> The Contals data processing agreement under the Swiss revFADP and the GDPR – addenda for Switzerland and the EU, an optional one for church data protection law.

Source: https://contals.com/it/data-protection/dpa/  
Language: it

# Data processing agreement (DPA)

The Contals data processing agreement under the Swiss revFADP and the GDPR – addenda for Switzerland and the EU, an optional one for church data protection law. Version 1.0.

Ultimo aggiornamento: 16 ottobre 2026

Questa pagina è disponibile in inglese e in tedesco. Fanno fede le versioni inglese e tedesca; in caso di divergenze prevale la versione tedesca.

**Version 1.0 of 16 October 2026.** German version:  [Auftragsverarbeitungsvertrag (AVV)](https://contals.com/de/data-protection/dpa/) . This DPA is part of the  [terms of service](https://contals.com/en/terms/)  and applies to every organization in Contals; an owner can also accept it in the organization settings, which shows this version by its date (2026-10-16). Addendum C for church bodies under the KDG or the DSG-EKD is optional and applies when the Customer activates it.

**between**

the customer organization named in the Contals organization settings or in the order (“**Customer**”, controller),

**and**

Unique-P GmbH, Burengasse 11, 4655 Stüsslingen, Switzerland, limited liability company (GmbH) under Swiss law, entered in the Commercial register of the canton of Solothurn under UID CHE-294.954.310, represented by its managing director Dimitri König (“**Contals**”, processor).

## 1\. Subject, scope and duration

1.1 Contals provides the Contals work management service (boards, lists, cards and related features, “**Service**”) under the  [terms of service](https://contals.com/en/terms/)  (“**Main Agreement**”). In doing so, Contals processes personal data on behalf of the Customer. This DPA governs that processing.

1.2 This DPA covers the personal data that the Customer and its users put into the Service or that the Service creates for the Customer’s organization: board content, members, roles, invitations and related logs (“**Customer Data**”). It does not cover data Contals processes as an independent controller: user accounts and sign-in, billing, security and abuse prevention, and the Contals website. These are described in the  [privacy policy](https://contals.com/en/privacy/) .

1.3 This DPA applies for as long as Contals processes Customer Data, including the retention periods in section 10.

## 2\. Nature, purpose, data and data subjects

2.1 Details are in **Annex 1**. Contals processes Customer Data only to provide, secure and support the Service and never for advertising, profiling, selling data or training AI models.

2.2 The Customer decides what it stores. Customer Data may include **special categories** of personal data (for example religious affiliation, health information in prayer requests, data about children). The Customer remains responsible for the lawfulness of that processing, including any consent and its own data protection impact assessment. Contals provides guidance for sensitive boards (Annex 1, item 7).

## 3\. Instructions

3.1 Contals processes Customer Data only on documented instructions from the Customer. The Main Agreement, this DPA and the Customer’s use and configuration of the Service (for example board visibility, invitations, integrations, AI settings, exports and deletions) are the Customer’s complete instructions. Further instructions must be in text form and technically feasible; if they cause additional effort, Contals may charge for it after informing the Customer in advance.

3.2 Contals informs the Customer without delay if it considers an instruction to infringe applicable data protection law, and may suspend carrying it out until the Customer confirms or changes it.

3.3 If law requires Contals to process Customer Data otherwise, Contals informs the Customer before processing, unless that law prohibits it (see section 12).

## 4\. Confidentiality

4.1 Contals ensures that every person authorized to process Customer Data is bound by confidentiality, by contract or by law, and that this obligation continues after their engagement ends.

4.2 Contals personnel do not access Customer content in normal operations. Access for support requires a request or consent of the Customer for the specific case, is limited to what the case needs, and is logged.

4.3 Professional secrets: Contals does not offer customer-held-key encryption. Whether storing information subject to a professional secrecy duty (for example pastoral confidentiality under Art. 321 of the Swiss Criminal Code) is permitted is the Customer’s assessment. Contals recommends not storing such secrets in the Service.

## 5\. Security of processing

5.1 Contals implements the technical and organizational measures in **Annex 2** to ensure a level of security appropriate to the risk (GDPR Art. 32, revFADP Art. 8 and DSV Art. 1–6).

5.2 Contals may update the measures as technology develops, provided the overall level of protection does not decrease. Material changes are documented in Annex 2.

## 6\. Assistance

6.1 **Data subject requests.** The Service lets the Customer export data (board, workspace, organization) and delete content and accounts itself. Where this is not enough, Contals assists with reasonable technical measures. Requests that reach Contals directly are forwarded to the Customer without undue delay where the Customer can be identified.

