Data Processing Agreement

Capitalised terms not defined here have the meaning given in the Agreement, in the GDPR, or in the FADP, as the context requires.

In this DPA:

• "Applicable Data Protection Law" means, as applicable to a given processing activity: (a) the GDPR and the ePrivacy Directive 2002/58/EC together with the national laws implementing them; (b) the UK GDPR and the Data Protection Act 2018; and (c) the Swiss Federal Act on Data Protection of 25 September 2020 (FADP / nLPD, SR 235.1) and the Data Protection Ordinance (DPO, SR 235.11).
• "Client Personal Data" means personal data contained in or derived from Client Content that Cigno processes on the Client's behalf under the Agreement.
• "Client Content" means all documents, files, data, prompts, instructions, configurations and outputs that the Client or its Authorised Users upload to, generate in, or transmit through the Services.
• "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing" and "Supervisory Authority" have the meanings given in the GDPR; where Swiss law applies, they are to be read as their FADP equivalents, and "Processor" includes an Auftragsbearbeiter under FADP Art. 9.
• "EU SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• "Sub-processor" means any third party engaged by Cigno to process Client Personal Data.
• "AI Provider" means a Sub-processor that supplies artificial-intelligence model inference used to deliver the Services.
• "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under s.119A of the Data Protection Act 2018, version B1.0, in force 21 March 2022.

References to "personal data" in a Swiss-law context are to data relating to identified or identifiable natural persons. The revised FADP no longer protects data relating to legal entities, and no provision of this DPA is to be read as extending Swiss data protection obligations to legal-entity data.

Incorporated documents. Annex I forms part of this DPA. Annex II (technical and organisational measures) and Annex III (authorised Sub-processors) are published separately at <https://cignoai.com/legal/security> and <https://cignoai.com/legal/sub-processors> respectively, are incorporated into this DPA by reference, and form part of it. The version of each in force at the Effective Date is recorded in the Particular Conditions. Cigno maintains a dated archive of every superseded version and makes it available to the Client on request. Each is published with its own version stamp, and the version in force at any date can be identified from that stamp and from the archive.

Cigno as Processor. In respect of Client Personal Data, the Client is the Controller (or a processor acting for a third-party controller) and Cigno is the Processor. Cigno processes Client Personal Data only to provide the Services and only on the Client's documented instructions.

Cigno as Controller. Cigno acts as an independent Controller in respect of: account administration and authentication data; billing and contract data; and its own marketing and business-development contacts. Cigno is also Controller of the operational security and telemetry data it generates about the running of the platform — log-in timestamps, IP addresses, device and browser data, error and performance traces — which it processes for security, fraud prevention, reliability and service-improvement purposes. That processing is governed by Cigno's Privacy Policy, not by this DPA, and Cigno is independently responsible for its compliance.

For the avoidance of doubt, the in-workspace audit trail — the record of actions taken on Client Content and of how each output was generated — is Client Content, and Cigno processes it as Processor under this DPA.

The Client's responsibilities. The Client warrants that:

(a) it has a valid legal basis under Applicable Data Protection Law for the Client Personal Data it processes through the Services, and for disclosing it to Cigno;

(b) it has given all notices and, where required, obtained all consents required for that processing, including in respect of AI-assisted processing and the transfers described in Clause 11 and Annex III;

(c) its instructions to Cigno comply with Applicable Data Protection Law;

(d) it will not upload special category data (GDPR Art. 9), criminal offence data (GDPR Art. 10) or sensitive personal data (FADP Art. 5(c)) unless it has notified Cigno in writing in accordance with Annex I §C and the Parties have agreed any additional measures required; and

(e) where the Client is itself a processor for a third-party controller, it has that controller's authorisation to engage Cigno as a sub-processor on these terms.

The Client's rights as Controller, for the purposes of the chapeau to GDPR Art. 28(3), are those set out in Clauses 3 (instructions), 7.3 (objection to Sub-processors), 8 (assistance), 10.1 and 10.2 (information and audit) and 12.1 (return or deletion).

