Data Processing Agreement

How we process and protect data on behalf of Swiss educational institutions, in compliance with the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR).

FADP & GDPRCompliantAES-256EncryptionEUData Residency

Last updated: February 2026

Scope & Roles

Agreement Scope

This Data Processing Agreement (DPA) governs the processing of personal data by Swiss Private Schools (the "Processor") on behalf of subscribing educational institutions (the "Controller"). It applies to all personal data processed through the platform, including student inquiries, family contact details, booking information, and analytics data.

Controller Responsibilities

As the Controller, your institution determines the purposes and means of processing personal data collected through the platform. You are responsible for ensuring a lawful basis for data collection, providing privacy notices to data subjects, and responding to data subject access requests.

Processor Obligations

As the Processor, Swiss Private Schools processes personal data only on documented instructions from the Controller. We implement appropriate technical and organizational measures, assist with data subject rights requests, and notify the Controller of any data breaches without undue delay.

Data Processing Details

Categories of Data

We process the following categories of personal data: contact information (names, emails, phone numbers) of prospective families; inquiry and booking details; analytics data (anonymized usage patterns); school staff account credentials; and billing information for subscribing institutions.

Processing Purposes

Personal data is processed exclusively for: facilitating inquiries between families and schools; managing visit bookings and scheduling; providing analytics and reporting to schools; platform administration and account management; and billing and invoicing services.

Technical Measures

We implement encryption at rest (AES-256) and in transit (TLS 1.3), role-based access controls, automated access logging, regular security testing, and database-level Row Level Security (RLS) ensuring schools can only access their own data.

Sub-Processors

Current Sub-Processors

Swiss Private Schools engages the following sub-processors: Supabase Inc. (database and authentication, EU region); Stripe Inc. (payment processing, EU/US with SCCs); Vercel Inc. (application hosting, EU edge network); and Resend (transactional email delivery).

Sub-Processor Management

We maintain contractual agreements with all sub-processors that impose data protection obligations no less protective than this DPA. We conduct annual reviews of sub-processor compliance and security practices.

Change Notification

We will notify Controller of any intended changes to sub-processors at least 30 days before the change takes effect. Controllers may object to a new sub-processor within 14 days. If the objection cannot be resolved, the Controller may terminate the agreement.

International Data Transfers

Primary Data Location

All primary data storage and processing occurs within the European Economic Area (EEA), with Swiss data residency where technically feasible. Our database infrastructure is hosted in EU regions to ensure compliance with Swiss and EU data protection requirements.

Transfer Mechanisms

Where data transfers outside the EEA are necessary (e.g., for certain sub-processor services), we rely on EU Standard Contractual Clauses (SCCs), adequacy decisions by the Swiss Federal Council, or other approved transfer mechanisms under the FADP and GDPR.

Swiss Adequacy

Switzerland is recognized by the European Commission as providing an adequate level of data protection. Data transfers between Switzerland and the EEA do not require additional safeguards under GDPR Article 45.

Data Retention & Deletion

Retention Periods

Inquiry and booking data is retained for 24 months from the date of submission. Analytics data is retained in aggregated form indefinitely and in identifiable form for 12 months. Account data is retained for the duration of the subscription plus 90 days.

Deletion on Termination

Upon termination of the subscription agreement, we will delete or return all personal data within 30 days, except where retention is required by law (e.g., billing records under Swiss commercial law must be retained for 10 years).

Data Export

Controllers can export all their data at any time through the dashboard's Data Export feature. Exported data is provided in standard formats (CSV, JSON). We recommend regular exports as part of your data management practices.

Breach Notification

Notification Timeline

In the event of a personal data breach, Swiss Private Schools will notify the affected Controller without undue delay and no later than 72 hours after becoming aware of the breach. The notification will include the nature of the breach, categories and approximate number of records affected.

Notification Content

Breach notifications include: a description of the breach; the likely consequences; measures taken or proposed to address the breach; the name and contact details of our Data Protection Officer; and recommendations for the Controller to mitigate potential adverse effects.

Cooperation

We will cooperate fully with the Controller's own breach assessment and notification obligations. This includes providing additional information as it becomes available, assisting with regulatory notifications, and supporting any required communication to affected data subjects.

Data Subject Rights

Right of Access & Rectification

Data subjects have the right to access their personal data and request corrections. When we receive such requests directly, we forward them to the relevant Controller within 48 hours. We provide tools in the dashboard for Controllers to fulfill these requests efficiently.

Right to Erasure & Portability

Data subjects may request deletion of their personal data or receive it in a portable format. Controllers can process deletion requests directly through the dashboard. We ensure deletion propagates to all sub-processors within 30 days.

Right to Object & Restrict Processing

Data subjects may object to processing or request restrictions. Controllers manage these requests through the platform. We implement technical measures to honor processing restrictions, including the ability to suppress specific data from automated processing.

Swiss Data Protection Authority

This DPA is governed by the Swiss Federal Act on Data Protection (FADP/nFADP) and, where applicable, the EU General Data Protection Regulation (GDPR). Our Data Protection Officer can be contacted at dpo@swissprivate-schools.ch.

For questions about data protection in Switzerland, contact the Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch