Data Processing Agreement (DPA)

Last updated: October 29, 2026

This Data Processing Agreement ("DPA") is concluded between the Customer (the "Controller") and ark.swiss sàrl ("ark.swiss sàrl"). It forms an inseparable annex to the Terms of Service (the "Terms") and applies as from their acceptance. It is drafted in accordance with Article 28 of the General Data Protection Regulation (GDPR) and Article 9 of the revised Swiss Federal Act on Data Protection (FADP).

1. Parties

Controller: the Customer identified upon subscription to the ark.flow Service.
Processor: ark.swiss sàrl, CHE-139.880.181, Chemin de la Duchesne 13, 1806 St-Légier, canton de Vaud, Suisse.

2. Subject matter and scope

This DPA governs the processing, by ark.swiss sàrl, of personal data on behalf of the Controller in the context of operating the ark.flow suite (products ark.flow Compta and ark.flow Fiduciaire). It applies to all personal data contained in the Controller's Instance, excluding data that ark.swiss sàrl processes for its own purposes (administrative account, billing, Service security).

3. Processing details

3.1 Nature and purpose

ark.swiss sàrl processes data for the sole purpose of hosting and operating the Instance made available to the Controller, in accordance with the Terms and the Controller's documented instructions.

3.2 Categories of data subjects

Employees and users of the Controller
Customers, principals and contacts of the Controller (third-party data)
Suppliers and partners of the Controller
Prospects entered into the Instance

3.3 Categories of data

Identity data (first name, last name, email, phone, address)
Accounting and fiduciary data (bookkeeping entries, supporting documents, balances, VAT)
Transactional data (invoices, payments, bank statements)
Notes, attachments and interaction history entered by the Controller
Technical identifiers (access logs, session IDs)

In the initial version of the Service, ark.swiss sàrl does not process, on behalf of the Controller, any sensitive data within the meaning of Art. 5 lit. c FADP or Art. 9 GDPR. Should the Controller introduce any, it undertakes to inform ark.swiss sàrl beforehand.

3.4 Duration of processing

The processing applies for the entire duration of the Service contract, as well as for the 30-day post-termination retention period provided for in clause 11 below, and beyond for statutory retention periods (in particular invoices issued by ark.swiss sàrl, Art. 958f CO).

4. Controller obligations

Ensure the lawfulness of processing and have an adequate legal basis within the meaning of Art. 31 FADP and Art. 6 GDPR.
Inform its own data subjects in accordance with Art. 19 FADP and Art. 13 GDPR.
Respect data subject rights as the primary point of contact (access, rectification, erasure, portability, objection).
Provide written instructions to ark.swiss sàrl where necessary, and ensure their lawfulness.
Properly configure its users' access rights within the Instance.

5. Processor obligations (Art. 28 GDPR, Art. 9 FADP)

Lawfulness of instructions: process data only on documented instructions from the Controller, unless otherwise required by mandatory law (in which case ark.swiss sàrl informs the Controller, unless the law prohibits it).
Confidentiality: ensure that authorised personnel are bound by a contractual and, where applicable, statutory confidentiality obligation.
Security: implement the technical and organisational measures described in clause 6 below.
Sub-processing: use only the subprocessors authorised in clause 7; notify any change with a notice period allowing the Controller to object.
Assistance: assist the Controller in fulfilling its obligations — responding to data subject requests, carrying out data protection impact assessments (DPIAs), prior consultations with the authority — to a reasonable and proportionate extent.
Breach notification: notify the Controller as soon as possible (Art. 24 §3 FADP) and without undue delay (Art. 33 §2 GDPR) after becoming aware of a breach (clause 8 below).
Deletion or return: at the end of the contract, upon the Controller's instructions, return or delete the data (clause 11 below).
Documentation: make available to the Controller all information necessary to demonstrate compliance with the obligations of this DPA.

6. Technical and organisational measures (TOMs)

The full list of measures is published and kept up to date on the Security page. In summary:

Encryption in transit: HTTPS connections through Cloudflare, with a Cloudflare origin certificate between Cloudflare and our servers, and HSTS.
Encryption at rest: AES-256-GCM for credentials, OAuth tokens and secrets.
Authentication: password hashing with bcrypt; TOTP authentication available in ark.flow Fiduciaire, required at every sign-in once enabled.
Per-Instance isolation: application containers specific to each Instance and a separate PostgreSQL database, on a shared server; for ark.flow Compta, files are kept in a reserved storage space accessed with a key specific to the Instance.
Backups: daily encrypted Borg archives on ark.swiss-owned infrastructure in Switzerland, kept for 14 days, 8 weeks and 24 months; integrity check and restore of a test file at every full cycle; for ark.flow Compta, continuous replication of the databases to the Infomaniak standby site in Geneva.
Access control: administration with SSH keys over a private WireGuard network; containers run without unnecessary privileges; production and demo environments kept separate.
Logging: application audit logs (including permission changes, AI assistant actions and, in ark.flow Compta, entry changes), written append-only and kept with the Instance; centralised technical logs kept for 14 days.
Incident management: automated monitoring with alerts, application errors collected in GlitchTip and logs centralised in Grafana; notification under clause 8.
Development: Trivy and Semgrep scans on every build and automated tests before every release.
Subprocessor management: list published in clause 7; any change is notified under that clause.
Secure erasure: deletion of the Instance database, files and keys once the 30 days following the end of the contract have elapsed; encrypted copies held in backups expire at the end of their rotation (24 months at most), excluding statutory accounting obligations.

