Data Processing Agreement (DPA) – evidona Cloud

Draft – pending legal review. The German version is authoritative; this English version is a non-binding translation.

0. Preamble, Parties and Definitions

This Data Processing Agreement (hereinafter “DPA”) governs the processing of personal data carried out by SimplyConnect GmbH, Schulstrasse 2b, 5426 Lengnau, Switzerland (UID CHE-160.031.708), represented by Daniel Baumann (hereinafter “SimplyConnect”, “we” or “us”), within the scope of the evidona cloud service provided via *.evidona.ch (hereinafter “Service”) on behalf of the Customer. General contact: office@simplyconnect.ch; data protection: datenschutz@simplyconnect.ch.

This DPA applies exclusively to the cloud offering (see Section 2). It forms part of and gives concrete effect to the contractual relationship between the parties (General Terms and Conditions – evidona Cloud, hereinafter “GTC”) and specifies the data protection obligations of both parties.

In cloud operation, SimplyConnect acts as processor (processor within the meaning of Art. 28 GDPR or processor within the meaning of Art. 9 revFADP/Swiss DPA) and the Customer as controller. The following definitions apply (in addition to the definitions in the GTC):

Customer / Organisation: the legal or natural person that maintains an account or tenant (“Organisation”) with evidona Cloud; with respect to the documents it uploads, the controller under data protection law.
Authorised User: a person registered by name and assigned to the Customer’s tenant.
Signer or Guest Signer: a person invited to sign; a Guest Signer has no account and accesses via a secure link.
Document: a file uploaded by the Customer for signing (typically PDF).
Evidence Bundle or evidentiary record: the sealed proof generated for each signing run, comprising a qualified timestamp, SHA-256 integrity hash, signer metadata and signature log.
signature level: the level achieved for each signature of a simple (SES) or advanced (AES) electronic signature.
Personal data, data subject, processing, data security breach: within the meaning of the revFADP/Swiss DPA or the GDPR. The German and Union law terms are used here with equivalent meaning; “processor” and “controller” under the revFADP/Swiss DPA and the GDPR are to be understood as congruent for the purposes of this DPA.

Legal review: conclusively confirm the terminological harmonisation revFADP/Swiss DPA ↔ GDPR (in particular “disclosure” vs. “transfer”, “processor” terminology).

1. Subject Matter and Dual Legal Basis

The subject matter of this DPA is the processing of personal data by SimplyConnect on behalf of and in accordance with the instructions of the Customer, insofar as it is necessary for providing the Service. The DPA applies in parallel and cumulatively under the dual legal basis of Art. 28 GDPR and Art. 9 revFADP/Swiss DPA, since SimplyConnect is domiciled in Switzerland, hosting and data storage take place in Germany or the EU, and the Service may be used cross-border (CH ↔ EU). Where one of the two regimes imposes stricter requirements, the stricter standard applies to the processing concerned.

Not subject to the processing on behalf of the Customer are those processing operations for which SimplyConnect is itself controller (see Section 4 and Section 15): in particular the processing of account, authentication, billing and usage data of Authorised Users, as well as the maintenance of the evidentiary record to ensure integrity.

2. Exclusion of Self-Hosting

This DPA relates exclusively to the evidona cloud service. In the case of self-hosting (operation of the software on the Customer’s own infrastructure), SimplyConnect is exclusively the licensor; no processing of personal data on behalf of the Customer takes place. In the case of self-hosting, the Customer is the sole controller and operator of the application; to that extent, no DPA with SimplyConnect comes into being. The details of self-hosting are governed by the separate software licence agreement.

This exclusion applies on the condition that, in the case of self-hosting, no personal data is transferred to the licensor. As soon as a future function (in particular a “phone-home”-based legal document verification / identity verification) transfers personal data from the Customer’s installation to SimplyConnect or to services engaged by it, a separate data processing agreement (“Connected Service DPA”) becomes necessary for that scope of functionality; until such agreement is concluded, the function may not be activated or used.

Legal review: define the trigger and scope of a “Connected Service DPA” in self-hosting once the architecture of the document verification is established; clarify the distinction from pure licence/telemetry communication.

3. Duration

This DPA commences upon activation of the cloud account or upon ordering and applies for the duration of the underlying cloud contractual relationship (GTC). It terminates automatically upon the termination thereof, unless individual obligations (in particular confidentiality, deletion/return, and the maintenance of the evidentiary record) continue to have effect by their nature.

