DPA

Data Processing Agreement (DPA) between the owner of a HOOP account (“Customer”) and HOOP Corporate Services SA, Heiligkreuzstrasse 5, 9008 St. Gallen (“Contractor”). Individually referred to as a “Party” or collectively as “Parties”

1.   Preamble

(1) The Customer commissions the Contractor with tasks for processing of personal data (“Data”) within the meaning of data protection provisions. Here, the Contractor can be a data processor or a further data processor within the meaning of data protection law. Such tasks occur for the performance of contracts, hosting and service solutions, support inquiries, maintenance work, or other tasks in which the Contractor receives access to Data, is provided with Data or can become aware of Data.

(2) This Agreement applies in order to comply with the legal requirements and shall apply to all activities in connection with contracts concluded between the Parties in which employees of the Contractor or agents commissioned by it process the Customer’s Data. In addition, it shall apply to future contracts between the Parties providing for data processing.

2.   Subject Matter of the Agreement

(1) The subject matter, nature and purpose of this Agreement are defined by the contracts concluded between the Parties (in particular the General Terms and Conditions (GTC) for the HOOP account) that may include data processing, and to which reference is made here. These contracts may contain special provisions that supplement and/or modify this Agreement and take precedence over this Agreement.

(2) The data processing shall be performed by the Contractor in Switzerland as well as by commissioning further data processors at the locations set out in the list of further data processors. The list of further data processors, which forms part of this Agreement as an appendix, applies. The Customer hereby declares its consent to their commissioning.

(3) Any further offshoring of the data processing (including sub-operations thereto) to additional third countries shall only occur when the special requirements under data protection law have been satisfied (e.g., adequacy decision, standard data protection clauses, approved codes of conduct, or another suitable guarantee for the data transmission). The Customer is responsible for ensuring that the necessary legal basis exists for lawful data processing on its behalf as well as for such processing outside the country of its registered office.

(4) In the event that the Customer is subject to any duty of confidentiality (such as in the case of manufacturing or business secrets, professional, banking or official secrecy), the Customer shall ensure that no unauthorised disclosure occurs through the data processing. Insofar as the Customer is subject to a statutory or professional duty of confidentiality (such as professional, banking or official secrecy) and the Contractor obtains access to information subject to this duty of confidentiality, the Contractor is engaged as an auxiliary person to whom such information is disclosed and who is thereby likewise subject to this duty of confidentiality. The Contractor undertakes to comply at all times with the resulting confidentiality requirements and acknowledges that, as an engaged auxiliary person, a breach of its obligations may result in consequences under criminal law provisions.

3.   Term of the Agreement

(1) The term of this Agreement shall be governed by the term of the contracts having as their object data processing insofar as no additional obligations or termination rights result from the provisions of this Agreement.

(2) The Parties can terminate this Agreement by complying with a notice period of 4 weeks in the event of a serious violation of data protection regulations or of the provisions of this Agreement. In case of minor violations—that is, neither intentional nor grossly negligent violations—the aggrieved Party shall set a reasonable time period within which the breaching Party can remedy the violation.

(3) As the HOOP services cannot be provided without this Agreement, termination of this Agreement shall also terminate the contract for the use of the HOOP account with effect from the same date.

4.   Nature and Purpose of the Processing, Nature of the Data, as well as Categories of Data Subjects

(1) The activities of the Contractor comprise services as described in the contracts concluded between the Parties and in which data processing is possible.