7. Authorised subprocessors

The Controller authorises ark.swiss sàrl to use the following subprocessors for the indicated purposes:

Name	Country	Role	Transfer basis
netcup GmbH	Karlsruhe, Germany; server in Vienna, Austria (EU)	Application production and database for ark.flow Compta	European Union
Infomaniak Network SA	Geneva, Switzerland	ark.flow Fiduciaire production, hot standby for ark.flow Compta, transactional SMTP and Swiss-hosted AI models (can be disabled on request)	Switzerland — adequate third country
Stripe Payments Europe Ltd.	Dublin, Ireland	Card payment collection	EU — single market
Cloudflare, Inc.	San Francisco, USA	CDN, DNS, WAF, anti-DDoS protection	EU Standard Contractual Clauses (SCCs) + EU-US Data Privacy Framework
Anthropic, OpenAI, Google (Gemini API)	United States	AI models for accounting categorisation, document reading and assistance (can be disabled on request)	Possible transfer to the United States — provider API terms, which in principle exclude training on the data sent
OpenRouter	United States	Routing to third-party AI models, when configured (can be disabled on request)	Possible transfer to the United States
Umami (self-hosted by ark.swiss sàrl)	European Union	Cookieless audience measurement on `arkflow.ch`	European Union (under ark.swiss sàrl's direct responsibility)

Any new subprocessor will be notified to the Controller with 30 days' prior notice (public list maintained in this DPA and on the Privacy Policy page). The Controller may raise a reasoned objection; in case of a reasonable objection not resolved, the Controller may terminate the contract free of charge.

8. Breach notification

In the event of a security breach concerning the data processed on behalf of the Controller, ark.swiss sàrl notifies the Controller as soon as possible and without undue delay after becoming aware. The notification contains, to the extent available:

the nature of the breach, the categories and approximate number of data subjects concerned;
the categories and approximate number of data records concerned;
the likely consequences and the measures taken or proposed to remedy them;
the contact details of a contact point for more information.

ark.swiss sàrl cooperates with the Controller for any notification to the competent supervisory authority (FDPIC, CNIL, etc.) and, if necessary, to data subjects (Art. 24 FADP, Art. 33-34 GDPR).

9. International transfers

The Controller's application data is hosted exclusively in Europe: ark.flow Compta in production at netcup GmbH in Vienna (Austria, European Union), with a hot standby site at Infomaniak Network SA in Geneva; ark.flow Fiduciaire in production at Infomaniak Network SA in Geneva (Switzerland); independent historical Borg backups on ark.swiss-owned infrastructure in Switzerland. Necessary transfers to other subprocessors are described in this DPA. When AI features are used, the required excerpts are sent to the configured provider: with Infomaniak, processing takes place in Switzerland; with Anthropic, OpenAI, Google (Gemini API) or OpenRouter, it may take place in the United States. The transfer to Cloudflare (USA) is framed by the Standard Contractual Clauses (SCCs) adopted by the European Commission in their 2021 version and, in the alternative, by the EU-US Data Privacy Framework.

10. Audit right

The Controller has a right to audit ark.swiss sàrl to verify compliance with this DPA. Terms:

Documentary audit: once per year, free of charge — ark.swiss sàrl answers reasonable security questionnaires (CAIQ, SIG) within 30 days.
On-site audit: possible with 30 days' written notice, limited to one per year, at the Controller's expense, subject to a prior mutual confidentiality agreement (NDA) and under conditions that do not compromise the security or confidentiality of other customers.
Third-party audit: possible after agreement on the choice of firm (independent and qualified) and at the Controller's expense.

ark.swiss sàrl may substitute an on-site inspection with a recent independent audit report (e.g. ISAE 3000, SOC 2, ISO 27001) if available and deemed sufficient by the Controller.

11. Deletion or return

At the end of the contract, upon the Controller's written instructions:

Export: ark.swiss sàrl makes available for 30 days read-only access and an export in open formats (JSON, CSV; native Crésus export for ark.flow Compta).
Deletion: after that period, or upon the Controller's earlier request, ark.swiss sàrl permanently deletes the Instance data; encrypted backups expire at the end of their rotation (24 months at most).
Statutory exception: invoices issued by ark.swiss sàrl to the Controller are retained for 10 years in accordance with Art. 958f CO, an obligation that prevails over the right to erasure.

Upon request, ark.swiss sàrl provides a signed deletion certificate.

12. Duration and termination

This DPA takes effect upon acceptance of the Terms and remains in force as long as ark.swiss sàrl processes personal data on behalf of the Controller. It ends automatically upon completion of the post-termination obligations under clause 11. The confidentiality, liability and governing law clauses survive the end of the DPA.

13. Liability

Each party is responsible for its own breaches of this DPA. ark.swiss sàrl's liability towards the Controller is limited, in accordance with clause 12 of the Terms, to the total amount of subscriptions actually paid by the Controller during the 12 months preceding the triggering event, subject to Art. 100 CO (wilful misconduct, gross negligence, harm to life, bodily integrity or health) and to mandatory data protection obligations.

14. Governing law and jurisdiction

This DPA is governed exclusively by Swiss law. Any dispute shall be submitted to the exclusive jurisdiction of the courts of Lausanne, canton of Vaud, subject to the mandatory consumer forum under Art. 32 CCP.

15. Signature and acceptance

Acceptance of the Terms by the Controller upon subscription constitutes acceptance of this DPA (electronic acceptance, time-stamped and archived). Upon written request to privacy@ark.swiss, a PDF version signed by both parties may be provided for Customers whose internal governance requires it.

16. Data protection contact

ark.swiss sàrl is not legally required to appoint a Data Protection Officer (DPO) within the meaning of Art. 37 GDPR. Requests concerning this DPA, notifications and audits are centralised at the dedicated contact point:

ark.swiss sàrl
Chemin de la Duchesne 13, 1806 St-Légier, canton de Vaud, Suisse
Email: privacy@ark.swiss

In case of discrepancy between language versions, the French version prevails.