The terms under which aqumo processes personal data on behalf of its clients. Written to be understood, not buried in an appendix.
This Data Processing Agreement ("DPA") forms part of the service agreement between aqumo technologies SA ("aqumo", the processor) and each client that uses the aqumo platform ("Client", the controller). It takes effect on the date the service agreement is signed or, if earlier, on the date the Client first transfers personal data to the aqumo platform.
aqumo processes personal data on behalf of the Client for the purpose of providing the aqumo operational-intelligence platform: collecting, storing, structuring, and making available operational data in the forms and through the interfaces specified in the service agreement.
The nature of the processing is automated. No profiling, scoring, or automated decision-making with legal or similarly significant effects is carried out on behalf of the Client.
The personal data processed under this DPA may relate to the following categories of data subjects:
The exact types and volume of personal data are determined by the Client. aqumo processes only the data the Client uploads or otherwise transfers to the platform, and processes it only as configured by the Client.
No special categories of personal data (health, biometric, racial or ethnic origin, and similar) are intended to be processed under this DPA. If the Client inadvertently transfers such data, it must inform aqumo without delay. Any deliberate processing of special-category data under this DPA requires a separate prior written agreement and, where required by applicable law, the implementation of additional technical and organisational measures.
This DPA runs for the same term as the service agreement and terminates automatically when the service agreement terminates, subject to the data-return and deletion obligations in Section 10.
aqumo processes personal data only on documented instructions from the Client. This DPA and the service agreement constitute the initial documented instructions. Additional instructions may be given by the Client's authorised representatives in writing.
If aqumo considers that an instruction infringes applicable data-protection law, it will inform the Client without delay and may suspend execution of that instruction until the Client confirms or modifies it. If applicable law requires aqumo to process data for reasons other than the Client's instructions, aqumo will inform the Client before that processing, unless the law prohibits such disclosure.
The Client warrants that it has a lawful basis to collect and transfer to aqumo all personal data uploaded or otherwise introduced into the platform, and that its instructions comply with applicable data-protection law. The Client remains solely responsible for the lawfulness of the processing it instructs and for the accuracy, relevance, and proportionality of the data it provides.
aqumo ensures that the persons authorised to process the Client's personal data are subject to a binding duty of confidentiality, whether by contract or by applicable professional rules. Access is restricted to the individuals who need it to provide the service (need-to-know principle).
aqumo implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
All processing takes place on aqumo-owned servers physically located in Switzerland. No personal data is stored or processed outside Switzerland.
aqumo does not engage sub-processors for the processing activities covered by this DPA. All processing is performed on infrastructure owned and operated by aqumo.
If aqumo intends to engage a sub-processor in the future, it will give the Client reasonable prior written notice of at least thirty days. The Client may object on reasonable data-protection grounds. If the parties cannot resolve the matter, either party may terminate the relevant part of the service with thirty days' notice.
Taking into account the nature of the processing and the information available to aqumo, aqumo assists the Client in meeting its obligations under applicable data-protection law:
The Client may audit aqumo's compliance with this DPA once per calendar year by submitting a written questionnaire (aqumo responds within thirty days) or by arranging an on-site audit with at least thirty days' prior written notice, during business hours and at the Client's cost. An appointed auditor must be independent and bound by confidentiality. aqumo may object to an auditor who is a direct competitor of aqumo.
Upon termination of the service agreement, aqumo will, at the Client's written choice made within thirty days of termination, either return a complete export of the Client's personal data in a structured, machine-readable format or delete all copies. If no choice is made, aqumo deletes the data. Deletion is completed within sixty days of termination. aqumo certifies deletion in writing on request. aqumo may retain personal data longer only to the extent required by applicable law.
Each party is liable, in accordance with applicable data-protection law, for damage caused by its failure to comply with its obligations under that law. The allocation of liability between the parties for claims by data subjects follows the mechanisms established by applicable law. Nothing in this DPA shall be construed to expand or increase any limitation of liability agreed in the main service agreement, except where mandatory applicable law prohibits such limitation.
This DPA is governed by Swiss law. The courts of the Canton of Ticino, seat in Lugano, have exclusive jurisdiction over any dispute arising from this DPA, without prejudice to the mandatory jurisdiction rules of applicable data-protection law. The competent supervisory authority for aqumo as processor is the Swiss Federal Data Protection and Information Commissioner (FDPIC) — www.edoeb.admin.ch.
aqumo may update this DPA to reflect changes in processing activities or applicable law. The Client will be notified of any changes at least thirty days before they take effect. Updates that do not materially reduce the level of protection afforded to data subjects or the rights of the Client take effect on the notified date if the Client continues to use the service. Updates that would materially reduce those protections or rights require the Client's express written acceptance; continued use of the service alone does not constitute acceptance of such changes.