The activities of the Contractor may comprise the following:

• Hosting of applications, software solutions, and Data
• Provision of the HOOP account and the HOOP services as Software as a Service
• Preparation of documents and their transmission to authorities, notaries, banks or other parties involved in accordance with the Customer’s instructions
• Provision of AI-supported functions
• Installation and testing of software
• Remedial actions to services provided
• Maintenance, installation, and testing of hotfixes, service packs, and new software versions
• Activities in the context of support
• Access to and processing of Data

The following types of processing are possible:

• collection, recording, organisation, or structuring of Data
• storage, adaptation, or alteration of Data
• retrieval, consultation, use, and disclosure of Data by transmission
• dissemination or otherwise making available, alignment or combination of Data
• restriction, erasure or destruction of Data

(2) The types of Data processed as well as the categories of data subjects are derived from the individual scope of the contract and the services to be provided. The following types of Data may be affected:

• Basic personal Data
• Copies and details of identity or identification papers
• Information on shareholdings and beneficial owners (e.g. share register and register of quotaholders, transparency register)
• Information on claims, creditors and debtors (e.g. debt enforcement proceedings, certificates of unpaid debts)
• Signature and identification data (e.g. for qualified electronic signatures)
• Information about professional life such as job titles, functions, etc.
• Information about private life such as place of residence, marital status, etc.
• User information such as login data, customer number, user behaviour, consumer behaviour
• Communications data (e.g., telephone, e-mail address)
• Contract master data (contract title, product or contract interest)
• Customer history
• Invoicing or payment data
• Planning and control data
• Project data
• Reference information (from third parties, e.g., credit reference agencies, data from public directories)
• Technical information such as IP address, device information, etc.
• Any Data that the Customer transfers to the Contractor within the framework of data processing

In addition, special categories of personal data/sensitive personal data may be affected; in each case, Data is classified in accordance with the applicable data protection legislation.

This Data may affect the following categories of data subjects:

• Natural persons such as the Customer, employees of the Customer, applicants, freelancers, employees of (potential) clients, end clients and business clients, subscribers, prospective customers, business partners, suppliers, commercial agents, salespersons, and dealers as well as their respective employees as contact persons
• Founders, governing bodies, authorised signatories, shareholders, partners and beneficial owners of companies as well as creditors and debtors in debt enforcement proceedings
• In the case of legal persons, their natural persons such as their employees, employees of their business partners, contracting partners, service recipients, service providers, or other vicarious agents of (potential) clients, suppliers, salespersons, dealers
• In case of other entities, their natural persons such as the employees of public sector entities, in the form of business partners, contracting partners, service recipients, service providers, or other vicarious agents of (potential) clients, suppliers

5.   Rights and Authority to Issue Instructions as well as Obligations of the Customer

(1) The Customer and its clients are solely responsible as data controllers (hereinafter “Data Controllers”) within the meaning of data protection provisions for assessing the permissibility of the processing as well as for safeguarding the rights of the data subjects. The Contractor shall forward all inquiries to the Customer insofar as they are identifiably addressed to the Customer or to a Data Controller.

(2) Changes to the object of processing and changes in processes may be coordinated jointly between the Parties and specified in writing or in a documented electronic format.

(3) The Customer has the right to issue instructions to the Contractor and shall normally issue such instructions in writing or in a documented electronic format. The Customer shall confirm oral instructions without delay in writing or in a documented electronic format. The instructions shall be retained for their applicability period and subsequently for at least five full calendar years. Instructions that are not provided for in the individual contract shall be treated as a request for a change in services and shall be paid for by the Customer accordingly.

(4) Persons at the Customer entitled to issue instructions and persons at the Contractor receiving instructions shall be specified between the Parties, including the communication channels to be used.

(5) The Customer shall inform the Contractor without delay when the Customer has discovered breaches in the protection of the Data, errors or irregularities during auditing of the contract performance results, or if such become known to it. The Contractor shall take the necessary measures to ensure the security of the Data and to mitigate possible adverse consequences for the data subjects and may consult with the Customer in this regard.

(6) The Customer and its clients are the sole Controllers for the Data that is provided to the Contractor. The Customer warrants that this Data was processed in a lawful manner (duty to provide information, legal basis, compliance with data protection principles, etc.), and may be further processed by the Contractor.

(7) In principle, the Customer will pay compensation based on the time and expense actually incurred for services from the Contractor that were not caused by misconduct of the Contractor. The Contractor’s current hourly rates will apply.

