Data processing agreement (DPA)

This English translation is provided for information purposes only. Only the German version of this document is legally binding.

This data processing agreement (the «DPA») specifies the data protection obligations between the Customer as the controller and Tailored Intelligence GmbH, Reistelstrasse 294, 5728 Gontenschwil, UID CHE-348.980.291 (the «processor» or «we») for the processing of personal data in connection with the use of Trophy.

The DPA applies under Art. 9 revFADP and — for data subjects in the EU or EEA — under Art. 28 GDPR. Pursuant to clause 19.2 of the general terms and conditions, it is an integral part of the contract between the parties and requires no separate signature. On request we additionally issue a signed copy.

1 · Subject matter, nature, and purpose of processing

1.1 The processor processes personal data exclusively to provide the services set out in the general terms and conditions, in particular operating the Trophy platform, connecting to the controller’s Google Business Profile, producing and linking the review media, and delivering the marketing services included in the booked package.

1.2 Nature of processing: in particular collection, storage, hosting, organisation, retrieval, disclosure within the system and to the sub-processors listed in Annex B, backup, and deletion.

1.3 The processor does not use the data for its own purposes. The data is not used to train artificial intelligence models, and such use is contractually excluded with the providers listed in Annex B.

2 · Duration

Processing takes place for the duration of the main contract. Obligations that by their nature continue — in particular deletion and return as well as confidentiality — apply beyond that.

3 · Data subjects and categories of data

3.1 Data subjects: the controller’s staff, owners and other users of the customer account, guests of the controller who leave a review or feedback, and, where website services are booked, visitors to the controller’s website.

3.2 Categories of personal data:

• Staff: first name and, where applicable, last name, personal identifier of the assigned tag or card, scan and review activity, team ranking, statistics, and awards
• Account users: name, email address, role assignment, login and log data
• Guests: content of publicly accessible Google reviews (name as displayed by Google, review text, star rating, timestamp), replies by the controller, and where applicable the content of privately submitted feedback
• Technical data: IP addresses and access logs for abuse prevention and rate limiting, truncated or pseudonymised where technically possible
• Where website services are booked: usage data of visitors to the customer website, to the extent of the tools deployed and consented to there

3.3 Special categories of personal data are not subject to processing. The controller ensures that such data is not transmitted via Trophy.

4 · Instructions

4.1 The processor processes personal data exclusively on documented instructions from the controller, unless a legal obligation requires otherwise. In that case the processor informs the controller in advance, where legally permitted.

4.2 The main contract including the package description, and the configuration made by the controller in the dashboard, constitute documented instructions. Further instructions are given in text form.

4.3 If the processor considers an instruction unlawful, it informs the controller and may suspend execution until the matter is clarified.

5 · Confidentiality

The processor obliges the persons involved in the processing to maintain confidentiality and grants access only to the extent necessary to perform their tasks (need-to-know). The obligation continues beyond the end of their activity.

6 · Technical and organisational measures

The processor takes appropriate technical and organisational measures to protect the data in accordance with Annex A and adapts them to the state of the art. The measures may be developed further, provided the level of protection is not reduced.

7 · Sub-processors

7.1 The controller authorises the engagement of the sub-processors listed in Annex B.

7.2 The processor contractually obliges sub-processors to equivalent data protection obligations.

7.3 Changes. The processor notifies the controller by email of intended changes — the addition of a new sub-processor or the replacement of an existing one — at least 30 days in advance. The controller may object to the change within this period on important data protection grounds. If the objection cannot be resolved with reasonable effort, the controller has an extraordinary right of termination effective on the date of the change.

8 · Assistance to the controller

8.1 The processor assists the controller with appropriate measures in fulfilling data subject rights (access, rectification, erasure, restriction, portability, objection). If a data subject contacts the processor directly, the processor forwards the request to the controller without delay.

8.2 The processor assists with the security of processing, with the notification of data breaches, and with any data protection impact assessments.

9 · Data breaches

9.1 The processor notifies the controller of breaches of the protection of personal data without delay, and at the latest 48 hours after becoming aware of them, and provides the information required for assessment.

9.2 The obligations to notify and inform authorities and data subjects lie with the controller (Art. 24 revFADP / Art. 33–34 GDPR).

10 · International disclosure

10.1 Processing takes place in Switzerland and the EU, or with the providers listed in Annex B.

10.2 Insofar as data is disclosed to providers in third countries without an adequate level of protection, the processor relies on appropriate safeguards, in particular the European Commission’s standard contractual clauses together with the Swiss addendum recognised by the FDPIC.

11 · Evidence and audits

11.1 The processor makes available to the controller the information required to demonstrate compliance with this DPA.

11.2 The controller may carry out appropriate audits, or have them carried out by a third party bound to secrecy. Audits are conducted with at least 14 days’ notice, during normal business hours, and without disproportionate disruption to operations.

12 · Deletion and return

12.1 After the end of processing, the processor returns the personal data in a common format or deletes it, at the controller’s choice.

12.2 Deletion from operational systems takes place within 30 days of the end of the contract, and from backups as part of the ordinary backup rotation, but no later than within 90 days. Statutory retention obligations remain reserved.

13 · Liability

Liability is governed by the applicable data protection provisions, in particular Art. 82 GDPR. In the internal relationship, the party that caused the breach bears responsibility. The liability limitations of the main contract apply in addition, to the extent permitted by data protection law.

14 · Final provisions

14.1 In the event of contradictions, this DPA takes precedence over the main contract in data protection matters; otherwise the main contract applies.

14.2 Changes to this DPA are communicated to the controller with at least 30 days’ notice. Clause 7.3 remains reserved.

14.3 Swiss law applies. Place of jurisdiction is Aarau, Switzerland.

14.4 Only the German version of this DPA is legally binding; translations are provided for information.

Annex A · Technical and organisational measures

• Role-based access and permission concept; multi-factor authentication for administrative access
• Encryption of transmission throughout via TLS; encryption of stored data where technically appropriate
• Regular, secured backups with tested restoration
• Logging of security-relevant access; separation of test and production environments
• Ongoing updating and hardening of systems; infrastructure monitoring
• Rate limiting and abuse prevention at application level
• Data minimisation and pseudonymisation where appropriate; documented deletion concept
• Confidentiality undertaking by all persons involved in the processing

Annex B · Authorised sub-processors

Status of this list: 21 August 2026. Changes are announced in accordance with clause 7.3.

• Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus — hosting of the Trophy platform and the database on a dedicated server; data centre in the EU
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — Google Business Profile API for retrieving reviews and publishing replies
• OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland — generation of suggested replies to reviews, analyses, and text suggestions. Review texts are transmitted in the process. Use of the data for training purposes is contractually excluded.
• Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA — sending transactional emails (invitations, notifications); transfer based on standard contractual clauses
• Upstash, Inc., 2261 Market Street, San Francisco, CA 94114, USA — Redis service for rate limiting and session handling; processing in the EU region
• Google Ireland Limited (Google Workspace), Dublin, Ireland — business email correspondence as part of support
• WhatsApp Ireland Limited, Dublin, Ireland — and Swisscom AG, Switzerland — support communication in the higher packages
• bexio AG, Alter Postplatz 2, 6300 Zug, Switzerland — invoicing and accounting

Where advertising or website services are booked, the corresponding services of Google Ireland Limited (Google Ads, Google Analytics) are added. The use of Analytics on the controller’s website requires visitor consent, for which the controller is responsible.