Data Processing Agreement (DPA)

This English translation is provided for convenience. Only the German version is legally binding.

Preamble

This Data Processing Agreement (hereinafter "DPA") governs the data protection obligations between TW Projects GmbH and its clients for all engagements in which TW Projects GmbH processes personal data on behalf of the client.

The DPA applies to all operating business areas of TW Projects GmbH, in particular:

• TW Services (brand): creation and operation of marketing landing pages, performance marketing campaigns, production of promotional films and visualisations for B2B clients in the DACH region.
• TW Projects (AI and software consulting): advice, design, development and operation of custom AI and software solutions for business clients, including hosting such solutions on the infrastructure of TW Projects GmbH.

This DPA becomes part of every engagement between TW Projects GmbH and a client where this is expressly agreed in the relevant quotation, order confirmation or framework agreement (together: "Main Agreement"), or where the client otherwise accepts the DPA in writing or electronically.

Parties

Processor:

Controller: The natural or legal person named in the relevant Main Agreement who instructs TW Projects GmbH to provide the services described there.

— together "Parties", individually "Party" —

1. Definitions

The terms used in this agreement correspond to the definitions in the FADP and the GDPR:

• "Personal data" means all information relating to an identified or identifiable natural person.
• "Controller" means the Party that decides on the purposes and means of the data processing.
• "Processor" means the Party that processes personal data on behalf of the Controller.
• "Sub-processor" means a third party engaged by the Processor that processes personal data on behalf of the Controller.

2. Subject matter, nature and purpose of the processing

2.1 Subject matter

The Processor provides the Controller with the services defined in the relevant Main Agreement. Depending on the business area, these include in particular:

TW Services engagements:

• Creation and technical operation of marketing landing pages
• Creation and placement of online advertising campaigns (Meta Ads, Google Ads, LinkedIn Ads)
• Production of promotional films and visualisations
• Forwarding of lead enquiries to the Controller

TW Projects consulting and software engagements:

• Advice on AI and software strategy
• Design and development of custom software and AI solutions
• Implementation and operation of such solutions on the Processor's infrastructure
• Integration with the Controller's third-party systems
• Training and support

2.2 Nature and purpose

The processing takes place for the purpose of performing the services agreed in the Main Agreement. Specific processing activities include hosting, processing, transmitting, displaying and forwarding the categories of data listed below.

2.3 Type of personal data

Within the scope of the processing, the following categories of personal data may be processed, depending on the engagement:

• Master data of the Controller's end customers, prospects, employees or business partners (name, email, phone, address, role)
• Communication content (free text from forms, chats, messages)
• Contract and transaction data
• Business documents that the Controller hands to the Processor for processing
• Technical data (IP address, user agent, log files) in connection with the operation of websites or systems
• For performance marketing: pseudonymous IDs (cookie IDs, advertising IDs)

Where the Controller gives the Processor access to sensitive personal data (Art. 5 lit. c FADP) or special categories of data (Art. 9 GDPR), this must be expressly agreed in the relevant Main Agreement, and the Processor will take enhanced security precautions.

2.4 Categories of data subjects

Depending on the engagement:

• End customers, prospects or potential buyers/tenants of the Controller
• Employees or business partners of the Controller
• Visitors to the websites or systems provided

2.5 Duration of the processing

The processing takes place for the duration of the relevant Main Agreement. After its termination, the provisions on deletion and return under section 10 apply.

3. Obligations of the Processor

The Processor undertakes:

a) to process personal data only on the Controller's documented instructions, unless required to process otherwise by the law of Switzerland, the EU or an EU Member State;

b) to ensure that the persons authorised to process the personal data have committed themselves to confidentiality or are subject to an appropriate statutory duty of confidentiality;

c) to implement the technical and organisational measures (TOMs) documented in section 5 of this agreement and in Annex 1 and to maintain them throughout the term of the agreement;

d) to engage Sub-processors only under the conditions of section 6;

e) to assist the Controller in meeting its obligations towards data subjects (section 7);

f) to report personal data breaches without undue delay in accordance with section 8;

g) to assist the Controller in complying with its obligations under Art. 24 FADP / Art. 32–36 GDPR;

h) at the Controller's choice, to delete or return all personal data after the end of the contractual relationship (section 10);

i) to make available to the Controller all information necessary to demonstrate compliance with this agreement and to allow for reviews (section 9);

j) to inform the Controller without undue delay if, in the Processor's opinion, an instruction infringes applicable data protection law.

4. Obligations of the Controller

The Controller remains solely responsible for the lawfulness of the data processing. In particular, it ensures:

a) that there is a sufficient legal basis for the processing (e.g. consent, pre-contractual measures, legitimate interest, legal obligation);

b) that data subjects have been informed about the processing in accordance with Art. 19 FADP or Art. 13/14 GDPR, in particular through a suitable privacy policy;

c) that instructions to the Processor are lawful and that the Processor is entitled to carry them out;

d) that requests from data subjects are addressed primarily to the Controller, which answers them independently.

5. Technical and organisational measures (TOMs)

The Processor implements the technical and organisational measures required to ensure a level of protection appropriate to the risk. The specific measures are documented in Annex 1. The Processor may further develop the TOMs during the term of the agreement, provided the level of protection is not reduced.

6. Sub-processors

6.1 General authorisation

The Controller grants the Processor a general authorisation to engage the Sub-processors listed in Annex 2.