6.   Obligations of the Contractor

(1) The Contractor processes Data within the framework of the agreements made and according to documented instructions of the Customer.

(2) The Contractor shall promptly inform the Customer if an instruction given by the Customer obviously violates statutory provisions. The Contractor is entitled to suspend implementation of the corresponding instruction until it is confirmed or amended by the Customer after review. If the Contractor can demonstrate that carrying out a processing operation according to the Customer’s instructions may render the Contractor liable, the Contractor is free to suspend further processing to that extent pending clarification of the liability between the Parties.

(3) No copies or duplicates of the Data shall be created without the Customer’s knowledge. Backup copies are excluded from this insofar as they are necessary to ensure orderly data processing, as well as Data with regard to compliance with the Contractor’s own existing retention obligations.

(4) The Contractor is not permitted to correct, delete, or limit the processing of the Data processed under the Agreement autonomously, but only following documented instruction by the Customer.

(5) Within its area of responsibility, the Contractor shall design and monitor its internal organisation in such a way that it meets the special requirements of data protection.

(6) The Contractor shall maintain a list of all categories of processing activities carried out on behalf of the Customer, which shall include all of the information necessary for a record of processing activities.

(7) The Data shall be strictly separated from other databases. Physical separation is not absolutely necessary.

(8) The Contractor shall cooperate to the necessary extent with the Customer in complying with the rights of the data subjects, the security of the processing, reporting of data protection violations, notification of data subjects affected by a violation of the protection, in necessary data protection impact assessments by the Customer as well as in necessary consultations with a supervisory authority, and reasonably support the Customer to the extent possible.

(9) Processing Data outside of the Contractor’s premises, for instance in employees’ home offices, is hereby permitted by the Customer. In such cases, appropriate technical and organisational data security measures are taken.

(10) The Contractor agrees to maintain confidentiality at all times while processing the Data under the Agreement. This duty shall continue in effect even after the end of this contractual relationship. The Contractor shall treat Data as confidential for as long as required by the contract with the Customer and by applicable law, and shall use it only as necessary for maintaining or providing the service.

(11) Data may not be disclosed to third parties unless this is necessary to comply with the Customer’s instructions, the obligations under the contract, the law, or a valid and binding order of a competent governmental authority (such as a ruling). In the event of an order for access to or disclosure of Data, and before complying with such an order, the Contractor shall (a) if legally permissible, inform the Customer and, if this is not the case, attempt to obtain permission to inform the Customer in order to enable the Customer to challenge such an order, and (b) itself exhaust reasonable legal remedies insofar as such an order can be challenged on the basis of deficiencies under the law of the requesting authority, the applicable law or any conflicts with the applicable law, and, to the extent possible, only disclose the Data that is necessary to comply with the order.

(12) Prior to commencing their activities, the Contractor has familiarised its employees with the provisions of data protection relevant for them, and has obligated them in a suitable fashion to maintain confidentiality for the period of their activity as well as after termination of the employment relationship.

7.   Notification Obligations of the Contractor in case of Data Breaches

(1) When the Contractor becomes aware of a data breach or a breach of data security, the Contractor shall notify this to the Customer orally, in writing or in textual form without undue delay after becoming aware of it.

(2) The notification to the Customer shall at least:

a. describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

b. describe the measures taken or proposed to be taken by the Contractor to address the breach, including, where appropriate, measures to mitigate possible adverse effects.

(3) Whenever a duty to provide information exists vis-à-vis third parties (such as the data subjects) or another statutory reporting obligation applicable to the Customer (e.g., to a supervisory authority), the Customer or the Data Controller is responsible for complying with such duty.

8.   Sub-Processing Relationships with further Data Processors

(1) Such sub-processing relationships include services that relate directly to providing the main service or portions of the main service as provided for under this Agreement. Purely ancillary services such as telecommunications, postal, or transport services, cleaning or security services without a specific connection to services that the Contractor provides for the Customer are not included. Preventive maintenance, maintenance, and audit services as well as disposing of data carriers represent such sub-processing relationships insofar as access to or knowledge of the Customer’s Data is possible and insofar as they are provided for IT systems that are also used in connection with providing services for the Customer.

