As of August 18, 2026

1. object

This agreement governs the rights and obligations of the Client and the Contractor, Netstream (hereinafter collectively referred to as the “Parties”), in connection with the processing of personal data on behalf of the Client (hereinafter referred to as “Processing on Behalf of the Client”).

This agreement applies to all activities in which the Contractor processes or arranges for the processing of personal data, in whole or in part, on behalf of the Client.

The terms used in this agreement are based on Swiss data protection law. The terms “personal data,” “processing,” and “data processor” correspond to the terms “personal data,” “processing,” and “data processor” in the General Data Protection Regulation (GDPR).

The Contractor is subject to Swiss data protection law, in particular the Federal Act on Data Protection (DSG). Through this Agreement, the Contractor ensures compliance with the applicable data protection requirements for data processing, in particular pursuant to Art. 9 DSG and, to the extent applicable, pursuant to Art. 28 GDPR.

In its decision of July 26, 2000, the European Commission determined that Swiss data protection law ensures an adequate level of protection for personal data. This determination constitutes an adequacy decision pursuant to Article 45(1) of the GDPR.

2. Roles of the Parties

The Contractor processes personal data on behalf of the Client to the extent necessary to provide the contractually agreed services. The Client is the data controller for this processing within the meaning of the DSG.

To the extent that this Agreement provides for the Contractor to process data for its own purposes, the Contractor shall act as the data controller for such processing. The scope and purposes are exhaustively specified in Section 4.4.

3. Nature, Subject Matter, and Purpose of Data Processing

Orders are processed in accordance with existing contractual agreements between the parties or those yet to be concluded. In the event of any conflicts, the hierarchy of the contractual components shall apply in accordance with the General Terms and Conditions ( Netstream ).

Data processing encompasses any handling of personal data, regardless of the means or methods used, including, in particular, the archiving, retention, disclosure, collection, deletion, storage, modification, destruction, and use of personal data. Personal data refers to any information relating to an identified or identifiable individual.

3.1 Categories of Personal Data Processed

As part of the agreed-upon services, the Contractor processes the following categories of personal data:

• Master and contact information for the client's points of contact and users
• Access, Authentication, and Device Data
• Technical connection and log data
• Content that the client stores or edits in the systems used, the nature and scope of which are determined by the client
• When using streaming services, additional usage data, including playback data, search terms, profile and configuration data, and recordings

The entries refer to categories, not individual data fields.

3.2 Categories of Data Subjects

The individuals concerned include employees and agents of the client, individuals whose data is processed by the client in the relevant systems, and—in the case of streaming services—the client’s subscribers and the authorized co-users of a subscription designated by them.

3.3 Specially Sensitive Personal Data

The Contractor shall process sensitive personal data only to the extent that this has been agreed upon in advance. Sensitive personal data includes data regarding trade union, political, religious, or ideological views or activities; data regarding health, privacy, sex life, sexual orientation, or ethnicity or race; data regarding social assistance measures; data concerning administrative or criminal proceedings or sanctions, biometric data that uniquely identifies a natural person, and genetic data.

When streaming services are provided, the processing of data as set forth in this Agreement is deemed to have been agreed upon to the extent that it arises from the nature of the service: usage data may allow inferences to be drawn regarding personal data requiring special protection. The Contractor shall implement the protective measures for this data in accordance with Section 5.

4. Obligations of the Parties

4.1 Duration

The Contractor shall process personal data for an indefinite period until the termination of this contract or the last contractual agreement between the parties concerning data processing.

4.2 Instructions

The Contractor shall process personal data exclusively as contractually agreed or in accordance with the Client’s documented instructions, unless the Contractor is legally or regulatory required to process such data in a specific manner. In such a case, the Contractor shall inform the Client of this obligation, provided that such disclosure is not prohibited by law.

The client may issue additional documented instructions throughout the entire duration of the project.

The Contractor shall immediately notify the Client if it believes that any contractual provisions or instructions issued violate applicable data protection requirements.

4.3 Earmarking

The Contractor shall process personal data exclusively for the purpose or purposes specified in the contractual agreements between the parties, unless the Contractor receives further documented instructions from the Client.

