Data Processing Agreement (DPA)

1. Subject matter

This Agreement governs the rights and obligations of the Client and the Contractor Netstream (hereinafter jointly the “Parties”) in connection with the processing of personal data on behalf of the Client (hereinafter “Processing on Behalf”).

This Agreement applies to all activities in which the Contractor processes, or has processed, personal data in whole or in part on behalf of the Client.

The terms used in this Agreement are to be construed in accordance with Swiss data protection law. The terms “personal data”, “processing” and “processor” correspond to the terms “personal data”, “processing” and “processor” of the General Data Protection Regulation (GDPR).

The Contractor is subject to Swiss data protection law, in particular the Federal Act on Data Protection (FADP). By means of this Agreement, the Contractor enables compliance with the applicable data protection requirements for Processing on Behalf, in particular pursuant to Art. 9 FADP and, where applicable, pursuant to Art. 28 GDPR.

By decision of 26 July 2000, the European Commission found that Swiss data protection law ensures an adequate level of protection for personal data. This finding constitutes an adequacy decision pursuant to Art. 45(1) GDPR.

2. Roles of the Parties

The Contractor processes personal data on behalf of the Client to the extent necessary for the provision of the contractually agreed services. The Client is the controller within the meaning of the FADP for such processing.

Insofar as this Agreement provides for processing for the Contractor’s own purposes, the Contractor acts as controller for such processing. The scope and purposes are exhaustively specified in clause 4.4.

3. Nature, subject matter and purpose of Processing on Behalf

Processing on Behalf is carried out in accordance with existing or future contractual agreements between the Parties. In the event of conflicts, the order of precedence of the contractual components set out in the Netstream General Terms and Conditions applies.

Processing on Behalf comprises any handling of personal data, irrespective of the means and procedures used, in particular the archiving, storage, disclosure, collection, erasure, saving, modification, destruction and use of personal data. Personal data means all information relating to an identified or identifiable person.

3.1 Categories of personal data processed

Within the scope of the agreed services, the Contractor processes the following categories of personal data:

• master and contact data of the Client’s contact persons and users
• access, authentication and device data
• technical connection and log data
• content that the Client stores or processes in the systems used, the nature and scope of which are determined by the Client
• in the case of streaming services, additionally usage data, comprising playback data, search terms, profile and configuration data as well as recordings

The above designates categories and not individual data fields.

3.2 Categories of data subjects

Data subjects are employees and agents of the Client, persons whose data the Client processes in the systems used and, in the case of streaming services, the Client’s subscribers and the co-users of a subscription authorised by them.

3.3 Sensitive personal data

The Contractor processes sensitive personal data only to the extent agreed in advance. Sensitive personal data means data on trade union, political, religious or ideological views or activities, data on health, the private sphere, sex life, sexual orientation or membership of an ethnic group or race, data on social assistance measures, data on administrative and criminal proceedings or sanctions, biometric data that uniquely identify a natural person, and genetic data.

In the case of streaming services, processing is deemed agreed by this Agreement insofar as it results from the nature of the service: usage data may allow conclusions to be drawn about sensitive personal data. The Contractor takes the protective measures pursuant to clause 5 for such data.

4. Obligations of the Parties

4.1 Duration

The Contractor processes personal data for an indefinite period until termination of this Agreement or of the last contractual agreement between the Parties relating to Processing on Behalf.

4.2 Instructions

The Contractor processes personal data exclusively as contractually agreed or in accordance with documented instructions of the Client, unless the Contractor is required by law or regulation to carry out specific processing. In such a case, the Contractor informs the Client of this obligation, unless such information is prohibited by law.

The Client may issue further documented instructions throughout the entire duration of Processing on Behalf.

The Contractor informs the Client without delay if it considers that contractual agreements or instructions issued infringe applicable data protection requirements.

4.3 Purpose limitation

The Contractor processes personal data exclusively for the purpose or purposes set out in the contractual agreements between the Parties, unless the Contractor receives further documented instructions from the Client.

