Contrat de sous-traitance

pursuant to Art. 9 of the Swiss Federal Act on Data Protection (FADP) and Art. 28 of the General Data Protection Regulation (GDPR)

between the organisation using Ladehase under the terms (hereinafter «controller»),

and siebenberge gmbh, Toggenburgerstrasse 29, CH-9652 Neu St. Johann, Switzerland (hereinafter «processor»).

This agreement forms part of the terms and applies upon their acceptance. A separate signature is not required. If you need a signed copy, write to info@ladehase.com.

1. Subject and duration

Under the Ladehase brand, the processor provides the controller with software that lets drivers charge and pay at the controller's charging stations (payment page, terminal app, control of charging stations, billing, receipts, dashboard, API). In doing so, it processes personal data on behalf of the controller. The agreement applies as long as the controller uses Ladehase and ends with the deletion of the organisation.

2. Nature and purpose, data categories, data subjects

Purpose: releasing and controlling charging sessions, recording energy, billing, triggering reservations, captures, releases and refunds with the controller's payment partner, issuing receipts and monthly statements, reports and exports.

Data categories: session data (charge point, times, meter readings, energy, tariff, amounts), payment metadata (amount, status, reference, type of payment method), email address for receipts, access grant details (name, email address, card identifier, personal link), contact details for statements, technical data of the payment page (IP address, browser).

Data subjects: drivers, persons with access grants (for example residents, employees) and team members of the controller.

Full card data is processed exclusively by the controller's payment partner (zahls.ch or Freika) under its own contract with the controller.

3. Obligations of the processor

The processor

• processes personal data only on documented instructions of the controller and only for the agreed purposes. Settings in the dashboard and API calls count as instructions;
• obliges persons entrusted with processing to confidentiality;
• takes appropriate technical and organisational measures (section 5);
• supports the controller with data subject requests and notification and documentation duties;
• reports data security breaches without undue delay, usually within 48 hours of becoming aware;
• deletes or returns all personal data after termination, unless a statutory retention obligation applies.

4. Sub-processors

The controller agrees to the use of the following sub-processors: Vercel Inc., USA, with servers in the EU (hosting of website, dashboard and payment page); Railway Corp., USA, with servers in the EU (database, API); Cloudflare Inc. (DNS, attack protection); a Swiss or European email provider (receipts, notifications). Manufacturers of charging stations only receive device data and commands, no personal data of drivers.

The processor announces changes at least 30 days in advance. The controller may object for good cause.

5. Technical and organisational measures

Encrypted transmission (TLS 1.2 or higher); encrypted storage of credentials and keys (AES-256-GCM); role and permission concept with two-factor login and passkeys; logging of access and changes; strict tenant separation in the database; separation of test and live data; regular backups; data centres in Switzerland and the EU with access control.

6. Audit rights

With reasonable notice, the controller may verify compliance with this agreement, in particular by inspecting evidence of the processor and its sub-processors. On-site audits are possible by arrangement and at most once a year, unless there is a specific suspicion.

7. Transfers abroad

Personal data is stored in Switzerland and the EEA. Where sub-processors based in the USA have access, an adequate level of data protection is ensured through standard contractual clauses and certification under the Swiss-U.S. Data Privacy Framework.

8. Liability and final provisions

Liability is governed by the terms. Swiss law applies, the place of jurisdiction is the registered office of the processor. In case of contradictions, this agreement takes precedence over the terms in matters of data protection.