Data processing agreement (DPA)

Agreement on the processing of personal data on behalf of the customer, between the customer as controller and Zerovia GmbH as processor.

Introduction

This data processing agreement ("DPA" or "Agreement") forms part of the Terms of Use and the Subscription Terms between the customer ("Customer" or "Controller") and Zerovia GmbH, Via Casti 52, 7151 Schluein, Switzerland ("ZEROvia" or "Processor"), together the "Parties".

Whereas

• the Customer uses the ZEROvia platform and thereby contributes personal data for which it acts as controller;
• ZEROvia processes this personal data exclusively on behalf of and on the documented instructions of the Customer;
• the Parties wish to set out the terms of this processing in accordance with Art. 9 of the Swiss Data Protection Act ("DSG") and Art. 28 of Regulation (EU) 2016/679 ("GDPR");
• the processing for which ZEROvia is itself responsible (in particular the website, customer administration and billing as described in the privacy policy) does not fall under this Agreement,

the Parties agree as follows:

Article 1 · Definitions

1.1 "Agreement" means this DPA including Annexes 1 to 3. "Customer personal data" means the personal data that ZEROvia processes on behalf of the Customer in connection with the Services (Annex 1). "Data Protection Laws" means the DSG including its ordinance (DSV), the GDPR and other applicable regulations. "Services" means the digital services of ZEROvia under the Terms of Use and Subscription Terms, in particular the platform zerovia.app. "Sub-processor" means any person that processes Customer personal data on behalf of or for ZEROvia.

1.2 Terms such as "controller", "data subject", "personal data", "personal data breach" and "processing" have the meaning given to them under the DSG or the GDPR respectively.

Article 2 · Subject matter, nature, purpose and duration

2.1 ZEROvia processes Customer personal data exclusively for the provision of the Services under the Main Agreement (Terms of Use and Subscription Terms, and any individual agreements).

2.2 The subject matter, nature and purpose, the categories of data subjects and the categories of personal data are set out in Annex 1.

2.3 The duration corresponds to the term of the Main Agreement plus the periods under Article 10.

2.4 Data campaigns. If a customer invites suppliers via the Services as a buyer, it is the controller for the contact data it imports and for the processing of the released data in its account. ZEROvia processes this data as processor of the buyer. The supplier is responsible for the data it records and releases in its own account; its own contract with ZEROvia applies to that data.

Article 3 · Instructions

3.1 ZEROvia processes Customer personal data only on the Customer's documented instructions, unless it is required by law to process it otherwise; in that case, it informs the Customer of this beforehand, unless the law prohibits it.

3.2 The Main Agreement and the use and configuration of the Services by the Customer, including roles, rights, releases and consents, count as documented instructions.

3.3 ZEROvia informs the Customer without undue delay if, in its view, an instruction infringes Data Protection Laws, and may suspend an instruction that is manifestly unlawful.

Article 4 · ZEROvia's obligations

4.1 ZEROvia undertakes

4.1.1 to comply with the applicable Data Protection Laws;

4.1.2 to process Customer personal data only on instructions and only to provide the Services;

4.1.3 not to use Customer personal data for its own purposes, in particular not to train AI models accessible to third parties; ZEROvia uses anonymised aggregate data for internal improvement only after the Customer's explicit opt-in;

4.1.4 to bind all persons authorised to process data to confidentiality;

4.1.5 to limit access to Customer personal data to persons who need it for their task; access by support and development to customer data takes place only with a documented reason, for a limited time and logged;

4.1.6 to implement the technical and organisational measures under Article 5;

4.1.7 where permitted, to inform the Customer of binding requests from authorities concerning Customer personal data and to limit any disclosure to what is legally required.

Article 5 · Technical and organisational measures

5.1 Taking into account the state of the art, the costs and the nature, scope and purpose of the processing, ZEROvia implements appropriate measures to ensure a level of protection appropriate to the risk (Art. 8 DSG in conjunction with Art. 1 et seq. DSV; Art. 32 GDPR).

5.2 The measures are described in Annex 2. Some of the infrastructure measures are provided by sub-processors, in particular Infomaniak, and are contractually assured to ZEROvia.

5.3 ZEROvia continuously reviews and improves the measures and may adapt them, provided the level of protection does not decrease.

Article 6 · Sub-processors

6.1 The Customer gives ZEROvia general authorisation to engage sub-processors. The sub-processors engaged are listed in Annex 3, maintained at zerovia.ch/unterauftragsverarbeiter/.

6.2 ZEROvia informs the Customer at least 30 days before engaging or replacing a sub-processor, by email and on this page. The Customer may object in writing within 30 days on important data protection grounds (email is sufficient). If the objection prevents continuation, either party may terminate the affected Service.

6.3 ZEROvia binds each sub-processor contractually to data protection obligations at least equivalent to its own and remains responsible to the Customer for their compliance.

Article 7 · Rights of data subjects

7.1 ZEROvia supports the Customer, within what is technically possible, in responding to requests from data subjects.

7.2 If a data subject addresses a request to ZEROvia, ZEROvia forwards it to the Customer without undue delay and responds only on the Customer's instructions or where legally obliged to do so.

Article 8 · Support for the Customer

8.1 ZEROvia supports the Customer with data security, notification of personal data breaches, data protection impact assessments and prior consultation of the supervisory authority, insofar as the information is available to ZEROvia.

