The terms under which aqumo processes personal data on behalf of its clients. Written to be understood, not buried in an appendix.
This Data Processing Agreement ("DPA") forms part of each service agreement between aqumo technologies SA, Via Ceresio 12, 6963 Lugano, Switzerland, UID CHE-113.809.603 ("aqumo", the processor) and each client that uses one or more of the Services described below ("Client", the controller). It takes effect on the date the service agreement is signed or, if earlier, on the date the Client first transfers personal data to aqumo.
This DPA applies to every Service the Client receives from aqumo. The sections of this DPA apply to all Services alike. The subject matter and nature of the processing, the categories of data subjects and the types of personal data are described for each Service in its annex:
An annex applies only if the Client receives the corresponding Service. Where the Client receives both, each annex applies to the data processed within its Service.
The nature of the processing is automated. No profiling, scoring, or automated decision-making with legal or similarly significant effects is carried out on behalf of the Client.
This DPA runs for the same term as the service agreement and terminates automatically when the service agreement terminates, subject to the data-return and deletion obligations in Section 11. Where the Client receives several Services under separate agreements, this DPA continues to apply to each Service until that Service ends.
The obligations of confidentiality, return and deletion survive the termination of this DPA until all of the Client's personal data has been returned or deleted, and for any personal data aqumo must retain by law, for as long as it is retained.
aqumo processes personal data only on documented instructions from the Client. This DPA and the service agreement constitute the initial documented instructions. Additional instructions may be given by the Client's authorised representatives in writing.
If aqumo considers that an instruction infringes applicable data-protection law, it will inform the Client without delay and may suspend execution of that instruction until the Client confirms or modifies it. If applicable law requires aqumo to process data for reasons other than the Client's instructions, aqumo will inform the Client before that processing, unless the law prohibits such disclosure.
aqumo does not process the Client's personal data for its own purposes. In particular, it does not use it for analytics, product development, the training of any system or marketing, and it does not sell it or make it available to third parties.
The Client warrants that it has a lawful basis to collect and transfer to aqumo all personal data it uploads, stores or otherwise introduces into the Services, and that its instructions comply with applicable data-protection law. The Client remains solely responsible for the lawfulness of the processing it instructs and for the accuracy, relevance, and proportionality of the data it provides.
aqumo ensures that the persons authorised to process the Client's personal data are subject to a binding duty of confidentiality, whether by contract or by applicable professional rules. Access is restricted to the individuals who need it to provide the Services (need-to-know principle).
aqumo implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
Except for the third-party services described in Section 7, all processing, including backups, takes place on aqumo-owned servers physically located in Switzerland. No personal data is stored or processed outside Switzerland by aqumo. aqumo and its personnel do not transfer personal data abroad or access it from abroad, including by remote access, except in emergencies, with the Client's prior consent.
Access to the Services by the Client, or by persons it authorises, takes place from locations the Client determines and under the Client's responsibility. On request, aqumo restricts such access to the networks or addresses the Client specifies.
For clients subject to the GDPR, Switzerland benefits from an adequacy decision of the European Commission.
aqumo does not engage sub-processors for the Services covered by this DPA. All processing is performed on infrastructure owned and operated by aqumo.
As an exception requested by the Client, where the Client expressly asks aqumo to provide a service through a third party, aqumo engages that third party as sub-processor for that service only. The Client's request constitutes its prior written authorisation. The third party is named in the service agreement, and for that service its terms on data location and access apply in place of those in Section 6. The Client remains responsible for assessing whether that service is compatible with its own legal and regulatory obligations.
If aqumo intends to engage a sub-processor in the future, it will give the Client reasonable prior written notice of at least thirty days. The Client may object on reasonable data-protection grounds. If the parties cannot resolve the matter, either party may terminate the relevant part of the Services with thirty days' notice.
aqumo imposes on any sub-processor, by written contract, the same data-protection obligations as those set out in this DPA, and remains fully liable to the Client for the sub-processor's performance of those obligations.
Taking into account the nature of the processing and the information available to aqumo, aqumo assists the Client in meeting its obligations under applicable data-protection law:
Subject to the regulatory rights in Section 10, the Client may audit aqumo's compliance with this DPA once per calendar year by submitting a written questionnaire (aqumo responds within thirty days) or by arranging an on-site audit with at least thirty days' prior written notice, during business hours and at the Client's cost. An appointed auditor must be independent and bound by confidentiality. aqumo may object to an auditor who is a direct competitor of aqumo.
An audit never extends to the data or systems of other aqumo clients. aqumo may take reasonable measures to protect them during an audit, provided these measures do not prevent the audit.
Where the Client is supervised by the Swiss Financial Market Supervisory Authority (FINMA), aqumo cooperates with the Client so that it can meet the supervisory requirements applicable to its use of the Services. Depending on the Client's licence, these may include Art. 14 of the Financial Institutions Act (FinIA) and Art. 16 of the Financial Institutions Ordinance (FinIO), FINMA Circular 2018/3 "Outsourcing" and FINMA Circular 2023/1 "Operational risks and resilience — banks". This section applies only to the extent that such requirements apply to the Client.
