Data processing agreement

As of 25.10.2026 (draft, legal review pending). The German version is authoritative.

Data processing agreement
between the customer under the General Terms and Conditions of igs.ch (hereinafter "customer", controller)
and Hunkeler Digital Services, Richard Hunkeler, Im Storchen 1, 8212 Neuhausen am Rheinfall, Switzerland (hereinafter "igs.ch", processor)

1. Subject matter and duration

• This agreement governs the processing of personal data by igs.ch on behalf of the customer under Art. 9 of the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies to the customer, it also constitutes a contract under Art. 28 GDPR.
• It forms part of the General Terms and Conditions (GTC) of igs.ch and applies for the duration of the contract and until the data is deleted in accordance with section 9.
• If a partner uses the platform for its own client organisations, igs.ch processes the data as a further processor of the partner. The partner ensures that it may engage igs.ch under its contracts with its client organisations.

2. Nature and purpose of the processing

igs.ch receives the DMARC aggregate reports (rua) on the customer's domains at the respective report address, fetches them via IMAP, reads them in, assigns the sending mail servers to senders (catalogue of known services, reverse DNS, network operator), stores, aggregates, displays and deletes them exclusively in order to provide the customer with the sender inventory, check results and recommendations for introducing e-mail authentication. In addition, igs.ch manages the tasks for remedying errors that the customer assigns to users of its account or to externals without an account, with history, replies and files. At the customer's request, igs.ch also receives and evaluates TLS-RPT reports for its domains and, in the Project and Partner plans, provides its MTA-STS policy.

3. Categories of data subjects and data

• Data subjects: operators and users of mail servers that send e-mails in the name of the customer's domains, including third parties using the domain without authorisation; reporting organisations; externals to whom the customer assigns tasks (e.g. employees of an IT partner).
• Data per report: reporting period, reporting organisation and report identifier; the received report e-mail with headers and attachment until its deletion.
• Data per report row: IP address of the sending mail server, number of mails, disposition, SPF and DKIM results, domains and selectors, alignment, domain in the From header (header-from); derived from these, host name (reverse DNS), network operator (ASN), assignment to a sender and its classification by the customer; daily aggregates per sender.
• Data from TLS-RPT reports: reporting period, reporting organisation with contact address, report id, policy, number of successful and failed encrypted connections, type of failure, name and IP address of the receiving mail server and, where reported, IP address of the sending mail server.
• E-mail content, subject lines and recipient addresses are not processed. Forensic reports (ruf) are discarded without evaluation.
• The IP addresses mostly belong to systems of businesses and mail providers; occasionally a personal reference may exist (e.g. a self-employed person's own mail server). Sensitive personal data is not intended to be processed.
• Data on tasks: sender, error pattern, deadline, status, history with replies, internal notes and uploaded files; for externals, e-mail address, name (optional), language and times at which the personal link was accessed; replies of the assigned person by e-mail to order@igs.ch (text without quotation, attachments in permitted formats).
• If further functions are offered in which igs.ch processes personal data on behalf of the customer, igs.ch supplements this section in advance in accordance with section 11 of the GTC.

4. Instructions

• igs.ch processes the data only on documented instructions from the customer. Instructions are this agreement, the customer's settings and actions on the platform (e.g. adding and removing domains, classifying senders, assigning and closing tasks) and written communications from the main users.
• If igs.ch considers an instruction to be unlawful, it informs the customer without delay and may suspend its execution until clarified.
• No processing for igs.ch's own purposes takes place. Excepted is data that igs.ch processes as controller (account and users, billing, platform security, reports that cannot be assigned to any customer); the privacy policy applies to it.

5. Confidentiality

igs.ch obliges all persons with access to the data to maintain confidentiality. Access is limited to what is necessary for operation, support and security.

6. Data security

igs.ch implements the technical and organisational measures set out in annex 2 and adapts them to the state of the art. Changes must not lower the level of protection.

