Data Processing Agreement

Last updated 2026-10-29

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between your organisation (“you”) and Help Comptabilité & Immobilier Sàrl, Chemin du vallon 18, 3960 Sierre, Valais, Switzerland, operating PlotDR (“PlotDR”, “we”, “us”). It is accepted together with the Terms when your organisation registers, and it governs every case in which we process personal data on your behalf. Where this DPA and the Terms conflict on a matter of personal data, this DPA prevails.

This DPA follows the structure of the standard contractual clauses the European Commission adopted for controller-to-processor relationships under Article 28(7) of the GDPR (Implementing Decision (EU) 2021/915), adapted to the fixed scope of a single service.

1. Roles and scope

You are the controller of the personal data that you and your users submit to PlotDR for screening: supplier records, plot geometries, the checks run on them and the reports generated from them (together, “Customer Data”). We process Customer Data only as your processor, under this DPA, and never for purposes of our own.

We are the controller of the data we need in order to run your account: organisation and user account details, billing data and security logs. That processing is described in our Privacy Policy and is outside the scope of this DPA.

Where your organisation is subject to the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the references to GDPR articles below apply directly. Where it is subject to the Swiss Federal Act on Data Protection (“FADP”), those references are read as references to the corresponding FADP provisions, in particular Article 9 FADP on processing by processors. The obligations we take on are the same in both cases.

2. Details of the processing

3. Your obligations as controller

You are responsible for the lawfulness of the Customer Data you submit and of the instructions you give us. In particular you warrant that:

• you have a lawful basis to collect the Customer Data and to have it screened by us, and the right to submit it (see also section 4 of the Terms);
• you have given the data subjects concerned the information Articles 13 and 14 GDPR require, and in particular that your suppliers know their plot locations are checked against satellite data;
• your instructions comply with data-protection law;
• you do not submit special categories of personal data;
• you send us Customer Data outside the service, for example in a support message, only where it is needed to resolve your request, and refer to records by their identifiers where you can;
• the email addresses of your organisation administrators are kept current, since every notice under this DPA is sent to them; and
• accounts and API keys are used only within your organisation, as section 4 of the Terms requires.

4. Our obligations as processor

4.1 Instructions. We process Customer Data only on your documented instructions. The Terms, this DPA and the use your users and API clients make of the service’s features are your instructions. You may give further written instructions to the contact in section 12, provided they are compatible with the service. If we consider that an instruction infringes the GDPR, the FADP or other applicable data-protection law, we will tell you immediately and may suspend the processing concerned until you change or withdraw it. We may process Customer Data otherwise only where Swiss law, EU law or the law of an EU Member State to which we are subject requires it; in that case we will tell you of that legal requirement before processing, unless that law prohibits this on important grounds of public interest.

4.2 Purpose limitation. We process Customer Data only for the purpose in section 2. We do not sell it, share it with third parties other than the sub-processors in Annex 2, or use it for our own purposes. Support messages that contain Customer Data are treated as Customer Data under this DPA and are kept in our email system only for as long as needed to resolve the request.

4.3 Confidentiality. Access to Customer Data is limited to the persons who need it to operate the service, and every such person is bound by a duty of confidentiality that survives the end of their engagement.

4.4 Security. We implement and maintain the technical and organisational measures described in Annex 1, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing and the risks to data subjects (Article 32 GDPR). We may update Annex 1 as the service evolves, but no update may reduce the overall level of security it describes.

4.5 Documentation and compliance. We keep the records Article 30(2) GDPR requires of a processor and make available to you, on request, the information you reasonably need to demonstrate compliance with your own obligations under Article 28 GDPR. Section 7 describes how.

4.6 Notice of inability to comply. If we become unable to comply with this DPA, for whatever reason, we will tell you promptly. You may then suspend the affected processing or terminate under section 11 of the Terms.

4.7 Error reports. To keep the service working, the dashboard and the service send technical reports of unexpected errors to an error tracker we host on the Infomaniak infrastructure in Switzerland described in section 6 and Annex 1. Reports are designed to exclude Customer Data, but an error message or an identifier in a report can occasionally contain or refer to it, for example a record ID or plot coordinates. We process any such Customer Data only to find and fix the error, as part of operating the service for you, and every report is deleted automatically about 30 days after it is received, which is why reports are not erased individually under section 7.1 or section 9.