6.2 Notification of changes

The Processor informs the Controller at least 30 days in advance of any intended changes concerning the addition or replacement of Sub-processors, for example by updating Annex 2 or by email. The Controller may object to the change on reasoned grounds within this period. In the event of a justified objection, both Parties are entitled to terminate the Main Agreement with 30 days' notice.

6.3 Obligations towards Sub-processors

The Processor contractually binds each Sub-processor to data protection obligations that correspond at least to those of this agreement. Where Sub-processors in third countries are engaged, the Processor ensures that appropriate safeguards (in particular EU Standard Contractual Clauses, the EU-U.S. Data Privacy Framework) are in place.

6.4 Liability

The Processor is liable for the conduct of the Sub-processors it engages as for its own conduct.

7. Assistance to the Controller

The Processor assists the Controller, where possible, through appropriate technical and organisational measures:

a) in responding to requests from data subjects for access, rectification, erasure, restriction, data portability and objection;

b) in complying with the security obligations under Art. 8 FADP / Art. 32 GDPR;

c) in reporting personal data breaches under Art. 24 FADP / Art. 33–34 GDPR;

d) in carrying out a data protection impact assessment under Art. 22 FADP / Art. 35 GDPR.

Requests from data subjects received directly by the Processor are forwarded to the Controller without undue delay.

8. Notification of personal data breaches

The Processor notifies the Controller of any personal data breach without undue delay, and no later than 48 hours after becoming aware of it. The notification contains at least:

• A description of the nature of the breach
• Where possible, the categories and approximate number of data subjects and records concerned
• A description of the likely consequences
• Measures already taken and proposed

The Processor assists the Controller in meeting any notification obligations towards supervisory authorities (FDPIC, EU data protection authorities) and data subjects.

9. Evidence and audits

On request, the Processor makes available to the Controller all information necessary to demonstrate compliance with this agreement. In addition, after prior written notice (at least 30 days) and during normal business hours, the Controller may carry out audits or have them carried out by an independent auditor. The Processor may require reasonable remuneration for excessive or disproportionate audits.

10. Termination and return of data

After the end of the Main Agreement, the Processor deletes all personal data processed under this agreement within 30 days, unless a statutory retention obligation applies. At the Controller's request, the data is instead returned in a structured, commonly used electronic format.

Deletion is confirmed in writing on request. Backup copies are overwritten in the course of the regular backup cycles.

11. Confidentiality

The Processor and all persons acting for it treat the personal data processed under this agreement as strictly confidential. This obligation continues after the end of the agreement.

12. Liability

The Parties' liability is governed by the provisions of the Main Agreement, unless applicable data protection law mandatorily provides otherwise. The Parties indemnify each other against claims by data subjects to the extent that these are based on a breach of duty by the other Party.

13. Term

This agreement enters into force when the Controller accepts the Main Agreement and ends automatically when the Main Agreement ends. The obligations of confidentiality, deletion and information continue beyond the end of the agreement.

14. Final provisions

14.1 Applicable law

Swiss law applies, excluding its conflict-of-laws rules. Where the GDPR applies as a third-country regime, its mandatory provisions take precedence.

14.2 Jurisdiction

The exclusive place of jurisdiction is the registered office of the Processor (Dürnten ZH).

14.3 Precedence

In the event of conflicts between this agreement and the Main Agreement, the provisions of this agreement take precedence in matters of data protection.

14.4 Severability

If individual provisions of this agreement are wholly or partly invalid, the validity of the remaining provisions is unaffected. The invalid provision is to be replaced by a valid one that comes closest to its economic purpose.

14.5 Amendments

TW Projects GmbH reserves the right to amend this DPA to adapt it to changes in the legal situation or to technical changes. Material changes are communicated to the Controller with 30 days' notice. The version published at the time the Main Agreement is concluded applies, unless expressly agreed otherwise.

Annex 1 — Technical and organisational measures (TOMs)

The Processor applies the following technical and organisational measures:

1. Confidentiality

• Physical access control: Business premises are locked outside business hours. No permanent physical storage holding production data on the premises.
• System access control: All administrative access is protected by multi-factor authentication (MFA). Passwords meet current complexity requirements and are managed in a password manager.
• Data access control: Permissions are granted on a need-to-know basis. Row-level security at database level. Access is logged.
• Separation requirement: Data of different Controllers is processed in logically separated form.
• Pseudonymisation: Where sensible and technically possible, data is processed in pseudonymised form.

2. Integrity

• Transmission control: All data transfers are encrypted using TLS 1.2 or higher.
• Input control: Changes to personal data are logged.

3. Availability and resilience

• Availability control: Use of cloud services with guaranteed SLAs (Vercel, Supabase, Google Workspace).
• Recoverability: Daily automated backups with the cloud services used.

4. Procedures for regular review

• Data protection management: The record of processing activities is updated on an ongoing basis.
• Incident response: Documented procedure for handling personal data breaches.
• Order control: Written agreements with all Sub-processors.

5. Specific measures for AI-assisted processing

For engagements that involve AI-assisted processing:

• Use only of AI services that contractually exclude the use of customer data for model training.
• Preferred use of AI services hosted in the EU or Switzerland, where technically feasible.
• For transfers to US-based AI services: only providers with DPF certification and EU Standard Contractual Clauses.

Annex 2 — Sub-processors

As of: 26 May 2026

Acceptance of the DPA: By accepting the quotation, order confirmation or a framework agreement, or by express written or electronic confirmation, the Controller accepts this DPA as a binding part of the contract. Confirmation may also be given in text form by email.