This is without prejudice to the Contractor's right to process the data for its own purposes in accordance with Section 4.4.

4.4 Usage Data

When streaming services are used, the contractor also processes usage data for the following purposes of its own:

1. Platform operation, error analysis, troubleshooting, and capacity planning
2. Providing the client with reports on the use of its services
3. Preparation of aggregated, cross-customer analyses of platform usage
4. Further Development of the Application and Platform Features
5. Compilation and Management of the Program Lineup
6. Providing recommendation features for subscribers
7. Publication of aggregated analyses in accordance with Section 3

This list is exhaustive.

Analyses pursuant to Sections 3 and 7 shall be conducted exclusively on an aggregated basis. The aggregation method, including the minimum number of cases per result cell, is documented by the Contractor. The Contractor shall disclose the method upon a justified request, provided that doing so does not reveal any trade secrets.

Recommendation features as described in Section 6 are derived from relationships between content. These derivations do not contain any personal information. Personal usage data is used exclusively within the respective client’s environment.

The Contractor shall not disclose usage data or insights derived therefrom that can be attributed to a specific Client to other clients or third parties. The use of aggregated, cross-client insights for the purposes specified in this Section 4.4 remains permitted.

The contractor does not disclose usage data to third parties for advertising or marketing purposes and does not combine it with data from other sources to enrich individual profiles.

5. Safety

The Contractor shall implement at least the technical and organizational measures (TOM) published at https://netstream.ch/tom/ to ensure the security of the personal data being processed. The TOM constitute an integral part of this contract. These measures include, in particular, the protection of the processed personal data against a security breach that, whether unintentional or unlawful, results in the unauthorized disclosure of personal data, unauthorized access to personal data, or the alteration, loss, or destruction of personal data (hereinafter collectively referred to as “data security breaches”).

The contractor may adapt the technical and organizational measures in line with technological developments. However, the level of protection achieved through the measures in place to date must not be reduced.

The Contractor shall grant its personnel access to personal data only to the extent strictly necessary for the performance, monitoring, and administration of this Contract. The Contractor warrants that the persons authorized to process the order have agreed to maintain confidentiality or are subject to an appropriate statutory duty of confidentiality.

6. Documentation, Evidence, and Verification Methods

The parties must be able to demonstrate compliance with this Agreement.

The Contractor shall promptly and appropriately process the Client’s requests regarding the performance of the contract in accordance with this Agreement.

6.1 Documentation and Information

The Contractor shall provide the Client with the documentation and information necessary for the Client to fulfill its data protection obligations. The published details are accessible through the information on information security published by the Contractor.

The Contractor shall provide further documentation in an appropriate form upon reasonable request and subject to a confidentiality agreement. The scope and form of such documentation shall be determined by the Client’s documentation requirements and the Contractor’s security interests.

If the effort involved exceeds a reasonable level—particularly in the case of client-specific questionnaires, reporting formats, or tests—the Contractor may bill the Client for such effort on a time-and-materials basis. The Contractor shall notify the Client in advance of the estimated effort involved.

6.2 Exams

Upon request, the Contractor shall allow the Client to review the performance of the contract in accordance with this Agreement at reasonable intervals or in the event of documented indications of noncompliance, and shall cooperate with such a review.

The Client may conduct an audit itself or have it conducted by an independent auditor. Such audits are limited to one day per calendar year. An audit may also include inspections of the contractor’s physical facilities or premises, provided that such inspections are necessary, take place during normal business hours without disrupting operations, and are announced with reasonable advance notice. Furthermore, such inspections are only permitted if and to the extent that the audit cannot be conducted through appropriate evidence, such as certificates or certifications, particularly in the case of data centers.

The Client shall bear the Contractor’s costs for inspections in accordance with this Section 6.2.

The parties shall make the information specified in this Section 6, including audit results, available to the competent supervisory authority or authorities upon request, provided that such disclosure is not prohibited by law.

7. Subcontracting

The Client grants the Contractor general authorization to engage the subcontractors listed in the list published at https://netstream.ch/subcontracting/. The list forms an integral part of this contract.

