Data Processing Agreement (DPA)

Last updated: October 29, 2026

This Data Processing Agreement ("DPA") is concluded between the Customer (the "Controller") and ark.swiss sàrl ("ark.swiss sàrl"). It forms an inseparable annex to the Terms of Service (the "Terms") and applies as from their acceptance. It is drafted in accordance with Article 28 of the General Data Protection Regulation (GDPR) and Article 9 of the revised Swiss Federal Act on Data Protection (FADP).

1. Parties

• Controller: the Customer identified upon subscription to the ark.stock Service.
• Processor: ark.swiss sàrl, CHE-139.880.181, Chemin de la Duchesne 13, 1806 St-Légier, canton de Vaud, Suisse.

2. Subject matter and scope

This DPA governs the processing, by ark.swiss sàrl, of personal data on behalf of the Controller in the context of operating the ark.stock modular inventory-management platform. It applies to all personal data contained in the Controller's Instance, excluding data that ark.swiss sàrl processes for its own purposes (administrative account, billing, Service security).

3. Processing details

3.1 Nature and purpose

ark.swiss sàrl processes data for the sole purpose of hosting and operating the Instance made available to the Controller, in accordance with the Terms and the Controller's documented instructions.

3.2 Categories of data subjects

• Employees and users of the Controller
• Customers, principals and contacts of the Controller (third-party data)
• Suppliers and partners of the Controller
• Prospects entered into the Instance

3.3 Categories of data

• Identity data (first name, last name, email, phone, address)
• Customer inventory and management content (items, containers, projects, customers, related documents)
• Project data transmitted to ark.plan for invoicing purposes, at the Controller's request
• Notes, attachments and interaction history entered by the Controller
• Technical identifiers (access logs, session IDs)

In the initial version of the Service, ark.swiss sàrl does not process, on behalf of the Controller, any sensitive data within the meaning of Art. 5 lit. c FADP or Art. 9 GDPR. Should the Controller introduce any, it undertakes to inform ark.swiss sàrl beforehand.

3.4 Duration of processing

The processing applies for the entire duration of the Service contract, as well as for the 30-day post-termination retention period provided for in clause 11 below, and beyond for statutory retention periods (in particular invoices issued by ark.swiss sàrl, Art. 958f CO).

4. Controller obligations

• Ensure the lawfulness of processing and have an adequate legal basis within the meaning of Art. 31 FADP and Art. 6 GDPR.
• Inform its own data subjects in accordance with Art. 19 FADP and Art. 13 GDPR.
• Respect data subject rights as the primary point of contact (access, rectification, erasure, portability, objection).
• Provide written instructions to ark.swiss sàrl where necessary, and ensure their lawfulness.
• Properly configure its users' access rights within the Instance.

5. Processor obligations (Art. 28 GDPR, Art. 9 FADP)

• Lawfulness of instructions: process data only on documented instructions from the Controller, unless otherwise required by mandatory law (in which case ark.swiss sàrl informs the Controller, unless the law prohibits it).
• Confidentiality: ensure that authorised personnel are bound by a contractual and, where applicable, statutory confidentiality obligation.
• Security: implement the technical and organisational measures described in clause 6 below.
• Sub-processing: use only the subprocessors authorised in clause 7; notify any change with a notice period allowing the Controller to object.
• Assistance: assist the Controller in fulfilling its obligations — responding to data subject requests, carrying out data protection impact assessments (DPIAs), prior consultations with the authority — to a reasonable and proportionate extent.
• Breach notification: inform the Controller as soon as possible after becoming aware of a breach (clause 8 below).
• Deletion or return: at the end of the contract, upon the Controller's instructions, return or delete the data (clause 11 below).
• Documentation: make available to the Controller all information necessary to demonstrate compliance with the obligations of this DPA.

6. Technical and organisational measures (TOMs)

The measures in place are listed below; the Security page gives a summary:

• Encryption in transit: TLS 1.2 minimum, TLS 1.3 available, HSTS, Let's Encrypt certificates auto-renewed.
• Encryption at rest: AES-256-GCM for credentials, OAuth tokens and secrets.
• Authentication: password hashing with bcrypt; two-factor authentication available for Instance accounts; server access by SSH key only.
• Per-customer isolation: a PostgreSQL database, database role and file storage of its own for each customer. On the Starter platform, the application (server, interface and cache) is shared by all customers; it identifies the customer by the address of its workspace, and the encryption keys at rest are those of the platform. Enterprise Instances run in dedicated containers.
• Backups: daily database export and continuous replication to Geneva; encrypted Borg archives in Switzerland, rotated as 14 daily, 8 weekly and 24 monthly backups; each full cycle checks archive integrity and restores a sentinel file.
• Access control: roles and permissions configurable in the Instance; demo environment separate from production.
• Logging: a log of sensitive actions in each customer's database; central technical logging retained for 14 days.
• Monitoring and incidents: automatic checks of services, replication and backups, with alerts; documented recovery procedures.
• Development: Trivy and Semgrep security scans on every build.
• Secure erasure: deletion of the Instance database, files and keys once the 30 days following the end of the contract have elapsed; encrypted copies held in backups expire at the end of their rotation (24 months at most), excluding statutory accounting obligations.

