This English version is a translation for convenience. In the event of any discrepancy, the German version prevails.

Between the Customer (controller) and miller IT-Solutions, Bahnhofstrasse 18, 3312 Fraubrunnen (processor).

1. Subject matter and duration

1.1 The processor processes personal data on behalf of the controller in order to provide the Varmo service under the main contract (General Terms and Conditions). Details of the nature, purpose, data and data subjects are set out in Annex 1.

1.2 This DPA applies for as long as the processor processes personal data of the controller, including beyond the end of the main contract until deletion.

2. Instructions

2.1 The processor processes the data only on documented instructions from the controller. The main contract, this DPA and the settings the controller makes in the Service (e.g. roles, deletion periods, support authorisations) are deemed to be instructions.

2.2 If the processor considers an instruction to be unlawful, it informs the controller without delay.

3. Confidentiality

Persons at the processor who may have access to the data are bound by confidentiality. The processor obtains access to the controller’s data for support purposes only with a time-limited, read-only authorisation from a Tenant Admin of the controller.

4. Data security

The processor implements the technical and organisational measures set out in Annex 2 and adapts them to the state of the art without lowering the level of protection.

5. Sub-processors

5.1 The controller approves the sub-processors listed in Annex 3.

5.2 The processor gives at least 30 days’ notice of new or replaced sub-processors. The controller may object for good cause; if no agreement is reached, the controller may terminate the main contract with effect from the date the change takes effect.

5.3 The processor contractually obliges sub-processors to provide at least the same level of protection.

6. Disclosure abroad

The data are processed in Switzerland. Disclosure to countries without adequate data protection takes place only with appropriate safeguards (e.g. standard contractual clauses) and after informing the controller.

7. Assistance to the controller

7.1 The processor assists the controller with requests from data subjects (access, rectification, erasure, data portability). The controller can deal with most requests itself in the Service (editing, deleting, data export).

7.2 It assists the controller with data protection impact assessments and consultations of the supervisory authority, insofar as they concern the Service.

8. Data security breaches

The processor notifies the controller of data security breaches affecting the controller’s data without delay, and at the latest within 48 hours of becoming aware of them, providing the information available (nature, data and persons concerned, consequences, measures taken). It provides any information that becomes known later as a follow-up.

9. Deletion and return

9.1 Before the end of the contract, the controller may export its data itself (ZIP file per organisation, available for download for 7 days).

9.2 After the end of the contract and once the account’s deletion period has expired (30 days by default, adjustable between 30 and 365 days), the processor permanently deletes all of the controller’s data, including uploaded files and sign-in accounts. Data in backups are overwritten after 7 days and are no longer processed until then.

9.3 The processor confirms the deletion upon request.

10. Evidence and audits

10.1 The processor makes available to the controller the information necessary to demonstrate compliance with the obligations under this DPA.

10.2 The controller, or an auditor appointed by it and bound by confidentiality, may carry out an audit no more than once a year, with 30 days’ prior notice, except where there is reasonable cause. Each party bears its own costs. If the audit reveals material deficiencies, the processor bears the costs of the audit.

11. Final provisions

In the event of any conflict, this DPA takes precedence over the main contract as far as data protection is concerned. The governing law and place of jurisdiction of the main contract apply.

12. Addendum for controllers subject to the GDPR

12.1 Application. Where the controller’s processing is subject to the EU General Data Protection Regulation (GDPR, Art. 3), this section applies in addition to sections 1–11. It does not change the rules under the Swiss Federal Act on Data Protection (FADP). Terms used in this DPA are then to be understood within the meaning of the GDPR (e.g. “disclosure abroad” as a transfer to third countries, “data security breach” as a personal data breach). Where the GDPR provides for stricter obligations, those apply; otherwise sections 1–11 apply. Annex 1 describes the subject matter, duration, nature and purpose of the processing, the type of personal data and the categories of data subjects within the meaning of Art. 28(3) GDPR.

12.2 Instructions (Art. 28(3)(a) GDPR). The processor processes the data only on documented instructions from the controller (section 2), including with regard to transfers to third countries or international organisations, unless required to do so by Union or Member State law to which the processor is subject. In such a case, the processor informs the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. If the processor considers that an instruction infringes the GDPR or other Union or Member State data protection provisions, it informs the controller immediately.

12.3 Confidentiality (Art. 28(3)(b) GDPR). The processor ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (section 3).

12.4 Security of processing (Art. 28(3)(c), Art. 32 GDPR). The measures set out in Annex 2 constitute the measures under Art. 32 GDPR. The processor thereby ensures a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing (section 4).

12.5 Sub-processors (Art. 28(2) and (4) GDPR). Section 5 constitutes a general written authorisation within the meaning of Art. 28(2) GDPR; the notice under section 5.2 gives the controller the opportunity to object to changes. The processor imposes on each sub-processor, by contract, the same data protection obligations as set out in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. Where a sub-processor fails to fulfil its data protection obligations, the processor remains liable to the controller for the performance of those obligations in accordance with Art. 28(4) GDPR.