Processing for the Contractor’s own purposes pursuant to clause 4.4 is reserved.

4.4 Usage data

In the case of streaming services, the Contractor additionally processes usage data for the following purposes of its own:

1. operation, error analysis, troubleshooting and capacity planning of the platform
2. provision to the Client of analyses of the use of the Client’s services
3. preparation of aggregated, cross-customer analyses of the use of the platform
4. further development of the application and of the platform functions
5. compilation and management of the programme offering
6. provision of recommendation functions for subscribers
7. publication of aggregated analyses pursuant to clause 3

This list is exhaustive.

Analyses pursuant to clauses 3 and 7 are carried out exclusively in aggregated form. The aggregation procedure, including the minimum number of cases per result cell, is documented by the Contractor. The Contractor discloses the procedure upon justified request, provided that no trade secrets are thereby revealed.

Recommendation functions pursuant to clause 6 are derived from relationships between content items. These derivations do not contain any personal reference. Personal usage data are used exclusively within the environment of the respective Client.

The Contractor does not pass on usage data or insights derived therefrom that can be attributed to an individual Client to other customers or third parties. The use of aggregated, cross-customer insights for the purposes set out in this clause 4.4 remains permitted.

The Contractor does not pass on usage data to third parties for advertising or marketing purposes and does not combine them with data from other sources to enrich personal profiles.

5. Security

The Contractor takes at least the technical and organisational measures (TOMs) published at /en/toms/ to ensure the security of the personal data processed. The TOMs form an integral part of the Agreement. These measures include in particular the protection of the personal data processed against a breach of security which, whether unintentionally or unlawfully, leads to the unauthorised disclosure of personal data, to unauthorised access to personal data, or to the modification, loss or destruction of the personal data (hereinafter jointly “Data Security Breaches”).

The Contractor may adapt the technical and organisational measures in line with technical developments. In doing so, the level of protection achieved by the previous measures must not be reduced.

The Contractor grants its personnel access to personal data only to the extent strictly necessary for the performance, monitoring and administration of this Agreement. The Contractor ensures that the persons authorised to carry out Processing on Behalf have committed themselves to confidentiality or are subject to an appropriate statutory duty of confidentiality.

6. Documentation, evidence and audit options

The Parties must be able to demonstrate compliance with this Agreement.

The Contractor deals appropriately and promptly with enquiries from the Client regarding Processing on Behalf under this Agreement.

6.1 Evidence and information

The Contractor provides the Client with the evidence and information required for the fulfilment of the Client’s data protection obligations. The published details are accessible via the information on information security published by the Contractor.

The Contractor provides further evidence upon justified request and subject to a confidentiality agreement in a suitable form. Scope and form are determined by the Client’s need for evidence and the Contractor’s security interests.

If the effort exceeds a reasonable level, in particular in the case of customer-specific questionnaires, evidence formats or audits, the Contractor may charge for it on a time and materials basis. The Contractor notifies the Client of the expected effort in advance.

6.2 Audits

Upon request, the Contractor enables the Client to audit Processing on Behalf under this Agreement at reasonable intervals or where there are documented indications of non-compliance, and contributes to such an audit.

The Client may carry out an audit itself or have it carried out by an independent auditor. Such audits are limited to one day per calendar year. An audit may also include inspections of the Contractor’s physical facilities or premises, provided that such inspections are necessary, take place during normal business hours without disrupting operations, and are announced with reasonable advance notice. Such inspections are otherwise permitted only if and to the extent that the audit cannot be carried out by means of suitable evidence such as certificates or certifications, in particular in the case of data centres.

The Client bears the Contractor’s costs for audits pursuant to this clause 6.2.

The Parties make the information referred to in this clause 6, including the results of audits, available to a competent supervisory authority or competent supervisory authorities upon request, unless such provision is prohibited by law.

7. Sub-processing

The Client grants the Contractor general authorisation to engage the sub-processors included in the list published at /en/sub-processors/. The list forms an integral part of the Agreement.

