Data Processing Agreement

The terms on which we process personal data on behalf of a subscribing school, under Article 28 GDPR and Article 9 of the Swiss FADP. It describes what we actually do — where a safeguard is not in place, this document says so rather than implying it.

FADP & GDPROur frameworkAES-256At restEUEuropean Union

Last updated: 1 September 2026

Scope and Roles

What this agreement covers

This Data Processing Agreement forms part of the contract between the school (“you”, the controller) and Lucien Pochon, trading as Swiss Private Schools, Avenue de Maria-Belgia 1, 1006 Lausanne, Switzerland (“we”, the processor). It governs every piece of personal data we process on your instructions through the platform: enquiries, tour and open-day bookings, admission applications and the documents attached to them, messages between you and families, your team's account records, and the analytics we compute about your listing. It applies for as long as you hold an account and until the data is deleted or returned under the retention section below.

Who is controller of what

You are the controller of the family and applicant data you receive and manage through the platform, and you decide why and how it is used. We are your processor for that data. Separately, we are our own controller for a small set of things you do not instruct: the accounts your staff hold with us, our billing records, security logs, and the measurement of our own public pages. That second set is governed by our privacy policy, not by this agreement. Where the same family also contacts other schools, each school is a separate controller of its own copy.

Your responsibilities as controller

You are responsible for having a lawful basis for the personal data you collect through the platform, for the content of the application form you design — including any medical, dietary or support questions you add, which attract special-category data — for the consent text you present, for giving data subjects your own privacy notice, and for responding to their requests. You must not use the platform to collect data you have no basis to hold, and you must keep your team's access list current.

Our obligations as processor

We process personal data only on your documented instructions, keep it confidential, apply the security measures set out below, engage sub-processors only under the conditions in this agreement, assist you with data subject requests and with your own security and impact-assessment duties, and delete or return the data when the contract ends. If we ever believe an instruction of yours breaches data protection law, we will tell you and may pause that processing until it is resolved.

What We Process, and Why

Categories of data subjects and data

Data subjects are the families who contact you, the students they enquire or apply on behalf of — usually children — and your own staff. The data comprises contact details (names, email addresses, telephone numbers, country and language), enquiry and booking content, the answers to the questions you configured on your admission form and any files uploaded with them, messages exchanged through the platform, your staff's account and role records, and your billing details. Because you design the form, its answers may include special-category data such as health or support needs. That is a consequence of your form design, and it is your decision to ask.

Purposes of processing

We process the data only to provide the service you subscribed to: routing enquiries to you, scheduling visits and interviews, carrying applications through your form, collecting an application fee where you charge one, notifying both sides, giving you aggregate statistics about your listing, and supporting you when you ask. We do not use your family data for our own purposes, we do not use it to train models, we do not sell it, and we do not use it to market to those families on our own behalf.

Duration

Processing lasts for the term of your subscription and through the wind-down described under retention below. Individual records last as long as you keep them — see the retention section, which states plainly what we delete automatically and what we do not.

Documented instructions

Your instructions are the subscription contract, this agreement, and the configuration you set in the dashboard — your form questions, your consent text, your notification settings, your team's roles. Actions you take in the dashboard are instructions. If you need us to process data in a way the product does not support, ask us in writing; we will not act on an instruction we have not recorded.

Security Measures

Technical measures

All traffic runs over TLS. Data is encrypted at rest by our infrastructure providers. Separation between schools is enforced in the database itself by row-level security, so one school cannot read another's records even if application code is wrong — the isolation does not depend on us getting every query right. Passwords are stored as salted hashes by our authentication provider and are never visible to us. Sensitive administrative actions are written to an audit log.

Access control

Sign-in supports two-factor authentication, and it is mandatory for our own administrators. Within your school, access follows the role you assign each team member, and you can change or revoke it at any time. Access to production systems is limited to the people who operate the platform.

Confidentiality, and our access to your data

Everyone with access to production systems is bound to confidentiality. We have no standing access to your dashboard: where support requires it, an administrator must request access, an owner of your school must approve it, and the resulting session is time-limited and written to an audit log you can read. You can decline, and support will proceed without it.

What we do not claim

We do not hold ISO 27001, SOC 2 or an equivalent certification, we do not commission external penetration tests on a schedule, and we do not run a formal annual review of our sub-processors. Earlier versions of this document implied all three; none was true. We would rather you knew the real posture and could weigh it than rely on an assurance nobody performs. If you need a certified processor, tell us before you subscribe.

Sub-Processors

Who we engage

Supabase (database, authentication and file storage, hosted in the European Union); Vercel (application hosting, and — only for visitors who accept non-essential cookies — its page-performance measurement); Stripe (payments and invoicing); Resend (email delivery); Twilio (SMS verification, only where a user chooses to verify a number); DeepL (machine translation of the text you write about your school); Google (address suggestions, embedded maps and Google sign-in, the last two only for visitors who accept non-essential cookies); and Sentry (error monitoring). No artificial-intelligence provider is engaged: we send no enquiry, application or message to any language model. This list is the same one published in our privacy policy, and the two are kept in step deliberately.

