Data processing agreement.

01 Subject matter and duration of the agreement

This agreement governs the rights and obligations of Aeberli Treuhand AG, Zimmergasse 17, 8008 Zurich (hereinafter the "Processor") and its individual clients (hereinafter, uniformly, the individual "Controllers", together the "Parties") in connection with data-protection processing on behalf. This agreement applies to all activities in which the Processor processes, or arranges for the processing of, personal data in whole or in part on behalf of and on the instructions of the responsible Controller.

The Processor provides fiduciary and accounting services to the Controller on the basis of a separate contractual relationship.

This agreement enables the Parties to meet their obligations under the applicable data-protection law when the Processor processes personal data for the Controller. It specifies the data-protection obligations of the Parties that arise from the processing on behalf described in the separate contract. The provisions of this agreement apply to all activities connected with the separate contractual relationship in which the Processor and its staff, or persons instructed by the Processor, come into contact with personal data originating from the Controller or collected on behalf of the Controller.

The term of this agreement follows the term of the separate contractual relationship and may only be terminated together with it, whether ordinarily or extraordinarily.

02 Nature of processing and types of data

The Processor obtains access to personal data on behalf of the Controller. This includes the activities described in the separate contractual relationship.

The activities of the Processor may include, among others:

• Receipt, processing and dispatch of payroll data
• Preparation and dispatch of payslips
• Administration of employee master data
• Preparation of certificates and reports to authorities and insurers
• Access to and processing of data at the Controller or directly at its client

Personal data required to perform these activities:

• Master data of individuals
• Employee master data
• Communication data
• Contract master data
• Payroll data
• Social-security and health data
• Settlement and payment data
• Any further personal data arising from the separate contractual relationship

03 Obligations of the Processor

3.1 The Processor and the persons under its authority who have access to the personal data may process the data only within the scope of the mandate and the instructions of the Controller (collect, store, retain, use, alter, disclose, archive, delete or destroy, etc.), unless an exceptional case applies, e.g. in connection with investigations by criminal prosecution authorities. In such cases the Processor notifies the Controller of the legal order, provided that the relevant law does not prohibit such notification on grounds of overriding public interest. In the event of a change of the persons authorised to give instructions, or a longer-term unavailability of the persons named, the successor or deputy must be identified to the contract partner. Where an instruction of the Controller infringes applicable statutory requirements, the Processor will notify the Controller of this without delay.

3.2 The Processor uses the data entrusted to it for processing exclusively for the agreed purpose and not for its own purposes. It does not produce copies or duplicates of the data without the knowledge of the Controller, save for back-up copies.

3.3 The Processor is not entitled to delete or otherwise destroy data processed on behalf on its own initiative. Any deletion or destruction of the data may take place only on the basis of a written instruction from the Controller, unless a statutory basis requires such a measure.

3.4 Data processing outside the company premises of the Processor, such as in the home office of employees, is hereby authorised by the Controller. In cases where data processing takes place in a private home, appropriate contractual security measures must be ensured.

3.5 The Processor undertakes to treat as confidential all personal data that comes to its knowledge in the context of this data processing agreement. This obligation remains in force after the termination of this agreement. The Processor will ensure that all persons who have access to the personal data or are engaged in its processing are informed of the duty of confidentiality and are bound accordingly by contract.

3.6 The Processor is obliged to notify the Controller of any data-protection breaches or irregularities without delay and to disclose all relevant details of the breach, including the nature of the breach, the personal data affected, the possible consequences and the measures taken or planned to contain the incident and minimise any negative consequences.

3.7 At the request of the Controller, the Processor is obliged to rectify data if it is inaccurate or incomplete. If a data subject asserts their rights directly with the Processor, in particular the right of access, delivery or portability, the right to object or the right to rectification, deletion or destruction of the data, the Processor will not act on its own initiative but will refer the person to the Controller without delay and await its instructions.