7. Sub-processors

• The customer approves the sub-processors listed in annex 1.
• igs.ch informs the customer by e-mail at least 30 days in advance of the engagement or replacement of a sub-processor. The customer may object for good cause within this period; if no agreement is reached, the customer may terminate the subscription as of the date of the change, with a pro rata refund of amounts already paid, or close an account on the Free plan.
• igs.ch imposes the obligations of this agreement on sub-processors insofar as they apply to their services.
• Processing outside Switzerland only takes place in states with adequate data protection according to annex 1 of the Data Protection Ordinance or with appropriate safeguards. This is without prejudice to the queries of public directory services under annex 1, in which only the IP address of a sending mail server is transmitted.

8. Assistance to the customer

• Data subject rights: igs.ch forwards requests it receives directly to the customer and assists with access, rectification, erasure and data portability. The customer can delete domains and the associated report data on the platform itself and download its data.
• Data security breaches: igs.ch notifies the customer of a breach affecting the customer's data as soon as possible, as a rule within 48 hours of becoming aware of it, with the available information on the nature, scope, consequences and measures taken. Further information follows.
• igs.ch reasonably assists the customer with data protection impact assessments and with requests from supervisory authorities insofar as processing by igs.ch is concerned.

9. Return and deletion

• The customer can download its data at any time in the customer area.
• During the contract, igs.ch deletes the data according to the following time limits: report e-mails in the mailbox after 7 days; reports for domains without proof of ownership after at most 7 days; individual report rows after 30 days on the Free plan and after 13 months on the Project and Partner plans; thereafter only daily aggregates per sender remain, as long as the domain is recorded in the account; tasks with history, files and the information on the externals 24 months after their completion; links for externals are valid for at most 30 days. If the customer removes a domain, igs.ch deletes the associated report data and tasks.
• After the end of the subscription or after suspension for non-payment, the data is kept for 90 days and then deleted, unless it is continued within the scope of the Free plan (section 6 of the GTC). igs.ch reminds the main users by e-mail every 10 days beforehand. If the customer closes its account, the data is deleted immediately.
• Deleted data may remain in backups until they expire (annex 2); it is no longer processed and only becomes available again in the event of a restore.
• igs.ch records deletions on request and account closures in a deletion record and repeats them after a backup has been restored; the platform repeats automatic deletions after the expiry of the time limits by itself. igs.ch does not keep a record of individual deletions of content by the customer (deletion log): if a backup has to be restored, such content may be present again, as a rule at most the deletions of the last 12 hours. In that case igs.ch informs the customer without delay so that it can repeat the deletion.
• Invoices and records that igs.ch is required to keep are retained for the statutory period.

10. Evidence and audits

• Information: on request, igs.ch provides the customer with the information necessary to demonstrate compliance with this agreement, in particular the current technical and organisational measures (annex 2), the list of sub-processors (annex 1), a summary of the last backup restore test and written answers to a questionnaire from the customer. The customer sees the action log of its own account directly in igs.ch.
• Audit: if the information demonstrably does not suffice, the customer may audit compliance itself or have it audited by an auditor; the same applies after a data security breach affecting the customer's data or if a supervisory authority requires it. The auditor must be bound by confidentiality and must not be a competitor of igs.ch.
• Procedure: an audit must be announced in writing at least 30 days in advance, or 5 working days after a data security breach. It takes place at most once every 12 months, except after a breach or at the request of a supervisory authority, and as a rule lasts no more than one working day.
• Form: audits are carried out remotely (video conference, inspection of documents and settings). An on-site audit only takes place if a remote audit demonstrably does not suffice, if a supervisory authority requires it or after a serious data security breach affecting the customer's data. It is carried out by an independent auditor bound by confidentiality at a location in Switzerland designated by igs.ch; the customer bears the costs. For the hosting provider's data centre, the provider's evidence applies; visits to the data centre are not possible.
• Limits: the audit does not include access to other customers' data, to source code, keys or access credentials, or to igs.ch's trade secrets. Security tests against the platform (e.g. penetration tests or scans) are only permitted with igs.ch's prior written consent and according to agreed rules.
• Costs: information is free of charge once every 12 months. For further information and for audits, each party bears its own costs; igs.ch charges its effort at CHF 180 per hour. If an audit reveals a material breach of this agreement by igs.ch, igs.ch bears its own effort.
• Results: the customer provides igs.ch with the result of the audit. igs.ch remedies identified deficiencies within a reasonable period and informs the customer of the measures taken.
• Authorities: audits by competent supervisory authorities remain reserved; the limitations of this section do not apply to them insofar as the law so provides.

