1. Subject Matter of the Contract  ScopeThis data processing agreement (DPA) supplements the service agreement between the customer (Controller) and the service provider (Processor) insofar as a service agreement including applicable general terms and conditions (the Agreement) refers to this DPA and the Processor processes personal data of the Controller (the Processed Data) in performance of the Agreement and subject to a separately concluded data processing agreement for the relevant services. The Processor is a company of the BKW Group; a directory of the group members can be viewed at https://www.bkw.ch/en/about-us/the-bkw-group/our-network-of-companies. The DPA applies between the Contractor and, on the other hand, the Client and, where applicable, all other companies affiliated with the Client within a group that are entitled under the contract to receive services, in the provision of which the Contractor processes order data. Insofar as the Client, for its part, acts as a processor for another controller, the Contractor acts as a sub-processor. In this case, the provisions of this DPA apply as a sub-processing agreement, and the Client warrants that the instructions it issues correspond to the controller’s instructions. SubjectIn this DPA, the parties regulate the requirements applicable to the Contractor in connection with the processing of the commissioned data by the Contractor. The duration of the commissioned processing, its nature and purpose, the categories of processed data and the categories of data subjects are set out in the contract. In the event of any contradiction between the contract and this DPA, subject to clause 8, the stricter provisions for the protection of personal data shall prevail.  DefinitionsTerms in bold are used in this DPA with the meaning assigned to them in each case. Legal terms such as "personal data," "processing," "data security breach," etc. have the meaning set out in the applicable data protection law. Applicable data protection law means the Swiss Federal Act on Data Protection (FADP) and the associated ordinance, the General Data Protection Regulation (GDPR), and other data protection regulations, in each case to the extent they apply to the processing of commissioned data. References in this DPA to provisions of the FADP or the GDPR are to be read as references to corresponding provisions of the data protection law applicable in each case.  DurationThis data processing agreement takes effect upon conclusion of the contract, but no later than the contractor's first access to client data, and ends upon termination of the contract, but no earlier than the deletion of all client data processed by the contractor.

2. General Obligations of the Contractor Compliance with instructionsThe Contractor is obliged to process order data exclusively for the performance of the contract, this DPA and the instructions of the Client. Reserved are differing obligations under the applicable mandatory law, about which the Client must be informed in advance to the extent permitted. Instructions regarding the processing of personal data by the Contractor are binding insofar as they do not extend the contractual obligations. They are generally issued through direct interaction with the Contractor's systems (where technically possible) or in text form; in urgent cases, they may also be given orally. The Client is obliged to document instructions appropriately. PersonnelThe Contractor shall take appropriate measures to ensure that its employees and engaged third parties who may have access to order data processed for the provision of the services are reliable, trustworthy, and adequately trained for the tasks assigned to them in the secure handling of data and process the order data exclusively in accordance with the provisions of this DPA. Place of data processingThe data processing shall be carried out exclusively at the contractor's locations, subject to outsourcing to engaged subcontractors in accordance with the provisions under section 6. If the contractor intends to transfer personal data to a country that does not have a level of protection deemed adequate under the applicable data protection law, it shall conclude an agreement for such data transfer that permits the transfer under the applicable data protection law. Return and deletion obligation(i) If the Contractor no longer needs order data to fulfill its obligations to the Client, it shall ensure that the relevant order data is returned to the Client and/or that any remaining copies are deleted. The Client shall issue corresponding instructions to the Contractor upon termination of the data processing agreement. (ii) Reserved in each case is a longer storage in customary backup systems until the next regular deletion, provided these systems are secured at least in accordance with the requirements of this AV agreement and the stored commissioned data are used exclusively for backup purposes.

3. General obligations of the client  Responsibility for the lawfulness of data processing lies with the client. The client warrants the lawfulness of transferring the data processing to the contractor and of the contractor’s corresponding processing. In the case of special requirements for the processing (such as, for example, increased security needs), the contractor must be informed accordingly. 

4. Data and information security  4.1. General obligations  The Contractor undertakes to take appropriate technical and organizational measures to protect the commissioned data processed for the provision of the service against impermissible processing, but at least the measures pursuant to Annex 1 "Technical and Organizational Measures" (the TOM). The Client confirms the appropriateness of the TOM, taking into account the protection needs of the commissioned data as assessed by it. The Contractor may adjust the TOM at any time. Changes that impair the security level of the commissioned data must be communicated to the Client in text form in advance. The Client may object to such changes within a period of two weeks.

