubscribe status, interaction data
Email inbox	Add-on	Receiving and storing	Sender, recipients, subject, content, attachments
Knowledge base	Add-on	Indexing and searching	Contents of documents
AI functions and voice input	Add-on	Processing of inputs by language models, transcription	Inputs, voice recordings, the Customer Data used for them

Data subjects: the Customer's contacts, customers, prospects, newsletter subscribers, members, employees and business partners, and the users of its workspace.

Special categories: The services are not designed for sensitive personal data (Art. 5 lit. c FADP, Art. 9 GDPR). If the Customer processes such data, the Customer ensures that the TOMs in Annex 2 are sufficient for it.

Annex 2: Technical and organisational measures

Objective	Measures
Physical security	Data centres of Hetzner Online GmbH in Germany (ISO 27001) with access control and video surveillance; no physical access by Klarino
Access to systems	Personal accounts; password policy; two-factor authentication available to users; server access only via SSH key for authorised persons
Access to data	Role and permission model; tenant separation at application level; administrative access by Klarino only when needed (§3.1)
Transmission	TLS encryption for all connections to the services and to sub-processors
Logging	Logging of security-relevant events; application and error logs with limited retention and data minimisation
Availability	Daily database backups in separate object storage; monitoring of servers, services and backups; regularly tested restores
Separation	Separate environments for development, testing and production; no production data in test environments
Organisation	Confidentiality undertakings; process for security incidents (§6.2); regular review of the measures; careful selection of sub-processors

Annex 3: Sub-processors

Sub-processors for add-on functions receive Customer Data only if the Customer uses that function.

Sub-processor	Purpose	Location
Hetzner Online GmbH	Hosting, files, backups	Germany
Amazon Web Services EMEA SARL (Amazon SES)	Email and newsletter sending	Germany
Cloudflare, Inc.	Receiving inbound email, bot protection (Turnstile)	USA
OpenAI	AI functions	USA
Anthropic	AI functions	USA
Google (Gemini)	AI functions	USA
PostHog, Inc.	Product analytics and monitoring of AI functions	EU (Germany)
Functional Software, Inc. (Sentry)	Error monitoring	USA

If the Customer uses its own provider for sending email (e.g. its own SMTP, Postmark, SendGrid), that provider is not a sub-processor of Klarino; the contractual relationship exists directly between the Customer and the provider.