Data Processing Agreement (DPA)
Pursuant to Art. 9 revFADP; for Controllers subject to the GDPR, additionally Art. 28 GDPR · Version 1.3 · Last updated: 31 October 2026
§ 1 Contracting parties
(hereinafter the “Controller”)
Registered office: Blegistrasse 11A, 6340 Baar, Switzerland
Contact: [email protected]
(hereinafter the “Processor” / “Bilanzo”)
§ 2 Subject matter and duration
This agreement governs the rights and obligations relating to the processing of personal data by the Processor in the context of the use of the software Bilanzo. It applies from the conclusion of the contract for the entire duration of use and ends automatically upon termination of the contract.
§ 3 Nature, purpose and scope of the processing
| Characteristic | Description |
|---|---|
| Nature of the processing | Collection, storage, transmission, deletion |
| Purpose | Licence validation, software update check, technical support |
| Data subjects | Users of the Bilanzo application (employees of the Controller) |
| Categories of data | Licence key, pseudonymous device identifier (fingerprint hash), software version, timestamp and three usage counters: number of processed receipts, number of clients, number of bank reconciliations. No e-mail address is transmitted by this route. |
| Storage location | Server in Gossau SG, Switzerland (MediaVault), Cloudflare CDN and Cloudflare R2 (Western Europe); support requests at Atlassian (§ 5) |
| Not processed | Accounting data, receipts, bank details, financial data (remain exclusively local on the Controller’s device, except in booked cloud operation under § 3a) |
§ 3a Booked cloud operation
If the Controller temporarily books a MediaVault instance via mediavault.ch, the following also applies:
| Characteristic | Description |
|---|---|
| Nature of the processing | Storage and processing on a rented graphics card (GPU) |
| Purpose | Operating Bilanzo instead of the Controller’s device, as a stopgap or backup |
| Data subjects | Employees, customers, suppliers and other business partners of the Controller |
| Categories of data | All data the Controller processes in this operation, in particular receipts, accounting and bank data |
| Storage location | Data centres in the countries listed in § 5 for the sub-processor Vast.ai |
| Applicable law | revFADP and GDPR |
| Duration | Until the job is completed or the booking ends; the instance is then destroyed at the provider |
§ 4 Obligations of the Processor
4.1 Processing on instructions
The Processor processes personal data exclusively on the documented instructions of the Controller. If the Processor is of the opinion that an instruction infringes applicable data protection law, it informs the Controller without delay.
4.2 Confidentiality
The Processor ensures that all persons authorised to process the data are bound by an appropriate duty of confidentiality.
4.3 Technical and organisational measures (TOMs)
- Encryption: TLS 1.2+ for all data transmissions; database encryption at rest
- Access control: role-based access, MFA for all systems containing personal data
- Pseudonymisation: installation IDs are technical identifiers without direct reference to a person
- Availability: daily backups, automatic failover configuration
- Resilience: Cloudflare protection (DDoS, WAF), regular security audits
- Verifiability: audit logs for all data access
4.4 Support of the Controller
The Processor supports the Controller in fulfilling its obligations under Art. 8 (data security), Art. 22 and 23 (data protection impact assessment, consultation of the FDPIC) and Art. 24 revFADP (notification of data security breaches), for Controllers subject to the GDPR additionally under Art. 32 to 36 GDPR, and in responding to data subject requests.
4.5 Deletion and return
Upon completion of the processing, the Processor deletes or returns all personal data, unless a statutory retention obligation exists. Deletion is confirmed in writing on request.
§ 5 Sub-processors
The Processor engages the following sub-processors:
| Provider | Service | Location | Basis |
|---|---|---|---|
| Cloudflare, Inc. | CDN, DDoS protection, DNS, R2 object storage (Western Europe) for software downloads | USA / EU | Cloudflare Data Processing Addendum; Swiss-U.S. Data Privacy Framework or EU standard contractual clauses |
| Atlassian Pty Ltd, Sydney | Jira Service Management support system (tickets from support and support chat) | Atlassian data centres at Amazon Web Services; processing also in Australia and the USA | Atlassian Data Processing Addendum; EU standard contractual clauses with adaptations for Switzerland; Data Privacy Framework for the US entities |
| Vast.ai Inc., Los Angeles, USA | GPU computing for booked cloud operation (§ 3a), via a marketplace of data centre operators | USA (contracting party); data centres in: EU and EEA states, Switzerland, United Kingdom, Canada, Argentina, Israel, New Zealand, Uruguay, Andorra, Guernsey, Isle of Man, Jersey, Faroe Islands, Japan and South Korea | Countries with adequate data protection under Annex 1 to the Data Protection Ordinance; for the USA, Japan and South Korea EU standard contractual clauses according to Vast.ai |
| MediaVault, Gossau SG | Server hosting, databases, backups | Switzerland | no disclosure abroad |
bexio is not a sub-processor of ours. If the bexio integration is active, Bilanzo Local connects directly from the Controller’s device to bexio. We do not stand in between and do not receive these data. The same applies to ePost, Amnis and the queries to authorities.
The complete and continuously updated list of our sub-processors is available in the privacy policy. The table above names those involved in the processing governed here.
Changes to the use of sub-processors are communicated to the Controller in good time. The Controller may raise justified objections in writing.
§ 6 Rights of data subjects
The Processor supports the Controller in handling requests from data subjects (access, rectification, erasure, restriction, data portability, objection). Requests are to be addressed to: [email protected]
§ 7 Notification obligations
The Processor notifies the Controller of data security breaches as soon as possible (Art. 24 para. 3 revFADP; for Controllers subject to the GDPR, without undue delay within the meaning of Art. 33 para. 2 GDPR), but contractually at the latest within 24 hours of becoming aware of them. The notification contains at least: the nature of the breach, the categories and volumes of data concerned, the likely consequences and the measures taken or proposed.
§ 8 Right of audit
The Controller is entitled to verify compliance with this agreement: by obtaining evidence, questionnaires or on-site inspections with reasonable advance notice (at least 14 days). The Processor makes all necessary information available.
§ 9 Liability
Each party is liable for damage it causes through breaches of this agreement. In the external relationship with data subjects, the legal claims under Art. 32 revFADP and the Swiss Code of Obligations apply, and for Controllers subject to the GDPR additionally Art. 82 GDPR. The Processor’s liability is limited to the remuneration agreed in the main contract, unless mandatory law provides otherwise.
§ 10 Final provisions
- Applicable law: Swiss law (revFADP) with subsidiary application of the GDPR for EU customers
- Place of jurisdiction: Baar (ZG), Switzerland
- Precedence: in the event of contradictions between this DPA and the main contract, the DPA takes precedence
- Written form: amendments must be made in writing
§ 11 Signature
By using the Bilanzo software, the Controller accepts this agreement electronically. A signed paper version is issued on request.
Baar, Switzerland
Place, date: _______________
Version 1.3 · 31 October 2026 · Mediaquotes Jones Schibli · [email protected] · This document can be downloaded as a PDF or requested by e-mail as a signed version.
The German version is authoritative.
