under Art. 9 of the Federal Act on Data Protection (FADP/DSG) and, for customers based in the EU or the EEA, under Art. 28 of the General Data Protection Regulation (GDPR/DSGVO)
between
[Customer's company name], [Address], the «Controller» or «Customer»
and
Tyche Consulting GmbH (Klaumo), Tobelstrasse 13, 5445 Eggenwil, Switzerland, UID CHE-351.849.013, the «Processor» or «Klaumo»
Preliminary remarks
This DPA forms part of the contract between the customer and Klaumo, consisting of the accepted quote (Offerte) and Klaumo's General Terms and Conditions (GTC/AGB) (the «Main Contract»). It applies automatically whenever Klaumo processes personal data on behalf of the customer in providing its services, even without a separate signature. On request, both parties sign a copy.
The following order of precedence applies: quote, this DPA, the declaration of commitment to confidentiality (where applicable), the addendum for customers in the EU and the EEA (where applicable), the GTC. In the event of conflicts concerning data protection, this DPA takes precedence over the GTC.
1. Subject matter
1.1Klaumo is an agency for AI and automation. It sets up AI agents (for example for telephone, chat, WhatsApp and e-mail), automations and digital solutions for the customer and, where agreed, maintains them in ongoing operation. The individual services are set out in the quote.
1.2The customer uses these services in its business. In doing so, Klaumo processes personal data for which the customer is responsible.
1.3This DPA governs the obligations of both parties in protecting this personal data. Klaumo acts as processor within the meaning of Art. 5 lit. k and Art. 9 FADP, and the customer as controller within the meaning of Art. 5 lit. j FADP. Terms such as «personal data», «processing», «sensitive personal data» and «breach of data security» have the meaning given in Art. 5 FADP.
2. Term
2.1The DPA begins upon acceptance of the quote, and at the latest with the first processing of personal data on behalf of the customer.
2.2It applies for as long as Klaumo processes the customer's personal data. It ends only when all data has been returned or deleted in accordance with section 16, even if the Main Contract ends earlier. Termination of this DPA alone is excluded for as long as the Main Contract is in force.
3. Nature, purpose and scope of the processing
3.1Purpose. Klaumo processes personal data only to provide the services agreed in the quote. These include in particular: receiving and answering calls, chats and messages on behalf of the customer; recording requests, appointments and enquiries; passing them on to the customer's team and systems; preparing summaries and analyses; sending reminders and messages on behalf of the customer; creating and publishing content for the customer; setting up, testing, monitoring and improving solutions.
3.2Source of the data. The data reaches Klaumo by the route appropriate to the service concerned, for example: in an agent's conversation with a person calling or writing, via interfaces to the customer's systems (calendar, CRM, e-mail), through documents and information that the customer provides for the set-up, or in exchanges with the customer's team.
3.3Processing operations. Klaumo collects, receives, stores, organises, reads, analyses, summarises, combines, transmits, corrects, restricts and deletes personal data, in each case only to the extent required by the agreed service.
3.4Customer's responsibility. As controller, the customer is solely responsible for ensuring that the data it hands over to Klaumo or has processed via the solution has been lawfully collected, is accurate and is based on a legal basis, and that the data subjects have been informed (Art. 19 FADP). This also includes informing callers that they are talking to an AI and that the conversation is being recorded, where recording has been agreed. Klaumo's obligations under this DPA and under Art. 9 FADP remain unaffected.
3.5Klaumo does not check the content of the data or the lawfulness of the customer's processing and is not obliged to do so (section 20.10 GTC). If Klaumo notices an obvious infringement of the law, section 5.3 applies.
4. Data and data subjects
4.1The categories of personal data and data subjects covered and how long the data is retained are set out in Annex 1.
4.2Agents and automations also record information that callers or writers provide of their own accord. Klaumo cannot fully limit this information in advance. The customer specifies in the quote or in its instructions which information an agent may actively ask for.
4.3If the categories of data or data subjects change, for example because the customer connects a new channel or a new customer group, the customer notifies Klaumo in advance and issues the necessary instructions. Klaumo then adapts the processing.