4. Nature and Purpose of the Processing

SimplyConnect processes personal data for the purpose of providing the Service, i.e. for carrying out electronic signature workflows and the associated functions. The processing comprises in particular:

Signature workflow: uploading documents, defining sequential or parallel signature workflows, inviting Authorised Users and Guest Signers, and obtaining electronic signatures.
Identity confirmation (OTP): confirmation of the Signer’s identity in the signing process by means of a one-time code (OTP) delivered by email or SMS. Guest Signers have no account.
Evidence Bundle: generation of a sealed Evidence Bundle for each signing run (qualified timestamp, SHA-256 integrity hash, signer metadata, signature log).
Retention and deletion: provision of the documents during the retention period and subsequent automatic deletion of the document content (see Section 12).
Future identity verification (cloud-only): a planned “legal document verification” / identity verification as a future higher signature level; this function will – insofar as implemented – be offered exclusively in the cloud service and provided with the involvement of an identity verification / KYC service provider not yet selected (see Annex 3).

The processing takes place in an automated manner and, insofar as necessary, within the scope of support and operational activities. SimplyConnect does not carry out any processing of its own going beyond the contractual purpose for the Customer’s own purposes; anonymised technical data may be used to operate and improve the Service.

Legal review: assess separately the data protection impact assessment and legal bases for the future identity verification once the function and the service provider are established.

5. Categories of Data Subjects and Data

Categories of data subjects: the Customer’s Authorised Users; Signers and Guest Signers; further persons named in the document content, insofar as the Customer uploads such data.

Categories of personal data:

Identification and contact data: name, email address, telephone number (for OTP delivery).
Authentication data of Authorised Users (within the scope of the account function).
Content data: the documents uploaded by the Customer and the personal data contained therein – their nature and sensitivity are determined solely by the Customer; SimplyConnect does not take cognisance of the content, insofar as this is not necessary for operation or support.
Evidentiary/log data: signer metadata, timestamps, SHA-256 integrity hash, signature log, technical access and event data (e.g. IP address, times, OTP delivery events).

The Customer does not upload special categories of personal data into documents, unless this is necessary for its use case; in that case, the Customer is responsible for an appropriate legal basis and any protective measures.

Legal review: whether and to what extent special categories of personal data (Art. 5 lit. c revFADP/Swiss DPA / Art. 9 GDPR) are permitted in the Service; if applicable, supplement notice/restriction obligations.

6. Instructions and Obligations of the Controller

SimplyConnect processes the personal data exclusively on the documented instruction of the Customer, unless a legal obligation requires otherwise; in that case, SimplyConnect informs the Customer of that obligation before processing, unless the law prohibits this. This DPA, the GTC, and the configuration within the Service (e.g. retention period, signature workflows) are deemed documented instructions. Further individual instructions are issued by the Customer in text form to datenschutz@simplyconnect.ch.

SimplyConnect informs the Customer without undue delay if it is of the opinion that an instruction infringes applicable data protection law; it is entitled to suspend the execution of a manifestly unlawful instruction.

The Customer, as controller, is responsible for ensuring that the processing is lawful (legal basis, information of the data subjects, where applicable consents, in particular the consent to electronic signing), that it is entitled to disclose the data to SimplyConnect, and that the Signers it designates and the content it uploads are permissible.

7. Confidentiality

SimplyConnect commits the persons authorised to process the personal data to confidentiality, insofar as they are not already subject to an appropriate statutory duty of secrecy. The confidentiality obligation continues to apply beyond the termination of the activity or of this DPA. SimplyConnect ensures that access to personal data is limited to the persons required for the provision of the services.

8. Technical and Organisational Measures (TOM)

SimplyConnect takes the technical and organisational measures (TOM) necessary to ensure a level of data security appropriate to the risk in accordance with Art. 32 GDPR or Art. 8 revFADP/Swiss DPA and Art. 1 et seq. of the Data Protection Ordinance. The specific measures are described in Annex 2. In doing so, SimplyConnect controls in particular the time source, the signature log and the integrity sealing. SimplyConnect may further develop the TOM, provided that the level of protection is not thereby reduced below the required standard.

9. Sub-Processing

The Customer grants SimplyConnect general authorisation to engage sub-processors. The sub-processors engaged at the time of conclusion of the contract are listed in Annex 3. SimplyConnect contractually binds each sub-processor to data protection obligations that substantially correspond to the obligations of this DPA, and remains responsible to the Customer for compliance.

SimplyConnect informs the Customer of intended changes regarding the addition or replacement of sub-processors (e.g. within the Service or by email) and grants the Customer a right to object. The Customer may object to a change for important data protection reasons within 30 days of notification, in text form. In the event of a justified objection, the parties shall seek an amicable solution; if this is not achieved, each party is entitled to terminate the affected contractual relationship or the affected part of the services.

Legal review: align the objection period (30 days) and the consequences of termination with the GTC; bindingly define the form and channel of the change notification.

