Data Processing Agreement

This agreement governs how Schweizerform processes personal data on behalf of its customers. It forms part of the Terms of Service and is accepted automatically when you create an account — no signature is required.

1. Scope, roles and order of precedence

This Data Processing Agreement ("DPA") governs the processing of personal data that Schweizerform carries out on your behalf when you use the Schweizerform online form service (the "Service"). It is concluded between you as the customer (the "controller") and Balathanusan Jeyarasan, sole proprietorship, trading as «Schweizerform» (the "processor"), whose full details appear at the end of this document.

For the personal data you collect through your forms, you alone determine the purposes and means of processing and are the controller (Art. 5 lit. j nFADP, Art. 4(7) GDPR). Schweizerform processes that data exclusively on your behalf, as processor (Art. 5 lit. k in conjunction with Art. 9 nFADP and, where applicable, Art. 28 GDPR).

This DPA forms part of the Terms of Service and prevails over them in all matters concerning the processing of personal data on your behalf. In all other respects the Terms of Service apply.

Your own contact, account and billing data is processed by Schweizerform as controller under its privacy policy, not under this DPA.

2. Subject matter, nature and purpose of the processing

Schweizerform processes personal data for the sole purpose of providing the Service: collecting the responses submitted through your forms, storing them in encrypted form, and making them available for you to retrieve and decrypt.

Where you use the corresponding optional capabilities (section 8), the purpose also covers: an encrypted directory of the recipients you enter or import; the invitations to your forms that you instruct to be sent to recipients you designate; and a receipt sent to a person who has filled in one of your forms, at that person's own request and to the address they supply.

The data subjects are the persons who fill in your forms and, where you use the contact directory, the persons you enter in it. You decide through your forms which data is collected; this may include sensitive personal data (Art. 5 lit. c nFADP, Art. 9 GDPR), to which this agreement applies in full.

The processing comprises collection, transmission, storage, provision for retrieval by you, the sending of the messages described above, and deletion. It lasts for the term of your subscription.

Schweizerform does not process the data for its own purposes: no advertising, no personality profiles, no disclosure to third parties and no training of artificial intelligence or machine-learning systems on your data. It may evaluate aggregated, fully anonymised usage statistics to operate and improve the Service, provided no conclusions can be drawn about you, about data subjects or about content.

3. Instructions

Schweizerform processes the personal data only within the scope of this agreement and in accordance with your documented instructions, including as regards any disclosure abroad.

Using and configuring the Service — in particular creating, publishing, changing and deleting forms and submissions, managing access, maintaining your contact directory, sending invitations and enabling optional features — constitutes your instructions. Other instructions are given in text form to the contact address at the end of this document.

If Schweizerform considers an instruction to infringe data protection law, it informs you without delay and may suspend it until clarified. Where it is legally obliged to carry out further processing, it informs you beforehand unless the law prohibits this.

Instructions that would require a change to the Service, additional measures or effort beyond the agreed service are carried out only by separate agreement and against reimbursement at our then-current rates (section 10).

4. Confidentiality

Every person who may gain access to the personal data is bound to confidentiality in writing before taking up their activity, unless already subject to a statutory duty of secrecy; the owner is bound personally. The obligation continues after the activity ends. Access is limited to persons who need it for their tasks.

5. Professional secrecy (Art. 321 SCC)

Insofar as the data collected through the Service is subject to professional secrecy under Art. 321 of the Swiss Criminal Code — as it is for medical practices, law firms, notaries and counselling services — Schweizerform and every person acting for it act, to that extent, as your auxiliary persons within the meaning of that provision. Schweizerform preserves that secrecy, binds every person with possible access to it expressly in writing, and remains bound without limit in time, beyond the end of this agreement.

Schweizerform discloses no data to third parties, including upon an order of a public authority, without informing you beforehand so that you can examine legal remedies; where the law prohibits prior information, it informs you as soon as permitted. It is not obliged to challenge official orders at its own expense.

Sub-processors with intended access to data covered by professional secrecy are engaged only if they are bound by a duty of confidentiality corresponding to Art. 321 SCC. The mail delivery provider listed in section 11 has no such access; section 4 applies to it.

Invitations and receipts disclose the recipient's e-mail address and the name of your organisation to that mail delivery provider. They contain no submission and no answer, and name the form only where you choose to. Before using them you assess whether this disclosure is admissible under your professional secrecy; receipts are switched off by default and invitations are sent only on your instruction.

