Data Processing Agreement

General terms for personal data that Torveno processes for Customers as part of the monitoring engagement.

1. Parties and roles

The client is the respective Torveno Customer.

The processor is:

Nicolas Graf / Torveno
Dorfstrasse 45
8494 Bauma
Switzerland

Where Torveno processes personal data exclusively on behalf of the Customer, the Customer acts as controller and Torveno as processor.

The Customer remains responsible for the lawfulness of the underlying data processing and for its instructions.

Where Torveno processes data for its own contractual, billing, security, evidence or legal purposes, such processing is carried out under Torveno’s own responsibility.

2. Subject matter, purpose and duration

The subject matter of processing on behalf is the technical performance of authorised form and email tests as part of the Torveno monitoring service.

The processing serves in particular:

• the execution of the agreed test profile;
• the checking of defined form and email processes;
• the detection of disruptions;
• safe repeat checking;
• status communication;
• recovery notification;
• internal technical documentation and evidence;
• the provision of the intended understandable monitoring information for the Customer.

Internal error details, full-test data and screenshots may be technically processed for these purposes but are not automatically disclosed in the customer portal.

Processing on behalf generally continues for as long as Torveno provides the relevant monitoring services or lawfully continues to process engagement-related data.

3. Types of personal data

Torveno generally uses synthetic and clearly identifiable test data for regular monitoring tests.

Data processed may include in particular:

• business contact and recipient addresses;
• synthetic form test data;
• test IDs;
• technical status, time, connection and error messages;
• Torveno control copies;
• automated confirmation emails from full tests;
• internal screenshots of the tested form process;
• technical log and evidence data.

Normal genuine customer inquiries received by the Customer should not be copied to Torveno.

4. Categories of data subjects

Data subjects may include in particular contact persons and employees of the Customer.

Other natural persons may be affected only where their data is processed unintentionally for technical reasons or as part of an expressly agreed test process.

5. Instructions and purpose limitation

Torveno processes engagement-related personal data only within the scope of the agreed monitoring engagement, the documented configuration and lawful instructions of the Customer, unless a statutory obligation requires different processing.

6. Confidentiality

Persons with access to engagement-related personal data are bound to confidentiality or are subject to an equivalent statutory duty of secrecy.

Access is restricted to the extent required for provision of the service.

7. Data security

Torveno implements technical and organisational safeguards appropriate to the risk.

These include in particular:

• access restrictions;
• protected customer accounts;
• authentication;
• encrypted transmission via HTTPS/TLS;
• logical separation of customer data;
• restrictive permissions for configuration and secret files;
• backups and recovery procedures;
• technical logging and monitoring;
• updates to components relevant to operations.

8. Subprocessors

The Customer grants Torveno general authorisation to use required subprocessors for hosting, server operation, email infrastructure, data backups and comparable technical operational services.

Material new or replacement subprocessors that process engagement-related personal data will be communicated to the Customer in an appropriate manner.

The Customer may object to a change for important data-protection reasons.

Payment service providers such as Stripe are covered by this agreement only to the extent that they actually act as processors for the monitoring data described here.

9. Processing abroad

Engagement-related personal data may in particular be processed in Switzerland and the European Union.

Where data is disclosed or transferred to a country for which additional protective measures are required, Torveno ensures a legally permitted transfer mechanism.

10. Assistance to the Customer

Torveno assists the Customer, to a reasonable and technically feasible extent, with data-protection obligations insofar as they relate to data processed on behalf of the Customer.

11. Data security breaches

If Torveno identifies a data security breach affecting engagement-related personal data, Torveno informs the Customer without undue delay using the information available.

12. Requests from data subjects

If Torveno receives a request from a data subject that clearly concerns data processed by Torveno exclusively on behalf of the Customer, the request will generally be forwarded to the Customer or the further procedure will be coordinated with the Customer.

13. Deletion, return and end of contract

After processing on behalf ends, Torveno deletes or returns engagement-related personal data in accordance with the agreed and statutory requirements unless statutory retention obligations or legitimate security or evidence reasons prevent this.

Technically necessary backup copies may continue to exist until they are routinely overwritten or deleted.

Data that Torveno processes under its own responsibility for contractual, billing, security or legal purposes is governed by the Privacy Policy.

14. Evidence and audit rights

Upon reasonable request, Torveno provides the Customer with information required to assess compliance with this agreement.

Inspections, audits or further evidence must be coordinated in advance and carried out with due regard to confidentiality, information security, operational stability, the rights of other Customers and proportionality.

15. Relationship to other contractual documents

This agreement supplements the confirmed order overview, the GTC and the Service Description.

Individually and expressly agreed provisions remain reserved.

Where provisions relate exclusively to processing of personal data on behalf of the Customer, those provisions take precedence over general contractual provisions.

16. Term and changes

This agreement applies for the duration of those Torveno services under which Torveno processes personal data on behalf of the Customer.

Obligations which by their nature must continue beyond the end of the contract remain in force to the extent required.

Torveno may amend this general version if data processing, subprocessors, technical safeguards or legal requirements change.

Last updated: 27.08.2026