7. Authorised subprocessors

The Controller authorises ark.swiss sàrl to use the following subprocessors for the indicated purposes:

Any new subprocessor will be notified to the Controller with 30 days' prior notice (public list maintained in this DPA and on the Privacy Policy page). The Controller may raise a reasoned objection; in case of a reasonable objection not resolved, the Controller may terminate the contract free of charge.

8. Breach notification

In the event of a security breach concerning the data processed on behalf of the Controller, ark.swiss sàrl notifies the Controller as soon as possible after becoming aware (Art. 24(3) FADP; where the GDPR applies, without undue delay under its Art. 33(2)). The notification contains, to the extent available:

• the nature of the breach, the categories and approximate number of data subjects concerned;
• the categories and approximate number of data records concerned;
• the likely consequences and the measures taken or proposed to remedy them;
• the contact details of a contact point for more information.

ark.swiss sàrl cooperates with the Controller for any notification to the competent supervisory authority (FDPIC, CNIL, etc.) and, if necessary, to data subjects (Art. 24 FADP, Art. 33-34 GDPR).

9. International transfers

The Controller's application data is hosted exclusively in Europe: production at netcup GmbH in Vienna (Austria, European Union), a standby copy of the databases continuously replicated to Infomaniak Network SA in Geneva and independent historical Borg backups on ark.swiss-owned infrastructure in Switzerland. Necessary transfers to other subprocessors, including AI providers and the other services located in the USA, are described in clause 7. The transfer to Cloudflare (USA) is framed by the Standard Contractual Clauses (SCCs) adopted by the European Commission in their 2021 version and, in the alternative, by the EU-US Data Privacy Framework.

10. Audit right

The Controller has a right to audit ark.swiss sàrl to verify compliance with this DPA. Terms:

• Documentary audit: once per year, free of charge — ark.swiss sàrl answers reasonable security questionnaires (CAIQ, SIG) within 30 days.
• On-site audit: possible with 30 days' written notice, limited to one per year, at the Controller's expense, subject to a prior mutual confidentiality agreement (NDA) and under conditions that do not compromise the security or confidentiality of other customers.
• Third-party audit: possible after agreement on the choice of firm (independent and qualified) and at the Controller's expense.

11. Deletion or return

At the end of the contract, upon the Controller's written instructions:

• Export: ark.swiss sàrl makes read-only access and an export available for 30 days in common formats (CSV or Excel, with attached files).
• Deletion: after that period, or upon the Controller's earlier request, ark.swiss sàrl permanently deletes the Instance data; encrypted backups expire at the end of their rotation (24 months at most).
• Statutory exception: invoices issued by ark.swiss sàrl to the Controller are retained for 10 years in accordance with Art. 958f CO, an obligation that prevails over the right to erasure.

Upon request, ark.swiss sàrl provides a signed deletion certificate.

12. Duration and termination

This DPA takes effect upon acceptance of the Terms and remains in force as long as ark.swiss sàrl processes personal data on behalf of the Controller. It ends automatically upon completion of the post-termination obligations under clause 11. The confidentiality, liability and governing law clauses survive the end of the DPA.

13. Liability

Each party is responsible for its own breaches of this DPA. ark.swiss sàrl's liability towards the Controller is limited, in accordance with clause 12 of the Terms, to the total amount of subscriptions actually paid by the Controller during the 12 months preceding the triggering event, subject to Art. 100 CO (wilful misconduct, gross negligence, harm to life, bodily integrity or health) and to mandatory data protection obligations.

14. Governing law and jurisdiction

This DPA is governed exclusively by Swiss law. Any dispute shall be submitted to the exclusive jurisdiction of the courts of Lausanne, canton of Vaud, subject to the mandatory consumer forum under Art. 32 CCP.

15. Signature and acceptance

Acceptance of the Terms by the Controller upon subscription constitutes acceptance of this DPA (electronic acceptance, time-stamped and archived). Upon written request to [email protected], a PDF version signed by both parties may be provided for Customers whose internal governance requires it.

16. Data protection contact

ark.swiss sàrl is not legally required to appoint a Data Protection Officer (DPO) within the meaning of Art. 37 GDPR. Requests concerning this DPA, notifications and audits are centralised at the dedicated contact point:

ark.swiss sàrl
Chemin de la Duchesne 13, 1806 St-Légier, canton de Vaud, Suisse
Email: [email protected]

In case of discrepancy between language versions, the French version prevails.