Because of the end-to-end encryption (section 7), Schweizerform cannot take note of the content of submissions; in practice this obligation covers metadata, form content and all other information accessible to Schweizerform.

6. Technical and organisational measures

Schweizerform takes the technical and organisational measures required by Art. 8 nFADP in conjunction with the Data Protection Ordinance and, where applicable, Art. 32 GDPR, to ensure a level of security appropriate to the risk. They comprise:

• Encryption. End-to-end encryption of responses and file attachments (section 7); transmission exclusively over TLS; encrypted responses cryptographically bound to their form and submission.
• Access control. Personal credentials; passwords stored only as a hash; a one-time code by e-mail for security-relevant operations; account lockout, rate limiting, blocking of conspicuous IP addresses on short-lived records or a block list, and protection against cross-site request forgery.
• Sessions. Server-side sessions with a limited lifetime that you can view and revoke; automatic sign-out of the browser, deleting the master key from its memory, after a configurable period of inactivity.
• Separation and permissions. Owner-bound storage and a permission check on every access; a separate key pair per form and a separate key per contact directory; graduated roles in team workspaces.
• Logging. Security-relevant events are logged; IP address and user agent only for actions of your signed-in users, never for submissions by data subjects.
• Operation and backups. Managed infrastructure of a Swiss provider in data centres in Switzerland (section 11); separate development and production environments; prompt security updates; a daily database backup within Switzerland. File storage is redundant but not separately backed up, and restoration of data lost at the provider is not guaranteed; you are expected to export your data regularly (section 14).
• Public form pages. No analytics session, browser fingerprint or third-party analytics, advertising or tracking. Usage is recorded only as aggregate counters and coarse technical metadata per submission — never an IP address, a user agent, a per-visit record or an answer — and deleted with the form; extended counters only on forms where you switch them on. Where you limit a form to one submission per connection, a keyed value derived from the IP address, not the address itself, is stored with the submission and deleted with it.

Schweizerform may adapt the measures to technical progress provided the level of protection is not reduced; a change that reduces it is made only under section 17.

7. End-to-end encryption and its limits

Responses and files uploaded by data subjects, including file names, are encrypted in the data subject's browser and stored by Schweizerform exclusively as ciphertext. They can be decrypted only with your master key, which is derived in your browser from your Vault key and exists in clear only there. Your Vault key and your recovery code are never transmitted to or stored on Schweizerform's systems. Schweizerform has no access to the content of submissions and will take no measures to obtain it.

Not covered by this encryption, and therefore accessible to Schweizerform: form names, question texts, settings and branding; your users' account data; timestamps and technical metadata of submissions; and the security logs (section 6). Do not enter personal data of data subjects in these fields.

Entries in your contact directory are encrypted in your browser in the same way, under a key protected by your master key or by the key of your team workspace. The technical values that make the directory work — such as values derived from e-mail addresses to recognise duplicates and objections, group assignments and timestamps — are not encrypted; none of them can be read as an identity. The address a person supplies for a receipt is used to send that one message and then discarded; only a keyed value derived from it is held briefly, to prevent abuse.

You alone are responsible for keeping your Vault key and your recovery code safe. If both are lost, the data cannot be decrypted until one of them is regained, and Schweizerform cannot restore it. A reset without either code does not re-encrypt your personal data but locks it, and it becomes readable again only if an old code is regained. For team workspaces, your access must be granted again by another administrator; if none holds the workspace key, that content can no longer be decrypted. Schweizerform's liability for such loss is excluded to the extent permitted by law.

A return of data by Schweizerform takes place as ciphertext with its metadata, as a return in plaintext is technically impossible; it is of no use without your Vault key. Export your data yourself in good time before the contract ends.

If a change to the architecture would mean that the first paragraph of this section no longer applies, Schweizerform informs you without delay in text form, and you may terminate this agreement and the Terms of Service extraordinarily with effect from the date of the change.

8. Your obligations as controller

You are solely responsible for the lawfulness of your forms and of the processing, for a valid legal basis and for informing data subjects (Art. 19 ff. nFADP). You collect only the data necessary for your purpose. Schweizerform does not review your forms and, because of the encryption, cannot.

You manage access to your account and team workspaces, keep passwords and Vault keys secure and secret, and inform Schweizerform without delay of any indication that they have been compromised or that data security has been breached in your sphere. Actions carried out through your accesses are deemed to be yours.