6.2 **DPIA and consultation.** Contals provides the information the Customer reasonably needs for its data protection impact assessment (GDPR Art. 35, revFADP Art. 22, KDG § 35, DSG-EKD § 34) and for consultations with a supervisory authority, in particular this DPA, Annex 2, Annex 3 and the transfer assessment.

## 7\. Subprocessors

7.1 The Customer gives general authorization for Contals to engage subprocessors. The current subprocessors are listed in **Annex 3** (published at  [contals.com/en/data-protection/subprocessors/](https://contals.com/en/data-protection/subprocessors/) ).

7.2 Contals informs the Customer’s organization owners by e-mail and in the list at least **30 days** before a new or replacement subprocessor starts processing Customer Data. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service with effect before the change; prepaid fees for the remaining term are refunded.

7.3 Contals imposes data protection obligations on each subprocessor that are substantially equivalent to this DPA and remains responsible for its subprocessors’ performance.

7.4 Recipients that the Customer chooses and configures itself (for example chat platforms, its own AI provider, its own identity provider, API clients) are not subprocessors of Contals. They are listed in Annex 3 for transparency.

7.5 **The Customer’s own AI provider.** AI features are off until an owner or admin of the Customer enters a provider, confirms that the Customer has a data processing agreement with it and switches AI on. The Customer chooses the provider and the region, concludes and maintains the contract with it, and decides in its data policy which data may be sent (people’s names and comments off by default, e-mail addresses and confidential boards never). Contals sends data to that provider only on the Customer’s instruction – when an authorized person uses an AI feature – and only what the data policy allows; Contals does not store prompts or answers beyond the assistant conversation kept for the person (Annex 2). The provider processes the data under its contract with the Customer; Contals is not responsible for its processing and does not choose, contract or monitor it.

## 8\. International transfers

8.1 Customer Data is **stored** in the EU jurisdiction of Cloudflare (Annex 3). Requests are processed in the Cloudflare data center nearest to the user, and some metadata and support access occur outside the EU (Annex 4).

8.2 Transfers to countries without an adequate level of protection take place only with appropriate safeguards: the EU–US or Swiss–US Data Privacy Framework for certified recipients, otherwise the EU standard contractual clauses (with the Swiss amendments for data subject to the revFADP). A summary of the transfer assessment is in **Annex 4**.

8.3 Contals informs the Customer at least 30 days in advance if it intends to move the **storage** of Customer Data out of the EU/EEA or Switzerland; section 7.2 applies accordingly.

## 9\. Personal data breaches

9.1 Contals notifies the Customer **without undue delay**, and aims to do so within **48 hours**, after becoming aware of a personal data breach affecting Customer Data. The notice goes to the organization owners and the privacy contact stored in the organization settings, if one is set.

9.2 The notice contains, as far as known: the nature of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken or proposed, and a contact. Information that is not yet available is provided in phases.

9.3 Contals supports the Customer in notifying supervisory authorities (GDPR Art. 33: 72 hours; revFADP Art. 24: as soon as possible; church law accordingly) and data subjects. The process is described in the incident response summary on the  [data protection kit page](https://contals.com/en/data-protection/) .

## 10\. Deletion and return

10.1 The Customer can export its data at any time during the term. When an owner of the Customer’s organization asks for its deletion, the organization is retained read-only for **30 days** for export and then deleted with its workspaces, boards and member lists. The end of a paid subscription deletes nothing: the organization continues on the free plan. Billing records are kept as tax and commercial law requires.

10.2 Deletion removes the data from the live systems. Copies remain only in:

-   point-in-time recovery of the databases (**30 days**);
-   the immutable event archive (**90 days**), which protects against tampering and accidental loss and cannot be altered before its retention ends;
-   control-plane backups and nightly copies of the boards that changed (**35 days**), also as a copy encrypted by Contals at DigitalOcean in Frankfurt (Annex 3);
-   the archive of the audit log (**2 years** after an entry leaves the live database at 180 days; IDs, actions and times of security-relevant actions, no board content).

These copies are not used for any other purpose and are deleted when their retention ends. Every deletion is recorded beforehand in a separate list (IDs only, kept 120 days – longer than any of these copies); if data is restored from them, the recorded deletions are applied again.

10.3 Editing or deleting a comment, and deleting a status update, also erases the earlier text from the board’s history, the search index and exports (Annex 2, section 7). Known limitation: earlier versions of card titles and descriptions remain in the board’s history for up to **13 months** (contained in exports) – a board keeps 13 months of history and folds older changes into its state; the copies listed in 10.2 keep the earlier text until their retention ends.

