Data processing agreement
When Nguyen Development processes personal data on your behalf — under Art. 9 FADP and Art. 28 GDPR.
Draft — legal review pending. Version 0.1 · 28 October 2026. This translation is provided for convenience; the German version is authoritative.
1. Subject matter
This agreement applies between you as controller (“you”) and Nguyen Development, Hoang Nguyen, sole proprietorship, Hohfurristrasse 24, 8408 Winterthur, Switzerland, as processor (“Nguyen Development”), insofar as Nguyen Development processes personal data for you. It forms part of the project or maintenance contract and of the terms and conditions and fulfils Art. 9 of the Swiss Federal Act on Data Protection (FADP) and, where applicable, Art. 28 of the EU General Data Protection Regulation (GDPR). In the event of contradictions regarding data protection, it takes precedence.
2. What is processed
Purpose: development, testing, delivery, operation, maintenance and support of your application. Type: storing, reading, backing up, restoring, transferring, exporting and deleting. Data subjects and data categories: depending on the application, for example users, employees and customers of your organisation with names, contact details, roles, logs and the content of the application; the details are set out in the project or maintenance contract. Duration: the term of the contract and the period under section 9.
3. Instructions
Nguyen Development processes the data only on your instructions: this agreement, the contract and your written instructions, including by email. If Nguyen Development considers an instruction unlawful, it will tell you. Statutory obligations remain reserved; Nguyen Development informs you of them in advance where the law permits.
4. Confidentiality
Anyone at Nguyen Development who accesses the data is bound to confidentiality. Today this is the owner; if further persons join, they are bound in writing. Access to your systems is granted only as far as necessary for the assignment.
5. Security
Nguyen Development takes appropriate technical and organisational measures under Art. 8 FADP and Art. 32 GDPR, in particular:
encrypted transmission on all channels and encrypted storage media on its own devices;
sign-in with a passkey or second factor, access only as far as necessary, no secrets in the source code;
development and tests with invented test data; real data only if you request it, and then only locally and without access from the internet;
backups and deployment with a way back where Nguyen Development takes over operation;
deletion of copies after completion of the assignment (section 9).
6. Sub-processors
You approve the sub-processors named in the contract — for operation in Switzerland, for example, cyon AG, Basel. Nguyen Development announces new or replaced sub-processors at least 30 days in advance; you may object for good cause under data protection law. Nguyen Development binds every sub-processor to an equivalent level of protection and is answerable for it.
7. Disclosure abroad
Data is disclosed abroad only with your consent, and only to countries with adequate data protection or with safeguards under Art. 16 FADP and Art. 46 GDPR.
8. Support and notifications
Nguyen Development supports you with requests from data subjects, notifications to supervisory authorities and data protection impact assessments, insofar as its own processing is concerned, and forwards requests from data subjects to you. Nguyen Development reports a data security breach to you as soon as possible, at the latest within 48 hours, with everything that is known.
9. Deletion and return
After the end of the assignment, Nguyen Development returns the data to you on request and deletes remaining copies within 30 days, unless there is a statutory obligation to retain them. On request, Nguyen Development confirms the deletion in writing.
10. Evidence and audits
Nguyen Development provides you with the information you need to demonstrate compliance. An on-site audit is possible for good reason, with 30 days’ notice and by a person bound to confidentiality.
11. Liability and final provisions
Liability is governed by the contract and the terms and conditions, as are the applicable law and place of jurisdiction. The German version is authoritative.