4.4No recognition of persons by their voice. Klaumo processes voice recordings only to convert speech into text, to speak answers and to record conversations, where agreed. Klaumo does not create voice profiles, does not compare voices and does not use any methods that uniquely identify a person by their voice or recognise them across several conversations. The technical separation of agent and caller within a conversation does not serve identification purposes. In Klaumo's view, it therefore does not process biometric data within the meaning of Art. 5 lit. c no. 4 FADP. The legal classification in the individual case lies with the customer. Conversation content may nevertheless contain sensitive personal data, for example health information; section 17 applies to this.
4.5Klaumo processes sensitive personal data only if the quote expressly provides for this. Section 17 then applies.
5. Instructions
5.1Klaumo processes the data only in accordance with the Main Contract and the customer's documented instructions and only in the way the customer itself would be permitted to do (Art. 9 para. 1 lit. a FADP). The quote, the agreed set-up of the agent and this DPA constitute the initial instructions.
5.2The customer issues further instructions in writing or by e-mail to support@klaumo.ch. The customer confirms oral instructions by e-mail without delay. Instructions that go beyond the agreed services are changes to the scope of services and are remunerated in accordance with the GTC.
5.3If Klaumo considers an instruction to be unlawful, it informs the customer without delay. Klaumo may suspend execution until the customer confirms or changes the instruction. Klaumo is not required to carry out an obviously unlawful instruction.
5.4Klaumo does not use the data for its own purposes or to train AI models, either itself or through sub-processors, insofar as their contracts allow this (Annex 2). Only anonymous, aggregated metrics under section 20.8 of the GTC are permitted.
5.5If Klaumo is required by a legal obligation to process data differently, it informs the customer in advance, unless the law prohibits this.
6. Klaumo's general obligations
6.1In processing, Klaumo complies with the FADP and the Data Protection Ordinance (DPO/DSV) and, for customers in the EU and the EEA, also with the GDPR in accordance with section 14.
6.2Klaumo processes only as much data as is necessary for the service and designs the solutions to be privacy-friendly, with data-minimising default settings (Art. 6 para. 2 and Art. 7 FADP).
6.3At Klaumo, only persons who need access to customer data for their work are given such access.
6.4Klaumo keeps a record of the processing activities it carries out on behalf of the customer (Art. 12 para. 1 and 3 FADP) and, on request, helps the customer with the information it needs for its own record.
6.5Klaumo has not appointed a data protection advisor under Art. 10 FADP. The contact for data protection is the management, who can be reached at support@klaumo.ch.
6.6If Klaumo finds that it can no longer comply with this DPA, it informs the customer without delay.
7. Confidentiality
7.1All persons at Klaumo who have access to customer data are bound to confidentiality in writing before they begin their work. This applies to employees and to freelancers. The obligation applies without time limit, including after the end of their work for Klaumo.
7.2Klaumo informs these persons of the consequences of a breach, in particular of Art. 62 FADP, and trains them in data protection.
7.3If the customer is subject to professional secrecy (for example under Art. 321 of the Swiss Criminal Code (SCC/StGB)), Klaumo's declaration of commitment to confidentiality (document 07) also applies. It is deemed agreed upon acceptance of the quote if the quote designates the customer as bound by professional secrecy. A signature is not required for it to take effect; at the customer's request, both parties sign.
8. Data security
8.1Klaumo takes the technical and organisational measures set out in Annex 3. They ensure confidentiality, availability, integrity and traceability of the data appropriate to the risk (Art. 8 FADP and Art. 1 to 6 DPO).
8.2Klaumo adapts the measures to technical developments. It may replace measures with equivalent ones, provided that the level of protection does not decrease. Klaumo documents material changes and communicates them to the customer on request.
9. Assistance with requests
9.1Rights of data subjects. Klaumo assists the customer with appropriate technical and organisational means so that it can respond to requests from data subjects, in particular for access (Art. 25 FADP), release or transfer (Art. 28 FADP), rectification, erasure, restriction and objection (Art. 32 FADP). Klaumo locates the relevant data in its systems and at the sub-processors, provides it to the customer in a common format and corrects or deletes it on the customer's instructions.
9.2If a data subject contacts Klaumo directly, Klaumo forwards the request to the customer within 3 working days and does not answer it itself, unless the customer instructs it to do so.
9.3Requests from authorities and third parties. If Klaumo receives a request, order or communication from an authority, a court or a third party concerning the customer's data, it informs the customer without delay, insofar as the law permits. Klaumo discloses data only if it is legally obliged to do so, and only as much as necessary. For customers subject to professional secrecy, section 4 of the declaration of commitment to confidentiality also applies.