4.8 Application logs. The API and background services write technical logs on the Infomaniak servers described in section 6. A log line records what happened, when, and the identifiers of the records concerned (organisation, user, check, plot, batch or report), and an error text can occasionally quote a record’s content, for example plot coordinates. The API’s request logs also record the time, the requested address including any query string, and the IP address of the requesting client. We process any such Customer Data only to operate, secure and troubleshoot the service for you. Logs are not erased individually under section 7.1 or section 9: they are held only up to a fixed size per server and deleted entirely when the service is updated, typically within days to a few weeks. Error-level lines, and the lines leading up to them, that reach the error tracker in section 4.7 follow its 30-day period.

5. Sub-processors

5.1 General authorisation. You authorise us to engage the sub-processors listed in Annex 2 for the processing described there. The list is complete: no other third party processes Customer Data on our behalf.

5.2 Changes. Before a new sub-processor processes any Customer Data, or an existing one takes on a new role or changes the country in which it processes Customer Data, we will email your organisation administrators at least 30 days in advance, naming the sub-processor, its role and the country in which it processes the data. You may object in writing within that period on reasonable data-protection grounds. If we cannot accommodate the objection, you may terminate by deleting your organisation under section 11 of the Terms before the change takes effect, and we will refund pro rata any prepaid subscription period not yet used. If you choose “delete everything now” under section 11 of the Terms before the change takes effect, the new sub-processor never processes your Customer Data.

5.3 Same obligations. We engage each sub-processor under a written contract that imposes, in substance, the same data-protection obligations as this DPA imposes on us (Article 28(4) GDPR), and we remain fully responsible to you for the sub-processor’s performance.

5.4 Who is not a sub-processor. Stripe processes billing data for which we, not you, are the controller; it never receives Customer Data and is described in the Privacy Policy. The publishers of the satellite datasets we screen against are not sub-processors either: we hold copies of their datasets on our own infrastructure and send them nothing.

6. International transfers

Customer Data is stored and processed in Switzerland, on infrastructure operated by Infomaniak. We do not process or transfer Customer Data outside Switzerland, and no sub-processor located elsewhere is authorised to process it.

Switzerland holds an adequacy decision of the European Commission (Article 45 GDPR), so Customer Data may move between your EU establishment and us without additional safeguards.

Screening runs entirely on our own infrastructure, against copies of the satellite datasets we hold there. No plot geometry, supplier record or screening result is sent to the dataset publishers or to any other third party.

Should we ever need to process Customer Data outside Switzerland, we will treat it as a sub-processor change under section 5.2 and, for a destination outside the European Economic Area, rely on a transfer mechanism recognised under Chapter V GDPR and the FADP and tell you which one.

7. Assistance, data-subject requests and audits

7.1 Data-subject requests. Taking into account the nature of the processing, we assist you in meeting your obligations towards data subjects under Articles 12 to 23 GDPR. Your organisation administrators can, at any time and without our involvement, view, correct and archive any supplier or plot record, and retrieve Customer Data through the dashboard, the API and generated reports. On your request through the contact in section 12, we erase a specific supplier or plot record together with its checks and single-check reports ahead of its retention period, and likewise any check that is not attached to a plot, within ten business days. A record erased this way, or deleted with your organisation, stays in our encrypted backups until they roll off (section 9) and is erased again if a backup is ever restored. If a data subject contacts us directly about Customer Data, we will not respond on the substance except to refer them to you, and we will forward the request to your organisation administrators within five business days.

7.2 Impact assessments and security. We assist you, with the information available to us, in meeting your obligations under Articles 32 to 36 GDPR: security of processing, breach notification to the supervisory authority and to data subjects, data protection impact assessments and prior consultation. The documentation in Annex 1 and the information in this DPA are our standard contribution and are provided at no charge. Where you need assistance that goes materially beyond them, we may charge reasonable costs agreed with you in advance.

7.3 Audits. On request, we provide the information reasonably necessary to demonstrate compliance with this DPA: this DPA and its annexes, the current sub-processor list, our relevant internal policies, and the security attestations our sub-processors make available to their customers. We answer a written audit questionnaire within 30 days. You may exercise this right at most once in any 12-month period, and additionally after a personal data breach affecting your Customer Data or when a supervisory authority requires it.

Where that documentation is demonstrably insufficient, or in the two additional cases just mentioned, you or an independent auditor you appoint may inspect our processing of Customer Data, including remotely, subject to: at least 30 days’ written notice; a scope agreed in advance and limited to Customer Data; ordinary business hours; a duty of confidentiality on everyone involved; the auditor not being a competitor of ours; and your bearing the costs. We will remediate any reasonable finding within a reasonable time and tell you when it is done.