Particulars. The particulars this DPA requires of the Client — its role under Clause 2.3(e), the data-residency election, any notification under Annex I §C, and its privacy contact — are those recorded in §7 of the Cigno Particular Conditions or, where the Client subscribed through the Platform, in the subscription process. Those particulars form part of Annex I to this DPA.

No independent purposes. Cigno does not determine the purposes or means of processing Client Personal Data. If Cigno were to do so, it would become a controller for that processing under GDPR Art. 28(10). Cigno confirms that it does not, and Clause 6.1, together with Clause 11.6 of the Agreement, is given specifically to preclude the most likely route by which it could.

Cigno processes Client Personal Data only on the Client's documented instructions, including as to international transfers, unless required to do otherwise by Union or Member State law to which Cigno is subject. Where such a legal requirement applies, Cigno will inform the Client of that requirement before processing, unless the law prohibits it on important grounds of public interest. Where Swiss law imposes a conflicting requirement, Cigno will notify the Client, will not act on it without the Client's instruction unless legally compelled to do so, and will apply Clause 4.4.

What counts as an instruction. The Client's documented instructions are constituted by: the Agreement; this DPA including its Annexes; the Client's and its Authorised Users' use of the Services' features and configuration settings; and any further written instruction the Parties agree.

Unlawful instructions. Cigno will immediately inform the Client if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend performance of that instruction until it is confirmed, withdrawn or amended. (GDPR Art. 28(3), second sub-paragraph.)

Instructions outside scope. Cigno may charge for, or decline, instructions that fall materially outside the scope of the Services as described in Annex I. Cigno will not decline an instruction that is necessary for the Client's compliance with Applicable Data Protection Law.

Swiss law overlay. Cigno processes Client Personal Data only in the manner in which the Client is itself permitted to process it, and confirms that no statutory or contractual duty of confidentiality to which it is subject prohibits it accepting this engagement. (FADP Art. 9(1)(a) and (b).)

Cigno keeps Client Personal Data confidential and does not disclose it except as permitted by this DPA.

Cigno ensures that every person it authorises to process Client Personal Data — employees, contractors and temporary staff alike — is bound by a written confidentiality undertaking that survives the end of their engagement, or is under an appropriate statutory duty of confidentiality. (GDPR Art. 28(3)(b).)

Cigno limits access to Client Personal Data to those personnel who need it to perform Cigno's obligations, on a least-privilege basis, and ensures that they process it only on the Client's instructions. (GDPR Art. 32(4).)

Compelled disclosure. If Cigno receives a legally binding request from a public authority for Client Personal Data, it will:

(a) notify the Client without undue delay before disclosing, unless legally prohibited;

(b) where prohibited from notifying, use reasonable efforts to obtain a waiver and document those efforts;

(c) disclose only the minimum amount of data legally required, having assessed the request carefully; and

(d) challenge the request where there are reasonable grounds to consider it unlawful under the law of the requesting authority or under applicable international law, and pursue available appeal routes.

Cigno will make available to the Client, on request, a record of the requests received to the extent it is lawfully able to do so.

Cigno implements and maintains the technical and organisational measures set out in Annex II, published and incorporated by reference under Clause 1.4, which are appropriate to the risks presented by the processing, taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of the processing. (GDPR Art. 32; FADP Art. 8 and DPO Arts. 1–6.)

Cigno may update the measures in Annex II from time to time provided the updated measures do not materially reduce the overall level of security. The current version is always available at <https://cignoai.com/legal/security>.

Assurance. Cigno's control environment is designed to the SOC 2 Trust Services Criteria and is structurally aligned with the principles of ISO/IEC 27001. Cigno does not hold a SOC 2 attestation or an ISO/IEC 27001 certificate as at the effective date of this DPA, and does not represent that it does; it will notify the Client if that position changes. Cigno commissions an independent third-party penetration test at least annually, as provided in Clause 17.5 of the Agreement.

