Data processing agreement (DPA)

1. Subject matter and duration

This agreement governs the processing of personal data in connection with the use of the “Helferplanung.app” platform.

Processing takes place for the duration of the use of the platform.

2. Nature and purpose of processing

The Contractor processes personal data exclusively to provide the platform for organising and planning helper shifts.

3. Categories of data and data subjects

Data subjects:

• Helpers / volunteers
• Users of the organisation

Data categories:

• Master data (name, email, phone number)
• Planning data (shift assignments)
• Communication data
• Custom details

4. Instructions

The Contractor processes personal data exclusively on documented instructions from the Client, unless there is a legal obligation to process it.

5. Obligations of the Contractor

The Contractor undertakes:

• to take appropriate technical and organisational measures
• to ensure confidentiality
• to support the Client with requests from data subjects
• to report data breaches without delay
• to delete or return data after the end of the contract

The Contractor ensures that all persons authorised to process personal data are bound to confidentiality.

The Contractor supports the Client in complying with statutory data protection obligations, in particular with regard to the security of processing and any data protection impact assessments, where necessary.

6. Obligations of the Client

The Client is responsible for:

• the lawfulness of the processing
• obtaining any necessary consent
• the content of the data collected

The Client undertakes not to process any special categories of personal data (e.g. health data) without an appropriate legal basis.

7. Subprocessors

The Contractor uses the subprocessors listed on the Subprocessors page.

The Client consents to the use of these subprocessors.

The Contractor provides information about changes to subprocessors. The Client has the right to object for good cause.

8. Security of processing (TOMs)

The Contractor takes appropriate technical and organisational measures, in particular:

• Encryption of data transmission (HTTPS)
• Access controls and role-based permissions
• Authentication systems
• Protection of systems against unauthorised access

9. Data breaches

The Contractor informs the Client without delay of any data breaches affecting personal data.

10. Audit rights

The Client is entitled to check compliance with this agreement to a reasonable extent. As a rule, this is done through appropriate evidence (e.g. documentation).

11. Deletion and return

After use ends, personal data is deleted or returned, at the Client’s choice, unless statutory retention obligations apply.

12. Processing in third countries

Personal data is generally processed within Switzerland and the European Union.

An exception applies to the delivery of WhatsApp notifications: if the Client has enabled the WhatsApp channel, the mobile phone number and message content of the helpers concerned are transmitted to the subprocessor Meta Platforms Ireland Limited; onward transfer to Meta Platforms, Inc. in the USA is possible. This transfer is based on the Swiss-U.S. and EU-U.S. Data Privacy Framework, under which Meta is certified, and additionally on the EU standard contractual clauses. If the Client does not enable the WhatsApp channel, this transfer does not take place.

Any further transfers to third countries only take place if the requirements of Art. 16 et seq. FADP or Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision or appropriate safeguards.

13. Final provisions

This agreement forms part of the terms of use of Helferplanung.app.