Snapshot 187402
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Agreement
Introduction statutory duty of non-disclosure. The duty of confidentiality / non-disclo-
1 This Agreement sets forth the obligations of the Parties with regard to the sure shall continue to apply after termination of the Contract.
requirements under the Swiss Data Protection Act (DPA) and the EU Gen-
eral Data Protection Regulation (EU GDPR). It shall supplement in this re- 5 Swisscom shall inform the Customer promptly should it become aware of
gard the contractual agreements ("Contract") concluded between any breaches of the protection of the Relevant Data within its area of re-
Swisscom and the Customer. These may be comprised of one or more con- sponsibility or that of one of its sub-contracted processors (data breach).
tracts concluded between the Parties under which Swisscom has the sta- Swisscom shall inform the Customer appropriately in writing (email is suf-
tus of a provider of services to the Customer. ficient) of the nature and extent of the breach and of possible remedial
measures. In such an eventuality, the Parties shall take the necessary
2 The present Agreement shall apply only to the extent that the following steps in order to ensure that the Relevant Data is protected and to reduce
preconditions are met: any potential adverse consequences for both the data subjects and the
Parties, which steps they shall discuss promptly with each other.
a) The Customer is either a controller or a contracted processor falling
within the scope of the DPA and/or the EU GDPR and
6 Swisscom shall designate a contact person for the Customer concerning
data protection issues arising in relation to the Contract and, where re-
b) the Customer avails itself of Swisscom under the Contract as a con- quired pursuant to Article 37 EU GDPR, a data protection officer.
tracted processor or sub-contracted processor for processing per-
sonal data that falls within the scope of the DPA and/or the EU GDPR 7 Swisscom undertakes to support the Customer upon request as far as it is
("Relevant Data"). able, for a separate fee agreed in advance, to fulfil the rights of the data
subjects in relation to the Customer in accordance with Chapter 4 of the
1 Object, duration and nature of data processing DPA or Chapter III of the EU GDPR. In addition, Swisscom may offer fur-
ther support to the Customer in return for separate remuneration, e.g. in
The object, duration and nature and purpose of the processing shall be connection with a data protection impact assessment, supervisory author-
stated in the Contract. The categories of the Relevant Data processed, ity consultation or reports etc.
the categories of data subjects and the technical and organisational
measures ("TOM") that must be adopted shall be stipulated either in the 8 Relevant Data shall be surrendered or deleted upon termination of the
Contract or in an annex or annexes to this Agreement.
Contract in accordance with the contractual terms. Swisscom shall use
standard procedures in the IT sector for deleting Relevant Data.
2 Scope and responsibility
1 Swisscom shall process the Relevant Data exclusively for the purposes of 4 Duties and responsibilities of the Customer
the performance of the Contract or for the purposes set forth in the Con- 1 The Customer shall independently take reasonable technical and organisa-
tract. The Customer shall bear responsibility for the conduct of lawful
tional steps to protect the Relevant Data within its area of responsibility
data processing as such, including the lawful status of contracted (sub-
(e.g. in its own systems, buildings, applications/environments for which it
contracted) processing.
is operationally responsible).
2 The instructions of the Customer shall be documented in this Agreement 2 The Customer shall inform Swisscom promptly if it finds any breaches of
and the Contract. The Customer shall be entitled at any time to issue fur-
data protection provisions in the service provided by Swisscom.
ther written instructions to Swisscom concerning the processing of the
Relevant Data. Swisscom shall comply with these instructions, provided
that they are feasible and objectively reasonable for Swisscom having re-
3 The Customer shall designate a contact person for Swisscom concerning
gard to the services agreed to under contract. If such instructions result in data protection issues arising in relation to the Contract and, where re-
Swisscom incurring additional costs or lead to a change in the scope of quired pursuant to Article 37 EU GDPR, a data protection officer
services, the contractually agreed contract change procedure shall apply.
5 Queries by data subjects
3 Swisscom shall inform the Customer promptly if it is of the view that an In the event that a data subject contacts Swisscom directly with requests
instruction contravenes the DPA or the EU GDPR. Swisscom may in this for rectification, deletion, information or other claims relating to Rele-
case defer implementing the instruction until it has been confirmed or vant Data, Swisscom shall refer the data subject to the Customer where it
amended by the Customer. The above shall not apply to instructions by is possible to associate the data subject with the Customer according to
the Customer in connection with the granting of access rights or the sur- the information provided by him/her. The support provided to the Cus-
render of Relevant Data to the Customer itself, and Swisscom may at all tomer by Swisscom for queries from data subjects shall be governed by
times assume that these instructions are legally compliant. It is, however, section 3.
