Data processing agreement (DPA)

Data Processing Agreement pursuant to Art. 28(3) GDPR and Art. 9 of the Swiss Federal Act on Data Protection (FADP, SR 235.1).

between

[Customer's company], [address], [country] – hereinafter "Controller" or "Customer" –

and

Netgen Switzerland AG, Seestrasse 356, 8038 Zürich, Switzerland – hereinafter "Processor" or "Netgen" –

This DPA covers, in one document, Art. 28 GDPR (customers in Germany and the EU/EEA) and Art. 9 FADP with the Data Protection Ordinance (DPO) (customers in Switzerland). It forms part of every PIM Gate contract and is accepted together with the Main Agreement.

Agreement

§0 Preamble, scope and definitions

1. The parties have concluded an agreement on the use of the SaaS platform PIM Gate (the "Main Agreement", consisting of the offer, the terms of service and the service description). In performing it, Netgen processes personal data on behalf of the Customer. This DPA governs the parties' data-protection obligations.
2. This DPA applies to all activities in which Netgen, its staff or engaged sub-processors process personal data of the Customer ("Customer Data").
3. Depending on the Customer's seat and activity, Regulation (EU) 2016/679 (GDPR) and/or the Swiss FADP with the Data Protection Ordinance (DPO) apply. For customers in Germany, the BDSG applies in addition.
4. Terms are used as defined in the GDPR. For the FADP they apply mutatis mutandis: "processing" corresponds to "Bearbeitung", "processor" to "Auftragsbearbeiter", and "supervisory authority" includes the Swiss Federal Data Protection and Information Commissioner (FDPIC).
5. In case of conflict, this DPA prevails over the Main Agreement in data-protection matters.

§1 Subject matter, duration, nature and purpose of processing

1. The subject matter is the provision and operation of PIM Gate as a portal layer for the Customer's product data, including customer, supplier and sales portals, interfaces (API, webhooks, SFTP), search, AI-assisted functions (e.g. tagging, translation), and support and maintenance.
2. The nature, purpose, categories of data and data subjects are described in Annex 1.
3. The duration of this DPA corresponds to the term of the Main Agreement. It does not end as long as Netgen still processes Customer Data.
4. Processing takes place in Switzerland and in member states of the EU/EEA. Processing in other third countries takes place only in accordance with §6.

§2 Customer's right to issue instructions

1. Netgen processes Customer Data exclusively on the Customer's documented instructions. The instructions are set out conclusively in the Main Agreement, in this DPA and in the settings the Customer configures in PIM Gate. Further instructions are issued by the Customer in text form (e-mail to support@avidia.ai).
2. Processing without instructions is permitted only where Netgen is required to do so by Union, member-state or Swiss law. In that case Netgen informs the Customer in advance, unless the law prohibits this.
3. If Netgen considers that an instruction infringes data-protection law, it informs the Customer without undue delay. Netgen may suspend execution until the Customer confirms or amends the instruction.
4. Instructions exceeding the agreed scope of services are treated as change requests and may be charged on a time-and-materials basis.

§3 Obligations of Netgen

1. Netgen processes Customer Data only for the purposes stated in Annex 1 and not for its own purposes.
2. Netgen binds all persons with access to Customer Data to confidentiality in writing, unless they are subject to a statutory duty of secrecy. The obligation survives the end of their engagement.
3. Netgen ensures that only persons who need access for their tasks have it, and that they are trained in data protection.
4. Netgen logically separates Customer Data from the data of other customers (tenant isolation at schema level).
5. Netgen maintains a record of processing activities pursuant to Art. 30(2) GDPR and Art. 12 FADP, where legally required.
6. Netgen's contact person for data protection is Christian Paredes, Managing Director, support@avidia.ai.
7. Netgen informs the Customer without undue delay of inspections or measures by supervisory authorities insofar as they concern Customer Data.
8. AI functions: Netgen does not use Customer Data to train or improve AI models, neither its own nor third parties'. Inputs to AI services of sub-processors are made only where these contractually warrant not to use the data for training and not to retain it longer than needed to deliver the service.
9. Netgen may use anonymised or aggregated usage and operational data without personal reference to safeguard and develop its operations.

§4 Technical and organisational measures (TOM)

1. Netgen implements the measures described in Annex 2 pursuant to Art. 32 GDPR and Art. 8 FADP in conjunction with Art. 1–6 DPO. They ensure a level of protection appropriate to the risk for confidentiality, integrity, availability and resilience.
2. Netgen operates an information-security management system certified to ISO/IEC 27001 and an AI management system certified to ISO/IEC 42001, and maintains them for the term of the agreement.
3. Netgen may adapt the measures to the state of the art provided the level of protection is not reduced. Material changes are documented and communicated to the Customer on request.

§5 Sub-processors

1. The Customer approves the sub-processors listed in Annex 3.
2. The Customer grants Netgen general authorisation to engage further sub-processors or replace existing ones. Netgen informs the Customer at least 30 days in advance in text form (e-mail or notice in the platform).
3. Within this period the Customer may object for important data-protection reasons. If the parties find no solution, the Customer may terminate the affected part of the Main Agreement extraordinarily as of the date of the change. Fees already paid for the period thereafter are refunded pro rata.
4. Netgen contractually imposes on every sub-processor the same data-protection obligations agreed in this DPA, in particular sufficient guarantees for appropriate TOM.
5. Netgen is liable to the Customer for its sub-processors' compliance as for its own conduct.
6. Ancillary services without access to Customer Data – such as telecommunications, postal services, cleaning or infrastructure maintenance where no access to personal data is possible – do not constitute sub-processing.

