Data processing
Data processing agreement.
The provider’s contracting party is Rima Hallaoui, trading as Rewalz, Alderwies 6, 8700 Küsnacht, Switzerland. Anyone processing personnel data in someone else's software needs a contract for it. This page is that contract in plain language. It applies between the customer as controller and Rewalz as processor, in addition to the terms of service. Elsewhere this contract is called a data processing agreement or DPA; it is the same document.
Subject and duration
Rewalz processes personal data solely to provide the contractually agreed services. The engagement begins when the tenant is opened and ends with the contract. Section 10 applies thereafter.
Nature and purpose of processing
Processing covers storing, organising, analysing and deleting the data the customer enters itself or has its staff enter. There is no purpose other than operating the software. Personal data is never sold, never used for advertising and never used to train language models.
Data subjects and categories of data
Data subjects include employees, applicants and customer contacts. Processing covers identity, employment and salary data, social insurance numbers, absences, working time, documents and applications. This may include sensitive personal data such as health information.
Instructions
Rewalz processes the data only on documented instruction from the customer. The contract, the settings inside the tenant and explicit instructions in text form all count as instructions. If Rewalz considers an instruction unlawful it will say so and may suspend execution.
Confidentiality
Everyone with access to customer data is bound to confidentiality. The obligation survives the end of their engagement.
Technical and organisational measures
Access is enforced in the database itself and not only in the application. Every query is bound to the customer's own tenant and to the role of the person asking. Transmission and storage are encrypted, sign-ins and changes to permissions are logged. The overview of the measures is Annex 1 and has its own page; the detail for each protection goal belongs to the signed contract.
Sub-processors
Operations use Supabase for database and files, Vercel for the application and Resend for email. Contractual and transfer documentation is still being completed. The procedure for changes to these providers will be set out in the approved agreement.
Rights of data subjects
If a data subject contacts Rewalz directly they are referred to the customer. The software provides the functions needed for access, rectification, erasure and portability so the customer can meet its deadlines without a detour.
Personal data breach
Rewalz reports a personal data breach without delay and at the latest within twenty-four hours of becoming aware of it, with all known details of nature, scope and the measures taken. Notifying the supervisory authority and the data subjects remains the customer's responsibility.
Deletion and return
After the contract ends the data is handed over in a common format on request and then deleted. Absent other instructions, deletion happens ninety days after the contract ends, except for data subject to a statutory retention period.
Evidence and audit
Rewalz demonstrates compliance with these obligations on request. The customer may audit the processing itself or have it audited, with notice and without disrupting the operation of other tenants.
Place of processing
The database and files are stored with Supabase in the Zurich region. We use Vercel for the application and Resend for email. These services may process personal data outside Switzerland, including in the USA. Swiss storage therefore does not mean exclusively Swiss processing. Processing by Vercel and Resend may take place in the USA. Contractual and transfer documentation is still being completed in the draft DPA.
Request the signed version
The published text is a draft. Contact us to discuss the contractual documents for your company and their approval status.