Data Processing Agreement (DPA)

§1Subject matter and duration

(1) The subject matter of this agreement is the processing of personal data by ISOCALCX in connection with the provision and operation of the ISOCALCX SaaS platform for the controller. The specific services result from the main contract (GTC and the chosen subscription).

(2) The duration of this data processing agreement corresponds to the term of the main contract and ends with its termination, subject to the obligations regarding return or deletion of data set out in §10.

(3) The processing location is within the European Union and Switzerland. The exceptions are the AI evaluation of uploaded tenders/bills of quantities (PDF analysis) and the “Jarvis” assistant: the content to be processed is transferred to Anthropic PBC in the USA for this purpose (see §6). Any transfer of data to third countries takes place exclusively under the conditions of Chapter V GDPR or Art. 16 revFADP.

§2Nature and purpose of processing

(1) ISOCALCX processes personal data exclusively for the purpose of the contractual provision of the SaaS services to the controller. The purpose is the AI-supported HVAC insulation calculation from Swiss bills of quantities and tender documents (BoQ / tender specifications). The processing comprises exclusively:

• AI-supported extraction and structuring of insulation items (material, dimension, thickness, BKP code, quantities) from bills of quantities and tender documents that the controller actively uploads via the platform;
• Storage of the uploaded BoQ/tender documents and the structured calculation data derived from them;
• Matching of extracted items with the price lists uploaded by the controller and creation of calculations and offer drafts;
• Provision of the results via web user interface, including authentication of the controller's users;
• Export of data to common file formats (Excel, PDF, JSON) and API-based integration upon separate request;
• Maintenance of the controller's customer directory, and creation and, when triggered by the controller, e-mail dispatch of invoices and payment reminders to its customers;
• when triggered by the controller: import of address lists (Excel, CSV or PDF) that it uploads into its customer directory. Excel and CSV files as well as PDFs with a recognisable table are read without AI; for other PDFs, their text (for scanned PDFs, the file itself) is transmitted to a language model via AWS Bedrock in the EU for reading. The result is shown as a preview and enters the customer directory only after its confirmation;
• preparation of acceptance reports and daywork reports; on request, the persons involved sign by hand on the screen (with a finger or mouse). The signature is stored as an image with the respective document and retained and deleted together with it; it is not a qualified electronic signature;
• when switched on by the controller's management: the “Jarvis” assistant, which carries out typed instructions from users within the platform. For this purpose, the instruction, the history of the current conversation, information on the open page, the confirmed company terms and the data the assistant reads for the instruction (e.g. projects, items, customers and contact persons, offers, invoices and payment reminders) are transferred to a language model (see §6). Reading takes place without further confirmation; ISOCALCX carries out changes only after confirmation by the user, and steps with a financial effect or e-mail dispatch only after explicit confirmation with a summary. Terms the assistant proposes as company terms are used only after confirmation by management and only for the controller itself;
• upon set-up by the controller: retrieval of its personal purchasing terms (net prices according to the IGH ikk industry standard) from the dealers it has chosen via their web service, using the access credentials that it stores itself, or import of an ikk file that it has uploaded. The prices enter its calculation only after its confirmation.

(2) No AI training with customer content: Processing for own purposes — in particular training, fine-tuning or model improvement of generative AI models with content uploaded or entered by the controller — takes place neither at ISOCALCX nor at the sub-processors named under §6 (in particular AWS and Anthropic). This is governed by the contractual terms of the sub-processors, for Anthropic in accordance with Anthropic's commercial terms.

(3) Aggregated, anonymised telemetry data (e.g. usage statistics, performance metrics) may be evaluated to improve the service, provided that any reference to a person is fully excluded.

(4) No automated individual decisions with legal effect: The AI output prepares decisions for the calculation and offer creation by the controller. No automated decision within the meaning of Art. 22 GDPR takes place.

§3Categories of data and data subjects

(1) Categories of data subjects include in particular:

• Employees and contact persons of the controller who use the service or appear in connection with the contract;
• Third parties named in the uploaded bills of quantities or tender documents (e.g. clients, planners, contractors);
• Customers of the controller and their contact persons (several per customer), whom the controller records in or imports into the customer directory or to whom it addresses offers, invoices and payment reminders;
• parties involved in a project whom the controller records in the project (building owner, construction management), and persons who sign an acceptance report or a daywork report.

(2) Categories of personal data:

• Master data: name, business e-mail address, company name, function;
• Project metadata: project names, BKP codes, trade assignments, time stamps;
• Content data: texts and structures of the uploaded BoQ/tender documents, insofar as they contain personal information;
• Usage data: login times, IP addresses (only for security purposes, retention 30 days), audit logs;
• Customer data of the controller: company or name, address and billing address, e-mail address, telephone, correspondence language, notes; several contact persons per customer with salutation, first and last name, function, e-mail address, telephone, mobile, note and flags (main contact, invoices, copy, inactive);
• Project participants (optional): building owner with name and address, construction management with company, person, telephone and e-mail address;
• Handwritten signatures: image of the signature with the name and function of the signatory, date and time of capture;
• Log of the “Jarvis” assistant (only if switched on): instructions and answers, conversation history, prepared and executed steps with time and the triggering and confirming person, ratings of answers, error list and company terms;
• Dealer access credentials (only if set up): user name, password and customer number for a dealer's terms web service, and the log of price retrievals (time, triggering person, result).