7.4 Supervisory authorities. We cooperate, on request, with the supervisory authority competent for you, and we make this DPA available to it on request.

8. Personal data breach

If we become aware of a personal data breach affecting Customer Data, we will notify your organisation administrators by email without undue delay and in any event within 48 hours of becoming aware of it, so that you can meet your own 72-hour deadline under Article 33 GDPR. The notice contains, as far as we know it at the time, the information Article 33(3) GDPR requires: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures we have taken or propose to take, and a point of contact. Where not everything is known at once, we provide the information in phases without undue further delay.

We assist you with your notifications to the supervisory authority and to data subjects (Articles 33 and 34 GDPR). We do not notify your data subjects or your supervisory authority on your behalf unless the law requires it or you ask us to. We document every breach, its effects and the remedial action taken, and make that documentation available to you on request.

9. Deletion and return of Customer Data

During the term, you can retrieve Customer Data at any time through the dashboard and the API, and export screening results as PDF, JSON and CSV reports. You can also archive individual supplier and plot records at any time; archiving a supplier archives its plots with it. The retention periods below run during the term as well as after it: each check is kept for six years from the screening it records and is then purged in our periodic retention review, even while your organisation is active. You can ask us under section 7.1 to erase specific records, with their checks and single-check reports, ahead of their retention period.

Retention periods. We keep Customer Data to support the record-keeping the EUDR requires of you (Art. 9(1) EUDR): each check for six years from the screening it records, which allows up to one year between screening and placing on the market or export, and each archived supplier and plot record for five years from its archiving, or longer while a check on it is still kept. Every record is therefore kept for at least five years from its screening or archiving. Reports go with the checks they cover: a report generated for a single check is purged with that check, and a report generated for a batch of checks keeps its content until every check it covers has been purged, or until it is deleted with the organisation. We purge each record in the first periodic retention review after its retention period ends, and we run that review at least every six months; it is not an automatic deletion the instant a retention period elapses. If a product is placed on the market or exported later, or you need a record for longer, export it before its retention period ends: you remain responsible for keeping the records the EUDR requires of you.

At the end of the term, section 11 of the Terms gives you the choice, at the moment you delete your organisation, between archiving Customer Data and deleting it immediately:

• Archive. Customer Data becomes inaccessible to your users and is kept for the retention periods above. It is available to you on request during those periods, and is then purged in our periodic retention review.
• Delete everything now. Supplier, plot and check records and generated report files are erased immediately.

After deletion we keep no copy of Customer Data, apart from the encrypted backups described below, transient processing caches that expire within 24 hours, error reports that expire within about 30 days (section 4.7), and application logs that are deleted by rotation and when the service is redeployed (section 4.8), and except where a legal obligation requires us to retain a specific record, in which case it stays confidential, is used for no other purpose and is deleted when the obligation ends. We confirm deletion in writing on request.

Backups. Every night we take an encrypted backup of the service’s databases, for disaster recovery only. It holds Customer Data (supplier, plot, check and report records) as it stood when the backup was taken, together with the account data our Privacy Policy describes, and is stored on Infomaniak infrastructure in Switzerland, in a storage project separate from the one that runs the service. We keep the newest backup of each of the last 30 days and the earliest of each of the last 12 months, so Customer Data that is deleted or erased stays in the backups for up to about 12 months after the deletion, for as long as the service runs. Backups are not erased individually and are used only to restore the service after a failure, data loss or operating error, and to test, automatically and regularly, that they can be restored. When a backup is restored, we first re-apply the deletions and erasures recorded in our erasure log since it was taken, which is copied off the server every few minutes, so that Customer Data deleted or erased does not return to the live service. Where a restore undoes a mistake by our own staff or tools, the deletions that mistake caused are not re-applied. Generated report files are not backed up: they are produced again from the restored records. If we end the service, we delete all backups, except a specific record that a legal obligation requires us to keep, which is then handled as described above.

10. Liability

To the maximum extent permitted by applicable law, each party’s total liability to the other arising out of or relating to this DPA, whether in contract, tort or otherwise, is limited to the greater of (a) the fees you paid us for the service in the twelve months preceding the event giving rise to the claim and (b) CHF 1,000. This limit is separate from the limit in section 7 of the Terms, which continues to apply to claims that do not arise under this DPA. Neither party is liable to the other for indirect, incidental, consequential or punitive damages, including lost profits.

The limit does not apply to liability for intent or gross negligence, or to any other liability that cannot be limited under Swiss law. Each party bears the administrative fines a supervisory authority imposes on it for its own breach of data-protection law, and neither party indemnifies the other for such fines.

