Data Processing Agreement
Version 1.0 · Effective: 24 October 2026
Legal documents: Data Processing Agreement
In short
- When you use Konsaro, you decide what happens to the data. We process it only on your behalf.
- The DPA meets the requirements of Art. 9 of the Swiss Federal Act on Data Protection (revFADP) and Art. 28 GDPR.
- The signable version is part of every customer contract. To request it, email info@softwarevision.ch.
This page summarises the Data Processing Agreement (“DPA”) between the Customer and Software Vision AG. It supplements the Terms and Conditions.
1.Roles
The Customer is the controller. Software Vision AG is the processor and processes personal data only on behalf of and on the documented instructions of the Customer.
2.Subject matter and duration
We process personal data solely to provide the Konsaro Service. Processing lasts for the term of the agreement and ends with the deletion described in section 10.
3.Data subjects and types of data
| Category | Examples |
|---|---|
| Data subjects | Directors, board office staff, executives, invited guests and advisors |
| Personal data | Names, contact details, roles, board materials, meeting notes, decisions, votes, access and audit logs |
| Special categories | Only if the Customer includes them in board materials |
4.Our obligations
- We process personal data only on the Customer’s documented instructions and inform the Customer if we consider an instruction unlawful.
- Everyone with access to Customer Data is bound by confidentiality.
- We maintain appropriate technical and organisational measures (section 9).
- We support the Customer in responding to requests from data subjects and with data protection impact assessments.
5.Sub-processors
We engage only the sub-processors listed on the Sub-processors page and bind them to obligations equivalent to this DPA. We announce new sub-processors at least 30 days in advance. The Customer may object on reasonable data protection grounds. If no solution is found, the Customer may cancel the affected service.
6.International transfers
Customer Data is stored in Switzerland. Where personal data is transferred to a country without an adequate level of data protection, this happens only with appropriate safeguards, such as the EU Standard Contractual Clauses with the amendments required under Swiss law.
7.Personal data breaches
We notify the Customer without undue delay after becoming aware of a personal data breach and provide the information the Customer needs to meet its own reporting obligations.
8.Audits
The Customer may verify our compliance with this DPA. We provide the necessary information, including our security documentation and answers to security questionnaires. On-site audits are possible with reasonable notice, during business hours and subject to confidentiality.
9.Technical and organisational measures (summary)
| Area | Measure |
|---|---|
| Encryption | TLS in transit, AES-256 at rest |
| Access control | Single sign-on (SAML 2.0), MFA, role-based access, need-to-know principle |
| Traceability | Complete audit trail of access and changes |
| Availability | Daily managed database backups |
| Hosting | Data stored in data centres in Switzerland (Zurich); application servers in Germany (EU) |
Full details: Trust Center
10.Return and deletion
After the agreement ends, the Customer can export its data for 14 days. We then delete Customer Data. Backups are deleted automatically within a further 14 days, unless the law requires us to retain data.
11.Contact
Questions about data protection or requests for the signable DPA: info@softwarevision.ch