11. Liability and final provisions

• Liability is governed by the GTC.
• In case of conflict, this agreement takes precedence over the GTC with regard to the protection of personal data.
• Swiss law applies. Place of jurisdiction is Schaffhausen. The German version is authoritative.
• This agreement forms part of the GTC and is concluded electronically upon their acceptance during registration; no separate consent is required. The version of the GTC, time, person and IP address are logged. Changes are made in accordance with section 11 of the GTC. The version in force is published on igs.ch.

Annex 1: Sub-processors

• Server4You GmbH, Hanau (Germany): provision of the dedicated igs.ch server (platform, database, files, mailbox for the aggregate reports, e-mail delivery) in a data centre in Strasbourg (France); igs.ch handles system administration itself. France and Germany are states with adequate data protection. A separate data processing agreement with Server4You does not yet exist; igs.ch aims to conclude it by 31.03.2027. Encrypted backups are additionally kept on a separate computer owned by igs.ch in Switzerland.
• Queries of public directory services (not sub-processors in the strict sense, disclosed for transparency): Team Cymru, Inc. (USA), "IP to ASN" service, queried via DNS to determine the network operator (ASN) of a sending mail server; reverse DNS queries to the name servers responsible for the respective IP range. In each case, only the IP address of the sending mail server is transmitted, without information on the customer, the domain or e-mails.
• Let's Encrypt (Internet Security Research Group, USA; not a sub-processor in the strict sense, disclosed for transparency): issuance of the certificate for the mta-sts.<domain> names with hosted MTA-STS. Only these names are transmitted; they are logged publicly under the Certificate Transparency procedure.
• Services that igs.ch uses as controller are not sub-processors, e.g. the accounting program cash.simples.ch (server of Server4You GmbH, Strasbourg data centre) and the payment service Revolut for card payments.
• E-mails to external recipients are delivered via their own mail providers.

Annex 2: Technical and organisational measures

• Access: login with password (stored only as a hash) and mandatory second factor (code from an authenticator app, key stored encrypted); exception: trusted devices only on request and for at most 90 days; logout after inactivity; recovery codes only as hashes; limitation of login attempts.
• Authorisations: tenant separation in every query; roles main user, editor and viewer; invitation of further users only by main users; externals see only the assigned task, without internal notes, via a random, time-limited and revocable link (stored only as a hash).
• Receipt of reports: separate, random report address per domain that cannot be guessed; evaluation only if the token matches in all headers and the domain in the report matches the token, otherwise filing as faulty and entry in the system log; evaluation only for domains with proven ownership; fetching via IMAP over TLS only; mailbox access credentials outside the web directory; check of the DKIM signature of the report e-mail, non-authenticated reports are flagged and do not count towards recommendations.
• Reading in reports: XML parser with external entities disabled (protection against XXE); only permitted file types (XML, GZIP, ZIP); size limits per attachment and for the unpacked size (protection against zip bombs); detection of duplicate reports; forensic reports are discarded.
• Data minimisation: no e-mail content, no subject lines and no recipient addresses; deletion of report e-mails after 7 days; limited retention of report rows, thereafter only daily aggregates (section 9); only the IP address of the mail server is passed to external directory services.
• Transmission: encrypted only (HTTPS); strict Content Security Policy without third-party content; fonts served from our own server; no tracking.
• Storage: files outside the web directory; uploaded files for tasks only in permitted formats (checked by content), with a size limit and delivered only as downloads; keys of the second factor encrypted.
• Logging: important actions with time and person (the e-mail address is retained after a login is deleted); access to interfaces (fetching of reports, exports) in a separate database with a hash chain that makes subsequent modifications detectable (6 months); system log for discarded reports.
• Backup: encrypted backup of database and files at least every 12 hours with a copy on a separate computer of our own in Switzerland; data loss of at most 12 hours, recovery within one working day; backups kept for at most 6 months; deletion record for requests and account closures, no deletion log for individual content (section 9).
• Operations: updates of operating system and software; monitoring of system status (mailbox, fetching, DNS records of igs.ch, unprocessed reports) and of backups with alerting; limitation of e-mail sending.
• Organisation: confidentiality undertaking, access to customer data only when needed for operation and support, regular review of these measures.