Version of August 26th, 2026 # DATA PROCESSING AGREEMENT (DPA) – TARELIO ## 1. Parties This Data Processing Agreement (the “DPA”) forms an integral part of the General Terms and Conditions (the “Terms”) of Tarelio Sàrl. It is entered into between: **Tarelio Sàrl** Chemin de Clamogne 27 1170 Aubonne Switzerland acting as data processor (the “Processor”), and the Tarelio Client, acting as data controller (the “Controller”). This DPA applies where and to the extent that Tarelio processes personal data on behalf of the Controller in connection with the provision of the Service. ## 2. Purpose and Applicable Law This DPA sets out the conditions under which the Processor processes personal data on behalf of the Controller. The processing activities covered by this DPA are subject to the Swiss Federal Act on Data Protection (“FADP”). Data protection terms used in this DPA shall have the meaning given to them under the FADP. ## 3. Duration of Processing This DPA applies for the entire duration of the contractual relationship between Tarelio and the Controller. Following termination of the contract, processing of personal data shall continue only for the period necessary for its return, export, temporary retention and deletion in accordance with this DPA. Unless a legal obligation requires longer retention, personal data shall be deleted no later than sixty (60) days after termination of the contract, subject to the backup provisions set out in Article 16. ## 4. Nature and Purpose of Processing The Processor processes personal data only to the extent necessary to perform the contract and to provide, operate, maintain, secure and support the Service. Processing operations may include in particular: * collection; * recording; * organisation; * structuring; * storage; * consultation; * modification; * extraction; * transmission; * analysis; * deletion; * and any other processing necessary to provide the Service. The purposes of processing may include in particular: * user account management; * project and operational management; * planning; * time, activity and timesheet tracking; * administrative management; * invoice and payment management; * storage and processing of documents; * extraction and processing of data; * artificial intelligence-based functionalities; * maintenance and technical support; * security and prevention of misuse; * technical operation of the Service. The Processor does not process personal data covered by this DPA for its own purposes. Where Tarelio processes certain personal data for its own purposes, including management of its commercial relationship, billing, security of its own systems, legal compliance or analysis of the use of its services, Tarelio acts as Controller in respect of such processing. Such processing is not governed by this DPA and is governed in particular by Tarelio's Privacy Policy. Tarelio may use genuinely anonymised or aggregated data that can no longer reasonably identify a natural person, including for the purpose of analysing, maintaining, developing or improving the Service. ## 5. Categories of Personal Data Personal data that may be processed includes in particular: * identification data, such as first name, last name and contact details; * email addresses and telephone numbers; * professional data, such as position, company, team or role; * user account and access-right data; * usage data, technical logs and activity history; * data relating to projects, tasks, interventions, construction sites or operations; * working time, attendance and activity data; * financial data, such as invoices, payments, prices or billing information; * data contained in documents, files, images or other content imported by the Controller; * data extracted or generated through automated or artificial intelligence-based functionalities; * any other personal data that the Controller or its users choose to enter or process through the Service. ## 6. Sensitive Personal Data The Service may occasionally process sensitive personal data within the meaning of the FADP where such data is entered into the Service by the Controller or its users, or where its processing reasonably results from the use of the Service's functionalities. The Controller remains responsible for determining whether the entry and processing of such data is lawful, necessary and appropriate. Where the Processor processes sensitive personal data on behalf of the Controller, it processes such data in accordance with the Controller's instructions and the security measures set out in this DPA. The Controller undertakes not to enter sensitive personal data that is not necessary for its legitimate use of the Service. ## 7. Categories of Data Subjects Personal data may relate in particular to: * employees and staff members of the Controller; * applicants and former employees; * service providers and subcontractors of the Controller; * customers and prospects of the Controller; * suppliers; * business contacts; * any other person whose data is entered into or processed through the Service by the Controller or its users. ## 8. Controller Obligations The Controller remains responsible for the lawfulness of processing carried out through the Service. The Controller warrants in particular that it: * has the necessary legal basis for processing the personal data; * is authorised to collect, transmit and have the relevant personal data processed; * provides data subjects with any information required by applicable law; * provides the Processor only with personal data necessary for its legitimate purposes; * gives the Processor only instructions that comply with the FADP; * respects the rights of data subjects; * takes appropriate measures to secure its users' access to the Service; * notifies the Processor without undue delay if it becomes aware of or suspects unauthorised access, account compromise or any incident that may affect the security of personal data processed through the Service. The Controller is responsible for the content, quality, accuracy and lawfulness of the personal data it enters or causes to be processed through the Service. ## 9. Controller Instructions The Processor processes personal data only on the Controller's instructions. The conclusion of the contract, use of the Service, settings configured by the Controller and actions performed by its