Data processing agreement

Version of 20 October 2026

This agreement forms part of the contract concluded when a customer subscribes to an AltiusForms instance hosted by Altius Group SNC (Free and Pro offers). It applies within the meaning of the Swiss Federal Act on Data Protection (FADP, Art. 9) and, where applicable, the EU General Data Protection Regulation (GDPR, Art. 28). It does not apply to self-hosted instances, whose data we do not process.

1. Parties and roles

• The customer (controller): the organisation that holds the account on the portal and decides what data its instance collects and why.
• Altius Group SNC (processor), Switzerland, which hosts, backs up, updates and maintains the instance on the customer's behalf.

2. Subject and duration

The subject is the hosting and operation of the customer's dedicated instance. The agreement runs for as long as the instance exists with us, including the deletion period described in section 12.

3. Nature and purposes of the processing

Storing the instance data, making it available to the customer's users on the web, in the mobile app and through the API, backing it up, applying updates, diagnosing outages and, on request, assisting the customer. We do not process this data for our own purposes: no advertising, no profiling, no resale, no training of artificial intelligence models.

4. Categories of data and data subjects

• Data subjects: users of the instance (the customer's staff and partners), people who fill in the customer's forms, people mentioned in responses.
• Data: whatever the customer chooses to collect, in particular identity and contact details, form responses, photos, videos, audio recordings, signatures, GPS positions, attached files; consent records (version and fingerprint of the accepted texts, date, channel, IP address); sign-in data and technical logs.
• Sensitive data: only the customer decides to collect it (for example health data); it must then have a legal basis and inform the people concerned.

5. The customer's instructions

We process the data only on the customer's documented instructions: the contract, the settings of its instance and its written requests. If an instruction seems to us to breach applicable law, we tell the customer.

6. Confidentiality

The people at Altius Group SNC who access the systems are bound to secrecy. Access to an instance's data is limited to what operation, support requested by the customer or a legal obligation require.

7. Technical and organisational measures

These are the measures actually in place on the date of this agreement.

Separation of customers - Each customer has its own instance: a separate namespace on the cluster, its own PostgreSQL database, its own Redis cache, its own secrets and its own address. - Files are stored either in the instance's own storage or at Wasabi in a space reserved for the instance, with an access key limited to that space.

Encryption and transport - All traffic uses HTTPS, with automatically renewed Let's Encrypt certificates; instances enforce HTTPS (HSTS) and secure cookies. - Operational secrets kept by the portal (cluster access, initial administrator password, storage keys) are encrypted there. The initial administrator password is shown to the customer only once. - User passwords are stored hashed (Argon2).

Access control - Role-based rights, with a hierarchy, groups and access set form by form. - Two-factor authentication (TOTP app and recovery codes), which the instance can require for privileged accounts; the mobile app supports it. - Single sign-on (OpenID Connect) possible with the customer's identity provider. - Lockout after 5 failed sign-in attempts (one hour) and rate limits on the API. - Infrastructure administered only by the Altius Group team, with SSH keys.

Integrity of incoming data - Attachments checked: list of allowed types, content checked against the extension, documents with macros and active content refused (HTML, SVG…), files served as downloads; optional antivirus. - Consent required on every filling channel when the form demands it, with proof kept with each response.

Logging - Log of sign-in attempts, activity log of collaborative filling sessions, log of emails sent, consent records.

Availability and backups - Nightly copy of each instance's database, kept for 14 days. - Automatic check of every instance every 5 minutes, published on the Service status page. - Updates in two steps: the database is migrated before the switch, and a failed update leaves the instance on its previous version.

Mobile app - Sign-in tokens in the device's secure keychain (Keychain or Keystore), app excluded from device backups on Android, no trackers.

8. Subprocessors

The customer authorises the use of the subprocessors listed on the Subprocessors page. We impose equivalent data protection obligations on them. We announce any change on that page before it takes effect; the customer may object on data protection grounds by writing to support@altius-group.ch and, failing a solution, terminate its subscription.

9. Place of processing and transfers

Instance data is processed in Finland (cluster) and, for files stored at Wasabi, in Germany. Transfers to a country without a recognised adequate level of protection (for example the United States for Stripe) are covered by appropriate safeguards, such as standard contractual clauses.

10. Assistance to the customer

We help the customer, as far as possible, answer requests from data subjects (access, rectification, erasure, portability, objection): the instance already lets the customer find, correct, export (CSV, Excel, PDF, JSON) and delete responses. A request that reaches us directly about an instance's data is passed on to the customer without our answering it ourselves. We also provide the information needed for an impact assessment.

11. Data security breach

If we detect a breach affecting an instance's data, we inform the customer by email without undue delay, with what we know: nature of the breach, data and people concerned, likely consequences, measures taken. The customer remains responsible for notifying the Federal Data Protection and Information Commissioner (FDPIC) or the competent authority and for informing the people concerned; we help.

12. End of contract: export and deletion

• Until the end of the paid period, the instance remains accessible: the customer exports its forms, responses and files.
• The instance is then suspended, and removed from the cluster 30 days after the subscription ends; during that period, a new subscription restores it as it was.
• A Pro instance the customer deletes from the customer area is stopped and kept for 30 days; during that period, the customer can restore it by subscribing to Pro again.
• A free instance the customer deletes is erased immediately, with no possible recovery. A free instance without activity for 90 days is erased, after two email warnings (14 and 4 days before).
• At the customer's request, or after these periods, we erase the instance's database, files and secrets. Backup copies expire on their own 14 days later at the latest.
• We confirm deletion in writing on request. Portal billing data follows the statutory retention period (10 years).

13. Audit

The customer may request the information needed to verify compliance with this agreement. An on-site check is agreed in advance, at its expense, without compromising the security or confidentiality of other customers.

14. Final provisions

In case of conflict, this agreement prevails over the terms of service on data protection matters. Otherwise, liability, applicable law (Swiss law) and jurisdiction are those of the terms of service. Contact: support@altius-group.ch.