Data processing agreement

Purpose of this document

If Butler Office processes personal data for a customer in the course of an assignment, Butler Office provides this data processing agreement (DPA) for that purpose. It becomes binding when it is designated as part of the contract in the quotation, the order confirmation or the statement of work, or when it is signed by both parties. The details of the specific assignment (Annex 1) are completed for each assignment.

A version ready for signature is available on request via the contact form.

1. Parties and legal bases

1.1 The parties are the customer and the sole proprietorship:

1.2 This agreement is based on Art. 9 of the Swiss Federal Act on Data Protection (FADP) and Art. 7 of the Data Protection Ordinance (DPO). To the extent that the EU General Data Protection Regulation (GDPR) additionally applies to a processing operation, this agreement is also deemed a contract under Art. 28 GDPR; the terms are then to be understood accordingly.

2. Roles

2.1 Model A: The customer is the controller, Butler Office is the processor.

2.2 Model B: The customer is itself a processor for a third party, Butler Office is the sub-processor. The customer confirms that the controller has authorised it to engage Butler Office, and passes the controller’s instructions on to Butler Office.

2.3 Which model applies is recorded in Annex 1. If nothing is specified, Model A applies.

3. Subject matter, duration, nature and purpose

3.1 The subject matter is the processing of personal data that is necessary for the services agreed in the main contract, for example the operation and maintenance of websites and systems, the administration of cloud services, support, administrative work or marketing work involving customer data.

3.2 The agreement applies for the duration of the main contract and beyond it for as long as Butler Office holds personal data of the customer.

3.3 The nature and purpose of the processing, the categories of personal data and the categories of data subjects are described in Annex 1.

4. Instructions

4.1 Butler Office processes the personal data only for the agreed purposes and in accordance with the documented instructions of the customer, never for its own purposes. The main contract and this agreement are deemed to be instructions; further instructions are given in text form.

4.2 If Butler Office considers an instruction to be unlawful, Butler Office notifies the customer accordingly and may suspend its execution until the matter has been clarified.

4.3 The customer remains responsible for the lawfulness of the processing and for informing the data subjects.

5. Confidentiality

5.1 Butler Office treats the personal data as confidential. Access is granted only to persons who need it for the assignment and who are bound to confidentiality. The obligation continues beyond the end of the contract.

6. Data security

6.1 Butler Office ensures a level of data security appropriate to the risk in accordance with Art. 8 FADP and Art. 1 to 6 DPO. The measures are described in Annex 3. Assignment-specific measures may be added in the statement of work.

6.2 Butler Office may develop the measures further as long as the level of protection does not decrease.

7. Sub-processors

7.1 The customer gives general authorisation for the engagement of the sub-processors named in Annex 2.

7.2 If Butler Office intends to engage further sub-processors or to replace existing ones, Butler Office informs the customer in advance in text form. The customer may object within 14 calendar days of being informed, on objectively justified data protection grounds. If the parties do not find a solution, the customer may terminate the affected service.

7.3 Engaged specialists: If Butler Office engages an external specialist for an assignment who is given access to personal data of the customer, that specialist is approved for this assignment in Annex 1 or in the statement of work. The purpose, scope, data categories, type of access and duration are recorded in the process. Without access to personal data, there is no sub-processing.

7.4 Butler Office contractually imposes on sub-processors obligations that correspond to this agreement and remains responsible to the customer for their compliance with them.

7.5 Services that the customer itself obtains from a provider (for example Microsoft 365 in its own tenant) are not sub-processors of Butler Office. They are governed by the customer’s contract with the provider.

8. Processing abroad

8.1 Butler Office processes the personal data in Switzerland and in states for which the Swiss Federal Council has determined an adequate level of data protection (Annex 1 DPO). The locations of the sub-processors are stated in Annex 2.

8.2 Processing in other states takes place only after the customer has been informed in advance and only with safeguards under Art. 16 para. 2 FADP, for example standard data protection clauses recognised by the FDPIC.

9. Rights of data subjects

9.1 If a data subject addresses a request (for example for information, rectification, erasure or the delivery of data) to Butler Office, Butler Office forwards it to the customer without delay and does not answer it itself.

9.2 Butler Office assists the customer, to a reasonable extent, in fulfilling such requests.

10. Data security breaches

10.1 Butler Office notifies the customer of a data security breach affecting the customer’s personal data as quickly as possible (Art. 24 para. 3 FADP).

10.2 The notification states, as far as known, the nature of the breach, the data and persons affected, the likely consequences and the measures taken and planned. Missing information is supplied subsequently.

