Data Processing Agreement

Between the Data Controller and Abilene Group SA as Data Processor. Annex 2 to the Order Form, forming an integral part of it.

This is the standard form. The party details and the Order Form date are completed, and the agreement executed, alongside the Order Form it forms part of. Questions to legal@abilenegroup.ch.

Parties

Between the undersigned:

[Customer], [Address] (hereinafter referred to as the "Data Controller")

and Abilene Group SA, Rue de la Gare 39, 1110 Morges, Switzerland (hereinafter referred to as the "Data Processor")

Hereafter, individually referred to as "Party" and collectively as "Parties," it has been agreed as follows:

Preamble

The Parties intend to set forth by this contract the terms of the Data Processor's engagement aimed at ensuring adequate protection of personal data, in accordance with applicable Swiss legislation, which has been entrusted to them (hereinafter referred to as "Personal Data") by the Data Controller within the scope of services governed by a separate main contract (hereinafter referred to as the "Main Contract").

The Main Contract is the Order Form dated [Order Form date] incorporating the AcunaGRC Terms Version 1.0, dated 21.08.2026.

This contract is an integral part of the Main Contract as an amendment and shall be interpreted and applied in conjunction with and within the limits of the rights and obligations provided therein.

To this end, the Parties agree as follows:

1. Purpose

This contract governs all processing of Personal Data carried out by the Data Processor on behalf of the Data Controller under the Main Contract and establishes the obligations of the Parties in accordance with applicable personal data protection legislation.

2. Personal Data Processing

The Data Processor commits to:

  1. Process Personal Data in compliance with the applicable data protection laws relevant to the Data Controller, notably the Swiss Federal Data Protection Act (FADP).
  2. Process Personal Data solely within the scope and for the purposes necessary for the provision of services as per the Main Contract or any other manner authorized by the Data Controller.
  3. Follow the Data Controller's instructions for Personal Data processing throughout the contract. The Data Controller can modify or suspend any Personal Data processing as required by their legal obligations.
  4. Ensure the confidentiality of Personal Data and take necessary measures to ensure all personnel comply with this obligation. The Data Processor shall not disclose Personal Data to third parties unless authorized by the Data Controller.
  5. Implement appropriate technical and organizational measures to protect Personal Data against unauthorized processing. A summary is provided in Annex 1, section 7. The Data Processor will regularly check these measures' effectiveness, considering the state of the art, implementation costs, processing scope, nature, context, and associated risks.
  6. When processing Personal Data involves sensitive data as defined by applicable data protection legislation, implement specific restrictions and/or additional safeguards tailored to the specific nature of the data and the associated risks. This may include limiting the personnel authorized to access Personal Data and/or additional security measures (such as encryption or pseudonymization).
  7. Appoint an internal officer responsible for ensuring compliance with this contract, especially regarding security measures and any specific instructions issued by the Data Controller. The Data Processor shall provide the contact details of the appointed person to the Data Controller for any related inquiries. For the purposes of this Agreement, the Data Processor designates the following contact: Henri Haenni, CEO, hh@abilene.ch.

3. Subsequent Subcontractor

3.1 The Data Controller hereby grants the Data Processor the general authorization to engage subsequent subcontractors for specific processing activities, provided the Data Processor notifies the Data Controller of a given subcontractor's identity and the Data Controller does not object within 30 days of the notice. The notice must include all relevant information for the Data Controller to assess the proposed subcontracting, especially the processes involved and the subsequent subcontractor's identity and contact details. This general authorization is valid as long as the subsequent subcontractor is likely to meet the requirements of this contract, particularly regarding the overseas transfer of Personal Data. The list of subsequent subcontractors of the Data Processor approved as of the signature of this DPA can be found in Annex 1, section 6.

3.2 Upon authorization as per article 3.1, the Data Processor must take appropriate measures, including contractual ones, to ensure the subsequent subcontractor adheres to the same protection level and obligations set by this contract, especially those related to informing and assisting the Data Controller. The Data Processor ensures the subsequent subcontractor continues to meet these obligations and offers the same guarantees regarding implementing suitable technical and organizational security measures.

3.3 Upon request, the Data Processor provides the Data Controller with a copy of the contract concluded with the subsequent subcontractor. The Data Processor may redact parts of the contract before sharing to protect business secrets or other confidential information.

3.4 The Data Processor remains fully liable to the Data Controller for the subsequent subcontractor's fulfilment of its obligations and for any damages incurred by the Data Controller as a result. The Data Processor notifies the Data Controller of any failure by the subsequent subcontractor to meet its obligations.