9.4Klaumo may charge for effort in providing assistance under this section that goes beyond the usual support, at the rates set out in the GTC, unless the effort arises from an error on Klaumo's part.
10. Breach of data security
10.1Klaumo informs the customer immediately, and at the latest within 24 hours of becoming aware of a breach of data security affecting the customer's data (Art. 24 para. 3 FADP). A breach is any incident in which data is accidentally or unlawfully lost, deleted, destroyed or altered, or disclosed or made accessible to unauthorised persons (Art. 5 lit. h FADP). Klaumo also reports well-founded suspicions.
10.2The notification is made by e-mail and by telephone to the customer's contact person. Insofar as known, it contains: what happened and when, which data and approximately how many persons are affected, possible consequences, measures already taken and planned, and a contact person at Klaumo. Klaumo provides missing information as soon as it becomes available.
10.3Klaumo immediately takes the measures necessary to contain the incident and mitigate its consequences, and documents the incident.
10.4The customer decides whether notification to the Federal Data Protection and Information Commissioner (FDPIC/EDÖB) and information of the data subjects are necessary (Art. 24 para. 1 and 4 FADP). These notifications are the customer's responsibility. Klaumo supports the customer with all the information it has. Klaumo informs data subjects or authorities only in consultation with the customer, unless the law requires otherwise.
11. Data protection impact assessment
11.1If the customer has to carry out a data protection impact assessment (Art. 22 FADP) or consult the FDPIC in advance (Art. 23 FADP), Klaumo supports it with information about its services, the sub-processors, the places of processing and the measures set out in Annex 3.
11.2For solutions involving sensitive personal data, Klaumo provides the customer with a short description of the data flows before launch.
12. Sub-processors
12.1Klaumo uses different sub-processors depending on the service. By this DPA, the customer approves the sub-processors listed in Annex 2 for the services it orders (Art. 9 para. 3 FADP).
12.2Klaumo concludes a contract with each sub-processor that binds it to data protection and confidentiality obligations at least equivalent to those provided for in this DPA, insofar as this is possible with the standard contracts of large providers. Where a provider offers only its own standard terms, Klaumo reviews them before use and states the basis in Annex 2.
12.3Klaumo selects the sub-processors carefully, checks their evidence (certificates, audit reports, contracts, list of their own sub-processors) before use and at least once a year thereafter, and documents the check. If Klaumo finds that a sub-processor no longer fulfils its obligations, it informs the customer without delay and ensures a remedy or replacement.
12.4Changes. If Klaumo wishes to add or replace a sub-processor, it informs the customer by e-mail at least 30 days in advance. It is also a change if a listed sub-processor is used for a new purpose or processes the data at an additional location outside Switzerland, the EU or the EEA.
12.5Objection. The customer may object by e-mail within these 30 days if it states important data protection reasons. As long as the parties have not found a solution, Klaumo does not use the new sub-processor for this customer's data, insofar as this is technically possible. If no solution is possible, either party may terminate the affected service with effect from the date of the change; Klaumo refunds on a pro rata basis any amounts already paid for the period after termination. Without objection, the change is deemed approved.
12.6Urgent change. If a provider fails or a security problem becomes known, Klaumo may immediately replace it with an equivalent provider. It informs the customer as quickly as possible; the right of objection under section 12.5 applies from the date of this information.
12.7Services that Klaumo uses only as ancillary services without them obtaining access to customer data (for example telephone and internet providers for its own connection) are not sub-processors within the meaning of this section. Nor are providers that the customer itself selects and with which it has its own contract (for example its CRM, its calendar or its practice software); the customer is responsible for these.
13. Disclosure abroad
13.1Some sub-processors process data outside Switzerland, in particular in the EU and in the USA. Klaumo discloses data abroad only if one of the following conditions is met (Art. 16 and 17 FADP):
- the state has adequate data protection under Annex 1 DPO; this applies to the EU and EEA states and to the United Kingdom. For the USA, this applies only to recipients certified under the Swiss-U.S. Data Privacy Framework (inclusion of the USA in Annex 1 DPO with effect from 15 September 2024);
- otherwise: the standard contractual clauses of the European Commission of 4 June 2021 with the adaptations for Switzerland recognised by the FDPIC, together with an assessment of the risks of the transfer and, where necessary, additional safeguards.
