Data processing agreement
Translation. Only the German version is legally binding.
1. Parties and subject matter
1.1 Controller: the Customer as defined in the GTC («Customer»).
1.2 Processor: Swiss 3D Surface, Inh. Swirski, sole proprietorship, Romanshornerstrasse 76b, 9320 Arbon, UID (enterprise identification number) CHE-429.712.336 («SBüro»).
1.3 SBüro processes personal data on behalf of the Customer to the extent necessary for operating the SBüro office software (Art. 9 FADP). In the event of conflicts regarding data protection, this agreement takes precedence over the GTC.
1.4 The Customer accepts this agreement together with the GTC in the app; the accepted version is stored (evidence of authorisation under clause 6).
2. Nature, purpose and scope of the processing
| Content | |
|---|---|
| Purpose | Provision of the office software: creating, storing, releasing, sending (only after the Customer's OK) and exporting quotes, invoices, credit notes, reminders; deadlines and appointments; customer and item management; Income & Expenses (if enabled); storage of bank files and attachments; logs; backup and restoration; retrieval by the Customer's Sicherungsbox (backup box); support. |
| Data subjects | The Customer's customers and their contact persons; paying third parties in bank files; the Customer's users (owner, employees); the Customer's fiduciaries/accountants; persons in appointments. |
| Data categories | Name, company, address, e-mail, telephone, language; the Customer's notes; content and amounts of quotes, invoices, credit notes, costings; incoming payments; bank files (camt) in original form with name, IBAN and remittance information of paying third parties; bookings and vouchers (Income & Expenses); appointments (type, customer, address, person); the Customer's attachments (PDF/images; image metadata such as location and camera are removed on upload); user accounts (name, e-mail, role, language); technical data (sessions, device class computer/telephone, IP address in the server log). |
| Not permitted | Sensitive personal data on a large scale; data subject to professional secrecy under Art. 321 SCC (GTC clause 4.3). |
| Duration | Term of the contract in accordance with the GTC, thereafter deletion under clause 8. |
3. Instructions
3.1 SBüro processes the data only in the way the Customer itself would be permitted to do, and only in accordance with its instructions. The instructions result from the GTC, this agreement and the settings and releases in the app (e.g. sending only after OK, connected AI, calendar subscription, fiduciary access).
3.2 SBüro does not use the data for its own purposes, in particular not for advertising and not for training AI models.
3.3 If SBüro considers an instruction to be in breach of data protection law, it informs the Customer.
4. Confidentiality and operator access
4.1 At present, only the operator himself has access to the data. If SBüro engages further persons, it first obliges them in writing to maintain confidentiality.
4.2 Access by the operator to the Customer's data takes place only with a reason (support on request, release, payment, security number, switching modules or preview) or to the extent strictly necessary for security and operation. Every access via the operator functions is entered in an append-only log that the Customer can view and export under «Security». Connections to the database are additionally logged outside the database (12 months). Honest limitation: anyone with full technical access to the server could circumvent a log in the database.
5. Technical and organisational measures (TOM)
5.1 SBüro takes the measures described in Annex A (Art. 8 FADP, Art. 1–3 DPO), reviews them throughout the entire duration of the processing and adapts them to the state of the art. A change must not lower the level of protection.
6. Sub-processors
6.1 The Customer authorises the sub-processors listed in Annex B (general prior authorisation, Art. 9 para. 3 FADP, Art. 7 DPO).
6.2 SBüro informs the Customer at least 30 days before engaging or changing a sub-processor (e-mail to the owners and notice in the app). The Customer may object; if no solution is possible, it may terminate the contract with effect from the date of the change.
6.3 SBüro obliges sub-processors to provide at least equivalent data protection and knows their registered office and place of processing.
6.4 Disclosure abroad: only to states with adequate data protection under Annex 1 of the Data Protection Ordinance (currently the Netherlands and Italy, see Annex B).
6.5 Not sub-processors of SBüro are recipients that the Customer itself chooses and connects: the provider of an AI of the Customer, the provider of the calendar app into which a person of the Customer enters their calendar subscription, other services connected by the Customer itself (e.g. social media planner, the Customer's mailbox) and fiduciaries/accountants with read access. The Customer is responsible for these disclosures; the app points this out before connecting.
7. Assistance, rights of data subjects, notifications
7.1 SBüro assists the Customer with access, data portability, rectification and erasure (Art. 25 et seq. FADP), primarily through the functions of the app (export, editing, deletion). Effort outside the app is charged on the basis of a prior quote.
7.2 Breach of data security: SBüro notifies the Customer as soon as possible of any breach of data security affecting its data (Art. 24 para. 3 FADP), with the information under Art. 15 para. 1 DPO, insofar as known: nature of the breach; time and duration; categories and approximate number of the data and persons concerned; consequences and risks; measures taken or envisaged; contact person. SBüro provides any missing information as soon as possible. Notification to the FDPIC and informing the data subjects are the Customer's responsibility (Art. 24 para. 1 and 4 FADP); SBüro assists it in doing so.