3.5 The Data Processor agrees with the subsequent subcontractor on a third-party beneficiary clause whereby, if the Data Processor has materially disappeared, ceased to exist legally, or become insolvent, the Data Controller has the right to terminate the subcontractor's contract and instruct it to delete or return the Personal Data.

4. Overseas Transfer

4.1 The Data Processor must not transfer and/or process Personal Data outside Swiss territory without the Data Controller's consent, provided the destination country ensures an adequate level of protection or appropriate safeguards are in place to legitimize the processing in accordance with applicable Swiss legislation.

4.2 The Data Processor ensures compliance with this obligation by any subsequent subcontractor authorized. It takes necessary measures to ensure the legality of any authorized overseas transfer with subsequent subcontractors based on appropriate legal grounds, for example, by signing recognized standard contractual clauses or implementing binding corporate rules for corporate groups. Upon request, a copy will be provided to the Data Controller in accordance with section 3.4 of this contract.

5. Notification of Security Breaches

5.1 In the event of a personal data security breach, the Data Processor must take appropriate actions to address the breach, including measures to mitigate any potential adverse effects. A security breach is defined as any incident that accidentally or unlawfully results in the loss, alteration, deletion, destruction, disclosure, or unauthorized access to personal data.

5.2 The Data Processor will notify the Data Controller of any potential personal data security breach within 48 hours of becoming aware of it, including breaches occurring at any subsequent subcontractor level. The notification will at least include:

  1. contact details for further information,
  2. nature of the breach, including the categories and approximate number of individuals and records affected,
  3. likely consequences,
  4. measures taken or proposed to address and mitigate the breach.

Initial notifications will include immediately available information and be supplemented as more details become known.

5.3 The Data Processor will collect and keep all evidence related to the security breach, including facts, circumstances, and remedial actions taken. They will also fully cooperate and assist in any investigations into the breach.

6. Cooperation Obligation

6.1 Considering the nature of processing and the information available, the Data Processor cooperates with the Data Controller, assisting in ensuring compliance with applicable legal obligations, particularly concerning requests from data subjects and competent authorities.

6.2 The Data Processor immediately informs the Data Controller if, in their opinion, an instruction violates applicable personal data protection laws.

6.3 The Data Processor promptly notifies the Data Controller of any requests related to personal data processing and awaits instructions on how to proceed. They do not respond to the request unless authorized by the Data Controller.

6.4 The Data Processor reasonably assists the Data Controller in conducting data protection impact assessments.

7. Information and Audit

7.1 Upon request, the Data Processor must provide the Data Controller with all necessary information to demonstrate compliance with this contract, particularly allowing audits and inspections by the Data Controller or an auditor appointed by them. The Data Processor agrees to cooperate with these procedures as necessary. For the avoidance of doubt, the audit does not include inspections at the premises of the Data Processor.

7.2 The Data Controller will notify the Data Processor in advance of any intended audits or inspections, providing reasonable notice and minimizing any disruption to the Data Processor. Audits should be conducted during normal business hours unless urgent circumstances require otherwise.

7.3 The Data Processor ensures that the right to audit extends to any subsequent subcontractors.

8. Access or Disclosure to a Foreign Authority

8.1 The Data Processor will promptly notify the Data Controller if it believes it is subject to laws or practices that would require unauthorized disclosure or processing of Personal Data under this contract and/or applicable legislation.

8.2 The Data Processor will also immediately inform the Data Controller if:

  1. it receives a legally binding request from a foreign authority for the disclosure of Personal Data, including details about the requested data, the requesting authority, the legal basis for the request, and the response given.
  2. it becomes aware of any direct access by foreign authorities to Personal Data, providing all available information.

8.3 If laws governing the foreign authority's request prohibit the Data Processor from informing the Data Controller, efforts will be made to lift this prohibition to notify as soon as possible, with records of these efforts available upon request.

8.4 The Data Processor commits to defending the Data Controller's interests by assessing the legality of the disclosure request and contesting it if deemed unlawful under the relevant legislation or international legal standards.

8.5 The Data Processor will provide the minimum information necessary when responding to a disclosure request.

9. Record of Processing Activities

9.1 The Data Processor commits to maintaining a record of processing activities for the Data Controller. This record includes necessary information to prove compliance with data protection laws, listing:

  1. the identities and contacts of the Data Controller, Data Processor, and any data protection officer;
  2. types of processing activities, including descriptions of personal data categories, data subjects, and processing purposes;
  3. technical and organizational measures for data security;
  4. if applicable, details on international data transfers, including destination countries and legal safeguards.