entitled to request the Customer to provide corresponding written confir-
mations. 6 Forms of evidence, reports and audits
1 Swisscom must provide the Customer upon request with information to
3 Duties of Swisscom document compliance with the duties set forth in this Agreement.
1 Swisscom shall process the Relevant Data exclusively in accordance with
the provisions set forth in the Contract and this Agreement. The fulfil- 2 The Parties agree that compliance with this obligation shall be evidenced
ment of Swisscom's statutory, regulatory or administrative obligations re- in principle by the fact that Swisscom has ISO 27001 certification or by
mains reserved. Swisscom providing the Customer, in respect of certain areas, with ISAE
3402 or ISAE 3000 reports or similar audit reports prepared by an inde-
2 Swisscom shall take the technical and organisational measures specified in pendent third party or confirmations concerning certifications etc. that
the Contract and the Annexes to this Agreement to protect the Relevant are specially referred to in the Contract. The above shall not exclude any
Data. Swisscom shall be entitled to adapt the agreed TOM at any time audit rights specified in the Contract and any audit rights of the Customer
provided the agreed level of protection is maintained. Swisscom shall also or its supervisory authorities which are mandated by law. The principle of
review the agreed TOM with reference to the current state of the art on proportionality shall be adhered to in all cases in such audits and reasona-
an ongoing basis and shall, where appropriate, propose to the Customer ble account must be taken of the legitimate interests of Swisscom
that additional measures be implemented, which may be agreed upon by (namely to confidentiality). Unless otherwise provided, the Customer shall
way of a contractual addendum. be responsible for all costs of such audits (including proven internal costs
incurred by Swisscom in cooperating in the audit).
3 Swisscom undertakes in relation to the Relevant Data to keep a record of
processing activities in accordance with Article 12(1) DPA and Article 3 In the event that any breaches of this Agreement or deficient compliance
30(2) EU GDPR. Swisscom shall allow the Customer to view such parts of by Swisscom with its duties are ascertained following the presentation of
this record that concern the provision of services to him/her by Swisscom evidence or reports or in relation to an audit, Swisscom shall take appro-
at any time upon request. priate corrective action promptly and at no charge.
4 Swisscom shall ensure that the employees charged with processing the 7 Involvement of sub-contracted processors
Relevant Data of the Customer and other employees and other auxiliary 1 Where the Contract contains no broader restrictions on the engagement of
agents of Swisscom are prohibited from processing the Relevant Data for third parties, Swisscom shall be authorised to engage sub-contracted pro-
any purposes other than those set out in the Contract and in any manner cessors but must inform the Customer beforehand if, after this Agreement
that departs from this Agreement. Swisscom shall further ensure that the comes into force, it engages new sub-contracted processors or changes
persons who are authorised to process the Relevant Data have subjected existing sub-contracted processors. If there is good cause under data pro-
themselves to a duty of confidentiality and/or are subject to a reasonable tection law, the Customer may within a period of 30 days file a written
April 2021 1
Data Processing Agreement
objection against the engagement of a new or the change of an existing
contracted processor/sub-contracted processor. If there is good cause un-
der data protection law, and where the Parties cannot agree on an amica-
ble solution, the Customer shall be granted a termination right in relation
to the service affected hereby.
2 Swisscom shall reach agreements with its sub-contracted processors as
necessary to ensure that the obligations specified in this Agreement are
complied with.
8 Cross-border disclosure
Any disclosure of Relevant Data by Swisscom to a third country or to an in-
ternational organisation shall only be permitted if Swisscom complies with
the provisions of Articles 16 et seq. DPA or Chapter V EU GDPR. Where, on
the other hand, such a disclosure of Relevant Data is desired by the Cus-
tomer or occurs on his/her behalf, the Customer alone shall be responsi-
ble for compliance with the corresponding provisions.
9 Concluding provisions
1 The article numbers for the DPA refer to the revised version of the DPA
(Federal Gazette 2020 7639 [German language version]). The terms
agreed to herein shall apply mutatis mutandis until its entry into force.
The term of this Agreement shall coincide with the term of all contracts
concluded between Swisscom and the Customer under which Swisscom
processes Relevant Data for the Customer, unless the obligations provided
for under this Agreement extend beyond such periods.
2 By way of derogation from any written form requirements in the Contract,
the present Agreement may also be agreed or amended electronically be-
tween the Parties.
3 The obligations under this Agreement shall apply by way of supplement-
ing, rather than limiting, the obligations stipulated in the Contract. In re-
lation to the TOM stipulated generically in an Annex to this Agreement,
the provisions of the Contract shall prevail in the event of inconsistency.
The Contract provisions shall continue to apply unchanged in all other re-
spects.
April 2021 2