The Client is responsible for the security decisions within its own control: user provisioning and deprovisioning, permission assignment, enforcement of multi-factor authentication on its accounts, choice of retention settings, and the security of its own endpoints and credentials.

Restrictions on use. Cigno will not retain, use or disclose Client Personal Data outside the relationship between the Parties, other than to provide the Services under the Agreement and this DPA or as Applicable Data Protection Law otherwise permits. Cigno will not sell or share Client Personal Data, and will not combine it with personal data it obtains from any other source. Cigno imposes materially the same restrictions on every Sub-processor and on every other provider that receives Client Content or Client Personal Data, by written contract.

Model training, human oversight and the AI Act. Cigno's commitment not to use Client Content to train, fine-tune, re-train, evaluate, benchmark or otherwise develop or improve any artificial-intelligence or machine-learning model, and the corresponding flow-down to every provider in its supply chain, are given in Clause 11.6 of the Agreement and warranted under Clause 18.2(e) of it. Human oversight of output, the accuracy of generated content, automated decision-making and the Parties' respective roles under the AI Act are dealt with in Clauses 11.2, 11.3, 11.9 and 11.10 of the Agreement. Those provisions apply to Client Personal Data, and nothing in this DPA limits them.

Retention at providers. Annex III states, for each AI Provider, the data retention position in force for Cigno's account. Where an AI Provider retains a limited abuse- or safety-monitoring capability that Cigno cannot contractually disapply, that carve-out is disclosed in Annex III. Cigno will not represent that no data is retained where a carve-out exists.

General authorisation. The Client gives Cigno general written authorisation to engage Sub-processors, subject to this Clause 7. The Sub-processors authorised as at the effective date are listed in Annex III, published and incorporated by reference under Clause 1.4.

Notice of change. Cigno will notify the Client at least 30 days before adding or replacing a Sub-processor, by email to the Client's nominated privacy contact and by updating the published list at <https://cignoai.com/legal/sub-processors>. The Client may subscribe to change notifications at that page. Where a Sub-processor is replaced because an existing provider has suspended, terminated, withdrawn or materially restricted Cigno's access to a service the Services require, and Cigno could not have given the full period of notice, Cigno will notify the Client as far in advance as it can and in any event without undue delay; the Client's objection right under Clause 7.3 is unaffected, and Cigno will not send Client Personal Data to the replacement before notifying the Client.

Objection. The Client may object to a new Sub-processor on reasonable data protection grounds by written notice within 30 days of Cigno's notification. If it does, the Parties will discuss the objection in good faith. If Cigno can provide the affected part of the Services without the Sub-processor, or can offer a reasonable alternative, but only at materially increased cost to Cigno, Cigno may offer that alternative at an adjusted fee reflecting the additional cost it directly incurs, and the Client may accept or decline it. If Cigno cannot provide the affected part of the Services without the Sub-processor and cannot offer a reasonable alternative within 30 days, or the Client declines an alternative offered at an adjusted fee, the Client may terminate the affected part of the Services — or, where the Sub-processor is essential to the Services as a whole, the Agreement — without penalty and with a pro-rata refund of prepaid fees for the terminated portion. This is the Client's sole remedy for such an objection.

Swiss law — prior approval. The Parties acknowledge that FADP Art. 9(3) requires the controller's prior approval for the engagement of a sub-processor. The authorisation in Clause 7.1, taken together with the named list in Annex III and the advance notice and objection rights in Clauses 7.2 and 7.3, constitutes that prior approval for the purposes of Swiss law. Cigno will not transfer Client Personal Data to a new Sub-processor before the notice period in Clause 7.2 has expired.

Flow-down. Cigno imposes on each Sub-processor, by written contract, data protection obligations materially equivalent to those in this DPA, in particular the obligation to provide sufficient guarantees as to technical and organisational measures. (GDPR Art. 28(4).)

Liability. Cigno remains fully liable to the Client for the performance of each Sub-processor's data protection obligations, as if it had performed them itself.