The Contractor notifies changes to this list by replacing or adding sub-processors in a suitable form. The amendment procedure pursuant to the General Terms and Conditions applies to objections and their consequences.

In the event of material changes, the Contractor provides information in advance where possible. This does not establish any time limit.

The Contractor must contractually impose on sub-processors engaged to carry out Processing on Behalf essentially the same obligations as those that apply to the Contractor under this Agreement. The Contractor ensures that each sub-processor fulfils the obligations to which the Contractor is subject under this Agreement and under the applicable data protection requirements.

The Contractor is liable to the Client for ensuring that a sub-processor fulfils its obligations under the sub-processing agreement concluded with the Contractor. The Contractor informs the Client if a sub-processor fails to fulfil its contractual obligations.

8. Export of personal data

8.1 Principle

Personal data are processed in Switzerland. Content that the Client stores or processes in the systems used is processed and stored exclusively in Switzerland.

8.2 Supporting services

For supporting services, in particular the processing of support requests and incident reports as well as communication with the Client, the engagement of sub-processors pursuant to clause 7 may involve processing in other countries. This covers the information that the Client transmits in its requests and reports, not the content stored in the systems used.

If an incident cannot be resolved by the Contractor and the involvement of the manufacturer of the software used as third-level support is required, access to the content stored in the systems used may, by way of exception, also become necessary. Such access is limited in time and in substance to what is required to resolve the incident and takes place only after prior approval by the Client.

8.3 In the case of streaming services

In the case of streaming services, error and diagnostic reports are also processed outside Switzerland by a sub-processor pursuant to clause 7. Such reports comprise the technical status of the application and of the device, the account and device details used for attribution, as well as the usage events preceding the event.

8.4 Level of protection

Where processing takes place outside Switzerland, the Contractor ensures an adequate level of protection in accordance with the applicable data protection requirements, in particular by means of an adequacy decision of the Federal Council or by means of standard contractual clauses recognised by the FDPIC.

8.5 Further export

Any further export takes place only insofar as contractually agreed, on documented instruction of the Client or on the basis of a statutory obligation. In the latter case, the Contractor informs the Client, unless this is prohibited by law.

9. Assistance to the Client

The Contractor informs the Client without delay of any request it has received from a data subject that relates to Processing on Behalf. The Contractor is entitled to confirm receipt to the data subject but does not otherwise respond to the request itself unless it has been authorised to do so by the Client.

Taking into account the nature of Processing on Behalf, the Contractor assists the Client in fulfilling its obligation to respond to requests from data subjects to exercise their rights. In providing such assistance, the Contractor follows the Client’s instructions.

Taking into account the nature of Processing on Behalf and the information available to it, the Contractor further assists the Client in complying with the following obligations:

1. maintaining any record of processing activities
2. carrying out a data protection impact assessment where a processing of personal data planned by the Client is likely to entail a high risk to the fundamental rights or the personality of the data subjects
3. consulting the competent supervisory authorities prior to the processing of personal data where a data protection impact assessment indicates that the planned processing, despite the measures envisaged, entails a high risk to the fundamental rights or the personality of the data subjects
4. ensuring that the personal data processed are accurate and up to date, by the Contractor informing the Client without delay if it becomes aware that the personal data processed by it are inaccurate or outdated
5. ensuring a level of data security appropriate to the risk, in particular by means of suitable technical and organisational measures pursuant to clause 5

The Client bears the Contractor’s costs for assistance pursuant to this clause 9.

10. Notification of Data Security Breaches

In the event of a Data Security Breach, the Contractor cooperates with and assists the Client accordingly so that the Client can fulfil its obligations to notify Data Security Breaches to the competent supervisory authorities or to inform the data subjects, the Contractor taking into account the nature of Processing on Behalf and the information available to it.

