Data Processing Agreement

1. Scope and parties

This Data Processing Agreement (“DPA”) forms part of the Terms & Conditions between ABIT Technology, Adrian Shajkofci (CHE-233.067.408), Rue des Champs du Bourg 28, 1920 Martigny, Switzerland (“Processor”) and the organization that uses Demo-Creator (“Customer”). It applies when the Processor processes personal data on the Customer’s behalf while providing Demo-Creator, and implements Article 28 of the GDPR and Article 9 of the Swiss Federal Act on Data Protection (FADP).

The DPA takes effect when the Customer accepts the Terms and needs no signature. A countersigned copy is available on request.

2. Subject matter, duration and purpose

The Processor processes personal data to host, operate, secure and support Demo-Creator as described in the Terms and the user manual, for as long as the Customer uses the service and until deletion under section 11. Processing includes storage, display, publication on the Customer’s instructions, translation and narration when requested, analytics, notifications and backups.

3. Data subjects and categories of data

Data subjects are the Customer’s workspace members, people who view the Customer’s demos, learners in the Customer’s training, and people who submit the Customer’s contact forms or are named in its recipient links.

The data comprises names, email addresses, account and role details; content the Customer uploads or records, including screenshots that may show personal data; viewing activity such as session identifiers, viewed steps, times, device category and approximate country; training progress, answers, scores and certificates; and contact form entries. The Customer does not include special categories of personal data unless this is necessary and lawful.

4. Customer instructions

The Processor processes personal data only on the Customer’s documented instructions. These are given by the Terms, this DPA and the Customer’s use and configuration of Demo-Creator. If the law requires other processing, the Processor informs the Customer first unless the law prohibits it. The Processor informs the Customer if it believes an instruction infringes data protection law.

5. Confidentiality

Persons authorized to process the personal data are bound by confidentiality and access it only as needed to provide, secure or support the service.

6. Security

The Processor implements the technical and organizational measures described in the annex and on the Security page, and keeps them appropriate to the risk. It may update them provided the overall level of protection is not reduced.

7. Sub-processors

The Customer authorizes the sub-processors listed on the Security page. The Processor imposes data protection obligations on each of them equivalent to this DPA and remains responsible for their performance.

The Processor announces a new sub-processor on that page at least 30 days before it starts processing personal data. The Customer may object on reasonable data protection grounds; if no solution is found, the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees.

8. International transfers

Personal data is hosted in the EU. Where a sub-processor processes it in a country without an adequacy decision recognized by Switzerland or the EU, the transfer relies on the European Commission’s Standard Contractual Clauses, with the adaptations required for Switzerland, or on another valid transfer mechanism.

9. Assistance

Taking into account the nature of the processing, the Processor helps the Customer respond to requests from data subjects, mostly through the export, editing and deletion functions of Demo-Creator, and provides reasonable information for data protection impact assessments and consultations with supervisory authorities.

10. Personal data breaches

The Processor notifies the Customer without undue delay, and at the latest within 72 hours of becoming aware of a personal data breach affecting the Customer’s personal data. The notice describes the nature of the breach, the categories and approximate number of data subjects and records concerned where known, the likely consequences, and the measures taken or proposed. It is supplemented as information becomes available.

11. Deletion and return

During the term, the Customer can export and delete its content at any time. After the Customer’s organization is deleted or the agreement ends, the Processor deletes the Customer’s personal data from active systems within 30 days; copies in backups expire with the 30-day backup rotation. This does not apply to data the Processor must keep by law, such as billing records.

12. Information and audits

The Processor makes available the information necessary to demonstrate compliance with this DPA, including the Security page and answers to reasonable security questionnaires. If this is not sufficient, the Customer may conduct an audit at its own cost, with 30 days’ notice, during business hours and no more than once a year, unless a supervisory authority requires otherwise or a personal data breach has occurred.

13. Liability and precedence

Liability under this DPA follows the Terms. If this DPA conflicts with the Terms on the protection of personal data, this DPA prevails. Swiss law governs this DPA, as it governs the Terms, subject to mandatory data protection law.

Annex: technical and organizational measures

• Hosting in an OVHcloud data center in Germany (EU), with daily backups kept for 30 days.
• Encryption in transit with HTTPS (TLS 1.2 or later); secrets encrypted at rest with AES-256-GCM; passwords stored as salted scrypt hashes.
• Role-based access within each organization, optional single sign-on, revocable sessions and a verified email address for sensitive actions.
• Every query is scoped to the selected organization; drafts stay private until published.
• Web application firewall based on the OWASP Core Rule Set, rate limiting and a strict content security policy.
• Audit log of platform administration actions; staff access only as needed for operation, security or support.
• Incident response with notification of personal data breaches within 72 hours.