Data Processing Agreement (DPA)

1. Parties

2. Subject Matter & Purpose

Syntech Solutions AG processes personal data on behalf of the Customer solely for the purpose of providing the Swizz.ai SaaS service as described in the GTC. This includes:

• Storing and processing User Content (texts, images, code) uploaded by the Customer
• Delivering websites and web applications created by the Customer to end users
• Processing AI prompts and inputs submitted by the Customer
• Providing the Customer with access to platform features, dashboards, and settings
• Sending transactional notifications related to the service

3. Nature, Type & Duration of Processing

4. Obligations of the Processor (Syntech Solutions AG)

Syntech Solutions AG undertakes to:

• Process personal data only on documented instructions from the Customer (as set out in the GTC and this DPA)
• Ensure that authorised personnel are subject to confidentiality obligations
• Implement and maintain the technical and organisational measures (TOMs) set out in clause 6
• Assist the Customer in responding to requests from data subjects exercising their rights under GDPR or DSG
• Assist the Customer with security obligations, breach notifications, data protection impact assessments, and prior consultations where required
• Delete or return all personal data to the Customer at the end of the contract in accordance with clause 9
• Provide all information necessary to demonstrate compliance with this DPA and allow for audits
• Notify the Customer without undue delay if it believes an instruction infringes applicable data protection law

5. Sub-Processors

The Customer grants Syntech Solutions AG general authorisation to engage the following sub-processors. Syntech Solutions AG will inform the Customer of any intended addition or replacement of sub-processors at least 30 days in advance, giving the Customer the opportunity to object.

Full sub-processor list: https://swizz.ai/legal/subprocessors

6. Technical & Organisational Measures (TOMs)

Syntech Solutions AG implements and maintains the following measures to ensure an appropriate level of security:

7. Data Breach Notification

In the event of a personal data breach, Syntech Solutions AG will:

• Notify the affected Customer within 48 hours of becoming aware of a breach that may affect the Customer's data
• Provide the Customer with all information necessary to fulfil the Customer's own notification obligations under Art. 33/34 GDPR or Art. 24 DSG
• Co-operate with the Customer and take reasonable steps to mitigate the effects of the breach

8. International Transfers

Where personal data is transferred to sub-processors located outside Switzerland or the EU/EEA (Vercel, Cloudflare, OpenAI, Stripe), such transfers are carried out on the basis of:

• Standard Contractual Clauses (SCCs) as approved by the European Commission (Module 3: Processor-to-Processor)
• Switzerland-specific equivalents or recognition under the DSG
• Supplementary measures including encryption of data in transit and at rest

9. Return & Deletion of Data after Termination

10. Obligations of the Controller (Customer)

The Customer, as data controller, is responsible for:

• Ensuring a valid legal basis for any personal data submitted to the platform
• Providing data subjects with the required privacy notices about processing carried out through Swizz.ai
• Ensuring that any personal data of third parties (e.g., end users of Customer websites) is collected and processed in compliance with applicable data protection law
• Notifying Syntech Solutions AG immediately of any request from a supervisory authority or data subject relating to personal data processed through the platform

11. Audit Rights

The Customer has the right to conduct audits or inspections to verify Syntech Solutions AG's compliance with this DPA. Audits may be carried out:

• By requesting documentation and evidence (preferred approach)
• By commissioning a qualified independent auditor under a confidentiality obligation, upon 30 days' written notice

Audits may not disrupt the Provider's operations and must be conducted during normal business hours. Costs of audits are borne by the Customer, except where a material non-compliance is identified.

12. Liability

Liability under this DPA is governed by the liability provisions in the GTC. Each party shall be liable for damages arising from its own breach of this DPA or applicable data protection law. Where both parties are found liable for a damages claim from a data subject, liability shall be apportioned according to each party's degree of responsibility.

13. Applicable Law & Jurisdiction

• Applicable Law: Swiss Law; additionally, GDPR Art. 28 where the Customer is established in the EU/EEA
• Jurisdiction: Stansstad (NW), Switzerland (subject to mandatory statutory jurisdiction)

14. Contact for Data Protection Matters