13.2Which basis applies to which provider is set out in Annex 2. Klaumo checks the basis before each new contract and keeps Annex 2 up to date. Where a provider's contractual clauses still refer to the Data Protection Act of 1992, they apply in the sense of the current FADP and the DPO.
13.3The customer acknowledges that speech and text are transferred to the EU and to the USA for AI processing; Anthropic may also process data in other countries. Data that remains stored (database) is located in Switzerland (Zurich). Under the law there, authorities in the USA may, under certain conditions, demand access to data held by US providers; the measures in Annex 3 and the providers' contracts reduce this risk but do not rule it out.
13.4For customers whose data should not leave Switzerland, Klaumo offers on request a solution with processing only in Switzerland, with a separate quote. Klaumo does not warrant that all data is processed in Switzerland unless this solution has been agreed.
14. Customers in the EU and the EEA
14.1If the customer is based in the EU or the EEA, or the GDPR applies to the processing for another reason, this DPA also constitutes a contract under Art. 28 para. 3 GDPR. The terms of the FADP are then to be understood in the sense of the GDPR.
14.2In that case, Klaumo fulfils in particular: processing only on documented instructions, including with regard to transfers to third countries (Art. 28 para. 3 lit. a GDPR); confidentiality (lit. b); security under Art. 32 GDPR (lit. c, Annex 3); sub-processors only in accordance with section 12 (lit. d); assistance with data subject rights (lit. e) and with Art. 32 to 36 GDPR (lit. f); deletion or return (lit. g); evidence and audits (lit. h, section 15).
14.3Notification under section 10.1 within 24 hours enables the customer to meet the 72-hour deadline for its notification to the supervisory authority (Art. 33 GDPR).
14.4The details, in particular on transfers to third countries, are governed by the addendum for customers based in the EU or the EEA (document 06). It takes precedence over this DPA insofar as it differs.
15. Audits and evidence
15.1On request, Klaumo provides the customer with all information it needs to verify compliance with this DPA, in particular the current list of sub-processors with their evidence (certificates, audit reports), the description of the measures set out in Annex 3 and the documentation of the commitments under section 7.
15.2If these documents are not sufficient, the customer may, once per calendar year and with at least 14 days' prior notice, carry out an audit itself or through a professional who is bound to confidentiality and does not work for a competitor of Klaumo. The audit takes place during office hours and must not disrupt operations disproportionately. In the event of a breach of data security or an order from an authority, an additional audit at short notice is also possible.
15.3The customer bears Klaumo's costs for an on-site audit at the rates set out in the GTC, unless the audit reveals a material breach of this DPA.
15.4Audits of sub-processors are governed by their contracts. As a rule, these providers demonstrate compliance by means of certificates and audit reports; Klaumo makes this evidence available to the customer insofar as the providers permit. Klaumo has no influence on the conditions under which large providers allow audits.
16. Retention, return and deletion
16.1Klaumo keeps the data only for as long as necessary for the service. The default periods are set out in Annex 1. The customer may instruct shorter periods. The parties agree in writing on periods longer than those in Annex 1.
16.2Klaumo deletes voice recordings and transcripts after 90 days unless the customer instructs a different period.
16.3Klaumo transfers enquiries, appointments and contacts to the customer's systems (for example CRM or calendar) and keeps them itself only for as long as necessary for operation, at most until the end of the contract.
16.4At the end of the contract, and earlier at the customer's request, Klaumo either hands over all data to the customer in a common format or deletes it, at the customer's choice. The customer communicates its choice within 14 days of the end of the contract. Klaumo then deletes the data from its own systems within 30 days of the end of the contract and ensures that it is deleted at the sub-processors in accordance with their retention periods (Annex 1). On request, Klaumo confirms the deletion in writing.
16.5This does not apply to data that Klaumo must retain due to a legal obligation (for example accounting records and vouchers for 10 years under Art. 958f of the Code of Obligations (CO/OR)), or to copies in backups that are overwritten according to the fixed cycle set out in Annex 3. This DPA continues to apply to this data until it is deleted.