users constitute documented instructions authorising the Processor to carry out the processing necessary to provide the Service. The Controller expressly authorises the Processor to carry out automated processing necessary for the operation of the Service, including processing based on artificial intelligence technologies. The Processor does not use personal data covered by this DPA for its own purposes. If the Processor considers that an instruction from the Controller is contrary to the FADP, it shall inform the Controller to the extent reasonably possible. The Processor may suspend implementation of such instruction until it has been clarified or amended. The Processor is not required to carry out a manifestly unlawful instruction. ## 10. Confidentiality The Processor shall ensure the confidentiality of personal data processed on behalf of the Controller. It shall ensure that persons authorised to process personal data: * access such data only to the extent necessary for the performance of their duties; * are subject to an appropriate confidentiality obligation; * are informed of applicable data protection and security obligations. These obligations shall continue after the end of the relevant person's duties or contractual relationship to the extent provided by applicable commitments or provisions. ## 11. Data Security The Processor implements appropriate technical and organisational measures designed to ensure a level of security appropriate to the risks associated with the processing. Such measures may include in particular: * encryption of communications and data in transit using secure protocols such as HTTPS/TLS; * authentication and access-control mechanisms; * role, permission and authorisation management; * secure management of credentials, secrets and keys; * logical segregation of environments and data where appropriate; * logging of access and operations where appropriate; * backup and restoration procedures; * measures protecting hosting infrastructure and environments; * vulnerability, update and security incident management processes; * organisational measures limiting access to data to persons who need such access. These measures may evolve according to the state of the art, identified risks, development of the Service and infrastructure used, provided that the overall level of protection is not substantially reduced. The Service relies in part on third-party infrastructure and providers that contribute to the implementation of these measures. ## 12. Subprocessors The Controller grants the Processor general authorisation to engage subprocessors where necessary to provide the Service. As of the date of this DPA, the following providers may in particular process Controller data in connection with the provision of the Service: * **Amazon Web Services (AWS)** – cloud infrastructure and services; * **Microsoft Azure** – cloud infrastructure and services; * **Vercel** – application hosting and infrastructure; * **Neon** – database infrastructure and services; * **OpenAI** – artificial intelligence-based functionalities; * **Plunk** – electronic communication and email services; * **Google Analytics** – measurement and analysis of Service usage, to the extent that the relevant processing is carried out on behalf of the Controller. The exact qualification of a provider and the scope of data it processes may depend on the functionalities used and the nature of the relevant processing. Processing carried out by a provider in connection with Tarelio's own purposes as Controller is not covered by this DPA and is governed in particular by Tarelio's Privacy Policy. The Processor undertakes to: * select subprocessors that provide sufficient guarantees regarding data protection and security; * impose appropriate data protection obligations on such subprocessors having regard to the nature of the processing entrusted to them; * remain responsible to the Controller for performance of its obligations under this DPA notwithstanding its use of subprocessors. The Processor shall inform the Controller of any intended addition or replacement of a subprocessor at least fifteen (15) days before that subprocessor begins processing personal data covered by this DPA, to the extent reasonably possible. Such notice may be provided by email, through the Service or by means of a list of subprocessors made available by Tarelio. Before expiry of the notification period, the Controller may raise a reasoned objection based on reasonable data protection grounds. The parties shall then endeavour in good faith to find a reasonable solution. If no reasonable solution can be found and use of the new subprocessor is necessary to provide the Service, the Controller may terminate the part of the Service directly affected by the change or, where that part cannot reasonably be separated, the affected Service. Failure to object within the applicable period constitutes acceptance of the change. ## 13. International Transfers Personal data may be processed in or made accessible from countries outside Switzerland where necessary to provide the Service. The Processor shall ensure that any disclosure of personal data abroad is carried out in accordance with the requirements of the FADP. Where the destination country does not provide a level of data protection recognised as adequate under Swiss law, the Processor shall ensure that the necessary safeguards are implemented, including, where appropriate, through recognised standard contractual clauses or clauses adapted to the requirements of Swiss law. The Processor shall also ensure, to the extent required, that its subprocessors comply with the applicable requirements governing disclosure of personal data abroad. ## 14. Assistance to the Controller Taking into account the nature of the processing and the information available to it, the Processor shall reasonably assist the Controller in complying with its obligations under the FADP. Such assistance may include in particular: * requests for access, correction, deletion or other requests made by data subjects; * locating, extracting, correcting or deleting personal data where such operations cannot reasonably be carried out directly by the Controller through the Service; * data security; * analysis and management of data security breaches; * data protection impact assessments where