12.6 Transfers. Processing in Switzerland is based on the European Commission’s adequacy decision for Switzerland. Transfers to other third countries or to international organisations take place only in accordance with Chapter V GDPR (e.g. an adequacy decision or standard contractual clauses of the European Commission) and section 6.

12.7 Assistance (Art. 28(3)(e) and (f) GDPR). The processor assists the controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the controller’s obligation to respond to requests for exercising the data subject’s rights under Chapter III GDPR (Arts. 12–22). Taking into account the nature of the processing and the information available to it, the processor also assists the controller in ensuring compliance with the obligations under Arts. 32–36 GDPR (security of processing, notification and communication of personal data breaches, data protection impact assessment, prior consultation). If a data subject contacts the processor directly, the processor forwards the request to the controller without delay.

12.8 Notification of breaches (Art. 33(2) GDPR). The processor notifies the controller of a personal data breach without undue delay after becoming aware of it, and at the latest within the period set out in section 8 (48 hours). The notification contains, where available, the information under Art. 33(3) GDPR (nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, measures taken or proposed, and a contact point); the processor provides further information in phases.

12.9 Deletion and return (Art. 28(3)(g) GDPR). At the choice of the controller, the processor deletes or returns all personal data to the controller after the end of the provision of services and deletes existing copies, unless Union or Member State law requires storage of the personal data. Return takes place via the data export (section 9.1), deletion in accordance with section 9.2; copies in backups are overwritten after 7 days.

12.10 Evidence and audits (Art. 28(3)(h) GDPR). The processor makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the controller or another auditor mandated by the controller. Section 10.2 applies. The powers of the supervisory authorities remain unaffected.

12.11 Precedence. In the event of any conflict between this section and the other provisions of this DPA or the main contract, this section prevails for processing subject to the GDPR.

Annex 1: Subject matter of the processing

  • Purpose: Provision of an information security management system (assets, protection requirements, risks, measures, controls, incidents, audits, documents) and support.
  • Nature: Storing, displaying, modifying, analysing, exporting, deleting; sending the Service’s e-mails.
  • Data subjects: Employees and other persons with access at the controller; persons the controller records in content (e.g. persons responsible, reporting persons, persons involved in incidents).
  • Categories of data: Account: name, e-mail, role, organisation, sign-ins (time, result, IP address, browser), change log. Content: whatever the controller enters; depending on use, this may also include sensitive personal data (e.g. in incidents or DPIAs).
  • Duration: Term of the main contract plus the deletion period (section 9).

Annex 2: Technical and organisational measures (TOMs)

Evidenced in the product (as at 22 October 2026):

Access control and separation

  • Strict separation of organisations in the database (row level security on all tables, enforced also for the table owner; foreign keys per organisation), additionally checked in the application; automated tests of the separation with every change.
  • Permissions according to the need-to-know principle via functional roles; administrative permissions (Tenant Admin) separate from functional permissions; segregation of duties with justified, approved exceptions; annual review of permissions.
  • Four-eyes principle for approvals (e.g. policies, risk acceptance, documents) enforced in the database.
  • Operator without access to customer data; support only with a time-limited, read-only authorisation from the Customer, technically restricted to read access and logged.

Authentication and sessions

  • Passwords of at least 12 characters; self-registration only with a confirmed e-mail address.
  • Second factor (authenticator app or passkey) mandatory for Tenant Admins; without it, the database returns no data.
  • After 5 failed attempts within 15 minutes, sign-in is blocked, with a waiting time that increases with each further failed attempt, up to a maximum of 30 minutes.
  • Maximum session duration and sign-out after inactivity configurable per account; deactivation and time limits for access.

Traceability

  • Immutable change log (old and new values, person, time) and log of sign-ins, also protected against modification by operations staff.
  • Administration log for Tenant Admins (members, roles, account, support access).

Transmission and operations

  • Encrypted transmission (TLS); security headers and Content Security Policy.
  • Error tracking operated in-house, without cookies, request contents or personal details.
  • Daily backups on the server and as a copy of the data storage at the hosting provider in Switzerland (7 days each); restoration regularly rehearsed.
  • Updating of dependencies with automatic checks for known vulnerabilities.

Deletion

  • Automatic deletion once periods expire (account, sign-ins, demo requests), including uploaded files; monitoring of the deletion jobs by operations.

Organisation

  • Operations are the responsibility of the owner; any other persons with access to systems are bound to confidentiality in writing.
  • Emergency access credentials are on file and used only in an emergency.
  • Security incidents are recorded, assessed and reported according to a defined procedure (section 8).
  • The owner undertakes continuous training in information security.

Annex 3: Sub-processors

  • Infomaniak Network SA, Geneva (data centre in Switzerland): data centre, servers, storage, backups
  • Infomaniak Network SA, Geneva (Switzerland): sending the Service’s e-mails

The processor operates error tracking and the database itself; there is no sub-processor for these.