§6 Transfers to third countries

1. The parties note: Switzerland benefits from an adequacy decision of the European Commission; the EU/EEA states are deemed to provide adequate protection under Annex 1 DPO. Processing by Netgen in Switzerland and by sub-processors in the EU/EEA therefore requires no additional safeguards.
2. Transfers to other third countries take place only if (a) an adequacy decision of the European Commission and a corresponding determination by the Swiss Federal Council exist for the country or recipient (e.g. the EU-US or Swiss-US Data Privacy Framework for certified recipients), or (b) the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914) with the amendments required for Switzerland have been concluded and any necessary supplementary measures implemented.
3. Netgen states the basis of every third-country transfer in Annex 3.

§7 Assistance to the Customer

1. Netgen assists the Customer with appropriate measures in responding to data-subject requests (Art. 12–23 GDPR; Art. 25–32 FADP), in particular access, rectification, erasure, restriction and data portability. Where possible, PIM Gate provides self-service functions for this.
2. If a data subject contacts Netgen directly, Netgen forwards the request to the Customer without undue delay and does not answer it itself, except on instruction.
3. Netgen assists the Customer with data-protection impact assessments, prior consultations of the supervisory authority and notification duties (Art. 32–36 GDPR; Art. 22–24 FADP) insofar as they concern Netgen's services.
4. Assistance beyond self-service functions and legally mandatory cooperation may be charged by Netgen on a time-and-materials basis at the rates of the Main Agreement, unless the cause lies in a breach by Netgen.

§8 Personal data breaches

1. Netgen notifies the Customer of a breach affecting Customer Data (Art. 4(12) GDPR; "breach of data security" under Art. 5 lit. h FADP) without undue delay and at the latest within 48 hours of becoming aware of it.
2. The notification contains, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken and proposed, and a contact person. Missing information is supplied by Netgen as soon as it is available.
3. Netgen takes immediate measures to contain and remedy the breach and documents the incident.
4. Notifications to supervisory authorities or data subjects are the Customer's responsibility. Netgen makes them only on instruction.

§9 Evidence and audits

1. On request, Netgen makes available to the Customer the information necessary to demonstrate compliance with this DPA. Valid ISO/IEC 27001 and 42001 certificates, audit reports and the current TOM description in particular serve as evidence.
2. Where such evidence is insufficient in an individual case, the Customer may carry out an audit on site or remotely, or have it carried out by an auditor bound to confidentiality who is not a competitor of Netgen. Audits are announced at least 30 days in advance, take place during business hours and without disproportionate disruption of operations.
3. One audit per calendar year is free of charge for the Customer. Further audits are borne by the Customer on a time-and-materials basis, unless they reveal a material breach by Netgen or are occasioned by an incident under §8.
4. The audit rights of supervisory authorities remain unaffected.

§10 Deletion and return

1. After the end of the Main Agreement the Customer may export its data for 30 days via the export functions or the API in a common format.
2. Thereafter Netgen deletes all Customer Data, including copies, unless a statutory retention obligation applies. Data in backups is overwritten within 30 days in the regular rotation cycle and is no longer actively processed until then.
3. Netgen confirms deletion in text form on request.
4. During the term, Netgen deletes or rectifies Customer Data on instruction where the Customer cannot do so itself in the platform.

§11 Obligations of the Customer

1. The Customer is responsible for the lawfulness of the processing, in particular for the legal basis and for informing data subjects.
2. The Customer manages user accounts, roles and permissions in PIM Gate on its own responsibility and protects its credentials and API keys.
3. The Customer does not transmit special categories of personal data (Art. 9 GDPR; sensitive personal data under Art. 5 lit. c FADP) unless agreed in writing beforehand.
4. The Customer informs Netgen without undue delay if it detects errors or irregularities in the processing.

§12 Liability

1. Liability is governed by the provisions of the Main Agreement, including any limitations of liability agreed there, to the extent permitted by law.
2. Liability towards data subjects under Art. 82 GDPR and mandatory statutory liability remain unaffected. Internally, each party bears the damage attributable to its own breach.

§13 Term and final provisions

1. This DPA enters into force upon signature or acceptance as part of the Main Agreement and ends with it. Obligations that by their nature continue (confidentiality, deletion, evidence) survive termination.
2. Amendments require text form. Netgen may adapt this DPA where changes in law or regulatory requirements so require; the Customer is informed at least 30 days in advance.
3. Governing law and place of jurisdiction follow the Main Agreement; unless agreed otherwise there, Swiss law applies to the exclusion of conflict-of-law rules and the place of jurisdiction is Zürich. Mandatory provisions of the GDPR and the BDSG remain unaffected for customers in the EU.
4. Should a provision be invalid, the remainder remains valid. The parties replace the invalid provision with one that comes closest to its purpose and the legal requirements.
5. Annexes 1–3 form part of this DPA.

Signatures

Annex 1 – Description of the processing

Annex 2 – Technical and organisational measures

Netgen is certified to ISO/IEC 27001, ISO 9001 and ISO/IEC 42001. Details are documented in the ISMS and evidenced to the Customer on request pursuant to §9.

Annex 3 – Approved sub-processors

Changes to this list are announced at least 30 days in advance pursuant to §5. The current version is this page.