9.2 The record of processing activities is regularly updated to accurately reflect processing activities.

9.3 The Data Processor makes this record of processing activities available to the Data Controller.

9.4 Upon termination of data processing services, the Data Processor will retain and then securely destroy the record of processing activities according to legal requirements.

10. Liability

10.1 Each Party's liability arising out of or related to this DPA shall be subject to the limitations and exclusions of liability set out in the Main Contract.

11. Non-Compliance and Termination

11.1 The Data Processor shall immediately inform the Data Controller if it is unable to comply with this contract for any reason. In such cases, it shall take necessary measures to remedy the situation, including the suspension of processing of Personal Data.

11.2 The Data Controller may terminate this Agreement and, consequently, the Main Contract with immediate effect if:

  1. The Data Processor, including any subsequent processor, seriously or persistently breaches the clauses of this contract. In particular, a breach of Articles 2b, 2c, 2d, 3, 4, 5, and 8 of this contract shall be considered serious;
  2. The Data Processor, including any subsequent processor, otherwise breaches this contract and fails to remedy the breach within 30 days after being requested to do so by the Data Controller;
  3. A request from a competent authority requires that the processing of Personal Data be terminated in whole or in part, as well as any other circumstance that would necessitate it, especially due to a change in legislation.

11.3 In the event of immediate termination in accordance with this article, no compensation shall be due to the Data Processor, either directly or in connection with a subsequent processor. Any amount paid in advance by the Data Controller shall be refunded on a pro rata temporis basis.

12. Duration of this Contract

12.1 This contract is entered into for the same duration as the Main Contract and shall automatically terminate at the same time as the Main Contract.

12.2 Notwithstanding the above, all obligations of the Data Processor arising from this contract shall continue to apply in full as long as the Data Processor, as well as any potential subsequent processor, continue to hold or have access to Personal Data.

13. Return and Deletion of Personal Data

13.1 Upon termination of the Main Contract, regardless of the cause, the Data Processor must, according to the prior written instructions of the Data Controller, return all Personal Data without additional charges, including any copies, versions, or other reproductions (e.g., backups) regardless of their form and location, in a structured, machine-readable format (such as CSV, JSON, or PDF, as applicable to the data type and as technically available through the platform's export functionality at the time of termination) and/or securely and permanently delete them. The Data Processor shall certify in writing that it retains no copies or reproductions of the Personal Data.

13.2 The Data Processor shall ensure that any subsequent processor acts in the same manner and certifies this in writing.

13.3 The Data Processor shall continue to ensure compliance with this contract until the Personal Data have been returned and/or deleted. The obligations of confidentiality and data protection shall continue to apply even after the return and/or deletion of all materials, media, and other items containing Personal Data.

13.4 The anonymization of Personal Data does not constitute a form of deletion within the meaning of this contract. Any retention of anonymized information following the termination of this contract, regardless of the purpose, requires the authorization of the Data Controller.

13.5 If, notwithstanding the obligations set out above, the Data Processor is legally required to retain Personal Data, including in an anonymized form, it must immediately inform the Data Controller. The Personal Data may not be retained or processed beyond the purposes imposed by the relevant legislation.

14. Final Provisions

14.1 Any changes to this contract and its annexes must be made in writing.

14.2 The Data Controller may demand any modification of the Main Contract and this contract (including its annexes) that would be required to comply with the applicable personal data protection legislation or to adhere to a decision by a competent authority. The Parties commit to negotiate such changes in good faith.

14.3 In the event of a contradiction or inconsistency between this contract and the Main Contract, the provisions of this contract shall prevail, unless otherwise agreed in writing between the Parties. This also applies to any modifications or additions made after the conclusion of this contract.

14.4 If one or more provisions of this contract are declared null and void or invalidated by a decision of competent authorities, the validity of the remaining provisions shall not be affected. In this case, the Parties shall replace the invalid provisions with new valid provisions that, as far as possible, have equivalent effects. In the event of a gap, this contract shall be supplemented in accordance with its meaning and purpose.

14.5 This contract is subject to Swiss law in its entirety. Any dispute shall be brought before the competent Swiss courts.

14.6 Notwithstanding the provisions of this Agreement, the Data Processor retains the right to access, use, and process User Data for research and development, analysis, and improvement of the Services, as expressly granted by the Data Controller under Section 6 of the Main Contract. This right is not affected by the data protection obligations set forth in this Agreement, provided that such use remains strictly limited to the purposes defined in the Main Contract and complies with applicable Swiss data protection law.