Transparency of the chain. On the Client's written request, Cigno will provide the identity (name, registered address and contact point), processing location, purpose and applicable transfer mechanism for each Sub-processor in the chain, including the infrastructure providers on which AI Providers themselves rely, to the extent that information is available to Cigno. (Reflecting EDPB Opinion 22/2024.)

Data subject requests. Taking into account the nature of the processing, Cigno assists the Client by appropriate technical and organisational measures, insofar as possible, in fulfilling the Client's obligation to respond to requests to exercise Data Subject rights under Chapter III GDPR and Arts. 25–32 FADP. (GDPR Art. 28(3)(e).)

The Services provide self-service functionality for the Client to access, export, correct and delete Client Personal Data. Where a request cannot be met through that functionality, Cigno will assist on written request; Cigno may charge its reasonable costs for assistance that goes materially beyond the Services' standard functionality, at rates notified in advance.

Requests received directly. If Cigno receives a request from a Data Subject relating to Client Personal Data, it will not respond substantively. It will forward the request to the Client without undue delay and in any event within 5 business days, and confirm to the Data Subject that it has done so.

Compliance assistance. Taking into account the nature of processing and the information available to it, Cigno assists the Client in ensuring compliance with its obligations under GDPR Arts. 32–36 and the equivalent FADP provisions (Arts. 8, 22, 23, 24) — that is, security, breach notification to the Supervisory Authority and to Data Subjects, data protection impact assessments, and prior consultation. (GDPR Art. 28(3)(f).) This includes making available its security documentation, sub-processor and transfer mapping, and completed security questionnaires, within 15 business days of a written request. Any costs associated with assistance under this Clause 8 are subject to the limitations of liability in the Agreement.

Notification to the Client. Cigno notifies the Client of a Personal Data Breach affecting Client Personal Data without undue delay and in any event within 36 hours of becoming aware of it. (GDPR Art. 28(3)(f), Art. 33(2); FADP Art. 24(3).)

Content. The notification will describe, to the extent known at the time: the nature of the breach; the categories and approximate number of Data Subjects and of records affected; the time and duration of the breach; the likely consequences; the measures taken or proposed to address it and mitigate its effects; and the contact point for further information. Where the full information is not available at once, Cigno will provide it in phases as soon as possible thereafter. (Mapped to GDPR Art. 33(3) and Swiss DPO Art. 15.)

Cooperation. Cigno will cooperate with the Client and take the remedial steps the Client reasonably directs to investigate, mitigate and remediate the breach, and will preserve relevant evidence.

No unilateral notification. Cigno will not notify any Supervisory Authority or Data Subject of a breach affecting Client Personal Data on the Client's behalf, or identify the Client publicly in connection with a breach, without the Client's prior written consent — unless Cigno is independently required to do so by law, in which case it will inform the Client first where permitted.

Notification under this Clause 9 is not an acknowledgement of fault or liability.

Records. Cigno retains documentation of each Personal Data Breach for at least two years from notification. (Swiss DPO Art. 15(4).)

Documentation first. Cigno makes available to the Client all information necessary to demonstrate compliance with GDPR Art. 28 and this DPA. (GDPR Art. 28(3)(h).) In the first instance this is satisfied by providing, at no charge, no more than once in any 12-month period and within 15 business days of a written request:

(a) any independent attestation or certification it holds, under NDA;

(b) its security whitepaper and current Annex II;

(c) a summary of its most recent penetration test findings and remediation status; and

(d) a completed response to a standard industry security questionnaire (e.g. CAIQ or SIG Lite) or to the Client's own questionnaire.