7.3 SBüro documents breaches for at least two years (Art. 15 para. 4 DPO).
8. Deletion and return
8.1 During the term of the contract, the Customer can fully export its data at any time (CSV/ZIP with checksums, PDF of the documents, bank files in original form); with the Sicherungsbox additionally as an encrypted copy on its own disk.
8.2 After the end of the contract, SBüro deletes the Customer's data after expiry of the export period (GTC clause 10.3). Encrypted backups are not purged individually but expire after their retention period (7 daily, 4 weekly, 12 monthly backups, i.e. at most approximately 12 months); they are used only for restoration.
8.3 The Customer fulfils its retention obligations (Art. 958f CO) with its export; SBüro does not retain the data on behalf of the Customer.
9. Inspections
9.1 On request, SBüro provides the Customer with the information necessary to demonstrate compliance with this agreement (this Annex A, report of an external security test as soon as available). On-site inspections by arrangement and at the Customer's expense.
10. Liability, duration, final provisions
10.1 Liability is governed by the GTC (clause 8).
10.2 This agreement applies as long as SBüro processes data of the Customer.
10.3 Swiss law applies; place of jurisdiction in accordance with the GTC. The German version is authoritative.
Annex A — Technical and organisational measures (as at 30.10.2026)
| Protection objective (DPO Art. 2) | Measure | Status |
|---|---|---|
| Confidentiality — separation of businesses | Every table containing business data has row protection (Row Level Security with FORCE); no application role can bypass it; an automated test turns new tables without protection red. | in operation |
| Confidentiality — access | Access code with approximately 100 bits of randomness, stored only as an argon2id hash; lockout after 5 failed attempts; sessions 12 hrs. (connected phone up to 90 days, can be disconnected at any time); cookies Secure/HttpOnly/SameSite=Strict; protection against third-party forms (CSRF). | in operation |
| Two-factor login (TOTP) mandatory for owners and fiduciaries/accountants, optional for employees; 10 recovery codes (argon2id); reset only after call-back to the stored security number + UID verification, with log entry. | in operation | |
| TOTP secrets encrypted (AES-256-GCM) with one key per business, which is encrypted with a master key outside the database. | in operation | |
| Customer data of the businesses are not encrypted field by field in the database; the storage medium at the current server provider is not encrypted. | current state, openly stated | |
| Confidentiality — network | TLS 1.2/1.3 only, HSTS; strict security headers (CSP without inline script); database not reachable from outside; firewall only 22/80/443; SSH with key only. | in operation |
| Confidentiality — operator | Operator console with its own code and second factor; separate database role; access to a business's data only with a reason, every access in the log at the business; database connections additionally logged outside the database (12 months). | in operation |
| Integrity | «Nothing without OK»: release only by the Customer; fingerprint (SHA-256) of every released document; bookings append-only with hash chain, correction only by reversal; logs append-only. | in operation |
| Availability / restoration | Daily encrypted backup (age) with automated restoration test; retention 7/4/12; encrypted copy daily to a storage medium of the operator outside the server, key kept separately. | in operation |
| Security updates automatic; restarts in the maintenance window Sunday from 22:00. | in operation | |
| Sicherungsbox (option): encrypted copy at the Customer's premises, key only with the Customer, retrieval with check value and receipt. | in operation (program for Mac; Windows only after testing) | |
| Traceability | Log of releases, rejections, exports, AI calls (without content) and operator access; server access log (IP, path, time) 14 days. Successful logins are not yet logged per business (planned). | in operation (gap stated) |
| Attachments | Only PDF, JPEG, PNG, HEIC up to 10 MB; images are re-saved (metadata removed); PDFs with active content rejected; no virus scanner. | in operation |
| AI of the Customer | AI off until the owner connects it with a second factor (revocable); AI reads only released areas and creates only drafts/suggestions, never sends, releases or deletes; bank data not visible; purchase prices only in the booked Purchasing module (price comparison). Customer's own AI key: stored encrypted (key per business), only the owner with second factor, not in the export; mailbox read-only, access data encrypted. | in operation |
| Testing | Automated tests on every change (2109 on 28.10.2026); smoke test after every deploy; external security test before public opening (decision D4). | partial (external test outstanding) |
| Confidentiality — voice | Speech output and speech recognition run in separate services on SBüro's server without outbound network access; recordings only in memory, not stored, no content in the log. | in operation |
Annex B — Sub-processors (as at 30.10.2026)
| Provider | Service | Location | Status |
|---|---|---|---|
| TransIP (Netherlands) | Server on which SBüro and the database run | Netherlands | current; contract documents |
| E-Mail-Anbieter (servers in the network of Register.it S.p.A.) | E-mail sending and receiving for post@sbuero.ch, DNS of sbuero.ch | Italy (according to network data) | current; contractual partner and location according to contract |
| Payment provider | Payment of the subscription by card/TWINT: Stripe as independent controller (privacy policy clause 3) | — | not a sub-processor |
Not sub-processors (clause 6.5): provider of the Customer's AI; provider of the calendar app of a person of the Customer; the Customer's fiduciaries/accountants.