Data Processing Agreement

Terms not defined here have the meaning given in the GDPR and in the Swiss Federal Act on Data Protection (FADP).

The Customer is the Controller for all personal data it uploads to, or collects through, repfarm. It decides which of its own customers are contacted, on what legal basis, and how long data is kept.

repfarm is the Processor for that data and processes it only on the Customer's documented instructions.

Where repfarm processes data for its own purposes (account administration, billing, security, and improving the service in an aggregated form) it acts as an independent controller, and its Privacy Policy applies instead of this DPA.

If this DPA conflicts with the Terms of Service on a data protection question, this DPA prevails.

Subject matter. Provision of the repfarm review and reputation management service.

Nature and purpose of processing. Collecting, storing, organising, transmitting, displaying, analysing and erasing personal data in order to: send review invitations and reminders on the Customer's behalf; operate landing pages that collect reviews, private feedback and testimonials; aggregate reviews from platforms the Customer has connected; generate and publish replies and social content; provide analytics and reporting; and run the automations the Customer configures.

Duration. For as long as the Customer's subscription is in force, plus the return-or-deletion period in section 11.

repfarm is not designed for special categories of data under Art. 9 GDPR or sensitive personal data under Art. 5(c) FADP. Review and feedback text may nevertheless reveal such data, for example when an end-customer describes a medical treatment. The Customer must take that into account when choosing a legal basis, when configuring the service, and when deciding what to publish. Customers in healthcare and similar sectors should assess this before going live.

repfarm processes personal data only on the Customer's documented instructions, including as regards transfers to third countries, unless required to do otherwise by law to which it is subject. In that case repfarm informs the Customer of the legal requirement before processing, unless the law prohibits it.

The Terms of Service, this DPA and the configuration the Customer makes in the platform constitute the Customer's complete initial instructions. Further instructions must be given in writing to info@repfarm.com.

repfarm informs the Customer if, in its opinion, an instruction infringes Data Protection Law. repfarm may refuse to carry out an instruction that is manifestly unlawful.

The Customer:

repfarm undertakes to:

The Customer gives repfarm general written authorisation to engage sub-processors for parts of the processing.

repfarm imposes on every sub-processor, by contract, data protection obligations that are no less protective than those in this DPA, and remains fully liable to the Customer for the performance of each sub-processor's obligations.

repfarm informs the Customer of any intended addition or replacement of a sub-processor at least 30 days in advance, by email to the account's contact address. The Customer may object on reasonable data protection grounds within that period. If the objection cannot be resolved, the Customer may terminate the affected part of the service with effect from the date the change takes place, and receive a refund of fees paid for the unused period.

repfarm engages service providers who process personal data on the Customer's behalf under contract, in the following categories: hosting and content delivery; payment processing; integrations with the review and social platforms the Customer connects; message delivery by email, WhatsApp and SMS; and AI text generation.

A current list of the sub-processors we use is available on request at info@repfarm.com.

Processing takes place in Switzerland and the European Economic Area. Where a service provider processes data outside those regions, the transfer is based on an adequacy decision or on the EU Standard Contractual Clauses together with the Swiss addendum, with additional safeguards where required.

Where a transfer to another country takes place, repfarm ensures an adequate level of protection through one of the following: an adequacy decision of the European Commission and, for transfers originating in Switzerland, recognition by the Swiss Federal Council; the EU Standard Contractual Clauses, in the module appropriate to the transfer, together with the Swiss addendum recognised by the Federal Data Protection and Information Commissioner, and supplementary measures where a transfer impact assessment shows them to be necessary; or another mechanism permitted by Art. 46 GDPR or Art. 16 and 17 FADP.

Where the Standard Contractual Clauses apply, they are incorporated into this DPA by reference. In case of conflict between the Clauses and this DPA, the Clauses prevail.

Taking into account the nature of the processing, repfarm assists the Customer by appropriate technical and organisational measures in fulfilling requests from data subjects to exercise their rights of access, rectification, erasure, restriction, portability and objection.

If a data subject contacts repfarm directly about data processed on the Customer's behalf, repfarm does not respond on the merits. It forwards the request to the Customer without undue delay and tells the data subject that it has done so.

On termination of the Terms of Service, the Customer may export its data through the platform for 30 days.

After that period, repfarm deletes the personal data processed on the Customer's behalf, including existing copies, within 90 days, unless retention is required by Union, Member State or Swiss law. If the Customer asks in writing during the export window, repfarm returns the data instead, in a structured, commonly used, machine-readable format.

Backups are overwritten in the ordinary backup cycle. Data in backups remains subject to this DPA until it is overwritten.

repfarm confirms deletion in writing on request.

repfarm makes available to the Customer the information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates.

In practice this works as follows: the Customer sends a written request; repfarm answers with documentation, security information and, where available, third-party certifications or reports, which will normally satisfy the request. If documentation is not sufficient, an on-site or remote inspection may take place at most once per calendar year, with at least 30 days' notice, during business hours, without disrupting operations, and subject to confidentiality. More frequent audits may take place after a personal data breach or where a supervisory authority requires it.

The Customer bears its own audit costs and the reasonable costs of repfarm's support, unless the audit reveals a material breach of this DPA by repfarm. The auditor may not be a competitor of repfarm.

Liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except where Data Protection Law does not permit them to apply. Nothing in this DPA limits a data subject's rights under Art. 82 GDPR.

This DPA takes effect when the Customer accepts the Terms of Service and remains in force for as long as repfarm processes personal data on the Customer's behalf. Provisions that by their nature should survive (confidentiality, deletion, liability, governing law) survive termination.

This DPA is governed by Swiss law, excluding its conflict-of-law rules. The exclusive place of jurisdiction is Basel-Landschaft, Switzerland, unless mandatory law provides otherwise. Where the Standard Contractual Clauses apply, the governing law and jurisdiction clauses of those Clauses prevail for the matters they cover.

repfarm maintains measures appropriate to the risk, reviewed as the service develops. The measures in place are:

Write to info@repfarm.com with your company name, address and the name of the person authorised to sign. We will return a countersigned copy of this DPA, including the Standard Contractual Clauses where they are needed.