4.2. Maintaining confidentiality All order data must be treated as confidential. The Contractor undertakes: (i) to protect the order data appropriately against access by unauthorized persons; (ii) to ensure that all persons with access to the confidential information are subject to an appropriate statutory or contractual duty of confidentiality; and (iii) to grant access to confidential information only to persons who require it for the performance of their duties, whereby access and rights of access must be limited to what is objectively and personally necessary for business purposes (compliance with the "need-to-know" principle). The Contractor is obliged to inform the Client without delay of requests or orders from authorities (e.g. judicial, criminal prosecution, and administrative authorities), insofar as this is permissible under the applicable law. In each case, it refers the requesting authority to the Client. Subject to any contrary instructions from the Client, it shall, at the Client’s expense, take the legal remedies available under the applicable law that are not clearly futile in order to prevent or restrict disclosure of order data. If it is under a binding obligation to disclose, it shall disclose only the minimum amount of order data.

4.3. Notification of personal data breaches  The Contractor shall notify the Client in the event of a data security breach without undue delay and no later than within 48 hours after the Contractor becomes aware of the data security breach. The notification to the client contains at least the following information (which must be provided in stages insofar as it is not yet fully known at the time of the notification): (i) Type of data security breach; (ii) affected persons (category and approximate number of affected persons); (iii) type and scope of the client's personal data affected by the data security breach (categories and approximate number of affected data); (iv) contact person of the client from whom additional information can be obtained; (v) expected consequences of the data security breach for the affected persons; (vi) measures taken or planned to investigate and address the data security breach.

5. Subcontractor PermissibilityThe Contractor is authorized to engage subcontractors, provided that they are engaged in accordance with the contract and this DPA and that the Contractor has entered into an agreement with them in text form that imposes on the subcontractor essentially the same obligations to which the Contractor is subject under this DPA. When engaging subcontractors from third countries, Clause 2(c) shall apply. The Contractor shall be liable to the Client for compliance with the obligations of the subcontractors as for its own conduct. Approval(i) If the Contractor intends to engage an additional sub-processor, the Client must be informed thereof as early as possible by express notice in text form. If the Client objects to the engagement of the sub-processor by notice in text form within 20 days of receipt of the corresponding notice and the Contractor is not willing to refrain from engaging the relevant sub-processor, each party shall have the right to terminate the contract and this AV Agreement for cause. (ii) The hereby approved Subprocessor are (i) the subcontracted service providers, if any, provided for in the contract, (ii) the subcontractors communicated to the Client in text form prior to the conclusion of the contract, and (ii) the companies of the BKW Group.

6. Data protection control rights  The client is entitled, in cases of urgency or suspicion of a breach, to inspect and review the processing of commissioned data entrusted to the contractor with regard to compliance with the applicable data protection regulations. This also includes reviewing the security of the IT infrastructure provided for services. In the context of such audits, the principle of proportionality must be observed and the contractor’s legitimate interests worthy of protection (in particular confidentiality) must be adequately taken into account. Subject to any deviating provision, the client shall bear all costs of such audits (including the contractor’s documented internal costs incurred in cooperating with the audit). Any audit rights defined in the contract as well as any legally mandatory inspection rights of the client or its supervisory authorities remain reserved.

7. Additional support obligations The Contractor shall reasonably support the Client in complying with its obligations to ensure appropriate data security, to report data breaches, and to carry out data protection impact assessments. If a data subject contacts the Contractor in connection with data protection claims (e.g. a request for access or erasure), the Contractor shall forward the relevant request to the Client without undue delay. It shall not respond to such requests. It shall reasonably support the Client in handling such requests, as well as in fulfilling obligations to cooperate with authorities.

8. Transfer abroad  Insofar as the permissibility of the transfer of personal data by the Contractor to the Client is based on the inclusion of approved standard contractual clauses, the parties hereby agree, for this transfer, as part of the DPA, to the European Standard Contractual Clauses (SCC; https://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32021D0914), general provisions and Module 4. In the event of a conflict, the SCC shall prevail over the Agreement and this DPA. https://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32021D0914), allgemeine Bestimmungen und Modul 4. Im Widerspruchsfall gehen die SCC dem Vertrag und diesem AV-Vertrag vor.  Clause 7 SCC shall apply; (ii) Clause 11 SCC shall apply without the option; (iii) for Clause 17 SCC, the law agreed in the Agreement shall apply, or Swiss law if the applicable law does not provide for this; (iv) for Clause 18 SCC, the place of jurisdiction of the Agreement shall apply; (v) Annex I of the SCC shall be governed by the Agreement and Annex II by Annex 1 of this DPA. (v) If the transfer subject to the SCC is subject to Swiss data protection law, references in the SCC to the GDPR shall also be read as references to the Swiss FADP and references to EU Member States also to Switzerland, and the FDPIC shall be a competent supervisory authority.

9. Contact persons  The Client shall designate to the Contractor one or more contact persons for questions in connection with this DPA. The Contractor shall be deemed authorized, until revoked, to communicate with this person on all matters relating to the processing activities, including notifications of data security incidents.