The Client, its internal and external auditors and FINMA may access, inspect and audit the information, documentation, systems and premises relevant to the Services provided to the Client, to the extent required by applicable supervisory law. The frequency, notice and cost conditions in Section 9 do not restrict these rights. On-site inspections are coordinated with aqumo where reasonably practicable, without limiting or delaying any access or audit right required under applicable supervisory law. The protection of other clients' data and systems under Section 9 also applies here.
Where available, aqumo provides reports of independent auditors or certifications covering the Services. Where supervisory law allows, the Client and its audit firm may rely on them in place of their own audit activities.
aqumo cooperates with the Client on information security, business continuity, incident management, and the orderly termination of the Services or their transfer to the Client or to another provider. Specific requirements, including recovery time and recovery point objectives, are set out in the service agreement.
Where a Service is a significant outsourcing for the Client, any engagement or replacement of a subcontractor relevant to that Service is subject, in addition to Section 7, to the contractual safeguards required by supervisory law, and the Client may terminate the affected Service in an orderly manner.
Where required by applicable supervisory law, the engagement or replacement of a subcontractor performing significant outsourced functions requires the Client's prior approval. aqumo ensures that such subcontractors are bound by the contractual obligations necessary to preserve the Client's regulatory rights, including the access and audit rights in this section.
In the event of a conflict with any other provision of this DPA or of the service agreement, this section prevails to the extent necessary to comply with mandatory supervisory requirements.
The Client remains solely responsible for its own regulatory obligations, including identifying significant outsourcing and assessing its risks. Where supervisory law requires a specific outsourcing agreement, this DPA does not replace it.
Upon termination of the service agreement, aqumo will, at the Client's written choice made within thirty days of termination, either return a complete export of the Client's personal data in a structured, machine-readable format or delete all copies. If no choice is made, aqumo deletes the data. Deletion covers all copies, including backups and snapshots, and is completed within sixty days of termination. aqumo certifies deletion in writing on request. aqumo may retain personal data longer only to the extent required by applicable law.
Each party is liable, in accordance with applicable data-protection law, for damage caused by its failure to comply with its obligations under that law. The allocation of liability between the parties for claims by data subjects follows the mechanisms established by applicable law. Nothing in this DPA shall be construed to expand or increase any limitation of liability agreed in the main service agreement, except where mandatory applicable law prohibits such limitation.
This DPA is governed by Swiss law. The courts of the Canton of Ticino, seat in Lugano, have exclusive jurisdiction over any dispute arising from this DPA, without prejudice to the mandatory jurisdiction rules of applicable data-protection law. The competent supervisory authority for aqumo as processor is the Swiss Federal Data Protection and Information Commissioner (FDPIC) — www.edoeb.admin.ch.
aqumo may update this DPA to reflect changes in processing activities or applicable law. The Client will be notified of any changes at least thirty days before they take effect. Updates that do not materially reduce the level of protection afforded to data subjects or the rights of the Client take effect on the notified date if the Client continues to use the Services. Updates that would materially reduce those protections or rights require the Client's express written acceptance; continued use of the Services alone does not constitute acceptance of such changes.
In the event of a conflict between this DPA and the service agreement on the protection of personal data, this DPA prevails, unless the service agreement affords a higher level of protection. Section 10 governs precedence for supervisory requirements.
This DPA is published in English and Italian. In the event of any discrepancy between the language versions, the English version prevails.
aqumo processes personal data on behalf of the Client for the purpose of providing the aqumo operational-intelligence platform: collecting, storing, structuring, and making available operational data in the forms and through the interfaces specified in the service agreement.
The exact types and volume of personal data are determined by the Client. aqumo processes only the data the Client uploads or otherwise transfers to the platform, and processes it only as configured by the Client.
No special categories of personal data (health, biometric, racial or ethnic origin, and similar) are intended to be processed on the platform. If the Client inadvertently transfers such data, it must inform aqumo without delay. Any deliberate processing of special-category data on the platform requires a separate prior written agreement and, where required by applicable law, the implementation of additional technical and organisational measures.
aqumo hosts the Client's servers, applications and data on infrastructure it owns and operates in Switzerland. The processing consists of storing, backing up, restoring, transmitting and protecting the data the Client places on the hosted systems, and of operating, monitoring and securing those systems.
aqumo acts as infrastructure provider. It does not access the content of the Client's data, except to the extent strictly necessary to operate, maintain, back up and restore the hosted systems, to carry out a request of the Client, to respond to a security incident, or to comply with a legal obligation. Access is limited to what the task requires.
The categories of data subjects and the types of personal data are determined solely by the Client, through the data it stores on the hosted systems. They may include, in particular:
aqumo has no knowledge of, and no control over, the content the Client stores. The hosted systems may therefore contain special categories of personal data. The Client is responsible for assessing whether the security measures described in this DPA and in the service agreement are adequate for the data it stores, and for informing aqumo if additional measures are required.
Backups and snapshots of the hosted systems are kept for the retention period specified in the service agreement, which does not exceed sixty days. On deletion under Section 11, data in backups is deleted at the latest when that retention period expires, and in any case within the sixty days set out in Section 11. Until then it remains protected by this DPA and is not restored except at the Client's request.