3.8 The Processor may only provide information about personal data from the processing relationship to third parties or the data subject after prior instruction or approval by the Controller.

3.9 After completion of the contractual work, the Processor undertakes to delete or destroy in a data-protection-compliant manner all documents and results of use arising in the context of this data processing agreement, and to return to the Controller all documents, data and data carriers made available to it in the context of the separate contractual relationship. Deletion or destruction takes place unless a statutory basis stands in the way. It should be noted that the Processor may be legally required to retain certain data for a defined period. Following the expiry of that period, the data concerned is likewise deleted or destroyed in a data-protection-compliant manner.

3.10 The Processor confirms that it is familiar with the relevant data-protection provisions and undertakes to comply with them in full.

04 Technical and organisational measures

4.1 The Processor undertakes to take appropriate technical and organisational measures to ensure the security of the personal data.

4.2 The Processor takes suitable technical measures to protect the personal data against unauthorised access, loss or destruction. This includes the use of firewalls, encryption technologies, access controls and other suitable security precautions.

4.3 In addition, the Processor implements appropriate internal organisational measures to ensure that only authorised employees have access to the personal data. This includes, among other things, training employees on data-protection provisions and implementing access restrictions.

4.4 These technical and organisational measures are reviewed regularly and updated where necessary to correspond to current technological standards and the applicable data-protection provisions.

05 Place of data processing

5.1 Data is processed exclusively in Switzerland or in a third country that meets the statutory data-protection requirements.

5.2 If data is processed abroad or transferred abroad, compliance with data-protection requirements is ensured beforehand:

Outsourcing to a sub-processor in a member state of the European Union (EU) or the European Economic Area (EEA), or in a country that has an adequate level of data protection under the applicable Swiss DPA, is permitted provided that a contractual arrangement in accordance with the DPA is concluded (a so-called data processing agreement).

Outsourcing to a sub-processor in a country that does not have an adequate level of data protection is permitted provided that the Processor and the sub-processor conclude a contractual arrangement in accordance with the DPA (a so-called data processing agreement, DPA) and that the specific requirements of the DPA are met, in particular:

because the Processor ensures adequate data protection by concluding standard data-protection clauses with the sub-processor which the FDPIC has previously approved, issued or recognised, and where necessary supplements the standard data-protection clauses with additional measures.

06 Sub-processor relationships

6.1 As a rule, the Processor provides its services itself. The use of sub-processors is only permitted with the prior written consent of the Controller.

6.2 A sub-processor relationship requiring consent exists where the Processor engages further processors to perform all or part of the services agreed in the contract.

6.3 The Processor is obliged to notify the Controller in writing of changes relating to the sub-processor, such as the addition or replacement of a sub-processor.

6.4 Sub-processors must be selected carefully according to their suitability and reliability. Engaging further processors in third countries may only take place where the statutory data-protection requirements are met.

6.5 The Processor is obliged to pass on to the sub-processor all data-protection obligations under this agreement contractually and to ensure that the sub-processor complies fully with the data-protection provisions and contractual requirements.

07 Liability

7.1 The Controller is responsible vis-à-vis the data subject for compensation of damage or other claims arising in connection with the processing of personal data. Direct recourse against the Processor is permitted only where the Processor has acted with gross negligence or has intentionally breached the provisions of this agreement.

08 Final provisions

8.1 Amendments or additions to this agreement, or to parts of it, must be made in writing.

8.2 Should any provision of this agreement be invalid or unenforceable, or should this agreement contain a gap, the validity and enforceability of the remaining provisions of the agreement shall not be affected. The invalid or unenforceable provision, or the gap, shall be replaced by a valid and enforceable provision that in economic terms comes closest, from the point of view of the Parties, to the objective pursued by the invalid or unenforceable provision.

8.3 This agreement is governed exclusively by Swiss law, to the exclusion of conflict-of-laws rules. The place of jurisdiction is Zurich.