Executed in Morges, in 2 original copies, each Party receiving one. The signed version is provided with the Order Form.

Annex 1: Description of Processing Activities

This Annex forms an integral part of the Data Processing Agreement between the Data Controller and Abilene Group SA (Data Processor). It describes the subject matter, nature, purpose, and duration of the processing, as well as the categories of personal data and data subjects, in accordance with Art. 9 nDSG.

1. Subject Matter and Nature of Processing

The Data Processor provides the Data Controller with access to the AcunaGRC platform, a cloud-based governance, risk and compliance (GRC) software solution hosted in Switzerland. In the course of providing these Services under the Main Contract, the Data Processor processes personal data on behalf of and under the documented instructions of the Data Controller. Processing operations include: storage, organisation, structuring, consultation, retrieval, use, transmission (where instructed), restriction, erasure, and destruction of personal data.

2. Purposes of Processing

Personal data is processed for the sole purpose of providing the Services to the Data Controller, in accordance with the Main Contract. No personal data shall be processed for any other purpose without the prior written authorisation of the Data Controller.

3. Categories of Personal Data

The following categories of personal data may be processed under this Agreement, to the extent entered into the platform by or on behalf of the Data Controller:

  1. Identification and contact data of employees, contractors, and authorised representatives of the Data Controller (e.g., first and last name, professional email address, phone number, job title, organisational unit);
  2. User account credentials and access data (e.g., usernames, platform role assignments, login timestamps, activity logs);
  3. Contact data of third-party and supplier representatives entered into the Supplier Shield module in the context of vendor risk management (e.g., name, professional email, organisation, role);
  4. Data appearing in ISMS-related documents, risk registers, audit records, and incident logs, to the extent such documents contain personal data (e.g., names of individuals involved in incidents, audit findings attributable to named personnel, risk owners).

No special categories of personal data within the meaning of Art. 5 nDSG (sensitive personal data) are intended to be processed under this Agreement. Should the Data Controller introduce sensitive personal data into the platform, it shall notify the Data Processor in advance so that appropriate additional safeguards may be implemented.

4. Categories of Data Subjects

The following categories of data subjects may be concerned:

  1. Employees and authorised staff of the Data Controller who are registered as platform End-Users;
  2. Contractors and third-party representatives whose contact details are entered in the context of ISMS management or supplier risk assessments;
  3. Any other natural persons incidentally identified in documents, incident records, audit logs, or risk management files uploaded or created within the platform by the Data Controller.

5. Duration of Processing and Retention

The Data Processor shall process personal data for the duration of this Agreement, which is coterminous with the Main Contract. Upon termination or expiration, the Data Processor shall return or securely delete all personal data in accordance with Article 13 of this Agreement and the instructions of the Data Controller. No personal data shall be retained beyond what is strictly required by applicable Swiss law.

6. Location of Processing and Sub-Processors

All personal data is hosted and processed exclusively within Swiss territory. The AcunaGRC platform is hosted on cloud infrastructure located in Switzerland. No cross-border transfer of personal data outside Switzerland is intended or authorised under this Agreement without prior written consent of the Data Controller in accordance with Article 4 of this Agreement.

The Data Processor hereby discloses the following sub-processors currently engaged in the processing of personal data under this Agreement:

  1. Cloud infrastructure provider (hosting): Supabase, eu-central-2, Zurich, Switzerland. Purpose: hosting, storage and availability of the AcunaGRC platform.

Any addition of or change to a sub-processor shall be subject to prior written notice to the Data Controller in accordance with Article 3.1 of this Agreement.

7. Technical and Organisational Measures (Summary)

The Data Processor implements and maintains the following categories of technical and organisational measures to protect personal data:

  1. Access control: role-based access management, authentication mechanisms including Admin Account controls, principle of least privilege;
  2. Data transmission security: encryption of data in transit (TLS/HTTPS) and at rest;
  3. Availability and resilience: regular backups, infrastructure redundancy, and incident response procedures;
  4. Confidentiality: personnel bound by confidentiality obligations; logical segregation of client data;
  5. Vulnerability management: reasonable care to keep the platform free from known system and software vulnerabilities, as described in the Main Contract.

The Data Processor shall provide further detail on technical and organisational measures upon written request by the Data Controller, in accordance with Article 7 of this Agreement.