DPA

Data processing agreement (DPA) under Art. 9 revDSG between the customer (property management) as the controller and Quartiero GmbH (Quartiero) as the processor. It applies together with the terms and prevails on data protection questions in the event of conflict.

1. Subject matter and duration

1.1 Subject matter

Quartiero operates the platform through which the customer maintains its content and plays it on the screens in its buildings. In doing so, Quartiero processes personal data solely on behalf of and on the instructions of the customer.

1.2 Duration

The processing on behalf of the customer lasts as long as the main contract and ends when that contract ends.

2. Nature and purpose of processing

Quartiero processes the data in order to:

• provide and operate the platform, including the management portal and the device connection
• manage the customer's accounts and organisations
• store the maintained content and media and prepare them for the screens, for example by converting a video
• assemble the playlist and deliver it to the assigned screens
• invoice the ordered services
• ensure technical operation and find faults

The anonymous counts from the screens (movement and touch without any link to a person) are not personal data and are not covered by this agreement. See the privacy policy.

3. Types of personal data

• account data of the portal users, such as name and email address
• billing and contact details of the customer
• content maintained by the customer, including the details it contains, for example contact details of the management or a caretaker in a notice, and images or videos in which people may be visible
• technical log data from operation, such as the IP address and time of an access

4. Categories of data subjects

• the customer's staff who use the portal
• persons whose details appear in the maintained content
• persons who visit the websites and portals

5. Obligations of Quartiero as processor

Quartiero undertakes:

• to process the data only on the customer's documented instructions and for the agreed purposes. As a rule the customer gives instructions through the use of the portal and its settings, otherwise in text form to the contact point named below
• to inform the customer if it considers an instruction unlawful, and to suspend its execution until the matter is clarified
• to bind the persons involved in the processing to confidentiality
• to implement the technical and organisational measures under section 6 and keep them in line with the state of the art
• to support the customer with data subjects' access, rectification and deletion requests, as far as the platform's means allow
• to support the customer in meeting its own obligations, for example when reporting a data security breach
• to provide the customer on request with the information and evidence it needs to verify this agreement

6. Technical and organisational measures

• Storage exclusively in Switzerland: database, content, media, invoices and backups are kept in Amazon Web Services data centres in Zurich.
• Encryption: stored data with the platform's own key in the AWS Key Management Service (KMS), located in Zurich; data in transit with TLS.
• Access: sign-in through Amazon Cognito with two-factor authentication, permissions per role and organisation, separation of the data per organisation (tenant isolation).
• Screens: every screen identifies itself with its own cryptographic key and only receives the content of its screen location.
• Backups: continuous backup of the database with the ability to restore an earlier point in time.
• Traceability: security-relevant events are logged.
• Data minimisation: the screens' sensors count anonymously, without a camera and without any link to a person.
• Infrastructure: the Amazon Web Services data centres are certified to ISO 27001 and SOC 2, among others.

7. Sub-processors

Quartiero uses three service providers (sub-processors) to operate the platform.

The key point first: your accounts, content, media and invoices are stored exclusively in Switzerland, in Amazon Web Services (AWS) data centres in Zurich, as are the backups. They are encrypted with the platform's own key, which is also located in Zurich.

Where data only passes through or is processed without staying there. In some technical processes data passes encrypted through locations outside Switzerland:

• Access to websites, portal and media: your browser and the screens connect to the nearest access point of the AWS worldwide network (Amazon CloudFront), in Europe usually one in the EU. The access point forwards requests encrypted to Zurich. It keeps images, videos and documents shown on the screens and in the portal in its cache for a limited time so that they load quickly; they are stored only in Zurich. A small function at the access point also checks the sign-in. Its technical error logs arise in the region of the access point and are deleted after 30 days.
• Access logs: CloudFront records which page was retrieved when and from which IP address, and delivers these logs to Zurich. They are kept there for 180 days, and K-I-Soft analyses them without cookies.
• Real-time connection: the screens and the open portal are connected through an AWS data centre in Frankfurt (Germany). Status messages, control commands and notices that something has changed pass through it, but no content. Technical connection logs with device identifiers are kept there for 30 days.
• Converting videos: an uploaded video is converted for the screens in Frankfurt, because AWS does not offer this service in Zurich. The video is read from Zurich for this and the result is written back there; it does not remain in Frankfurt.

According to the decision of the Swiss Federal Council, Germany and the EU provide data protection equivalent to that of Switzerland.

How data is protected if it reaches the USA. This can happen when a request runs through an access point in the USA. Amazon Web Services is also a company based in the USA. For these cases the AWS data processing agreement binds the company to the protection required by Swiss data protection law: through the EU standard contractual clauses (Decision 2021/914) and the Swiss-U.S. Data Privacy Framework, to which AWS is a party.

Services without personal data. For the tiles and the map, the platform queries public services in Switzerland: swisstopo for the location of a screen site, MeteoSwiss for the weather and opentransportdata.swiss for departures. They receive only the address or location of the screen site, no personal data, and are therefore not sub-processors.

Your consent and your right to object. By this agreement the customer consents to the use of these service providers. Quartiero binds each of them to an equivalent level of data protection. If Quartiero wants to add or replace a service provider, it informs the customer in advance by email to the owners and administrators of its organisation, and the customer can object.

8. Customer rights

The customer has the right:

• to give instructions on the processing
• to verify compliance with this agreement. Quartiero provides the necessary information and evidence on request. An on-site review is possible after prior arrangement and without disrupting operations; the customer bears the cost of a review it initiates
• to require the deletion or return of the data processed on its behalf after the end of the contract

9. Data security breaches

If Quartiero becomes aware of a data security breach affecting data processed on behalf of the customer, it reports this to the customer without delay, and at the latest within 72 hours of becoming aware of it, and supports the customer with the available information, so that the customer can meet its own reporting obligations.

10. Return and deletion

At the end of the contract Quartiero deletes the data processed on behalf of the customer or, at the customer's request, returns it in a common format. Statutory retention obligations remain reserved, in particular the ten-year period for invoices and accounting records (Art. 958f CO).

11. Contact

The customer directs data protection questions and instructions to:

Quartiero GmbH
Bernstrasse 27b
3122 Kehrsatz
Switzerland
info@quartiero.ch