The Contractor shall notify the Client of any changes to this list—whether by replacing or adding subcontractors—in an appropriate manner. The amendment procedure set forth in the General Terms and Conditions applies to any objection and its consequences.

In the event of significant changes, the Contractor shall provide advance notice whenever possible. This does not constitute a deadline.

The Contractor must impose on subcontractors engaged to perform the processing essentially the same obligations as those applicable to the Contractor under this Agreement. The Contractor shall ensure that each subcontractor complies with the obligations to which the Contractor is subject under this Agreement and in accordance with applicable data protection requirements.

The Contractor is liable to the Client for ensuring that a subcontractor fulfills its obligations under the subcontracting agreement entered into with the Contractor. The Contractor shall notify the Client if a subcontractor fails to fulfill its contractual obligations.

8. Export of Personal Data

8.1 Principle

Personal data is processed in Switzerland. Content that the client stores or edits in the systems it uses is processed and stored exclusively in Switzerland.

8.2 Support Services

For support services—in particular, the processing of support requests and incident reports, as well as communication with the client—the engagement of subcontractors in accordance with Section 7 may involve processing in other countries. This covers the information that the client provides in its requests and reports, not the content stored in the relevant systems.

If the contractor is unable to resolve a malfunction and it is necessary to involve the manufacturer of the software in use as a third level of support, access to the content stored in the systems in question may, in exceptional cases, be required. Such access is limited in terms of time and scope to what is necessary for resolving the malfunction and is granted only with the client’s prior approval.

8.3 When Purchasing Streaming Services

When streaming services are used, error and diagnostic reports are also processed outside of Switzerland by a subcontractor in accordance with Section 7. Such reports include the technical status of the application and the device, the account and device information used for assignment, and the usage activities preceding the event.

8.4 Level of Protection

If processing takes place outside Switzerland, the contractor shall ensure an adequate level of protection in accordance with the applicable data protection requirements, in particular through an adequacy decision by the Federal Council or through standard contractual clauses recognized by the FDPIC.

8.5 Further Export

Any further export shall take place only to the extent contractually agreed, upon documented instruction from the Client, or due to a legal obligation. In the latter case, the Contractor shall inform the Client, unless prohibited by law.

9. Support for the Client

The Contractor shall immediately inform the Client of any request it has received from a data subject regarding the processing of the order. The Contractor is entitled to confirm receipt to the data subject but shall not otherwise respond to the request itself, unless authorized to do so by the Client.

The Contractor shall assist the Client, taking into account the nature of the contract performance, in fulfilling its obligation to respond to requests from data subjects to exercise their rights. In providing this assistance, the Contractor shall follow the Client’s instructions.

The Contractor shall also assist the Client—taking into account the nature of the order processing and the information available to it—in complying with the following obligations:

1. Maintaining a list, if any, of data processing activities
2. Conducting a data protection impact assessment if the client’s planned processing of personal data is likely to pose a high risk to the fundamental rights or privacy of the data subjects
3. Consultation with the relevant supervisory authorities prior to the processing of personal data if a data protection impact assessment determines that the planned processing, despite the measures envisaged, poses a high risk to the fundamental rights or privacy of the data subjects
4. Ensuring that the personal data being processed is factually accurate and up to date by having the contractor promptly notify the client if it determines that the personal data it is processing is inaccurate or out of date
5. Ensuring data security commensurate with the risk, in particular through appropriate technical and organizational measures in accordance with Section 5

The Client shall bear the Contractor’s costs for the support provided in accordance with this Section 9.

10. Reporting Data Security Breaches

In the event of a data security breach, the Contractor shall cooperate with the Client and provide appropriate assistance so that the Client can fulfill its obligations to report data security breaches to the relevant supervisory authorities and to notify the affected individuals, taking into account the nature of the data processing and the information available to the Contractor.