required; * requests or investigations by a competent data protection authority. If the Processor receives directly a request from a data subject relating to data processed on behalf of the Controller, it shall forward the request to the Controller where it is able to identify the Controller, unless otherwise instructed or legally required. Any assistance extending beyond the normal operation of the Service or requiring specific work, custom development or disproportionate effort may be subject to reasonable charges, provided the Controller is informed in advance. ## 15. Data Security Breach The Processor shall inform the Controller without undue delay after becoming aware of a data security breach affecting personal data processed on its behalf. The notification shall include, to the extent the information is available: * a description of the nature of the breach; * the categories of personal data concerned; * the categories of data subjects concerned; * the known or reasonably foreseeable consequences of the breach; * the measures taken or proposed to remedy the breach or mitigate its effects; * information reasonably necessary for the Controller to assess its potential legal obligations. Where all information is not immediately available, the Processor may provide it progressively as it becomes available. The Processor shall reasonably cooperate with the Controller in analysing and managing the breach. Notification of a breach does not constitute an admission of fault or liability by the Processor. The Controller remains responsible for determining whether notification to the Swiss Federal Data Protection and Information Commissioner, affected data subjects or any other person is required. ## 16. Return, Retention and Deletion of Data Following termination of the contract, the Controller may request or perform, depending on available functionalities, an export of the data it wishes to retain. Tarelio may retain personal data in active systems for a maximum period of sixty (60) days following the effective termination date, in particular to enable orderly export, return and deletion of the data. The Controller may request earlier deletion during this period, subject to applicable legal retention obligations. No later than the expiry of this sixty (60) day period, the Controller's personal data shall be deleted from active systems unless retention is required by law. Residual copies may temporarily remain in technical backups. Such backups: * are retained only in accordance with the normal backup and retention cycles of Tarelio or its providers; * are not used for ordinary commercial or operational purposes; * are accessible only where necessary for continuity, security or restoration purposes; * are progressively deleted or overwritten according to their normal rotation cycle. If a backup containing Controller data must exceptionally be restored, Tarelio shall take reasonable steps to ensure that data previously subject to a deletion requirement is not returned to active processing beyond what is technically necessary. The confidentiality and security obligations under this DPA continue to apply to data temporarily remaining in backups. ## 17. Audit and Verification The Controller may request from the Processor information reasonably necessary to verify compliance with the obligations set out in this DPA. Where possible, verification shall primarily rely on: * documentation provided by Tarelio; * descriptions of technical and organisational measures; * available certifications, reports or attestations; * written responses to reasonable requests from the Controller. Where such information is insufficient to reasonably verify compliance with this DPA, the Controller may request an additional audit. Except in the event of a significant security incident, a request from a competent authority or an objective reason to suspect a material breach of this DPA: * an audit may not be requested more than once in any twelve (12) month period; * reasonable advance notice must be provided; * it must be carried out during normal business hours; * its scope must be limited to processing relevant to the Controller; * it must not compromise the security of the Service, confidentiality or the data of other clients; * any external auditor must be independent and subject to appropriate confidentiality obligations. Penetration tests, intrusive vulnerability assessments or other operations capable of affecting the security or availability of systems may not be performed without Tarelio's prior written consent. Reasonable costs of an audit requested by the Controller shall be borne by the Controller unless the audit identifies a material breach of this DPA attributable to Tarelio. Tarelio shall cooperate in good faith with any request or inspection lawfully required by a competent authority. ## 18. Liability The parties' liability relating to the processing of personal data is governed by the liability provisions of the Terms, unless mandatory provisions of the FADP provide otherwise. Nothing in this DPA limits any liability that cannot lawfully be excluded or limited. ## 19. Order of Precedence This DPA forms an integral part of the contractual relationship between Tarelio and the Controller. In the event of any conflict between this DPA and the Terms, the provisions of this DPA shall prevail with respect to the processing of personal data carried out by Tarelio as Processor. For all other matters, the order of precedence set out in the Terms shall continue to apply. ## 20. Amendments to the DPA Tarelio may update this DPA where reasonably necessary, including in order to: * reflect changes in applicable law; * modify or clarify its security measures; * reflect developments in the Service or its infrastructure; * update its subprocessors; * clarify or strengthen data protection provisions. Any material amendment affecting the Controller's rights or obligations shall be communicated within a reasonable period before it takes effect. Changes relating to subprocessors remain subject to the mechanism set out in Article 12. ## 21. Governing Law and Jurisdiction This DPA is governed by Swiss law. The exclusive place of jurisdiction is the Canton of Vaud, Switzerland, subject to any mandatory jurisdictions provided by law. The French version of this DPA shall prevail.