(3) Special categories of personal data within the meaning of Art. 9 GDPR or Art. 5 lit. c revFADP are not the subject of the processing; the controller ensures that such data are not uploaded.

§4Right of instruction of the controller

(1) ISOCALCX processes the data exclusively on documented instructions from the controller. The present agreement, the GTC and the instructions given through the configuration and use of the platform shall be deemed instructions.

(2) Verbal or textual individual instructions are to be confirmed in text form (e-mail is sufficient) by the controller without delay.

(3) ISOCALCX shall inform the controller without delay if, in its opinion, an instruction violates applicable data protection law. ISOCALCX is entitled to suspend the execution of such an instruction until the matter is clarified.

§5Technical and organisational measures (TOMs)

ISOCALCX implements the following technical and organisational measures in order to ensure a level of protection appropriate to the risk within the meaning of Art. 32 GDPR or Art. 8 revFADP:

§6Sub-processors

(1) The controller hereby grants ISOCALCX general authorisation to engage further processors (sub-processors). The currently engaged sub-processors are:

(2) ISOCALCX shall inform the controller in text form of intended changes regarding the addition or replacement of further processors with a notice period of at least 30 days before they take effect. The controller may object to such change within this period for important data protection reasons.

(3) ISOCALCX contractually obliges its sub-processors in writing to a level of data protection equivalent to that of this agreement.

(4) Dealers from whom the controller retrieves its purchasing terms (e.g. ISO-CENTER AG or Debrunner Acifer) are not sub-processors of ISOCALCX but contractual partners of the controller. On the controller's instruction, ISOCALCX transmits to them only the access credentials stored by the controller for login and receives the terms. The agreements between the controller and the dealer apply to processing at the dealer.

§7Rights of data subjects

(1) ISOCALCX supports the controller with appropriate technical and organisational measures in fulfilling its obligation to respond to requests from data subjects, in particular for access, rectification, erasure, restriction of processing and data portability (Art. 15–22 GDPR, Art. 25–28 revFADP).

(2) If a data subject addresses such a request directly to ISOCALCX, ISOCALCX shall forward the request to the controller without delay and shall only respond to it itself insofar as agreed or required by law.

(3) ISOCALCX may invoice expenses for support that exceed the usual scope on a separate time-and-material basis.

§8Notification obligations in case of data breaches

(1) ISOCALCX shall notify the controller of any breach of the protection of personal data without delay, but no later than within 72 hours of becoming aware of it, in text form.

(2) The notification contains, insofar as available, at least:

• a description of the nature of the breach as well as the categories and approximate number of affected persons and data records;
• the name and contact details of the responsible contact person at ISOCALCX;
• a description of the likely consequences and the measures taken or proposed for remediation and damage mitigation.

(3) ISOCALCX supports the controller in fulfilling its notification obligations vis-à-vis supervisory authorities (Art. 33 GDPR, Art. 24 revFADP) and data subjects (Art. 34 GDPR).

§9Audit rights of the controller

(1) The controller is entitled to satisfy itself, once a year by means of an audit, of compliance with the agreed data protection and security measures. The audit takes place after prior notice with reasonable notice period (at least 30 days), during normal business hours and without disrupting operations.

(2) The costs of the audit are borne by the controller; ISOCALCX's own expenses for support and preparation may be charged on at industry-standard rates.

(3) The presentation of current security or data protection certificates (in particular ISO/IEC 27001, SOC 2 Type II) or equivalent audit reports replaces a separate audit, insofar as they fully cover the audit subject.

§10Termination of the engagement

(1) After termination of the main contract, ISOCALCX shall, at the controller's choice, return all personal data processed on behalf of the controller or delete them from the productive systems without undue delay, but no later than within 30 days.

(2) Backup copies are not purged individually but expire: each backup is automatically deleted and overwritten no later than 30 days after it was created. During that period, backups are used solely to restore service after a fault and for no other purpose. If a backup has to be restored, the deletion is executed again immediately after the restore.

(3) Insofar as statutory retention obligations preclude immediate deletion, further processing shall be limited to the minimum required by law and shall be carried out without delay once the retention reason ceases.

(4) ISOCALCX shall confirm the proper return or deletion to the controller in writing upon request.

(5) ISOCALCX deletes stored dealer access credentials immediately when the controller removes the access or cancels the module, and otherwise in the next daily clean-up run once there is no longer an active subscription. The logs of price retrievals are deleted 12 months after the retrieval.