This agreement governs how Halvic Labs GmbH ("HALVIC") processes personal data on behalf of its customers ("the customer") when it runs ALVIREQ for them. It supplements the terms of service and meets Art. 9 of the Swiss Federal Act on Data Protection (FADP) and, where applicable, Art. 28 of the General Data Protection Regulation (GDPR).
1. Subject and duration
HALVIC runs the customer's ALVIREQ instance and in doing so processes the data its people store in it or retrieve through connected services. The agreement applies as long as HALVIC processes such data, also after the subscription ends until the data is deleted.
2. Nature and purpose
Storing, retrieving, searching and passing data to the chosen AI model to answer people and carry out their tasks; backups; support at the customer's request.
3. Data subjects and data
The customer's people and people whose data they process in ALVIREQ (for example contacts, customers, suppliers). Account data, conversation content, files, emails, appointments, bank statement entries and other content the customer processes. ALVIREQ processes sensitive personal data only if the customer enters it.
4. Instructions
HALVIC processes the data only on the customer's instructions, as given by the contract and by using ALVIREQ. If HALVIC considers an instruction unlawful, it informs the customer.
5. Confidentiality
Everyone at HALVIC with access to customer data is bound to confidentiality. HALVIC reads an instance's content only when the customer asks for it for support or the law requires it.
6. Security
HALVIC takes the technical and organisational measures described in the security overview and keeps them up to date.
7. Subprocessors
The customer approves the listed subprocessors. HALVIC announces new or changed subprocessors at least 30 days in advance; the customer may object for good reason and, if no solution is found, terminate the subscription as of that date. HALVIC binds its subprocessors to equivalent data protection.
8. Disclosure abroad
Data leaves Switzerland only if the customer chooses a plan with a model outside Switzerland (Claude by Anthropic, USA), and for card payments. HALVIC relies on appropriate safeguards under Art. 16 FADP.
9. Assistance
HALVIC helps the customer answer requests from data subjects and meet its obligations on security, notifications and data protection impact assessments, as far as reasonably possible.
10. Data security breaches
HALVIC notifies the customer of a data security breach affecting its data without undue delay, with the information the customer needs for its own notification.
11. Return and deletion
After the contract ends, the customer can export its data for 30 days. HALVIC then deletes the instance and its data; backups are overwritten in their regular cycle, unless the law requires retention.
12. Audits
HALVIC gives the customer the information it needs to check compliance with this agreement. On-site audits are possible with advance notice and at the customer's cost. The German version of this agreement is binding.