Data Processing Agreement (DPA)

1. Parties and roles

The relevant business customer is the controller where it determines the purposes and means of processing. The processor is Fabian Traub / CELVENO, Mühlenstrasse 40, 8200 Schaffhausen, Switzerland, to the extent CELVENO processes personal data for the business customer as part of the agreed SaaS services.

2. Subject matter and duration

The subject matter is technical processing required to provide CELVENO, including user accounts, roles, tenants, customers, contacts, projects, quotes, catalogues, invoices, documents, images, files, revisions, support and – where enabled – AI functions. Processing generally lasts for the contractual term plus required winding-down, security, backup and statutory retention periods.

3. Categories of data subjects and personal data

Data subjects may include the customer's employees and users, customers, contacts, suppliers and other business contacts. Data may include identification/contact details, company affiliation, roles/permissions, project/customer data, quote/invoice content, prices, catalogue data, documents, images, voice/transcription content, support information and technical security/session/audit data.

4. Processing on instructions

CELVENO processes customer data only to provide the agreed services, under documented product functions and lawful customer instructions, unless law requires different processing. If CELVENO considers an instruction unlawful, execution may be suspended until the issue is clarified.

5. Confidentiality and access limitation

Persons authorised to access customer data for operations, maintenance, support or security are bound by confidentiality or an equivalent legal duty. Access is limited on a need-to-know basis.

6. Technical and organisational measures

CELVENO applies risk-appropriate measures and develops them in line with product status and threats. Current measures include server-side tenant separation and permission checks, credential protection, no clear-text password storage, server-side treatment of secret API keys, transport encryption through the underlying platforms, logging/audit capabilities, backup/restore mechanisms and restricted administrative access. The exact scope may vary by plan and function.

7. Subprocessors

The customer gives CELVENO general authorisation to use subprocessors required to provide the service. The current list is published under Subprocessors. CELVENO ensures that subprocessors are contractually bound to appropriate privacy and security requirements.

Material changes are reflected in the published list. Any additional notification or objection rights expressly agreed in an individual customer contract take precedence.

8. International transfers

Where subprocessors cause transfers to countries without an officially recognised adequate level of protection, CELVENO uses appropriate safeguards or other lawful transfer mechanisms where required. These may include recognised standard contractual clauses with Swiss adaptations. Providers and known regions are described in the Subprocessor List.

9. Assistance with data subject rights and authority requests

CELVENO provides reasonable and technically feasible assistance with access, rectification, deletion, export/transfer and other applicable data subject rights where the relevant data is processed on behalf of the customer. Requests received directly by CELVENO that clearly concern customer-controlled data are generally forwarded to the relevant business customer unless law requires another approach.

10. Personal data breaches

If CELVENO becomes aware of a security breach affecting customer data, CELVENO informs the customer as soon as reasonably possible so that the customer can assess and comply with its own notification duties. Where available, the notice includes the nature of the incident, affected data/categories, possible consequences and measures taken or planned.

11. Return, export and deletion

The customer should export required data before contract end. At the customer's request or for an intended later reactivation of the subscription, customer data may be archived for up to 12 months after contract end. It is then deleted or anonymised unless statutory or contractually permitted retention grounds apply. Data in technically necessary backups is overwritten or deleted according to the relevant backup lifecycle and is not reactivated for unrelated purposes in the meantime.

12. Evidence, information and audit

On reasonable request, CELVENO provides information required to assess compliance with this DPA. On-site audits are only required where legally necessary or where appropriate documentation or external evidence is insufficient, and must be coordinated to preserve security and confidentiality.

13. Liability, precedence and governing law

Liability and liability limitations are governed by the main agreement and mandatory law. In case of conflict concerning data-processing obligations, this DPA prevails for the commissioned processing. Otherwise Swiss privacy law and the governing law/venue set out in the main agreement apply to the extent legally permissible.