## 11\. Information and audits

11.1 Contals makes available the information necessary to demonstrate compliance with this DPA: this DPA and its annexes, answers to reasonable security questionnaires (once a year, or after a breach), and Cloudflare’s current third-party audit reports and certificates as far as Cloudflare allows sharing them.

11.2 Where this is not sufficient, the Customer or an independent auditor bound to confidentiality may audit Contals’ compliance with this DPA once a year with 30 days’ notice, during business hours, without disrupting operations and at the Customer’s cost. Audits of Cloudflare follow Cloudflare’s terms (third-party reports; on-site audits only under the standard contractual clauses).

11.3 Supervisory authorities competent for the Customer may exercise their powers under applicable law.

## 12\. Requests from authorities

12.1 If an authority requests Customer Data, Contals refers it to the Customer where legally possible, informs the Customer before disclosure unless prohibited, discloses only the minimum legally required, and challenges requests that conflict with the law applicable to the Customer where there are reasonable grounds.

12.2 Contals’ main subprocessor has made corresponding commitments (Cloudflare DPA section 8, Annex 4).

## 13\. Final provisions

13.1 In case of conflict, this DPA prevails over the Main Agreement for the processing of Customer Data; the standard contractual clauses prevail over this DPA where they apply.

13.2 Liability under this DPA follows section 10 of the Main Agreement, including its limits. This does not limit the rights of data subjects or any liability that the law does not allow to be limited.

13.3 This DPA is governed by Swiss law, excluding its rules on conflict of laws; the place of jurisdiction is the seat of Contals (canton of Solothurn, Switzerland). For Customers in the EU, mandatory provisions of the GDPR and of the law of the Customer’s member state remain unaffected; where the standard contractual clauses apply, their rules on governing law and jurisdiction prevail.

13.4 The DPA is concluded in text form: as part of the Main Agreement, by electronic acceptance by an organization owner in the Service, or by signature. The Service stores who accepted it, when and which version (identified by the date of this text), and records the acceptance in the organization’s audit log. Changes follow section 13 of the Main Agreement; a new version is offered for acceptance in the Service.

13.5 This DPA is written in German and English; both versions are binding. If they differ, the German version prevails.

* * *

## Annex 1 – Description of the processing

| Item | Description |
| --- | --- |
| 1\. Subject and purpose | Hosting and operating the Service: storing and displaying boards, lists and cards; collaboration in real time; activity history; search; notifications; exports; integrations switched on by the Customer; support and security |
| 2\. Nature of processing | Collection, recording, organization, storage, retrieval, use, disclosure to authorized members of the Customer, restriction, erasure |
| 3\. Categories of data subjects | The Customer’s members, staff, volunteers, guests and viewers; people the Customer writes about on boards (for example event participants, newcomers, people in need of support); invited persons; people without an account who answer a date poll or book an appointment on a public page |
| 4\. Categories of personal data | Names, e-mail addresses, roles and memberships; content of boards (titles, descriptions, comments, status updates, checklists, custom fields, labels, assignments, due dates, votes, links, automation rules, date-poll answers, bookings, saved board filters); contact details of people without an account who book an appointment (name, e-mail address, answers) or leave an address on a date poll – kept in the account database, outside the board’s storage and history; activity history; notification items; personal preferences (favorites, saved personal filters, notification settings); push subscriptions of a person’s devices (address and keys issued by the browser’s push service, if the person switches push on); technical data (IP addresses, device and session data); integration settings |
| 5\. Special categories (only if the Customer stores them) | Religious or philosophical beliefs, health data, data about children, data relating to criminal offences or safeguarding concerns |
| 6\. Frequency and duration | Continuous for the term of the Main Agreement plus the retention periods in section 10 |
| 7\. Recommended use for sensitive data | Private boards, marked confidential, minimal and coded content, no AI and no chat integrations, short retention, no professional secrets – see the  [guide for sensitive boards](https://contals.com/en/data-protection/sensitive-boards/)  |

## Annex 2 – Technical and organizational measures

See  [Technical and organizational measures](https://contals.com/en/data-protection/toms/) . Version 1.0 of 16 October 2026.

## Annex 3 – Subprocessors and customer-configured recipients

See  [Subprocessors and recipients](https://contals.com/en/data-protection/subprocessors/) . Version 1.0 of 16 October 2026.

## Annex 4 – International transfers (summary)

Summary of the transfer impact assessment (full version on request): stored data in Cloudflare’s EU jurisdiction; Cloudflare, Inc. (USA) is certified under the EU–US and Swiss–US Data Privacy Framework, with the standard contractual clauses as fallback; residual risk from US law (CLOUD Act) because Cloudflare can technically access plaintext; metadata (Durable Object IDs, request metadata) and support access partly outside the EU; mitigated by data minimization, opaque identifiers and Cloudflare’s commitments on government requests. The second backup copy at DigitalOcean (Frankfurt) holds only data encrypted by Contals with a key DigitalOcean does not have; Stripe receives billing data only. Contals administers the Service from Switzerland, which the EU recognizes as adequate.