10.1 Breaches of security of personal data processed by the Client

In the event of a Data Security Breach in connection with the personal data processed by the Client, the Contractor assists the Client as follows:

1. in notifying the Data Security Breach to the competent supervisory authorities after the Client has become aware of the breach, where relevant, and, in each case as soon as available, in obtaining the information that must be contained in the notification in accordance with the applicable data protection requirements
2. in informing the data subjects in accordance with the applicable data protection requirements where this is necessary for the protection of the data subjects or is required by a competent supervisory authority

The Client bears the Contractor’s costs for assistance pursuant to this clause 10.1.

10.2 Breaches of security of personal data processed by the Contractor

The Contractor informs the Client within 48 hours after the Contractor has become aware of a Data Security Breach in connection with the personal data processed by it, providing the information available at that time. Deviating contractually agreed notification periods take precedence.

The Contractor provides supplementary information as soon as it becomes available, in particular:

1. a description of the nature of the breach, if possible stating the categories and the approximate number of data subjects concerned and the approximate number of data records concerned
2. the contact details of a contact point from which further information about the Data Security Breach can be obtained
3. the likely consequences of the Data Security Breach as well as measures taken or proposed to remedy it and to mitigate its possible adverse effects

The Contractor bears the costs for assistance pursuant to this clause 10.2.

11. Requests for access by authorities

If the Contractor receives a request from an authority for the surrender of personal data of the Client, it surrenders data only insofar as there is a legal obligation to do so and limits the surrender to the scope requested. The Contractor informs the Client of the request insofar as this is legally permissible.

12. Suspension of Processing on Behalf

In the event that the Contractor fails to fulfil its obligations under this Agreement, the Client may instruct the Contractor to suspend Processing on Behalf of personal data until the Contractor complies with this Agreement or this Agreement is terminated. The Contractor informs the Client without delay if it is unable to comply with this Agreement.

13. Liability

Liability is governed by any liability provisions contained in the contractual agreements between the Parties.

14. Termination

The procedure pursuant to the General Terms and Conditions applies to termination, notice periods and cost consequences. During the term of the Agreement, the Client has access to the data it has stored in the systems used and is responsible for backing up or exporting such data before termination. The return of the personal data processed on behalf of the Client takes place in this manner. There is no right to the return of data that the Contractor processes as controller pursuant to clause 4.4.

If there is no possibility of independent export for personal data processed on behalf of the Client to which the Client is entitled, the Contractor makes such data available upon request in a common format, insofar as this is technically possible. The Contractor may charge for the effort involved in any exports going beyond this.

After termination, the Contractor erases the personal data processed on behalf of the Client. The Client may request confirmation that the erasure has taken place. Technical locks set by the Client are reserved.

Until erasure, the Contractor ensures compliance with this Agreement.

Exempt from erasure are data that the Contractor must continue to retain on the basis of statutory or regulatory provisions or to safeguard the integrity of security logs, as well as data whose retention is necessary for the purpose of evidence in pending or foreseeable legal proceedings. Such data are blocked and used exclusively for this purpose.

In the case of streaming services, recordings are erased upon termination of access. There is no right to the surrender of recordings.

15. Amendments to this Agreement

The Contractor may amend this Agreement. Amendments are notified in a suitable form and apply from the date notified.

16. Final provisions

This Agreement forms an integral part of the Netstream General Terms and Conditions.

The Parties undertake to treat as confidential on a permanent basis, including after the termination of this Agreement, all knowledge obtained within the scope of this Agreement of the respective other Party’s trade secrets and of personal data, unless a Party is required by law to make a specific disclosure. In such a case, the obligated Party informs the respective other Party of this statutory obligation, unless such information is prohibited by law. If a Party is in doubt as to whether information is subject to this duty of confidentiality, the information must be treated as confidential until expressly released by the respective other Party.

Should individual provisions of this Agreement be impossible to perform, invalid or ineffective, this does not affect the performability, validity or effectiveness of the remaining provisions, and the Parties replace the individual provision with a performable, valid or effective provision that comes as close as possible to the intended data protection outcome of the individual provision.

This Agreement is governed exclusively by Swiss law. The conflict of laws rules and the UN Convention on Contracts for the International Sale of Goods are excluded. The exclusive place of jurisdiction is at the registered office of the Contractor.