Optional features — AI-assisted translation and form creation (section 11), the contact directory, invitations, receipts, the copy for respondents and extended counters — operate only on your instruction (section 3); the AI features, receipts, the copy for respondents and extended counters are switched off by default. The AI features process only form texts written by you, never submissions. Before using any of them you assess whether this is admissible for your processing, including under professional secrecy (section 5), and you warrant a lawful basis for contacting the people in your contact directory and for the messages you instruct.

9. Personal data breach

Schweizerform notifies you of any breach of data security affecting your data without delay, and at the latest within 48 hours of becoming aware of it, in text form, to the e-mail address of your account, which you keep up to date.

The notification states, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Missing information follows as soon as it is available; an incomplete first notification meets the deadline.

Schweizerform supports your notifications to the Federal Data Protection and Information Commissioner (Art. 24 nFADP) and, where applicable, under Art. 33 and 34 GDPR; assessing and making them is up to you. Schweizerform documents every breach and the measures taken. A notification is not an admission of fault or liability.

10. Rights of data subjects and support

Safeguarding the rights of data subjects is up to you. The Service lets you view, export and delete individual submissions and the entries in your contact directory. Schweizerform supports you with reasonable measures where you cannot do so yourself, limited to encrypted data and metadata.

Requests addressed directly to Schweizerform are forwarded to you without delay and not answered by Schweizerform. If a recipient of an invitation objects to further messages, Schweizerform records and enforces that objection for future sends, as the sender of the message.

Schweizerform supports data protection impact assessments and consultations with the supervisory authority insofar as the information lies in its sphere.

This support is free of charge to the usual extent. Beyond that — for example repeated or extensive requests, questionnaires, inspections or separate analyses — Schweizerform informs you in advance and starts only after your approval in text form, against reimbursement at our then-current rates, unless the effort results from a breach of duty on its part.

11. Sub-processors

You grant Schweizerform general authorisation to engage sub-processors in accordance with this section (Art. 9 para. 3 nFADP). This list is authoritative; the Terms of Service refer to it.

Payment processing (Stripe Payments Europe, Ltd., Ireland) concerns only your own billing data, which Schweizerform processes as controller (section 1); it is not sub-processing under this agreement.

Schweizerform notifies you at least 30 days in advance in text form before engaging a further sub-processor or replacing one. You may object within 30 days of the notification, in text form, on substantiated data protection grounds; without objection the change is deemed approved. If no amicable solution is found within 30 days, either party may terminate this agreement and the Terms of Service as of the planned date of the change; no further claims arise.

Removing a sub-processor without replacement needs no notification and takes effect with the new edition (section 17). Where necessary to avert an immediate danger to the security or availability of the Service, a sub-processor may be replaced without prior notification; you are informed without delay afterwards.

Sub-processors are contractually bound to obligations corresponding in substance to this agreement, including confidentiality (sections 4 and 5), and Schweizerform is liable for them as for its own conduct (section 15). Services without intended access to personal data, such as telecommunications, are not sub-processing.

12. Place of processing and disclosure abroad

Submissions — responses and file attachments — and the contact directory are processed and stored exclusively in Switzerland.

The only processing outside Switzerland is the delivery of transactional e-mail by the provider listed in section 11 (Norway; Germany and Finland). It never includes submissions or answers; it includes personal data of a data subject only for invitations and receipts, and then only the recipient's e-mail address and the message. These states provide adequate protection under Annex 1 of the Data Protection Ordinance, so the disclosure is permitted under Art. 16 para. 1 nFADP. Any further processing outside Switzerland takes place only after notification under section 11.

For onward disclosures outside the European Economic Area, Schweizerform engages only sub-processors with a basis compliant with Art. 16 and 17 nFADP and, where applicable, Chapter V GDPR, and passes on their documentation on request.

13. Evidence and audits

On request, Schweizerform demonstrates compliance with this agreement, primarily through a description of its measures, self-assessment, and certificates or reports of its sub-processors.

If this is insufficient in a substantiated case, you may carry out an audit once per calendar year, yourself or through an independent third party bound to secrecy and not in competition with Schweizerform: remotely, on documents and written answers, with at least 30 days' notice, and with no more than two working days of Schweizerform's effort. An on-site audit takes place only on a substantiated suspicion of a serious breach of data security, and then without these limits.

You bear the costs of an audit, including Schweizerform's effort at our then-current rates, unless material breaches by Schweizerform are established. Data of third parties, business secrets and direct access to production systems remain excluded.