Article 9 · Personal data breaches

9.1 ZEROvia notifies the Customer of a personal data breach affecting Customer personal data as soon as possible, and at the latest within 48 hours of becoming aware of it, and provides the information the Customer needs for its own notifications.

9.2 ZEROvia cooperates with the Customer and takes appropriate measures to investigate, contain and remedy the breach.

9.3 Notifications go to the contact address stored in the account or to the Customer's data protection contact; on ZEROvia's side, to privacy@zerovia.ch.

Article 10 · Deletion and return

10.1 At the Customer's choice, ZEROvia deletes Customer personal data or returns it once the Services have ended, at the latest 30 days after termination, unless a statutory retention obligation applies.

10.2 Before termination, the Customer carries out the necessary exports; ZEROvia supports this within what is technically possible.

10.3 ZEROvia confirms deletion in writing on request.

Article 11 · Evidence and audits

11.1 ZEROvia provides the information necessary to demonstrate compliance.

11.2 If this information is not sufficient, ZEROvia enables the Customer, or an auditor bound to confidentiality, to carry out reviews on reasonable terms and with reasonable advance notice, without endangering the security of other customers. Reasonable additional costs may be charged.

Article 12 · Transfers abroad

12.1 Customer personal data is primarily processed in Switzerland (hosting at Infomaniak, Geneva). AI processing takes place in the EU from 01.12.2026. Between Switzerland and the EU or the EEA there is a mutually recognised adequate level of protection; corresponding transfers do not require additional safeguards.

12.2 Transfers to sub-processors in other countries take place only with suitable safeguards, in particular the EU Commission's standard contractual clauses with the adjustments recognised by the FDPIC, supplemented by a transfer impact assessment and technical protective measures, or, for certified recipients, based on the Swiss-U.S. Data Privacy Framework. Annex 3 shows the mechanism for each sub-processor.

Article 13 · Liability

13.1 Liability is governed by the Main Agreement. Towards data subjects and supervisory authorities, the allocation of liability under Art. 82 GDPR or the provisions of the DSG applies.

Article 14 · Term and precedence

14.1 This Agreement applies together with the Main Agreement and for the survival periods under Article 10.

14.2 On matters of data processing, this Agreement takes precedence over the Terms of Use and Subscription Terms. Otherwise, the order of precedence is: individual agreement, Subscription Terms, this DPA, Terms of Use.

14.3 Amendments require text form. If a provision is invalid, the remaining provisions stay in effect.

Article 15 · Governing law and jurisdiction

15.1 Swiss law exclusively applies.

15.2 The place of jurisdiction is Chur (GR).

This Agreement takes effect electronically upon conclusion of the Main Agreement and is valid without a signature. For large customers, it may additionally be signed.

Annex 1 · Details of the processing

Aspect	Description
Subject matter	Provision of the platform zerovia.app: profile and release, reports and climate, product CO₂, customer requests, suppliers and data campaigns, partner access
Nature of processing	Collecting, recording, storing, structuring, reading out with AI, drafting texts with AI, displaying, transmitting after the customer's release, sending emails in the name of the buyer, deleting
Purpose	Exclusively the provision of the Services commissioned by the Customer
Data subjects	Users and employees of the Customer; contact persons in the profile; contact persons of the Customer's suppliers, including in data campaigns; persons named in uploaded documents or in public web sources of supplier screening
Personal data	Contact and master data (name, function, business email, telephone), account and usage data, log data, content of uploaded documents, sending and click events of invitations. Special categories of personal data only to the extent contributed by the Customer; the Terms of Use say this should not happen
Duration	Term of the Main Agreement plus the periods under Article 10

Annex 2 · Technical and organisational measures

Category	Implementation
Physical access	Operation in Infomaniak data centres in Switzerland, with access restrictions and physical security measures
System access	Two-factor sign-in as standard, with recovery codes; lockout after failed attempts; password rules; mandatory two-factor sign-in for administrators
Data access	Roles and rights (owner, admin, members; category manager read-only); principle of least privilege; support access to customer data only with a reason, a time limit and a log
Separation	Logical separation of customer tenants; release per customer and section
Encryption	Encrypted transmission (TLS) and encryption of data at rest in line with the state of the art
AI	No use of customer data for training public models; AI providers in the EU from 01.12.2026; suggestions with source, approval by the customer
Traceability	Change log (audit log), logging of security-relevant events and administrative access
Availability	Redundant storage and regular backups at Infomaniak; recovery processes
Incidents	Process for detecting, notifying and remedying personal data breaches (Article 9)
Testing	Internal reviews and external security tests; ISO 27001 in preparation
Processor control	Contractual binding of sub-processors to equivalent obligations
Deletion	Deletion and retention processes under Article 10
Personnel	Confidentiality undertaking by all persons with access rights

Annex 3 · Sub-processors

The approved sub-processors, with registered office, purpose and transfer mechanism, are listed on the page Sub-processors, with change history.

EU representative (Art. 27 GDPR): iuro Rechtsanwälte GmbH t/a Prighter, Schellinggasse 3, 1010 Vienna, Austria, privacy@zerovia.ch. Competent supervisory authority in Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Bern.