Audit. Where the documentation in Clause 10.1 does not reasonably enable the Client to verify compliance, the Client may audit Cigno's processing of Client Personal Data, including by inspection, subject to the following:

(a) not more than once in any 12-month period, save where required by a Supervisory Authority or following a confirmed Personal Data Breach affecting the Client, when an additional audit may be conducted;

(b) on at least 30 days' written notice;

(c) during normal business hours, without unreasonable disruption to Cigno's operations;

(d) conducted by the Client or an independent auditor it mandates, who is not a competitor of Cigno and who is bound by confidentiality obligations at least as protective as those in the Agreement;

(e) limited to systems, premises, records and personnel relevant to the processing of Client Personal Data, and excluding other clients' data, Cigno's commercially sensitive information, and any material Cigno is legally prohibited from disclosing;

(f) at the Client's cost, save where the audit reveals a material breach of this DPA by Cigno, in which case Cigno bears its own and the Client's reasonable costs; and

(g) the Client provides Cigno with a copy of the audit report, which is Cigno's confidential information and may be used by Cigno to remediate the findings.

Cigno will remediate material findings within a mutually agreed timeframe and report progress to the Client.

Processing locations. Client Personal Data is hosted and processed in the European Union on Scaleway infrastructure in Paris, France (fr-par). AI model inference is performed exclusively on models hosted in the European Union — Scaleway (Paris, France) and AWS Bedrock (Frankfurt, Germany) — or, where the Client selects Swiss residency, on AWS Bedrock in Zurich, Switzerland. Administrative and support access takes place from Switzerland. The full list of processing locations, per Sub-processor, is in Annex III.

Model inference architecture. Cigno does not call any AI model maker's own application programming interface. All inference is performed through two managed inference providers — Scaleway Generative APIs and AWS Bedrock — on infrastructure located in the European Union or Switzerland. The makers of the underlying models receive no Client Personal Data and are not Sub-processors. Annex III §B.1 sets out the basis for this and the controls Cigno maintains to preserve it.

Adequacy — EEA to Switzerland. The Parties record that Switzerland benefits from a European Commission adequacy decision (Commission Decision 2000/518/EC), which the Commission confirmed as continuing to provide an adequate level of protection in its report of 15 January 2024. Transfers of Client Personal Data from the EEA to Cigno in Switzerland therefore require no additional transfer mechanism.

Adequacy — Switzerland to EEA and UK. The EU and EEA States and the United Kingdom are listed in Annex 1 to the Swiss Data Protection Ordinance as providing adequate protection. Transfers from Switzerland to those States require no additional mechanism.

Onward transfers to Sub-processors in third countries. Where Cigno transfers Client Personal Data to a Sub-processor established in a country not benefiting from an adequacy decision under GDPR Art. 45 or FADP Art. 16(1), it will do so only on the basis of:

(a) the EU SCCs, concluded between Cigno and that Sub-processor; and/or

(b) where and only where the recipient is validly certified for the relevant framework, the EU–US Data Privacy Framework and/or the Swiss–US Data Privacy Framework.

Cigno undertakes that it has concluded, and will maintain for the term of the Agreement, the EU SCCs — Module Three (Processor to Processor), or Module Two where Cigno acts as controller — together with the Swiss addendum in Clause 11.6 and, where applicable, the UK Addendum, with every Sub-processor established in a country not benefiting from an adequacy decision, in compliance with Clause 8.8 of the EU SCCs, and will make copies available to the Client on request. Where Cigno relies on a Data Privacy Framework under (b), it will nonetheless maintain the EU SCCs with that Sub-processor as a standing fallback, taking effect automatically and without further action if the framework is invalidated, suspended or ceases to cover the transfer.

The Parties acknowledge that certification under the EU–US Data Privacy Framework does not cover transfers originating in Switzerland; a separate Swiss–US Data Privacy Framework certification is required. Annex III states, per Sub-processor, which certifications are held.