10. Assistance with Data Subject Rights

SimplyConnect supports the Customer with appropriate technical and organisational measures in fulfilling its obligations to give effect to the rights of data subjects (in particular access, rectification, erasure, restriction, data portability, objection), insofar as this is not possible for the Customer itself via the functions of the Service. If a data subject contacts SimplyConnect directly, SimplyConnect forwards the request to the Customer and does not respond to it itself, unless otherwise legally required.

Note on scope: the document content is often already deleted after expiry of the retention period (standard 90 days, see Section 12); to that extent, SimplyConnect can no longer provide any content data. The evidentiary record (Evidence Bundle) is maintained longer to ensure integrity; with respect to it, SimplyConnect is the controller in its own right or a joint controller (see Section 15), which is why its retention, despite an erasure request, may be based on an overriding integrity and evidentiary interest and may stand in the way of erasure.

Legal review: robustly document the balancing of the erasure request ↔ retention of the evidentiary record (integrity/evidentiary interest); design the information obligation towards data subjects in this regard.

11. Notification of Data Security Breaches

SimplyConnect notifies the Customer of any data security breach of which it becomes aware that may lead to a high risk to the data subjects or that may be notifiable under the GDPR, without undue delay, but at the latest within 48 hours of becoming aware of it. The notification contains, insofar as available, a description of the nature of the breach, the categories of data and data subjects affected (insofar as determinable), the likely consequences, and the measures taken or proposed. SimplyConnect reasonably supports the Customer in its own reporting and notification obligations towards the supervisory authority (FDPIC or the competent supervisory authority under the GDPR) and the data subjects. The Customer’s reporting obligations towards authorities and data subjects remain its responsibility.

Legal review: reconcile the notification deadline (48 hours) against the “without undue delay” requirement of Art. 33 GDPR and Art. 24 revFADP/Swiss DPA, as well as against the deadline towards supervisory authorities.

12. Deletion and Return

The processing follows the 90-day model of the Service: the content of uploaded and signed documents is automatically deleted after expiry of the retention period (standard 90 days, configurable per Organisation or plan). evidona does not archive the documents. The Customer is responsible for downloading completed documents and Evidence Bundles before expiry of the period or of access, and for retaining them itself.

Upon termination of the processing, SimplyConnect deletes the remaining personal data processed on behalf of the Customer or returns it at the Customer’s choice, insofar as no statutory retention obligation stands in the way. Excepted is the evidentiary record (SHA-256 hash, timestamp, signer metadata, signature log), which SimplyConnect, as controller in its own right or as a joint controller (see Section 15), retains to ensure integrity even beyond the end of the contract.

Legal review: bindingly determine the retention period of the evidentiary record and align it with statutory minimum/maximum periods as well as with Section 9 of the GTC.

13. Audit Rights

The Customer is entitled to verify compliance with the obligations under this DPA. SimplyConnect makes available to the Customer the information necessary for this purpose and enables verifications with reasonable advance notice, as a rule no more than once per year and additionally in the event of a specific, documented data security breach. Evidence is provided primarily by means of appropriate reports, summaries or certificates (e.g. recognised audit reports or security certifications). On-site inspections take place during normal business hours, as far as possible without disrupting operations, while preserving confidentiality and the data of third parties, and against a prior confidentiality undertaking. SimplyConnect may reasonably charge for the effort of a verification going beyond what is customary.

14. International Transfers and Data Location

Hosting and data storage take place in Germany / the EU (not in Switzerland). The transfer Switzerland ↔ EU is covered by mutual adequacy (recognition of an adequate level of data protection between Switzerland and the EU/EEA). If a disclosure is made to a country without an adequate level of protection (e.g. by a sub-processor), SimplyConnect bases the transfer on appropriate safeguards, in particular the Standard Contractual Clauses (SCC) of the EU Commission, including Swiss adaptations, as well as supplementary measures where applicable. SimplyConnect makes no claim of a data location in Switzerland.

Legal review: document the specific safeguards (SCC modules, CH adaptations, transfer impact assessment) per sub-processor once the final stack is established.

15. Liability, Responsibility for the Evidentiary Record, and Order of Precedence

Liability: The liability provisions of the GTC apply. SimplyConnect is liable exclusively for damages based on intent or gross negligence; liability for slight negligence is excluded. In particular, liability for indirect and consequential damages, data loss, lost profit, third-party claims, and damages arising from delayed performance is excluded. Insofar as liability exists, liability is limited in amount to the fees paid in the preceding twelve (12) months. Liability for personal injury as well as any further mandatory statutory liability remain unaffected. Data protection claims of data subjects against the controller and the processor under Art. 82 GDPR or the revFADP/Swiss DPA remain unaffected by this limitation in the external relationship.