(2) Commissioning further data processors (e.g., addition or replacement) for processing the Customer’s Data is in principle permitted for the Contractor, subject to the following provisions. The current list of the commissioned further data processors is available on the Contractor’s website.

(3) The Contractor shall inform the Customer of every intended change (e.g., of the location of data processing), addition or replacement of further data processors, whereby the Customer may raise objections to such changes.

(4) If no objection is raised by the Customer within the reasonable period communicated by the Contractor, the Customer agrees to the change. If an objection is made within this period, the commissioning of the further data processor shall not be permitted. In such a case, the Parties shall endeavour to find a solution by mutual consent with respect to the further data processor. If this is not possible, the Parties shall have an extraordinary right of termination. In emergency situations, the Customer shall respond without delay and, where applicable, raise its objection.

(5) The Contractor shall ensure that it carefully selects the further data processor.

(6) Commissioning further data processors in third countries shall only be permissible when the special requirements under data protection law have been satisfied for this purpose. The Contractor shall ensure this by implementing corresponding measures. If, on the other hand, such transmission of Data is activated by the Customer itself, compliance with the corresponding provisions shall be the sole duty of the Customer.

(7) The Contractor shall ensure by contract that the agreed upon regulations between the Contractor and the Customer will also apply vis-à-vis further data processors. The contract with the further data processor shall be drafted in written or electronic form.

9.   Technical and Organisational Measures

(1) A level of protection appropriate to the risk to the rights and freedoms of the data subjects affected by the processing shall be ensured for the specific data processing. The goals of protection such as confidentiality, integrity, and availability of the systems and services as well as their resilience with regard to the nature, scope, circumstances, and purpose of the processing will be taken into account in such a way that the risk will be reduced on an ongoing basis, using suitable technical and organisational measures.

(2) A list of the technical and organisational measures taken by the Contractor forms part of this Agreement as an appendix and is available from the Contractor. The measures contained therein represent the appropriate measures implemented by the Contractor to ensure a level of security appropriate to the risks assessed, taking into account the protection goals and the state of the art.

(3) As needed as well as at regular intervals, the Contractor will carry out a process to test, assess and evaluate the effectiveness of the measures. The result together with the audit report may be communicated to the Customer upon request. The measures may be adjusted to technical and organisational developments over the course of the data processing relationship.

(4) Insofar as the measures taken at the Contractor do not satisfy the Customer’s requirements, the Customer shall notify the Contractor immediately.

10.   Rights and Claims of the Data Subjects

(1) The Contractor shall support the Customer to the extent possible with suitable measures in the performance of the Customer’s duties with regard to inquiries and claims of the data subjects.

(2) If a data subject contacts the Contractor with demands for correction, blocking, deletion, or access, the Contractor shall immediately refer the data subject to the Customer insofar as an obvious allocation to the Customer is possible according to the information from the data subject, and shall await the Customer’s instructions.

(3) The Contractor shall not be liable if the data subject’s request is not responded to, not responded to correctly or not responded to in a timely manner by the Customer or the Data Controller.

11.   Monitoring and Reviewing

(1) The Contractor shall review the internal processes at regular intervals and consents to the Customer being entitled to regularly review compliance with the regulations on data protection and data security to a reasonable and necessary extent, prior to the beginning of processing and during the term of the Agreement.

(2) The Contractor will cooperate in these reviews and provide support to the extent necessary. The result shall be documented.

(3) Reviews shall be carried out during normal business hours, upon reasonable advance notice and without disruption to business operations. The Contractor is permitted to make them dependent on the signing of a confidentiality agreement. The Customer consents to the appointment of an independent external auditor by the Contractor insofar as the Contractor provides a copy of the audit report upon request of the Customer.

