Data Processing Agreement

1. Purpose and term of the agreement

This data processing agreement (hereinafter this DPA) is concluded between the organisation that creates a workspace on The Training Platform (hereinafter the Workspace), whatever the Plan chosen, including the Free Plan (hereinafter the Customer or the Controller), and Appogée Sàrl, a limited liability company under Swiss law with its registered office at Chemin de Paudex 5, 1132 Lully, Switzerland, entered in the commercial register under UID number CHE-340.224.808, which operates The Training Platform (hereinafter the Processor).

The purpose of this DPA is to set out the conditions under which the Processor processes personal data on behalf of the Customer in connection with The Training Platform service, in accordance with Article 9 of the Federal Act on Data Protection (FADP) and, where the processing concerns persons located in the European Union or the European Economic Area, Article 28 of the General Data Protection Regulation (GDPR).

This DPA forms an integral part of the Terms of Sale of The Training Platform. It is accepted by the Customer together with them when the Workspace is created, without any further formality.

This DPA applies from the creation of the Workspace until the closure of the Workspace, which marks the end of the Agreement within the meaning of the Terms of Sale, whatever the Plan, including the Free Plan and the trial period. Its provisions relating to the return and erasure of data, confidentiality and liability remain applicable after the closure of the Workspace for as long as the Processor holds personal data on behalf of the Customer.

This DPA does not govern the processing that the Processor carries out on its own behalf, in particular the management of the contractual relationship with the Customer, the invoicing of the subscription and the operation of The Training Platform website. That processing, for which the Processor acts as controller, is described in the Privacy Notice.

2. Nature and purpose of the processing

The Training Platform makes available to the Customer a training management portal, accessible at the address specific to its workspace. The Processor hosts and operates that portal, together with the associated database and files, on behalf of the Customer.

The sole purpose of the processing carried out by the Processor is to provide the Customer with the features of the portal: publishing its training catalogue, organising sessions, managing registrations and attendance, making participants' documents available, issuing invoices and tracking payments, and sending the emails relating to these operations.

This processing includes in particular the collection, recording, organisation, storage, consultation, alteration, transmission, backup and erasure of data, to the extent necessary for the provision of the service.

Emails are sent in the Customer's name, where applicable by means of the mailbox that the Customer has connected to the portal. Online payments are processed by the payment service provider appearing in the list of sub-processors; The Training Platform stores no payment card data.

The Processor shall not process the Customer's personal data for any other purpose, in particular for its own commercial or advertising purposes, nor sell them or disclose them to third parties except as provided for in this DPA.

3. Categories of data and data subjects

The data subjects are the participants in the Customer's training courses, the trainers, the company managers who register or monitor participants, and the Customer's staff who administer the portal.

The data processed include the identity and contact data of these persons, such as surname, first name, email address, other contact details entered and, where applicable, the company to which they belong, as well as data relating to their role.

They also include data relating to registrations and participation in training courses, in particular the sessions attended and attendance, as well as the documents uploaded to the portal by the Customer, the trainers or the participants, such as certificates.

Finally, they include billing data and payment status, excluding any payment card number. The following fall outside the scope of this DPA, since they are processed by the Processor as controller: portal user accounts, login codes, authentication and security logs and error reports, as described in the Privacy Notice.

The Customer alone determines the data that it enters, or has entered, in the portal. It shall ensure that no sensitive data within the meaning of the FADP, such as health data, are recorded there, unless this is necessary for its training courses and it has a legal basis for doing so.

4. Documented instructions of the Controller

The Processor shall process personal data only on the Customer's documented instructions. The use of the portal by the Customer and by the persons it authorises on it, as well as the settings it defines there, constitute its instructions. This DPA and the Terms of Sale also form part of them.

The Customer may give additional instructions in writing, provided that they are compatible with the features of the service. An instruction that requires a specific development or service may be the subject of a separate agreement.

The Processor shall inform the Customer without delay where an instruction appears to it to infringe the FADP, the GDPR or any other applicable data protection provision. It may then suspend the execution of that instruction until the Customer confirms or amends it.

Where the Processor is required by applicable law to process data without instructions from the Customer, it shall inform the Customer beforehand, unless that law prohibits this on important grounds of public interest.

The Customer remains responsible for the lawfulness of the processing it orders. In particular, it is responsible for informing the data subjects, in its own legal documents, of the processing carried out by means of the portal, and for having a legal basis for each processing operation.

5. Confidentiality

The Processor warrants that the persons authorised to process the Customer's personal data are subject to an obligation of confidentiality, whether contractual or statutory.

Access to these data is reserved for persons who need it to operate, maintain or support the service, and is limited to what is necessary for the performance of their tasks.

The Processor shall ensure that these persons are informed of the obligations arising from this DPA and from data protection legislation.

The obligation of confidentiality continues after the closure of the Customer's Workspace and after the end of the employment or mandate relationships of the persons concerned.

6. Technical and organisational security measures

The Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 8 of the FADP and, where applicable, Article 32 of the GDPR. This section describes the main measures and serves as the security annex.

The portal and its database are hosted in Switzerland by Infomaniak. Uploaded files and backups are entrusted to sub-processors whose location is indicated in the Privacy Notice. Communications between users and the portal are encrypted in transit using the TLS protocol.

The data of each workspace are isolated from those of other organisations: each request is linked to the workspace concerned and filtered accordingly. Access to features depends on the role assigned to each user, whether administrator, trainer, company manager or learner. Login to the portal is by means of a one-time code sent by email.

Technical access between the components of the service relies on API tokens restricted to the operations strictly necessary. Operations and errors are logged, and errors are continuously monitored so that incidents can be detected and corrected quickly.

The database is backed up daily, with the backups kept with a storage provider, so that the data can be restored in the event of an incident.