* * *

## Addendum A – Switzerland (revFADP)

-   “Personal data”, “processing”, “controller”, “processor” and “data subject” have the meaning of the revFADP (“Personendaten”, “Bearbeiten”, “Verantwortlicher”, “Auftragsbearbeiter”, “betroffene Person”).
-   Contals processes only as the Customer itself would be allowed to (revFADP Art. 9 para. 1). Subprocessing needs the Customer’s prior authorization (Art. 9 para. 3) – given in section 7.
-   The competent authority for transfers is the FDPIC; references to the GDPR in the standard contractual clauses are read as references to the revFADP.
-   **Public bodies under cantonal law** (for example Landeskirchen and Kirchgemeinden where cantonal data protection law applies): the Customer confirms that it has assessed the use of the Service under its cantonal law. Cantonal supervisors (privatim resolution of 2025-11-24; Zurich DPO information sheet of February 2026) consider outsourcing special personal data to US-related providers admissible only with encryption under the public body’s own keys, which the Service does not offer. Such Customers should not store special personal data in the Service.

## Addendum B – EU (GDPR)

-   Section numbers map to GDPR Art. 28(3): (a) instructions – section 3; (b) confidentiality – 4; (c) security – 5 and Annex 2; (d) subprocessors – 7; (e) data subject requests – 6.1; (f) assistance with Art. 32–36 – 5, 6.2, 9; (g) deletion or return – 10; (h) information and audits – 11.
-   Contals is established in Switzerland, outside the EU. Where Art. 3(2) GDPR applies to it: A representative in the EU (Art. 27 GDPR) is not appointed yet. One will be appointed before Contals serves its first customer in the EU and named here; until then, people in the EU reach us directly at privacy@contals.com.

## Addendum C – Church data protection law (KDG, DSG-EKD)

> **Optional.** This addendum applies only if the Customer is a church body subject to the KDG (Catholic) or the DSG-EKD (Protestant) and activates it – by a request in text form to  [privacy@contals.com](mailto:privacy@contals.com) , which Contals confirms in text form. Based on public summaries of the DSG-EKD as amended (in force 2025-05-01) and the KDG as amended (in force 2026-03-01); verify the wording in the gazette that binds you.

C.1 **Applicable law.** If the Customer is subject to the KDG or the DSG-EKD, references to the GDPR in this DPA are read as references to the corresponding provisions of that law (in particular § 29 KDG / § 30 DSG-EKD on processing on behalf, § 26 KDG / § 27 DSG-EKD on security, § 33 KDG / § 32 DSG-EKD on breach notification, §§ 39–41 KDG / § 10 DSG-EKD on third countries).

C.2 **Contract content.** Contals is not subject to church data protection law. § 30 para. 5 DSG-EKD allows the contract to follow Art. 28 GDPR in this case; under the amended KDG, contracts with GDPR-bound processors are recognized (§ 21 para. 5 KDG-DVO, per practitioner summaries). This DPA is concluded in text form.

C.3 **Supervision.** The church supervisory authority competent for the Customer supervises the Customer’s processing. Contals recognizes the tasks and powers of that authority with respect to the processing for the Customer, will answer its enquiries and allow audits under section 11. (A formal “submission” of the processor is no longer required by the amended DSG-EKD; this recognition is offered voluntarily because older church templates still ask for it.)

C.4 **Selection and checks.** § 30 para. 3 DSG-EKD requires the Customer to check the processor’s measures before processing starts and regularly afterwards and to document the result. Annex 2, the subprocessor list and the information in section 11 are provided for this purpose; Contals informs the Customer of material changes.

C.5 **Third countries.** Transfers rely on the adequacy decision for DPF-certified recipients (Cloudflare, Stripe, DigitalOcean – which holds only encrypted data), on the adequacy decision for Switzerland and on standard contractual clauses (§ 10 para. 1 DSG-EKD; § 40 KDG). If the Customer’s church law still requires that an adequacy decision does not conflict with important church interests (former § 40 para. 1 KDG), the Customer assesses this. Section 8.3 gives the Customer a termination right before storage would move to a third country.

C.6 **Confidentiality.** Contals’ personnel are bound to confidentiality (section 4). The confessional secret and pastoral confidentiality must never be stored in the Service.

 [← Documentazione sulla protezione dei dati](https://contals.com/it/data-protection/)