Data Processing Agreement (DPA)

Last updated: 2025-12-26

This Data Processing Agreement ("DPA") forms part of the contract between Global Innovator Fund (CHE-114.042.614) ("Processor", "Planck") and the customer entity that uses the Planck Security services ("Customer", "Controller").

1. Scope and roles

• The Customer is the Controller of personal data processed through the Services.
• Planck processes personal data on behalf of the Customer as Processor.

2. Processing details

• Subject matter: provision of the Services (organization management and verification workflows).
• Duration: for the term of the subscription and as needed for deletion/return.
• Categories of data subjects: Customer users, administrators, end users, and other individuals whose data is submitted.
• Categories of data: identifiers, contact data, authentication data, verification metadata, audit logs, and support communications.

3. Processor obligations

Planck will:

• process personal data only on documented instructions of the Customer;
• ensure personnel confidentiality;
• implement appropriate technical and organizational security measures;
• assist the Customer with data subject requests where applicable;
• notify the Customer of personal data breaches without undue delay;
• delete or return personal data upon termination, subject to legal retention.

4. Sub-processors

The Customer authorizes the use of sub-processors necessary to provide the Services (e.g., hosting providers, authentication and billing providers). Planck will maintain appropriate contracts with sub-processors.

5. International transfers

Where sub-processors process data outside Switzerland/EU/EEA, Planck will use appropriate safeguards such as standard contractual clauses.

6. Audits

Upon reasonable request and subject to confidentiality, Planck will provide information necessary to demonstrate compliance (e.g., security documentation) and may allow audits where commercially reasonable.

7. Contact

DPA inquiries: legal@plancksecurity.com