Data processing agreement

1. Subject matter and scope

This agreement applies between the customer as the controller and Swiss GU Group GmbH, which operates under the Swizz-IT brand (hereinafter “Swizz-IT”), as the processor. It governs the processing of personal data that Swizz-IT carries out on behalf of the customer when providing its services, in accordance with Art. 9 of the Swiss Federal Act on Data Protection (FADP) and, where applicable, Art. 28 of the EU General Data Protection Regulation (GDPR).

The agreement forms part of the terms and conditions and applies once they are accepted, without a separate signature. The confirmation available in the customer panel only serves as proof. The privacy policy applies to personal data that Swizz-IT processes as a controller, such as the information in the customer account and in invoices.

2. Nature, purpose and duration of processing

• Nature and purpose: storing, providing, transmitting, backing up and deleting data, insofar as this is necessary for the products ordered (web hosting, email, Website Builder and other products).
• Data: all personal data that the customer stores on their hosting, in databases, in mailboxes or in other products, or has collected from visitors to their website, including the logs of their website.
• Data subjects: in particular visitors to the customer's websites, the customer's own customers, employees and contacts, and persons with whom the customer corresponds by email.
• Duration: for as long as the contract for the product concerned runs, and until deletion under section 10.

As a rule, Swizz-IT does not know the customer's content and only takes note of it insofar as this is necessary for operation, for support or for averting risks. If the customer stores particularly sensitive personal data, they check themselves whether the services are suitable for this.

3. Instructions

Swizz-IT only processes the data in the way the customer would be permitted to do themselves, and only on the customer's documented instructions. The terms and conditions, the order and the settings that the customer makes in the customer panel count as instructions. The customer gives further instructions in text form, for example by support ticket. Instructions that go beyond the agreed scope count as an additional service under section B7 of the terms and conditions.

If Swizz-IT considers that an instruction violates data protection law, it informs the customer and may suspend its execution until the matter is clarified. If Swizz-IT is legally obliged to carry out processing, for example by an order of an authority, it informs the customer in advance, unless the law prohibits this.

4. Confidentiality

Swizz-IT only grants access to the data to persons who need it for their tasks. These persons are bound by confidentiality, also beyond the end of their activity, unless they are already subject to a statutory duty of confidentiality.

5. Technical and organizational measures

In particular, Swizz-IT takes the following technical and organizational measures:

• Connections to the website and to the customer panel are encrypted with HTTPS.
• Passwords for the customer panel are only stored as a non-reversible hash; logins are temporarily blocked after repeated failed attempts.
• Forms in the customer panel are protected against forged requests, and the admin area can only be reached at a separate address.
• Each web hosting account runs under its own system user and its own PHP processes, whose file access is limited to the account's own directory and temporary files.
• Login attempts are logged and deleted after 7 days.
• The physical security of the servers, in particular access, power supply and air conditioning, is ensured by the data center operator.

Swizz-IT adapts the measures to the state of the art. The level of protection must not decrease in the process. Under the terms and conditions, the customer is responsible for the security of their own applications, passwords and backups.

6. Subprocessors

The customer allows Swizz-IT to involve subprocessors of the following categories. Swizz-IT contractually obliges them to provide an equivalent level of data protection.

Swizz-IT announces the involvement of a new subprocessor or the replacement of an existing one by email at least 30 days in advance. The customer may object in text form for important reasons of data protection law. If the parties do not find a solution, the customer may cancel the products concerned as of the date of the change.

Swizz-IT only discloses data to countries with an adequate level of data protection or with appropriate safeguards, such as standard contractual clauses recognized by Switzerland.

7. Support with the rights of data subjects

If a data subject asserts their rights, for example to access, correction or deletion, the customer is responsible for this. The customer can view, change and delete much of the data themselves in the customer panel or in their applications. If a data subject contacts Swizz-IT directly, Swizz-IT forwards the request to the customer.

Insofar as the customer cannot answer the request themselves, Swizz-IT supports them with appropriate measures. It likewise supports the customer, within the scope of the information available to it, with data security, data protection impact assessments and notifications to authorities. Expenses beyond the agreed scope are charged under section B7 of the terms and conditions.

8. Notification of data security breaches

Swizz-IT notifies the customer as quickly as possible after becoming aware of it of any data security breach that affects the customer's data. The notification is sent to the email address stored in the customer account and contains, as far as known, the nature of the breach, the data and persons affected, the possible consequences and the measures taken.

As the controller, the customer assesses whether a notification to the competent authority or to the data subjects is necessary; Swizz-IT supports them in this under section 7.

9. Proof and audits

On request, Swizz-IT provides the customer with the information they need to demonstrate compliance with this agreement. Further audits, also by an expert commissioned by the customer and bound to confidentiality, are possible after prior notice in text form with a reasonable period. They take place during business hours and must not affect the operation and the data of other customers. The expenses of Swizz-IT are charged under section B7 of the terms and conditions.

10. Return and deletion at the end of the contract

During the term of the contract, the customer can download their data themselves at any time, for example via file access (FTP), the database backup in the customer panel or their email program. This counts as the return of the data.

After the contract ends, Swizz-IT deletes the customer's data under section A15 of the terms and conditions, that is, 30 days after the end of the contract. Data in backups is overwritten as part of the usual backup cycle. Statutory retention obligations remain reserved.

11. Liability, term and order of precedence

Section A13 of the terms and conditions applies to liability. This agreement applies as long as Swizz-IT processes personal data on behalf of the customer. In the event of contradictions with the terms and conditions, it takes precedence in matters of data protection. Changes are governed by section A18 of the terms and conditions. Swizz-IT answers questions about this agreement at info@swizz-it.com.