17. Sensitive personal data and professional secrecy
17.1If an agent processes sensitive personal data, the parties agree in advance in writing which data the agent may ask for. The agent does not make diagnoses and does not ask about medical history.
17.2For customers subject to professional secrecy under Art. 321 SCC (for example physicians, dentists, therapists, lawyers), the declaration of commitment to confidentiality (document 07) also applies. For these customers, Klaumo uses only the sub-processors that the customer approves in Annex A of that document; fallback providers other than another Claude model from Anthropic (Annex 2, Part C) are switched off unless the customer expressly switches them on.
17.3The customer decides for itself whether its professional rules permit the use of Klaumo and the sub-processors and whether it needs the consent of its patients or clients for this.
18. Liability
18.1Liability is governed by the Main Contract, in particular sections 23 and 20.9 to 20.14 of the GTC. Statutory claims of data subjects remain reserved.
18.2If Klaumo breaches this DPA or processes data contrary to the customer's instructions, it is liable within the scope of the GTC. If damage is based on the customer's data or instructions, section 20.13 of the GTC applies.
19. Final provisions
19.1Amendments and additions to this DPA must be made in writing; e-mail is sufficient if it is expressly designated as an amendment to this DPA. Section 28 of the GTC (amendment of the GTC by notice) does not apply to this DPA, except for updates to Annex 2 under section 12 and to Annex 3 under section 8.2.
19.2Swiss law and the place of jurisdiction under section 30.6 of the GTC apply. Mandatory provisions of the GDPR remain reserved for customers under section 14.
19.3If any provision is invalid, the remaining provisions remain valid. It is replaced by a provision that comes closest to its purpose and complies with data protection law.
19.4In case of discrepancies between the language versions, the German version prevails.
Place, date: ____________________
For the customer: ____________________
For Tyche Consulting GmbH: ____________________
Annex 1: Data categories, data subjects, retention
Data subjects
- The customer's own customers (including patients, clients, guests)
- Prospects, callers and persons writing to the customer
- The customer's employees
- Suppliers, business partners and other third parties with whom the customer is in contact
Categories of personal data
| Category | Examples | When |
|---|---|---|
| Master data and contact details | Name, telephone number, e-mail, address, language | always |
| Content of communications | Voice recordings, transcripts, chat and WhatsApp messages, e-mails, summaries, anything persons say of their own accord in the conversation | Agents and channels |
| Appointment, order and contract data | Preferred appointment, booked appointment, request, order, quote | depending on the service |
| Telephony and connection data | Caller's number, time, duration, channel, forwarding | Telephone |
| Technical data and logs | IP address for web chat, error and process logs, timestamps | Operation |
| AI inputs and outputs | Instructions to the model, the agent's knowledge base, answers | Agents |
| Set-up data | Settings, workflows, names and roles of employees for forwarding | Set-up |
| Access credentials for the customer's systems | Interface keys, authorisations for calendar or CRM (stored only in encrypted form) | Integrations |
| Content for channels and advertising | Texts, images, videos, comments and messages on social media | Content service |
| Payment and invoice data | Amount, payment status, billing address; no full card numbers at Klaumo | only with payment functions |
| Sensitive personal data | Information about health, treatments or legal proceedings, insofar as persons mention it in the conversation | only if agreed in the quote (section 17) |
Default retention periods
| Data | Period at Klaumo and its sub-processors |
|---|---|
| Voice recordings and transcripts (voice agents) | 90 days from the end of the conversation, then automatic deletion at ElevenLabs and in the database |
| Summaries, enquiries, appointments, contacts | until transfer to the customer's systems, at most until the end of the contract |
| Texts at Anthropic (Claude) | at most 30 days after the request, in accordance with Anthropic's terms |
| Logs of the server functions and the database | Vercel: at most 30 days (1 day on the Pro plan, 30 days with the «Observability Plus» add-on); Supabase: 7 days (Pro plan) |
| Telephony connection data | on request |
| Database backups | 7 days, then overwritten |
| Confirmation codes (WhatsApp, SMS) | at Klaumo, only until confirmation; at Zernio, the code is stored only as a check value (hash) and the record is deleted 24 hours after it is created |
| Invoices and vouchers | 10 years (Art. 958f CO); Klaumo processes these as a controller in its own right |
| all other data | deletion within 30 days of the end of the contract (section 16.4) |
Annex 2: Sub-processors
Checked against the providers' websites and the list of Data Privacy Framework participants (www.dataprivacyframework.gov). Providers' certifications and contracts may change; Klaumo checks them before each new contract and at least once a year.