(4) If a data protection authority or another sovereign supervisory authority carries out a review, the signing of a confidentiality statement is not necessary if this supervisory authority is subject to professional or statutory confidentiality under which a violation is subject to criminal penalties under the Swiss Criminal Code (StGB).

(5) The Customer and the Contractor shall cooperate upon request with the data protection supervisory authority in the performance of its tasks.

12.   Obligations of the Contractor after Termination of the Agreement

(1) After completion of the contractual work or at any time upon request of the Customer, the Contractor shall deliver all Data and data inventories being in its possession that are related to the contractual relationship to the Customer or delete or destroy them according to data protection principles, or have them destroyed (insofar as no retention obligation opposes this action). The same holds true for backups, test and discarded material.

(2) Upon request of the Customer, the Contractor can provide proof of proper deletion. Documentation to be discarded shall be destroyed using a document shredder. Data carriers to be discarded shall be destroyed according to their security classification. The deletion or destruction may be confirmed to the Customer upon request, specifying the date.

(3) The Customer has the right to check that the return or deletion of the Data at the Contractor is complete and in conformity with the contract.

13.   Liability in case of Breach of this Agreement

(1) The Customer and the Contractor shall be jointly and severally liable vis-à-vis the data subject for compensation for damage that a data subject suffers due to data processing or use within the scope of this Agreement that is not permitted or incorrect according to the data protection laws, insofar as the applicable laws and regulations on data protection so provide.

(2) Any limitations on liability between the Customer and its clients or the injured parties shall also apply to the benefit of the Contractor so that the Contractor is not obligated to indemnify the Customer for amounts that the Customer is not required to pay due to such limitations of liability.

(3) In all other respects, the liability regulations agreed upon in the individual contracts concluded between the Parties shall apply.

14.   Miscellaneous

(1) Agreements on the technical and organisational measures as well as monitoring and auditing documentation shall be retained by both Parties for their applicability period and subsequently for at least five full calendar years.

(2) The Contractor retains the right to amend this Agreement (such as in the event of changes to statutory provisions or existing case law as well as to market conditions). Amendments shall be communicated to the Customer in advance. The Customer may object to them if they entail a material change to the contractual provisions that significantly disadvantages the Customer. Such amendments shall be deemed accepted if the Customer does not raise its objection to the amendments in writing within 4 weeks after notification of the amendments. In the event of an objection, the Parties shall endeavour to find a solution by mutual consent with respect to these amendments. If this is not possible, each Party shall have an extraordinary right to terminate this Agreement with effect from the date on which the planned amendments enter into force. Amendments shall in any case be deemed accepted if the Contractor’s services are used from the date on which the amendments enter into force.

(3) Amendments or supplements to the Agreement as well as ancillary agreements must be in writing or in a documented electronic format; unilateral amendments of this Agreement by the Contractor are exempt from this form requirement. This shall also apply to the waiving of this form requirement. Amendments or supplements to this Agreement separately agreed in writing between the Contractor and the Customer shall remain valid even in the event of a new version of this Agreement.

(4) The defence of a right of retention shall be excluded with respect to the Data processed on behalf of the Customer.

(5) In the event that provisions of this Agreement prove to be invalid or null and void, this will not render the remaining provisions invalid or null and void. Instead, they will be replaced by clauses that most closely reflect the economic purpose of the Agreement. The same will apply in the event of a gap or omission.

(6) All disputes arising out of or in connection with this Agreement shall be referred exclusively to the courts of the Contractor’s registered office, with the exception of mandatory places of jurisdiction. However, the Contractor is authorised to also bring a dispute before the court of competent jurisdiction for the registered office of the Customer.

(7) This Agreement is governed by Swiss law to the exclusion of the conflict of law rules and the United Nations Convention on Contracts for the International Sale of Goods (Vienna Sales Convention).

(8) This Agreement is available in different languages. In the event of discrepancies or contradictions, the German version shall prevail.

(9) This version applies from 20 November 2026 and replaces the Agreement V 2.00 of 1 July 2024.

Appendices:

List “Other processors”

List “Technical and Organisational Measures” on request