Data Processing Agreement (DPA)

Last updated: 2 November 2026 · Agreement on processing on behalf under Art. 28 GDPR and Art. 9 of the Swiss Data Protection Act (revFADP) between you as the customer and TEISENDA GmbH.

1. Subject matter, parties & term

This agreement applies when you use the TEISENDA Hosting platform and we process personal data on your behalf in doing so. You are then the controller, and TEISENDA GmbH, Alte Zwillikerstrasse 9, 8908 Hedingen, Switzerland ("we") is the processor.

The agreement forms part of the usage contract (Terms and Conditions, section 10) and takes precedence over the Terms and Conditions. It applies for as long as the usage contract runs and beyond that until we have deleted all data from the processing.

This agreement does not cover the data for which we ourselves are the controller: your account, the management of the Spaces, billing and the security of the platform. The Privacy Policy applies to these.

2. Nature, purpose and scope of the processing

The purpose is to provide you with the platform as provided for in the usage contract. In detail:

The platform is not designed for special categories of personal data (Art. 9 GDPR, such as health data). Only process such data there if the measures in Annex 1 are sufficient for it.

3. Instructions

We process the data only on your documented instructions. These follow from the usage contract, from this agreement and from what you set and initiate in the platform or via a connected application. If we consider an instruction to be unlawful, we will inform you.

4. Confidentiality

At our company, only persons who need access to the data for their tasks and who are bound to confidentiality are given access to it.

5. Security of processing

We take the technical and organisational measures in Annex 1. We may develop them further, provided that the level of protection does not decrease.

6. Sub-processors

You agree that we engage the sub-processors in Annex 2. We contractually bind them to the same obligations that we have towards you, and we are answerable for them.

If we wish to engage an additional sub-processor or replace one, we announce this at least 30 days in advance: on this page and by email to the email address for invoices of your Space or, if no billing details are stored, to the members with the Owner role. You may object for good cause. If we cannot do without the provider, you may terminate the usage contract with effect from the day on which the change takes effect.

7. Assistance

If a data subject contacts us with a request concerning your data, we forward it to you. We assist you, within reasonable limits, in answering requests from data subjects and in fulfilling your obligations regarding security, the notification of breaches and data protection impact assessments.

8. Personal data breaches

If we discover that the security of your data has been breached, we notify you without undue delay, at the latest 48 hours after becoming aware of it, and tell you what we know: what happened, which data is affected and what we have done about it. The notification goes to the email address for invoices of your Space or, if no billing details are stored, to the members with the Owner role.

9. Deletion & return

If you mark a Space for deletion, we delete it permanently with all content after 30 days. If you delete a project, it is permanently deleted together with its versions and backups; there is no period for restoring it. If the hosting of a Space has been suspended after the end of a subscription, we delete its websites no earlier than 30 days after suspension and only after two warnings by email.

You upload the files of your websites yourself; keep your own copy. The platform does not offer an export function; until deletion you can read individual files via the Connector.

Deleted data remains in the backups until the respective snapshot expires: for the platform database 7 daily and 4 weekly snapshots, for the hosted websites 14 daily, 8 weekly and 6 monthly.

10. Evidence & audits

We provide you with the information you need to demonstrate compliance with this agreement. If it is not sufficient, you may, after giving reasonable notice, carry out audits yourself or through an auditor bound to confidentiality, provided that operations and the data of other customers remain protected.

11. Place of processing & transfers abroad

The servers are located at Hetzner in Germany (Falkenstein) and Finland (Helsinki). We access the data from Switzerland and from EU member states; an adequacy decision of the EU Commission exists for Switzerland. We do not transfer data from the processing to other countries.

If you connect Claude or ChatGPT to your Space, data goes on your instruction to the provider you have chosen. It is not our sub-processor; your own contract with it applies.

12. Liability & final provisions

Liability between you and us is governed by section 12 of the Terms and Conditions, to the extent permitted by law; claims of data subjects under Art. 82 GDPR remain unaffected. Otherwise, the choice of law and place of jurisdiction of the Terms and Conditions also apply to this agreement, unless mandatory data protection law provides otherwise.

Annex 1 – Technical and organisational measures

• Location. The servers of the platform, the hosting node and the Connector are located at Hetzner in Falkenstein (Germany), monitoring in Helsinki (Finland). There is no CDN in front of the hosted websites.
• Sign-in to the platform. We store passwords only as a hash. Accounts can be protected with a second factor (authenticator app, backup codes). Repeated failed sign-in attempts are limited. Before particularly consequential operations, such as deleting a Space, the platform requires the identity to be confirmed again.
• Permissions. Roles in the Space govern who may do what. The platform checks every request via the Connector for account, connection, Space, membership and role. Private websites can only be reached by signed-in members of the Space for whom they have been shared.
• Access to the servers. The servers are administered only via an encrypted internal network. Repeated failed attempts lead to an automatic block.
• Support access. TEISENDA staff access a customer account only if the customer asks them to; every access is logged.
• Transmission. Connections to the platform, to the Connector and to the hosted websites are encrypted via HTTPS. We provide TLS certificates for custom domains. We store access tokens of the Connector only as a hash.
• Logs. The platform keeps a log of security-relevant actions and, for each project, a log of changes. The system logs of the servers are continuously evaluated for attacks and disruptions.
• Backups. Daily backup, encrypted before it leaves the server, on storage at Hetzner.
• Payment data. Card numbers are processed only by the payment provider; they are not held by us.

Annex 2 – Sub-processors

Other service providers we use (email delivery, DNS, payment) process only data for which we ourselves are the controller; they are listed in the Privacy Policy.