EU SCCs between the Parties — contingent incorporation. The Parties record that, by reason of Clause 11.2, no transfer tool is presently required for transfers of Client Personal Data from the Client to Cigno. The EU SCCs are nonetheless incorporated into this DPA by reference between the Parties and take effect automatically, without further action by either Party, if and to the extent Switzerland ceases to benefit from an adequacy decision under GDPR Art. 45, or the Client is otherwise required to rely on a transfer tool for transfers to Cigno. On taking effect, the following applies:

Swiss addendum. Where a transfer is subject to Swiss law, the EU SCCs apply with the following modifications:

(a) the competent supervisory authority under Clause 13 is the Federal Data Protection and Information Commissioner (FDPIC);

(b) references to the GDPR are read as references to the FADP, and references to EU or Member State law are read as references to Swiss law, in each case to the extent the transfer is governed by Swiss law;

(c) references to Member States must not be interpreted so as to exclude Data Subjects in Switzerland from suing for their rights in their place of habitual residence in Switzerland, in accordance with Clause 18(c);

(d) breach notification obligations are read as including notification to the FDPIC under FADP Art. 24; and

(e) for the avoidance of doubt, and consistent with the revised FADP, the SCCs are not extended to data relating to legal entities.

UK transfers. Where a transfer is subject to the UK GDPR, the EU SCCs apply as amended by the UK Addendum (version B1.0), with Tables 1–4 completed by reference to the corresponding Annexes of this DPA and Table 4 completed as "neither Party", so that neither Party may terminate the Addendum on a change made to it by the Information Commissioner.

Transfer impact assessment. Cigno has documented a transfer impact assessment for each third-country transfer identified in Annex III and will make it available to the Client on request. Cigno will notify the Client without undue delay if it becomes aware of any law or practice in a destination country that prevents it from fulfilling its obligations under the EU SCCs.

On termination or expiry of the Agreement, and at the Client's election notified in writing within 30 days of termination, Cigno will return Client Personal Data to the Client in a structured, commonly used, machine-readable format, or delete it.

If the Client makes no election within that period, Cigno will delete Client Personal Data.

Timing and blocking. Deletion takes place without undue delay, and within the periods stated in Clause 23.7 of the Agreement. Copies held in encrypted backups remain subject to all the security and confidentiality obligations of this DPA until they are expunged, and are not accessed for any purpose other than backup restoration. Where deletion is impracticable, or is prohibited by a valid legal requirement, Cigno will instead block the data from all further processing and will notify the Client.

Legal retention. Cigno may retain Client Personal Data to the extent required by Union or Member State law, in which case it will retain it only for that purpose and for that period, will notify the Client of the requirement where permitted, and will continue to protect it under this DPA. Where Swiss law requires retention, Cigno will notify the Client of the requirement and of the data and period concerned, and will restrict processing of that data to the retention purpose alone.

Liability. Each Party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, save to the extent Applicable Data Protection Law prohibits that limitation. Nothing in this DPA limits either Party's liability to Data Subjects or to a Supervisory Authority.

Term. This DPA takes effect on the effective date and continues for as long as Cigno processes Client Personal Data, notwithstanding the expiry or termination of the Agreement. Clauses 4, 5, 6, 7.6, 9.6, 12 and 13 survive.

Changes in law. If Applicable Data Protection Law changes such that this DPA no longer provides a lawful basis for the processing, the Parties will negotiate in good faith to amend it. Cigno may amend this DPA on 30 days' notice where required to reflect a change in law, a new or replacement transfer mechanism, or guidance from a Supervisory Authority, provided the amendment does not materially reduce the protection afforded to Client Personal Data.

Severability. If any provision is held invalid, the remainder continues in force and the Parties will replace the invalid provision with one achieving its intended effect as closely as possible.

Governing law and jurisdiction. This DPA is governed by the substantive laws of Switzerland, excluding its conflict of law rules and the CISG, and the courts of the Canton of Vaud, Switzerland have exclusive jurisdiction, matching Clause 32.2 of the Agreement. Where the Client is a consumer, this is without prejudice to any mandatory right to bring or defend proceedings in the courts of their country of habitual residence. This is without prejudice to Clauses 11.5–11.7, under which the EU SCCs and the UK Addendum are governed by their own stated law and forum, and to any mandatory right of a Data Subject to bring proceedings in their place of habitual residence.

Counterparts and signature. This DPA may be executed in counterparts and by electronic signature, each of which constitutes an original. Where the Client accepts the Agreement online, acceptance of the Agreement constitutes execution of this DPA.