DPA

Data processing agreement (DPA) under Art. 9 revDSG between the advertiser (advertising customer or agency) as controller and the operator of the booked screens that issues this agreement (the "operator") as processor. The marketplace states the operator's name and address at the time of booking. This agreement applies together with the GTC and takes precedence over them in data protection matters in the event of conflict.

1. Subject matter and duration

1.1 Subject matter

The operator plays the advertiser's campaigns out on its screens, reviews the subjects and charges for the days run. The campaigns are created and booked through the advertiser portal of an advertising marketplace (the "marketplace"), for example regiowerber.ch, which is provided by the operator of the technical platform (the "platform"). In doing so, the operator processes personal data solely on behalf of and on the instructions of the advertiser.

1.2 Duration

The processing on behalf of the advertiser lasts as long as the main contract and ends when it ends.

2. Nature and purpose of the processing

The operator processes the data in order to:

• provide and run the advertiser portal
• administer the advertising account
• store the subjects and the chosen locations and prepare the subjects for the screens, for example by converting a video
• review and approve the subjects
• deliver the subjects to the chosen screens
• bill the days run
• ensure technical operation and find faults

The anonymous counts from the screens (motion and touch with no personal reference) are not personal data and do not fall under this agreement. See the privacy policy.

3. Types of personal data

• account data of the users of the advertiser portal, such as name and email address
• billing and contact details of the advertiser
• the subjects supplied by the advertiser, including the details they contain, for example a name shown, a contact detail or people in an image or video
• technical log data from operation, such as the IP address and time of an access

4. Categories of data subjects

• employees of the advertiser who use the advertiser portal
• people whose details appear in the subjects
• people who visit the website of the marketplace

5. Obligations of the operator as processor

The operator undertakes:

• to process the data only on the documented instructions of the advertiser and for the agreed purposes. The advertiser gives instructions as a rule through the use of the advertiser portal and its settings, otherwise in text form to the contact point named below
• to inform the advertiser if it considers an instruction unlawful, and to suspend its execution until the matter is clarified
• to bind the people entrusted with the processing to confidentiality
• to implement the technical and organisational measures under section 6 and keep them in line with the state of the art
• to support the advertiser with requests for information, rectification and erasure from data subjects, as far as the means of the advertiser portal allow
• to support the advertiser in meeting its own obligations, for example when notifying a data security breach
• to provide the advertiser on request with the information and evidence it needs to verify this agreement

6. Technical and organisational measures

• Storage exclusively in Switzerland: database, subjects, media, invoices and backups are kept in Amazon Web Services data centres in Zurich.
• Encryption: stored data with the platform's own key in the AWS Key Management Service (KMS), located in Zurich; data in transit with TLS.
• Access: sign-in through Amazon Cognito with two-factor authentication, permissions per role and advertiser, separation of data per advertiser (tenant separation).
• Screens: every screen identifies itself with its own cryptographic key and only receives the content intended for it.
• Backups: continuous backup of the database with the ability to restore an earlier point in time.
• Traceability: security-relevant events are logged.
• Data minimisation: the screens' sensors count anonymously, without a camera and with no personal reference.
• Infrastructure: the Amazon Web Services data centres are certified to ISO 27001 and SOC 2, among others.

7. Sub-processors

The operator uses up to three service providers (sub-processors) to run the advertiser portal and the playout.

The key point first: your account, your subjects, the chosen locations and your invoices are stored exclusively in Switzerland, in Amazon Web Services (AWS) data centres in Zurich, as are the backups. They are encrypted with the platform's own key, which is also located in Zurich.

Where data only passes through or is processed without staying there. In some technical processes data passes encrypted through locations outside Switzerland:

• Access to website, advertiser portal and media: your browser and the screens connect to the nearest access point of the AWS worldwide network (Amazon CloudFront), in Europe usually one in the EU. The access point forwards requests encrypted to Zurich. It keeps subjects and images shown on the screens and in the advertiser portal in its cache for a limited time so that they load quickly; they are stored only in Zurich. A small function at the access point also checks the sign-in. Its technical error logs arise in the region of the access point and are deleted after 30 days.
• Access logs: CloudFront records which page was retrieved when and from which IP address, and delivers these logs to Zurich. They are kept there for 180 days, and K-I-Soft analyses them on behalf of the operator without cookies (Munot).
• Real-time connection: the screens and the open advertiser portal are connected through an AWS data centre in Frankfurt (Germany). Status messages, control commands and notices that something has changed pass through it, but no subjects. Technical connection logs with device identifiers are kept there for 30 days.
• Converting videos: an uploaded video is converted for the screens in Frankfurt, because AWS does not offer this service in Zurich. The video is read from Zurich for this and the result is written back there; it does not remain in Frankfurt.

According to the decision of the Swiss Federal Council, Germany and the EU provide data protection equivalent to that of Switzerland.

How data is protected if it reaches the USA. This can happen when a request runs through an access point in the USA. Amazon Web Services is also a company based in the USA. For these cases the AWS data processing agreement binds the company to the protection required by Swiss data protection law: through the EU standard contractual clauses (Decision 2021/914) and the Swiss-U.S. Data Privacy Framework, to which AWS is a party.

Services without personal data. For the map of locations and the tiles, the platform queries public services in Switzerland: swisstopo for the location of a screen, MeteoSwiss for the weather and opentransportdata.swiss for departures. They receive only the address or location of the screen, no personal data, and are therefore not sub-processors.

Your consent and your right to object. By this agreement the advertiser consents to the use of these service providers. The operator binds each of them to an equivalent level of data protection. If it wants to add or replace a service provider, it informs the advertiser in advance by email to the owners and administrators of its organisation, and the advertiser can object.

8. Rights of the advertiser

The advertiser has the right:

• to give instructions on the processing
• to verify compliance with this agreement. The operator provides the necessary information and evidence on request. An on-site review is possible by prior arrangement and without disrupting operations; the advertiser bears the cost of a review it has initiated
• to require the erasure or return of the data processed on its behalf after the agreement ends

9. Data security breaches

If the operator becomes aware of a breach of data security affecting data processed on behalf of the advertiser, it notifies the advertiser without delay, and at the latest within 72 hours of becoming aware of it, and supports it with the available information, so that it can meet its own notification duties.

10. Return and erasure

After the agreement ends, the operator deletes the data processed on behalf of the advertiser or, at the advertiser's request, returns it in a common format. Statutory retention obligations are reserved, in particular the ten-year period for invoices and accounting records (Art. 958f CO).

11. Contact

The advertiser sends questions and instructions concerning data protection to the operator, at the address stated on its invoices and named by the marketplace at the time of booking.