Last updated 16 October 2026

Data processing agreement

This agreement governs how Vingrad GmbH processes personal data that customers store in their Managed Apps instances. It applies under Art. 9 of the Swiss Federal Act on Data Protection (FADP) and, where applicable, Art. 28 GDPR, and forms part of the Managed Apps contract for businesses. This is a translation; the German version is authoritative.

1. Parties and subject

The controller is the customer who ordered Managed Apps (“customer”). The processor is Vingrad GmbH, Bachstrasse 11, 8280 Kreuzlingen, UID CHE-334.348.307 (“we”).

The subject is operating the ordered applications as dedicated instances under the Managed Apps terms and conditions. In doing so we have access to the data the customer and its users store in the instances. The term corresponds to the term of the Managed Apps contract.

2. Nature, purpose and data concerned

• Nature of processing: storing, backing up, restoring, transferring and deleting data, and technical access for operation, updates and troubleshooting.
• Purpose: providing and operating the applications for the customer. No processing for our own purposes takes place.
• Categories of data: whatever the customer stores in the application — typically user accounts (name, email address, login data), content such as files, documents, messages, source code and wiki pages, and technical logs of the instance.
• Data subjects: users of the instance (e.g. the customer's employees) and people whose data appears in the content (e.g. the customer's clients and business partners).
• We process sensitive personal data only if the customer itself stores it in an instance. The customer ensures that the agreed measures are sufficient for it.

3. Instructions

We process the data only on documented instructions from the customer. The instructions are set out in this agreement and the terms; the customer gives further instructions in writing or by email. If we believe an instruction infringes data protection law, we inform the customer without delay.

If processing is required by law, we inform the customer beforehand unless the law prohibits this.

4. Place of processing

The instances and their backups are stored on servers in Switzerland. Data is disclosed abroad only through the sub-processors listed in section 7 or on the customer's instruction.

5. Confidentiality

Only people we need for operation and who are bound to confidentiality have access to the data. At present that is Vladimir Vinogradov alone. If anyone joins, we bind them to confidentiality in writing beforehand.

6. Technical and organisational measures

We take measures appropriate to the risk and adapt them to the state of the art without lowering the level of protection:

• Separation: each application runs as a dedicated instance with its own database, separate from other customers.
• Access: administrative access only with personal keys and only for the people under section 5; servers in an isolated network segment behind a firewall.
• Transmission: connections to the instances are encrypted (TLS).
• Availability: regular backups, stored encrypted; restores are tested regularly; monitoring with alerting.
• Integrity: security updates of the operating system and applications are applied promptly.
• Resilience and review: we review the measures at least once a year and after every security incident.

7. Sub-processors

The customer approves the following sub-processors:

• Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg — sending emails the applications send (e.g. invitations, notifications), through the data centre in Zurich (Switzerland).

We currently use no sub-processors for servers and storage. We announce new or changed sub-processors at least 30 days in advance by email; the customer may object for a substantial data protection reason and, if we find no solution, terminate the contract with effect from that date. We bind sub-processors contractually to the same level of protection as in this agreement.

8. Assisting the customer

We help the customer, with the means of the applications and where necessary by our own action, to answer requests from data subjects (access, rectification, erasure, portability). If data subjects contact us directly, we forward the request to the customer.

On request we assist the customer with data protection impact assessments and obligations towards supervisory authorities. Effort beyond the usual is charged as agreed.

9. Data security breaches

If we become aware of a data security breach affecting the customer's data, we report it to the customer without undue delay, at the latest within 48 hours, by email and phone. The report contains, as far as known, the nature of the breach, the data and people affected, likely consequences and measures taken; missing information follows.

10. Return and deletion

After the contract ends we hand the customer its data as a complete export and delete the instance 30 days later. Backups containing this data expire within a further 30 days. Longer retention takes place only where the law requires it; we then block the data for any other use.

11. Evidence and audits

On request we provide the customer with the information it needs to demonstrate compliance with this agreement and answer its questions about it in writing. On-site audits are possible after notice with a reasonable period during business hours, at most once a year unless there is cause; the customer bears the costs.

12. Final provisions

Liability is governed by the Managed Apps terms and conditions. In case of conflict, this agreement takes precedence over the terms as far as the protection of personal data is concerned. Swiss law applies; the place of jurisdiction is Kreuzlingen unless mandatory law provides otherwise.