10.1 Breaches of the security of personal data processed by the Client

In the event of a data security breach involving the personal data processed by the Client, the Contractor shall assist the Client as follows:

1. in reporting the data security breach to the relevant supervisory authorities after the client becomes aware of the breach, if applicable, and, as soon as the information becomes available, in obtaining the details that must be included in the report in accordance with applicable data protection requirements
2. when notifying data subjects in accordance with applicable data protection requirements, if such notification is necessary to protect the data subjects or is required by a competent supervisory authority

The Client shall bear the Contractor’s costs for the support provided in accordance with this Section 10.1.

10.2 Breaches of the security of personal data processed by the Contractor

The Contractor shall notify the Client within 48 hours after becoming aware of a data security breach involving the personal data it processes, providing the information available at that time. Any differing, contractually agreed-upon notification deadlines shall take precedence.

The contractor will provide additional information as soon as it becomes available, in particular:

1. Description of the nature of the breach, including, if possible, the categories and approximate number of individuals affected, as well as the approximate number of data records affected
2. Contact information for a point of contact where further information about the data breach can be obtained
3. Expected consequences of the data security breach, as well as measures taken or proposed to remedy the situation and mitigate any potential adverse effects

The Contractor shall bear the costs of the support provided in accordance with this Section 10.2.

11. Requests for Access from Government Agencies

If the Contractor receives an official request from a government agency to disclose the Client’s personal data, it shall disclose such data only to the extent required by law and shall limit the disclosure to the scope requested. The Contractor shall inform the Client of the request to the extent permitted by law.

12. Suspension of Order Processing

In the event that the Contractor fails to fulfill its obligations under this Agreement, the Client may instruct the Contractor to suspend the processing of personal data until the Contractor complies with this Agreement or this Agreement is terminated. The Contractor shall notify the Client immediately if it is unable to comply with this Agreement.

13. Liability

The liability provisions are governed by any liability provisions set forth in the contractual agreements between the parties.

14. Termination

The procedure set forth in the General Terms and Conditions applies to termination, notice periods, and financial consequences. During the term of the contract, the Client has access to the data it has stored in the systems it uses and is responsible for backing up or exporting this data prior to termination. Personal data processed under this contract shall be returned in this manner. There is no right to the return of data that the Contractor processes as the data controller in accordance with Section 4.4.

If there is no way to independently export personal data processed on behalf of the Client to which the Client is entitled, the Contractor shall, upon request, make this data available in a standard format, to the extent technically possible. The Contractor may charge for any additional exports.

Upon completion, the Contractor shall delete the personal data processed on behalf of the Client. The Client may request confirmation that the deletion has been carried out. The Client reserves the right to implement technical restrictions.

Until the contract is terminated, the Contractor shall ensure compliance with this contract.

Excluded from deletion are data that the contractor is required to retain due to legal or regulatory requirements or to maintain the integrity of security protocols, as well as data that must be preserved as evidence in an ongoing or foreseeable legal dispute. This data will be blocked and used exclusively for this purpose.

When streaming services are used, recordings are deleted upon termination of access. There is no right to request the release of recordings.

15. Amendments to This Agreement

The contractor may amend this contract. Changes will be communicated in an appropriate manner and will take effect as of the date specified in the notice.

16. Final Provisions

This contract is part of the Netstream GTC.

The parties are obligated to treat all knowledge of business secrets of the respective other party obtained within the scope of this Agreement as well as of personal data as permanently confidential even beyond the termination of this Agreement, unless one party is legally obligated to a certain disclosure. In such a case, the obligated party shall inform the respective other party of this legal obligation, unless such information is prohibited for legal reasons. If one party is in doubt as to whether information is subject to this confidentiality obligation, the information shall be treated confidentially until expressly released by the respective other party.

If individual provisions of this Agreement are unenforceable, invalid or ineffective, this shall not affect the enforceability, validity or effectiveness of the remaining provisions and the parties shall replace the individual provision with an enforceable, valid or effective provision that comes as close as possible to the intended data protection outcome of the individual provision.

This contract is governed exclusively by Swiss law. Conflict-of-laws provisions and the United Nations Convention on Contracts for the International Sale of Goods are excluded. The exclusive venue for legal proceedings is the Contractor’s place of business.