Data Processing Agreement (DPA)
This Data Processing Agreement forms part of the Terms of Service between:
Controller: Customer / Individual Researcher
Processor: GWC GmbH, Zug, Switzerland
1. Subject Matter and Duration
This DPA governs the processing of personal data by GWC on behalf of the Controller for the duration of the use of THOA Services.
2. Nature and Purpose of Processing
Processing includes:
- Storage
- Computation
- Analysis
- Transfer as instructed by the Controller
3. Types of Personal Data
May include:
- Identifiers
- Research data
- Genetic or health-related data
- Metadata and logs
4. Obligations of the Processor
GWC shall:
- Process data only on documented instructions
- Ensure confidentiality
- Implement appropriate security measures
- Assist with data subject requests
- Notify of personal data breaches without undue delay
5. Subprocessing
Controller authorizes GWC to engage subprocessors. GWC shall ensure equivalent data protection obligations.
6. International Transfers
Transfers outside Switzerland/EEA shall be subject to SCCs or equivalent safeguards.
7. Deletion or Return of Data
Upon termination, GWC shall delete or return personal data in accordance with customer instructions, subject to backup retention.
8. Audits
Controller may audit compliance upon reasonable notice, subject to confidentiality and security constraints.
9. Liability
Liability shall be governed by the Terms of Service.