How we engage them

Each sub-processor is bound by a written agreement imposing data protection obligations no less protective than this one, including confidentiality, security and assistance duties. We share with each only the data it needs to perform its function. We remain fully liable to you for their performance.

Changes

You give general authorisation for the sub-processors listed above. We will tell you at least 30 days before adding or replacing one, and you may object in writing within 14 days on reasonable data protection grounds. If we cannot resolve your objection, you may terminate the affected part of the service without penalty for the remainder of the term. Where a change is urgent and security-driven, we may make it sooner and tell you without delay.

Where the Data Is

Primary location

The database, file storage and backups are held in the European Union. Your family and applicant data is not stored outside the EU in the ordinary course of the service.

Transfers outside the EEA

Some sub-processors are established in the United States and receive data there in the course of their function: Stripe, Google, Twilio, Resend, Vercel and Sentry. Those transfers rely on the European Commission's Standard Contractual Clauses together with the Swiss addendum recognised by the FDPIC, and, where the provider is certified, on the EU–US and Swiss–US Data Privacy Frameworks. We will send you the safeguards that apply to any specific provider on request.

Switzerland and the EEA

We are established in Switzerland, which the European Commission recognises as offering an adequate level of protection, so data may move between Switzerland and the EEA without additional safeguards.

Retention and Deletion

What we delete automatically

Measurement events are deleted after 730 days. Records of emails we sent are kept for 180 days; API request logs and stored webhook payloads for 90 days; individual delivery attempts and background-job records for 30 days. A photo you delete is removed from underlying storage 30 days later. An email address that hard-bounced is suppressed for 90 days so sending can resume if the mailbox returns; an unsubscribe or spam complaint is honoured permanently.

What we do NOT delete on a timer

Enquiries, bookings and admission applications have no automatic expiry. They persist until you delete them, until the family closes their account, or until this agreement ends. An earlier version of this document promised a 24-month retention period; no such deletion existed, and rather than leave a promise we do not keep, we state the position accurately. As controller, the retention period for that data is yours to set — delete what you no longer need, and tell us if you want us to build a scheduled deletion for your school.

When the contract ends

On termination you may export your data through the dashboard. At your choice we will delete or return the personal data we hold as your processor, and we will do so within 30 days of your request. Records we must keep by law survive that deletion — chiefly invoices and accounting records, for ten years under Article 958f of the Swiss Code of Obligations. If you give no instruction, we delete.

Backups

Our database provider keeps encrypted backups on a rolling schedule, and deleted data can persist in a backup until it rotates out. Backups are used only to restore the service after a failure, never to reinstate data that was deleted on request.

Personal Data Breaches

Telling you

If we become aware of a personal data breach affecting data we process for you, we will notify you without undue delay and in any event within 72 hours of becoming aware of it. Because you are the controller, notifying your supervisory authority and, where required, the affected individuals is your decision and your duty — our job is to get you the facts fast enough to make it.

What we will tell you

The nature of the breach, the categories and approximate number of data subjects and records involved, the likely consequences, the measures we have taken or propose to take, and a contact point for further information. Where we cannot provide everything at once we will send what we have and follow up rather than wait.

Cooperation

We will cooperate with your own assessment and notification, provide additional information as it emerges, and support any communication you need to make to affected individuals.

Assistance and Audits

Data subject requests

The dashboard lets you find, correct, export and delete the records you hold, so most requests you receive can be answered without us. Where you need more, we will assist you, taking into account the nature of the processing and the information available to us. If a data subject comes to us directly about data we hold on your behalf, we will not answer it for you — we will forward it to you promptly and tell them we have.

Impact assessments and consultation

We will give you the information you reasonably need for a data protection impact assessment or a prior consultation with a supervisory authority, to the extent it concerns processing we perform for you. Note that the assessment itself is the controller's — given the platform can carry children's data and health information, you should consider whether one is required for your use.

Information and audits

On reasonable notice, and no more than once a year unless a breach or a regulator's instruction makes another necessary, we will make available the information needed to demonstrate compliance with this agreement and submit to an audit or inspection conducted by you or an auditor you appoint. Audits happen during business hours, must not disrupt the service or expose another school's data, and the auditor must accept confidentiality terms.

General Terms

Precedence and liability

Where this agreement conflicts with the subscription terms on the subject of data protection, this agreement prevails. Liability is governed by the limitations in the subscription terms, except where data protection law does not permit them to apply.

Governing law and jurisdiction

This agreement is governed by Swiss law. The courts of Lausanne, Switzerland have jurisdiction, without prejudice to any mandatory right a data subject has to bring proceedings elsewhere.

Changes to this agreement

We will give you at least 30 days' notice of a material change, by email to your account's owner and on this page. If a change materially reduces your protection you may terminate the affected service for the remainder of the term. The date at the top always reflects the current version.

Annex I — Description of the Processing

Parties

Controller (exporter): the subscribing school, as identified in its account and on its invoices. Processor (importer): Lucien Pochon, trading as Swiss Private Schools, Avenue de Maria-Belgia 1, 1006 Lausanne, Switzerland; contact privacy@swissprivate-schools.ch. Roles are as set out in section 1 of this agreement.