Part A: Always used for agents and operation
| Provider | Purpose | Klaumo's contractual partner | Place of processing | Basis for disclosure abroad |
|---|---|---|---|---|
| ElevenLabs | Speech recognition, voice, conversation management of the voice and chat agents; storage of recordings and transcripts until deletion; for the voice connection in the browser, ElevenLabs uses LiveKit Inc., USA | Eleven Labs Inc., New York, USA | USA | Swiss-U.S. Data Privacy Framework (Eleven Labs Inc. and LiveKit Incorporated: «Active») |
| Anthropic | Claude language model, which formulates the answers and analyses and summarises conversations; the fallback model in the event of an outage is also Claude | Anthropic Ireland, Limited, Dublin, Ireland | USA and other countries (worldwide processing) | Standard contractual clauses with adaptations for Switzerland (Anthropic is not certified under the Data Privacy Framework) |
| Supabase | Database for enquiries, appointments and transcripts | Supabase Pte. Ltd., Singapore | Switzerland (Zurich) | Storage in Switzerland; for access by the provider from abroad: standard contractual clauses with adaptations for Switzerland (Supabase is not certified under the Data Privacy Framework) |
| Vercel | Hosting and server functions | Vercel Inc., USA | Server functions in Frankfurt (Germany); Vercel may also process data in the USA | Swiss-U.S. Data Privacy Framework (Vercel Inc.: «Active») |
| Infomaniak | Klaumo's e-mail (exchanges with the customer); hosting in Switzerland for the «Switzerland only» solution | Infomaniak Network SA, Geneva, Switzerland | Switzerland | no disclosure abroad |
Note on ElevenLabs and Anthropic: In the voice and chat agents, Klaumo uses the Claude models offered by ElevenLabs; Klaumo does not store its own Anthropic key there. ElevenLabs then passes the texts on to Anthropic under its own contracts; to that extent, Anthropic is a sub-processor of ElevenLabs. Klaumo uses the direct contract with Anthropic (row above) where Claude is used outside ElevenLabs, for example in automations.
Part B: Depending on the service ordered
| Provider | Purpose | Klaumo's contractual partner | Place of processing | Basis for disclosure abroad |
|---|---|---|---|---|
| Twilio | Telephone number (+41) and forwarding of calls to the voice agent; WhatsApp channel | on request | By default, calls are routed via the USA, including for +41 numbers | Swiss-U.S. Data Privacy Framework (Twilio Inc.: «Active») |
| Zernio | Confirmation codes via WhatsApp or SMS; publication on social media (content service) | ZERNIO SOFTWARE SL, Palamós, Spain | United Kingdom and Western Europe; some service providers in the USA | Spain and United Kingdom: adequate data protection (Annex 1 DPO); USA: EU standard contractual clauses under Zernio's contract (zernio.com/dpa); Zernio is not certified under the Data Privacy Framework |
| Notion | Project management and notes on the set-up for the customer | Notion Labs, Inc., San Francisco, USA | USA | Swiss-U.S. Data Privacy Framework (Notion Labs, Inc.: «Active – Re-certification under Review»); if the certification lapses, Notion's standard contractual clauses apply |
| Stripe | Payments, only if a payment function for the customer's own customers has been agreed | Stripe Payments Europe, Limited, Dublin, Ireland | Ireland and USA (Stripe, LLC) | Ireland: adequate data protection; Stripe, LLC: Swiss-U.S. Data Privacy Framework («Active») |
| Telegram | Notifications to the customer's team and Telegram channels, only if the customer chooses Telegram; not for sensitive personal data | on request | on request | on request |
Part C: Fallback providers
If the Claude language model fails, the agent switches to another Claude model from the same provider, Anthropic (for example Claude Haiku). Part A applies to this; no further provider is added. Klaumo does not use any other fallback providers. If a further fallback provider is to be added later, the procedure under section 12.4 applies; for customers subject to professional secrecy, it remains switched off (section 17.2).
Training of AI models
Under their contracts, Anthropic, Zernio and Notion do not use customer data to train AI models. At ElevenLabs, Klaumo switches off use for training in the account before a customer's agent goes live.