10. Final provisions AmendmentsChanges or additions to this agreement require an explicit agreement in text form. LiabilityLiability arising from breaches shall be governed by the contract and, subsidiary, by the liability provisions applicable by law. NoticesNotices provided for in this DPA must in each case be made expressly and in text form (e.g. by email), unless otherwise agreed. Dispute resolutionThe applicable law and place of jurisdiction shall be governed by the contract. 

Appendix 1: Technical and organizational measures  

1. Introduction  The following technical and organizational measures describe the specific steps to be taken by the Contractor in connection with the processing of personal data and the fulfilment of the obligations under the main contract and the data processing agreement in order to ensure a level of protection appropriate to the risk. If the data processing is carried out by a subcontractor engaged by the Contractor, the Contractor shall ensure by means of suitable contractual arrangements that the subcontractors comply with comparable measures. The assessment of whether the technical and organizational measures described below are adequate to protect the data entrusted to the Contractor is the responsibility of the Client.

2. Access control Measures that are suitable for preventing unauthorized persons from gaining access to data processing facilities in which personal data are processed or used. Access control may include the following measures: alarm systems, automatic notification to a security service, electronic access systems using magnetic cards, authorizations and locking systems for sensitive rooms, data protection-compliant video surveillance, authorization process, visitor policy, reception staff, careful selection of cleaning and security personnel.

3. Access control  Measures suitable for preventing data processing systems from being used by unauthorized persons. Access control may include the following measures: IT systems in separate, secured networks, protection by user ID and password, secure passwords in accordance with the password policy, two-factor authentication, encryption of mobile devices, anti-virus software, trustworthy personnel for the security and cleaning areas, access on a need-to-know basis after prior approval, blocking of access after departure, regular review of all access authorizations.

4. Access controlMeasures that ensure that those authorized to use a data processing system can access only the data covered by their access authorization and that personal data cannot be read, copied, altered, or removed without authorization during processing, use, and after storage. Access control may include the following measures: Only approved devices (PCs, laptops, etc.) may use the network, access to computers and applications only by means of user ID and password. Secure passwords in accordance with the password policy, logging of access, authorization concept, granting of access according to the need-to-know principle and prior approval, periodic review of authorizations, in particular of administrative user accounts, limited number of administrators who have full access authorization, four-eyes principle for special applications, all employees participate in annual data protection training, disposal of confidential data via certified specialist disposal companies.

5. Separation controlMeasures that guarantee separate processing of data collected for different purposes. Separation control may include the following measures: security areas protected against unauthorized access, data-processing applications on virtualized application servers, access according to the need-to-know principle, separation of systems into development, test, integration and production, use of firewalls, tenant separation, database rights and authorization concepts adapted to the respective data records, authorization concept, separation of data stored for different purposes.

6. Input controlMeasures that ensure that it can subsequently be verified and determined whether and by whom personal data have been entered, modified, or removed in data processing systems. Input control may include the following measures: storage of confidential documents, traceability of access, access to logs by IT administration, logs are integrated into data backup procedures, retention periods, setup and use of individual usernames, assignment of access authorizations.

7. Disclosure controlMeasures that ensure that personal data cannot be read, copied, modified or removed without authorization during electronic transmission or during its transport or storage on data carriers, and that it can be checked and determined to which entities a transfer of personal data by data transmission facilities is intended. Transfer control may include the following measures: access to dedicated network zones exclusively via company-owned devices and VPN access with 2-factor authentication, data on mobile devices is encrypted, data exchange via SFTP, email encryption, disposal of confidential documents and electronic data carriers via a certified disposal service.

8. Order controlMeasures that ensure that the processing of personal data by subcontractors is carried out only in accordance with the instructions of the client. Order control may include the following measures: confidentiality obligation, reporting of security incidents, data protection impact assessments, careful selection of subcontractors, conclusion of data processing agreements.

9. Availability check Measures that ensure that personal data are protected against accidental destruction or loss. Availability control may include the following measures: Monitoring and securing server systems, data backup procedures and archiving, redundant systems, theft protection, antivirus protection, firewall/ IDS, alarm systems, fire protection measures in the server room and office spaces, data recovery tests, fire extinguishers, emergency management, standard processes when employees change roles or leave the company.

10. RecoverabilityMeasures that ensure the rapid restoration of data availability after its temporary loss or damage. Recoverability may include the following measures: virtualized systems, data backups, redundant servers with reserve capacity, emergency plans, exercise plans, emergency concept/emergency plan, audits, exercises, emergency documentation.

11. Review, Assessment and Evaluation (Organizational Control)Measures for the regular review, assessment and evaluation of the effectiveness of the technical and organizational measures to ensure the security of processing. Organizational control may include the following measures: data protection management or data protection organization, incident response management, privacy-friendly default settings, documented record of processing activities, employee training, centralized instruction management.