Data Processing Agreement (DPA)

1. Purpose and roles of the parties

This agreement (“DPA”) forms an integral part of the contract between the Client (“Controller”) and M-Heberge Avon (“Processor”) for the Swiss Agent Network service. It applies where the Processor processes personal data on behalf of the Controller, in accordance with the nFADP and, where applicable, Article 28 GDPR.

The Controller determines the purposes and means of processing the data it entrusts to the Agent. The Processor processes such data solely to provide the Service and on documented instructions from the Controller (including through the Service settings).

2. Nature, purpose and duration

• Nature: collection, storage, structuring, consultation, use by the Agent, transmission to the sub-processors listed in §7.
• Purpose: performance of the Service features requested by the Controller.
• Duration: the term of the contract, subject to §9.

3. Categories of data and data subjects

• Data subjects: the Controller’s contacts, clients, prospects, suppliers and correspondents; the Controller’s staff.
• Categories of data: identification and contact data, content of communications (e-mails, messages), commercial data (quotes, invoices), and any data the Controller chooses to submit. The Controller refrains from entrusting unnecessary sensitive data.

4. Obligations of the Processor

• process data only on the Controller’s instructions;
• ensure the confidentiality of persons authorised to process the data;
• implement appropriate technical and organisational measures (encryption, access control, segregation, logging);
• assist the Controller in responding to data subject requests;
• assist the Controller with security, breach notification and impact assessments;
• inform the Controller if an instruction appears to infringe applicable law.

5. Data breach

The Processor notifies the Controller, without undue delay after becoming aware of it, of any personal data breach affecting data processed on its behalf, and provides the information reasonably required.

6. Sub-processors

The Controller authorises the use of the sub-processors listed in §7. The Processor imposes on them protection obligations equivalent to those of this DPA and remains responsible for their performance. The Processor informs the Controller of any addition or replacement, allowing the Controller to object on legitimate grounds.

7. Sub-processor list

8. International transfers

Where data is transferred outside Switzerland or the EU (in particular to providers in the United States), the Processor ensures appropriate safeguards are in place: the Swiss–US / EU–US Data Privacy Framework where the provider is certified, and/or the Standard Contractual Clauses recognised by the FDPIC and the European Commission, together with supplementary measures.

9. Return and deletion

At the end of the contract, the Processor deletes or returns the personal data at the Controller’s choice, unless legally required to retain it. A reasonable period applies for the deletion of backups.

10. Audit

The Processor makes available to the Controller the information reasonably necessary to demonstrate compliance with this DPA and allows, within reasonable limits and with notice, proportionate audits to be carried out.

11. Miscellaneous

In case of conflict between this DPA and the Terms of Use or Terms of Sale regarding data protection, this DPA prevails. This DPA is governed by Swiss law; exclusive jurisdiction in Geneva.

Swiss Agent Network · Data Processing Agreement · 11 August 2026