Annex 3: Technical and organisational measures (TOMs)
Klaumo is a small team and does not operate its own data centres. The data is held by the providers listed in Annex 2. The measures combine the security of these providers with Klaumo's own measures.
Technical measures
Data centres and providers
- Operation only with providers that hold recognised security certifications (for example SOC 2 or ISO 27001); Klaumo files the evidence and provides it to the customer on request.
- Database in Switzerland (Zurich); server functions in Frankfurt (region «fra1» at Vercel).
Access and permissions
- Access to systems only for persons who need it for their work (need-to-know, least privilege); permissions are adjusted when a person's role changes and withdrawn on the same day when they leave.
- Two-factor sign-in for all services that contain customer data.
- Personal accounts, no shared passwords; long, random passwords in a password manager.
- Administrative rights only for the management and expressly designated persons.
- Automatic sign-out or lock after inactivity on work devices and administration interfaces.
- Interface keys only in protected environment variables (stored as «sensitive» at Vercel), never in the program code; limited permissions and spending limits per key.
Separation
- Each customer's data is logically separated; access in the database is governed by row-level permissions (Row Level Security) on all tables.
- Testing and production are separated; tests run with fictitious data, never with real customer data.
Transmission and storage
- Encrypted transmission (TLS) for all connections; HSTS on the website.
- Encrypted storage at the hosting and database providers.
- Work devices with encrypted storage media.
- Data leaves Klaumo's systems only via the providers listed in Annex 2; no sending of customer data via private accounts or private devices.
Protection against attacks and misuse
- Firewall of the hosting provider with limits on requests per IP address; daily limits and limits on concurrent conversations per agent.
- Interfaces accept requests only from Klaumo's own pages; access to conversations on Klaumo's website requires a confirmation code.
- Agents do not accept files and ignore instructions from callers or writers to change their rules.
- Before every change to an agent, tests are run with attack attempts (for example attempts to manipulate the agent or to extract data).
- Content security policy (Content Security Policy) on the website, initially in report-only mode.
- Up-to-date operating systems, browsers and program libraries; security updates are installed promptly, critical ones immediately.
- Protection against malware on work devices.
- External penetration tests are not currently agreed.
Traceability
- Access and changes in the database and hosting can be traced via the providers' logs; periods: Supabase 7 days, Vercel at most 30 days (Annex 1).
- Changes to the program code are managed in a version control system; automated tests must pass before every release.
Availability and recovery
- Daily backup of the database, kept for 7 days; manual backup before every change to the database structure; recovery is tested regularly.
- Monitoring of the agents; in the event of an outage, calls are forwarded to the customer's employees where technically possible.
Deletion
- Automatic deletion of recordings and transcripts after 90 days (setting per agent).
- Deletion of all customer data within 30 days of the end of the contract; backups are overwritten after 7 days.
Data minimisation
- Agents ask only for the information that the customer has specified for the task.
- No voice profiles and no recognition of persons by their voice (section 4.4).
- Where possible, data is aggregated or processed without names for analyses.
Organisational measures
- Responsibility: The management is responsible for data protection and data security and is the contact for customers and authorities.
- Commitment: All employees and freelancers sign the declaration of commitment to confidentiality (document 07, Part B) before first access; the declarations are kept on file.
- Training: Introduction to data protection and data security before first access, and at least once a year thereafter, with examples of phishing and manipulation of AI agents.
- Policy: A short internal policy on data security, devices, passwords and handling of customer data, reviewed annually.
- Data protection by design: New solutions are planned with data-minimising default settings (Art. 7 FADP); for sensitive personal data, the data flow is described before launch.
- Record: Record of processing activities on behalf of customers.
- Risk assessment: Assessment of the risks of transfers abroad before using a provider without adequate data protection.
- Providers: Selection of sub-processors on the basis of data protection and security; a data processing agreement with each; annual review of the evidence.
- Requests from data subjects: fixed procedure: record the request, forward it to the customer within 3 working days, provide, correct or delete data on instruction, document.
- Security incidents: fixed procedure: detect, contain, inform customers within 24 hours, remedy the cause, document, adapt measures.
- Deletion concept: Periods in accordance with Annex 1, set up technically, automatically where possible.
- Review: These measures are reviewed and adapted at least once a year and after every security incident.