Nothing in this DPA limits the rights of data subjects, including their right to compensation under Article 82 GDPR and the FADP, or alters the allocation of responsibility between controller and processor towards data subjects under Article 82(2) to (4) GDPR. Claims between you and us under Article 82(5) GDPR are subject to the limit in this section.

11. Term, changes and governing law

This DPA takes effect when your organisation accepts the Terms and remains in force for as long as we process Customer Data on your behalf, including the retention periods in section 9. Sections 4.3, 9, 10 and this section survive its end.

We may change this DPA as section 12 of the Terms provides. A change that adds a sub-processor, moves processing to another country or reduces the measures in Annex 1 is always material, and we notify your organisation administrators by email before it takes effect. The revision date at the top of this page states which version is current.

This DPA is governed by the laws of Switzerland, and the courts of the Canton of Valais, Switzerland, have exclusive jurisdiction over disputes between you and us arising from it, as section 14 of the Terms provides. This does not affect mandatory data-protection law, the powers of supervisory authorities, or the right of data subjects to bring proceedings where the GDPR or the FADP allows them to. This DPA is concluded in English.

12. Contact

Data protection inquiries and instructions under this DPA: contact@plotdr.ch, or by post to Help Comptabilité & Immobilier Sàrl, Chemin du vallon 18, 3960 Sierre, Valais, Switzerland.

Annex 1: Technical and organisational measures

The measures below apply to the production service and are reviewed whenever it changes materially.

Hosting and location. Customer Data is stored and processed only on infrastructure operated by Infomaniak in data centres in Switzerland. We hold no copy of Customer Data outside that infrastructure.

Backups and recovery. The databases are backed up every night, encrypted before they leave the server, so that the keys needed to decrypt them are never stored on the servers that run the service, to a separate storage project at Infomaniak in Switzerland. Backups are kept as section 9 describes, an automated restore check of a recent backup runs every week, and a failed backup raises an alert to the persons who operate the service.

Encryption in transit. Every connection to the dashboard, the API and our object storage uses TLS. The API sends HTTP Strict Transport Security headers, so browsers refuse to fall back to unencrypted connections.

Authentication. Passwords must be at least 12 characters long and are stored only as Argon2id hashes. New accounts must verify their email address before they can sign in. Dashboard sessions use an HTTP-only, Secure, SameSite cookie that expires 14 days after issuance or immediately on sign-out. Session tokens and API keys are stored only as cryptographic hashes; an API key is shown once, at creation, and can be revoked at any time by an organisation administrator.

Tenant isolation. Every supplier, plot, check and report belongs to exactly one organisation, and every request a user or API client makes can read or change only its own organisation’s Customer Data. Automated tests guard this boundary on every change.

Roles and least privilege. Organisations have administrators and members. Only administrators can invite users, manage API keys, change billing, purge records or delete the organisation, and those actions require a signed-in human session: an API key can never perform them.

Staff access. Staff access through the application is limited to named staff accounts, requires a signed-in session, is restricted to account administration, and every change a staff account makes is written to an audit log. Direct access to the production infrastructure is limited to the persons who operate it and is used only for operations and maintenance.

Abuse controls. Sign-up and sign-in are rate-limited, and screening and report requests are rate-limited per organisation and plan.

Data minimisation and confinement. Screening runs against copies of the satellite datasets held on our own infrastructure; no Customer Data is sent to the dataset publishers or any other third party. Generated report files are downloadable only through time-limited signed links. The dashboard and website load no third-party scripts, fonts or analytics.

Deletion. Administrators can archive supplier and plot records, and on request we erase a record with its checks ahead of its retention period (section 7.1). Erasing a check deletes its single-check report file from object storage; a batch report file is deleted once every check it covers has been erased. Deleting an organisation revokes every session and API key at once and applies the retention choice in section 9. Backups roll off as section 9 describes and are not erased individually; a restore first re-applies every erasure made since the backup was taken. Records that reach the end of their retention period are purged in a periodic retention review. Error reports expire after about 30 days (section 4.7) and are not erased individually. Application logs are deleted by rotation and when the service is redeployed (section 4.8) and are not erased individually.

Change management. Every change to the service goes through code review and an automated test suite before deployment.

Organisational measures. Access to production systems is granted on a need-to-know basis and withdrawn when no longer needed. Everyone with such access is bound by confidentiality. Personal data breaches are handled as section 8 describes and are documented.

Annex 2: Sub-processors

No other third party processes Customer Data on our behalf. Changes to this list follow section 5.2.