Categories of data subjects

Parents, guardians and other adults who contact the school through the platform; the students on whose behalf they enquire or apply, who are usually minors; and the school's own staff who hold platform accounts.

Categories of personal data

Identification and contact data (name, email address, telephone number, country, preferred language); enquiry and booking content, including free-text messages; admission application data, comprising the answers to the questions the school configured and any files uploaded with them; scheduling data for visits, open days and interviews; payment identifiers where the school charges an application fee; the school's staff account, role and authentication records; and usage data relating to the school's public listing.

Special categories of personal data

Health-related and comparable data may be processed where the school's own form asks for it — medical, dietary, allergy, medication or learning-support questions — and where a family completes a free-text special-educational-needs field on a student profile. The platform does not require any such field. Where present, the restriction is that we process it only to store, display and transmit it to the school that asked for it: we do not analyse it, profile on it, use it to order or score anything, or disclose it to any other party. Because the data subjects are frequently children, the school should satisfy itself that its questions are necessary and proportionate.

Nature, purpose and frequency

Nature: collection, recording, organisation, storage, retrieval, display to authorised users of the controller, transmission to the controller, and erasure. Purpose: providing the subscribed service, as set out in section 2. Frequency: continuous for the duration of the subscription, driven by the actions of families and of the school's staff.

Duration

For the term of the subscription and the wind-down in section 6. Retention of individual records is as stated in that section: the periods listed there are enforced automatically; enquiries, bookings and applications have no automatic expiry and are retained until the controller, the data subject, or termination removes them.

Annex II — Technical and Organisational Measures

Encryption and pseudonymisation

All data in transit is protected by TLS. Data at rest, including backups, is encrypted by our infrastructure providers. Passwords are stored only as salted hashes. Website audience measurement uses a random first-party identifier and a daily-rotating one-way hash; raw IP addresses are not persisted.

Access control and identification

Access to the controller's data requires authentication; two-factor authentication is available to all users and mandatory for our administrators. Within the controller's account, authorisation follows the role the controller assigns, which it may change or revoke at any time. Access to production systems is limited to the personnel who operate the platform, all of whom are bound to confidentiality. We hold no standing access to a controller's dashboard: support access must be requested, approved by an owner of that school, is time-limited, and is written to an audit log the school can read.

Confidentiality and separation of controllers

Separation between schools is enforced in the database itself by row-level security, so one school's account cannot read another's records even if application code is defective — isolation does not depend on every query being written correctly. Sensitive administrative operations are recorded in an audit log.

Integrity, availability and restoration

Our database provider maintains encrypted backups on a rolling schedule, from which the service can be restored after a failure. Backups are used only for restoration and never to reinstate data erased on request. Availability targets are those published in our service-level statement.

Testing, assessment and assurance — stated honestly

We do not hold ISO 27001, SOC 2 or an equivalent certification, we do not commission external penetration tests on a fixed schedule, and we operate no formal periodic review of sub-processors. Assurance rests on the architectural measures above, on automated tests that run before every deployment, and on error monitoring. A controller requiring certified assurance should raise it before subscribing; this annex is deliberately explicit so that no reviewer has to infer it.

Data minimisation, erasure and portability

The platform collects the fields the controller configures and no others; optional fields are marked as such to data subjects. The controller can find, correct, export and erase records from the dashboard, and export is available in standard machine-readable formats. Automatic deletion applies to the categories and periods stated in section 6.

Measures binding sub-processors

Each sub-processor is engaged under a written agreement imposing obligations no less protective than these, receives only the data its function requires, and is listed in Annex III. Transfers outside the EEA are covered by the Standard Contractual Clauses with the Swiss addendum recognised by the FDPIC, as set out in section 5.

Annex III — Sub-Processors

The authorised list

The sub-processors authorised under this agreement are those named in section 4 (Sub-Processors), together with the function each performs and whether it is engaged only for visitors who accept non-essential cookies. That section is the authoritative list and is not duplicated here: two copies of a sub-processor list is precisely how this document and our privacy policy came to disagree with each other, which is the error this rewrite exists to correct.

Location and transfer basis

Database, file storage and backups are in the European Union. Sub-processors established in the United States receive data there in the course of their function; the transfer basis for each is stated in section 5. A copy of the safeguards applying to any named sub-processor is available on request.

Notification of changes

General authorisation is given for the listed sub-processors. Additions and replacements follow the 30-day notice and 14-day objection procedure in section 4, with the termination right that accompanies an unresolved objection.

Questions and supervisory authority

Data protection questions about this agreement go to privacy@swissprivate-schools.ch, or by post to the address in section 1 marked “Data Protection”. We answer them ourselves — we have not appointed a formal Data Protection Officer under Article 37 GDPR, and this document no longer claims one. This agreement is governed by the Swiss Federal Act on Data Protection and, where it applies, the EU General Data Protection Regulation.

The Swiss supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC), at www.edoeb.admin.ch