10.3 Butler Office assists the customer with the customer’s notification obligations and takes the reasonable measures to remedy the breach and mitigate its consequences.

11. Further assistance

11.1 On request, Butler Office assists the customer with the available information in data protection impact assessments, with the record of processing activities and with enquiries from supervisory authorities.

11.2 Assistance that goes beyond a processor’s duties to cooperate is charged at the agreed rates after prior notice.

12. Evidence and audits

12.1 On request, Butler Office provides the customer with the information necessary to demonstrate compliance with this agreement.

12.2 If this information is insufficient for objective reasons, the customer may verify compliance itself or through an auditor bound to confidentiality, after giving advance notice, during normal business hours and while preserving confidentiality towards other customers. The customer bears its own costs; it reimburses Butler Office for its effort to the extent that the audit does not reveal any material breaches.

12.3 For data centres of the sub-processors, their evidence and audit rights apply.

13. Return and erasure

13.1 When the contract ends, Butler Office returns or erases the personal data, at the customer’s choice. In the absence of an instruction, Butler Office hands over the data as part of the handover and then erases the remaining data.

13.2 Copies in data backups are erased when the respective backup expires and are no longer actively processed until then. Statutory retention obligations remain reserved.

13.3 On request, Butler Office confirms the erasure in text form.

14. Liability, order of precedence and final provisions

14.1 Liability is governed by the main contract together with the GTC.

14.2 In matters concerning the processing of personal data on behalf of the customer, this agreement takes precedence over the main contract and the GTC.

14.3 Amendments are made in text form. The applicable law and the place of jurisdiction are determined by the main contract.

Annex 1: Details of the assignment

Annex 1 is completed for each assignment, as a rule as part of the statement of work:

• Assignment and main contract
• Role: Model A or Model B
• Nature and purpose of the processing
• Categories of personal data; sensitive personal data yes or no
• Categories of data subjects
• Systems and storage locations concerned
• Sub-processors and engaged specialists approved for this assignment – each with purpose, scope, data categories, type of access and duration
• Duration as well as return and erasure periods
• Contact persons for instructions and for notifications

Annex 2: Sub-processors

Further sub-processors that are used only for a particular assignment are named in Annex 1.

Annex 3: Technical and organisational measures (TOMs)

This customer version describes the measures of Butler Office in general terms. Security-relevant details are not published. For the data centres, the measures of the providers named in Annex 2 apply in addition. Assignment-specific measures are recorded in the statement of work.

1. Physical access

Servers that Butler Office uses for hosting services are located in data centres of the providers named in Annex 2; physical access is governed by their measures.

2. System access

Server administration takes place via encrypted connections with key-based login. Administration interfaces can be reached only via encrypted connections. Login attempts on websites are limited and logged. Test and staging environments are secured by additional access protection.

3. Data access

Administrative accounts are restricted to what is necessary. Editing program files via the administration interface of websites is disabled. Access to customer systems is granted for the respective assignment.

4. Separation

Production and staging environments are separate installations with separate databases. Changes are first tested in the staging environment.

5. Transmission

Websites are delivered exclusively in encrypted form (TLS). E-mails sent by websites and the transfer of files to servers use encrypted connections.

6. Availability

Changes to websites are rolled out as versioned releases that can be rolled back to the previous state. The availability of the data centres is governed by the measures of the providers; assured availability levels exist only if they have been agreed.

7. Restoration

Before changes are made to content and databases, a database backup and a content snapshot with checksums are created; restoration is verified in a trial run before the change.

8. Logging

Server access and failed logins are logged. Changes made by the deployment tools are recorded with time and result; the source code is version-controlled.

9. Patch and update management

Security updates of the content management system in use are installed automatically. Updates of extensions are carried out manually and first in the staging environment.

10. Backup

Data backups for customer systems are agreed for each assignment (scope, frequency, retention). Without an agreement, there is no entitlement to data backup by Butler Office.

11. Security incidents

Security incidents are assessed and documented by the owner. Affected customers are informed in accordance with clause 10 of this agreement.

12. Engaged specialists

External specialists work on behalf of and in accordance with the instructions of Butler Office on the infrastructure of Butler Office. They are given access to a customer’s personal data only if the specific assignment requires it and they have been approved for it (clause 7.3).

13. Staging and test data

Staging environments are access-protected and excluded from search engines.

14. Data protection management

The owner is responsible for data protection. A data processing contract is in place with the hosting provider. The measures are reviewed and adjusted in the event of material changes.