Responsibility for the evidentiary record: With respect to the evidentiary record / Evidence Bundle (SHA-256 hash, timestamp, signer metadata, signature log), SimplyConnect acts as controller in its own right or as a joint controller, since it pursues its own overriding integrity and evidentiary interest. This responsibility serves to make the retention of the evidentiary record tenable even against an erasure request (see Section 10 and Section 12). The same applies to account, authentication, billing and usage data of the Authorised Users, with respect to which SimplyConnect is controller in its own right; the details are governed by the privacy policy.

Order of precedence: In data protection matters, this DPA prevails over the GTC. In all other respects, the order of precedence of the GTC applies.

Legal review: (1) bindingly determine the liability cap (12 monthly fees vs. the previous “triple annual amount”) consistently across documents; (2) conclusively determine the classification of the evidentiary record as sole vs. joint controllership (Art. 26 GDPR) and – if joint – supplement an arrangement on joint controllership.

16. Applicable Law, Place of Jurisdiction, Language and Amendments

Swiss law applies exclusively, to the exclusion of conflict-of-laws rules and of the Vienna Sales Convention (CISG), without prejudice to mandatory data protection provisions of the revFADP/Swiss DPA and the GDPR. The exclusive place of jurisdiction is the registered office of SimplyConnect (Lengnau AG; competent District Court of Baden/Zurzach AG), unless mandatory law provides otherwise.

The German version is authoritative; the English version is a non-binding translation. SimplyConnect may amend this DPA with reasonable advance notice, insofar as this is necessary to adapt to changed legal or technical requirements and the level of protection is not reduced below the required standard; Section 9 (sub-processors) remains reserved. Should a provision be invalid, the remaining provisions remain unaffected.

Legal review: confirm the designation of the competent court as well as mandatory places of jurisdiction where private individuals are involved.

Annex 1 – Description of the Processing

Subject matter: provision of the evidona cloud service (electronic signature workflows and associated functions).
Nature of the processing: collection, storage, use, disclosure (to Signers/recipients), automated deletion; generation and sealing of the Evidence Bundle; OTP delivery; support.
Purpose: carrying out and evidencing electronic signatures (SES/AES) as well as – in the future, cloud-only – identity verification as a higher signature level.
Categories of data subjects: the Customer’s Authorised Users; Signers and Guest Signers; persons named in the document content.
Categories of personal data: identification and contact data (name, email, telephone); authentication data; content data of the documents (determined by the Customer); evidentiary/log data (timestamps, SHA-256 hash, signer metadata, signature log, technical access data).
Special categories of personal data: only insofar as uploaded by the Customer; responsibility lies with the Customer.
Duration of the processing: for the duration of the cloud contract; document content standard 90 days (configurable), thereafter automatic deletion; evidentiary record longer (see Section 12).
Data location: Germany / EU.

Legal review: complete Annex 1 once the final scope of functionality and the retention period of the evidentiary record have been determined.

Annex 2 – Technical and Organisational Measures (TOM)

Placeholder – to be filled from the actual implementation. The points below are structural specifications; the specific measures are to be bindingly described before publication.

Confidentiality: physical access, system access and data access control; role-based permissions; separation of tenants (Organisations).
Integrity: SHA-256 integrity hash; controlled time source and qualified timestamp; sealed signature log; protection against unauthorised alteration.
Availability and resilience: backups, recovery, failover resilience of the infrastructure used (DE/EU).
Encryption: transport encryption (TLS) and encryption of stored data (at rest).
Authentication: account login with OTP/multi-factor; OTP delivery to Signers by email/SMS.
Pseudonymisation/data minimisation: automatic deletion of the document content after the retention period; limitation to necessary data.
Procedures for review, assessment and evaluation: logging, incident management, regular review of the measures.

Legal review: derive the TOM description from the productive architecture (encryption used, key management, backup/deletion concept, hosting region, certifications) and substantiate it in a verifiable manner.

Annex 3 – List of Sub-Processors

Placeholder – the following list is to be completed before publication with company name, registered office, service and data location per sub-processor; all entries are still open.

Service	Sub-processor	Registered office / Data location	Data processed
Hosting / infrastructure	open	Germany / EU	all order data (hosting)
Payment processing	Mollie or Payrexx (open)	open	billing/payment data
Email dispatch	open	open	email addresses, dispatch/OTP data
SMS dispatch (OTP)	open	open	telephone numbers, OTP delivery data
Identity verification / KYC (future, cloud-only)	open	open	identity verification data

Legal review: (1) determine the final payment service provider (Mollie/Payrexx) – not Stripe; (2) enter the hosting, email and SMS providers as well as the data location per provider; (3) select the future identity verification / KYC service provider and supplement SCC/transfer safeguards before the function is activated.

← Back to home