In the event of a security incident, the Processor shall analyse the incident, limit its effects, document the measures taken and inform the Customer in accordance with clause 9. It regularly reassesses these measures and may adapt them to technical developments, provided that the overall level of protection is not reduced.

7. Sub-processors

The Customer grants the Processor a general authorisation to engage sub-processors for the provision of the service. The list of sub-processors, with their function and location, is set out in the Privacy Notice of The Training Platform, to which this DPA refers.

The Processor shall impose on each sub-processor, by contract, data protection obligations offering a level of protection at least equivalent to that of this DPA, in particular with regard to security and confidentiality. It remains liable to the Customer for the performance of those obligations.

Where data are disclosed to a sub-processor established outside Switzerland, such disclosure takes place in accordance with Articles 16 et seq. of the FADP. The applicable safeguards are indicated in the section of the Privacy Notice dealing with transfers outside Switzerland.

The Processor shall inform the Customer in writing at least thirty (30) days before adding or replacing a sub-processor. During that period, the Customer may object to the change on reasonable grounds relating to data protection.

In the event of an objection, the parties shall seek a solution in good faith. Failing agreement, the Customer may terminate the Agreement within the meaning of the Terms of Sale, and thereby this DPA, with effect from the date on which the change takes effect, without termination fees.

8. Assistance to the Controller

It is primarily for the Customer to respond, using the features of the portal, to requests from data subjects exercising their rights of access, rectification, erasure, restriction, objection or portability.

Where these features are insufficient, the Processor shall assist the Customer, insofar as possible, by appropriate technical and organisational measures, to enable it to respond to such requests within the statutory time limits.

Where a data subject sends a request relating to data processed on behalf of the Customer directly to the Processor, the Processor shall forward it to the Customer without delay and shall not act on it itself, unless otherwise instructed by the Customer.

Taking into account the nature of the processing and the information available to it, the Processor shall also provide the Customer with the assistance reasonably necessary for carrying out data protection impact assessments and, where applicable, for the prior consultation of the competent supervisory authority.

Assistance beyond what the service provides as standard may be invoiced to the Customer at a reasonable cost, communicated in advance.

9. Notification of data security breaches

The Processor shall notify the Customer of any data security breach affecting the personal data processed on the Customer's behalf as soon as possible after becoming aware of it, with the objective of notifying the Customer within seventy-two (72) hours.

The notification contains, insofar as this information is available, the nature of the breach, the categories and approximate number of persons and records concerned, the likely consequences of the breach, and the measures taken or proposed to remedy it and mitigate its effects.

Where not all of this information can be provided at the same time, the Processor shall provide it in stages without further undue delay.

The purpose of this information is to enable the Customer to fulfil its own reporting obligations, in particular towards the Federal Data Protection and Information Commissioner and, where applicable, towards a European supervisory authority, and to inform the data subjects where required. It is for the Customer to make these reports.

The Processor shall take reasonable measures without delay to contain the breach and limit its consequences, and shall cooperate with the Customer in analysing the incident.

10. Information and audit

The Processor shall make available to the Customer, upon written request, the information necessary to demonstrate compliance with the obligations laid down in this DPA, in particular an up-to-date description of the security measures described in clause 6.

If this information is insufficient, the Customer may have an audit carried out, by itself or by an independent auditor bound by confidentiality, no more than once per calendar year or following a data security breach within the meaning of clause 9.

The Customer shall give written notice of the audit, observing a reasonable notice period and specifying its scope. The audit takes place during normal working hours, so as not to disrupt the operation of the service, and may not extend to the data of the Processor's other customers or to information covered by business secrecy that is unrelated to the processing.

The costs of the audit are borne by the Customer, including the time spent by the Processor, invoiced at a reasonable cost. The Customer shall communicate the results of the audit to the Processor.

11. Return and erasure of data at the end of processing

Upon closure of the Workspace, which marks the end of the Agreement within the meaning of the Terms of Sale, the Processor shall cease to process personal data on behalf of the Customer, except for the operations necessary for their return and erasure.

At the Customer's request made within thirty (30) days following the closure of its Workspace, the Processor shall make available to it an export of the data of its Workspace in a commonly used electronic format.

The Processor shall erase the Customer's personal data from its active systems within ninety (90) days following the closure of the Workspace. Copies contained in backups are erased at the end of their usual rotation cycle; until then, they remain protected in accordance with this DPA and are no longer used.

These obligations do not apply to data that the Processor is required to retain under Swiss law. Such data are then stored securely for the statutory period and are not subject to any other processing.

12. Liability

Each party is liable for damage caused by the breach of its own obligations under this DPA and under applicable data protection law.

The Customer is liable in particular for the lawfulness of the data it causes to be processed and of the instructions it gives. The Processor is liable in particular for compliance with the Customer's instructions and with the obligations incumbent on it as processor.

The Processor's liability under this DPA is subject to the limitations set out in the Liability section of the Terms of Sale, without prejudice to the mandatory provisions of applicable law.

13. Final provisions

In the event of any conflict between this DPA and the Terms of Sale, this DPA prevails on any matter relating to the protection of personal data processed on behalf of the Customer.

The Processor may amend this DPA to adapt it to developments in applicable law or in the service, in accordance with the procedure set out in the Terms of Sale. No amendment may reduce the level of protection of the Customer's data.

Should any provision of this DPA prove void or unenforceable, the validity of the remaining provisions shall not be affected. The provision concerned shall be replaced by a valid provision whose effect comes as close as possible to that intended.

This DPA is governed by Swiss law. Any dispute relating to its conclusion, interpretation or performance falls within the jurisdiction of the courts at the registered office of Appogée Sàrl, in the Canton of Vaud.

Any question relating to this DPA or to data protection may be sent to the Processor at info@the-training-platform.ch.