14. Retention, deletion and return

During the contract you can export your data at any time; this self-service is the handing over of data within the meaning of Art. 9 nFADP. You can delete individual submissions yourself; if a deletion is exceptionally requested through Schweizerform, it is carried out within 30 days.

• Logs. IP address and user agent are removed from the security log after 90 days; the event entry itself is kept as evidence. E-mail delivery log entries, including message content, are deleted after 90 days; invitations and receipts are not written to that log.
• Contacts and invitations. Contacts are kept until you delete them, at the latest until your account or the workspace is deleted. For a deleted contact who had objected to further messages, only values that cannot be read as an address are kept so that the objection is still honoured; they are deleted with your account or the workspace. Invitation delivery records contain no address, name or message content and are deleted with the form. For receipts and the copy for respondents, only the time is recorded on the submission.
• Saved partial forms. Stored encrypted like submissions and deleted automatically 30 days after they were last saved, at the latest with the form.
• Backup copies. Deletions take effect immediately in production. Backup copies are overwritten within 30 days and are used only for restoration until then.

After the contract ends, Schweizerform returns (section 7) or deletes the data, including copies, at your choice, communicated in text form within 30 days; without it, the data is deleted when that period expires. Deleting your account yourself counts as choosing deletion and takes effect immediately and irreversibly; export your data beforehand.

Schweizerform confirms the deletion in text form on request. Data is kept beyond the contract only where the law requires it, and then only for that purpose.

15. Liability

The parties are liable in accordance with the law. The limitation of liability in the Terms of Service, including the exclusion of indirect and consequential damage, also applies to claims under this agreement, except for damage caused by gross negligence or intent (Art. 100 para. 1 CO) and injury to life, limb or health.

Schweizerform is not liable for damage attributable to: the loss of the Vault key or recovery code (section 7); the design, content or lawfulness of your forms; the lawfulness of the messages you instruct and the recipients you designate; your management of accesses; or instructions whose questionable nature Schweizerform pointed out (section 3).

If one party is held liable by data subjects or authorities because of a breach of duty by the other, the party in breach indemnifies the other to the extent of its share of responsibility, subject to the first paragraph.

16. Term, termination and discontinuation of the Service

This agreement applies from the creation of your account for the term of the Terms of Service and ends with them, without separate notice. For existing accounts, this edition applies from its effective date; continued use of the Service thereafter counts as acceptance, as it does for later editions that need no notification under section 17.

If Schweizerform discontinues the Service, it informs you at least 90 days in advance in text form and enables you to export your data during that period. Termination for good cause remains open to both parties. Confidentiality and professional secrecy (sections 4 and 5) continue after this agreement ends.

17. Changes to this agreement

Schweizerform may amend this agreement to adapt it to changes in law, case law or regulatory practice, or to the development of the Service. Every change is published as a new edition with its own date of entry into force and a changelog entry. Published editions remain retrievable and are not edited retroactively, except for corrections that do not change the meaning of a clause.

A change is material if it widens the processing on your behalf or weakens a protection or right under this agreement — in particular a new category of data or data subjects or a new purpose (section 2), a new or replaced sub-processor (section 11), a new country of processing (section 12), a longer retention period (section 14), a weaker measure under section 6 or guarantee under section 7, or a change to sections 5, 9, 13, 15 or 17 that reduces your rights. A change is not material if it only narrows the processing or strengthens a protection, describes existing processing more precisely, or adds a value under section 6 that identifies no person and is either an aggregate count per form or question or recorded only on your instruction or setting. In case of doubt, a change is treated as material.

Material changes are notified at least 30 days before they take effect, in text form, which includes e-mail to the address of your account. Other changes take effect when the new edition is published.

You may object only to a new or replaced sub-processor, under the procedure in section 11. Where a change weakens a measure under section 6 or a guarantee under section 7, you may terminate this agreement and the Terms of Service in text form before it takes effect, with effect from that date; until then the previous edition applies to you. A change that removes or curtails content required by Art. 9 nFADP or Art. 28(3) GDPR always requires your express agreement.

The date on which the edition in force took effect is stated at the end of this page.

18. Governing law and place of jurisdiction

Swiss law applies, excluding its conflict-of-law rules and the United Nations Convention on Contracts for the International Sale of Goods.

The exclusive place of jurisdiction for all disputes arising out of or in connection with this agreement is Pfäffikon SZ, Switzerland.