Swiss Agent Network
Data Processing Agreement (DPA)
Framework for processing personal data the Client entrusts to the Agent, under the revised Swiss FADP and Article 28 GDPR.
1. Purpose and roles of the parties
This agreement (“DPA”) forms an integral part of the contract between the Client (“Controller”) and M-Heberge Avon (“Processor”) for the Swiss Agent Network service. It applies where the Processor processes personal data on behalf of the Controller, in accordance with the nFADP and, where applicable, Article 28 GDPR.
The Controller determines the purposes and means of processing the data it entrusts to the Agent. The Processor processes such data solely to provide the Service and on documented instructions from the Controller (including through the Service settings).
2. Nature, purpose and duration
- Nature: collection, storage, structuring, consultation, use by the Agent, transmission to the sub-processors listed in §7.
- Purpose: performance of the Service features requested by the Controller.
- Duration: the term of the contract, subject to §9.
3. Categories of data and data subjects
- Data subjects: the Controller’s contacts, clients, prospects, suppliers and correspondents; the Controller’s staff.
- Categories of data: identification and contact data, content of communications (e-mails, messages), commercial data (quotes, invoices), and any data the Controller chooses to submit. The Controller refrains from entrusting unnecessary sensitive data.
4. Obligations of the Processor
- process data only on the Controller’s instructions;
- ensure the confidentiality of persons authorised to process the data;
- implement appropriate technical and organisational measures (encryption, access control, segregation, logging);
- assist the Controller in responding to data subject requests;
- assist the Controller with security, breach notification and impact assessments;
- inform the Controller if an instruction appears to infringe applicable law.
5. Data breach
The Processor notifies the Controller, without undue delay after becoming aware of it, of any personal data breach affecting data processed on its behalf, and provides the information reasonably required.
6. Sub-processors
The Controller authorises the use of the sub-processors listed in §7. The Processor imposes on them protection obligations equivalent to those of this DPA and remains responsible for their performance. The Processor informs the Controller of any addition or replacement, allowing the Controller to object on legitimate grounds.
7. Sub-processor list
| Provider | Role | Location |
|---|---|---|
| Anthropic (Claude) | Reasoning, drafting, text summarisation | United States |
| OpenAI | Speech transcription (Whisper) and speech synthesis (TTS) | United States |
| Perplexity | Web search (if enabled) | United States |
| Apollo | Prospect (lead) research | United States |
| Infomaniak | Sovereign AI models, sovereign speech transcription | Switzerland |
| Linkup | Web search (Sovereign mode) | European Union |
| Supabase | Database, authentication, storage | Ireland (EU) |
| Cloudfive | Application hosting | France |
| LWS (Ligne Web Services) | Marketing site hosting, transactional emails | France |
| Integrations: Gmail, Calendar, Drive, Sheets | European Union / United States | |
| Stripe | Payment and invoicing | Ireland / United States |
| Canva | Visual generation (community management) | United States / Australia |
Depending on the processing mode selected. In Performance mode, providers located in the United States are used. In Sovereign mode, no US provider is involved: processing runs on Infomaniak models in Switzerland and web search through Linkup in the European Union. The mailboxes and tools you connect remain your own services and are not listed here.
8. International transfers
Where data is transferred outside Switzerland or the EU (in particular to providers in the United States), the Processor ensures appropriate safeguards are in place: the Swiss–US / EU–US Data Privacy Framework where the provider is certified, and/or the Standard Contractual Clauses recognised by the FDPIC and the European Commission, together with supplementary measures.
9. Return and deletion
At the end of the contract, the Processor deletes or returns the personal data at the Controller’s choice, unless legally required to retain it. A reasonable period applies for the deletion of backups.
10. Audit
The Processor makes available to the Controller the information reasonably necessary to demonstrate compliance with this DPA and allows, within reasonable limits and with notice, proportionate audits to be carried out.
11. Miscellaneous
In case of conflict between this DPA and the Terms of Use or Terms of Sale regarding data protection, this DPA prevails. This DPA is governed by Swiss law; exclusive jurisdiction in Geneva.
Swiss Agent Network · Data Processing Agreement · 11 September 2026