This Data Processing Agreement ("DPA") forms part of the agreement between you (the "Controller") and unaxus GmbH, the company behind HyperLogin (the "Processor"), where we process personal data on your behalf — for example, data about your organization's members and devices.
You are the controller of the personal data you submit. HyperLogin acts as processor and processes that data only on your documented instructions.
We process personal data to provide the Service, for the duration of your subscription and as needed to comply with the law.
We will process data only on your instructions; ensure personnel are bound by confidentiality; implement appropriate technical and organizational measures; and assist you with data subject requests and security obligations.
You authorize us to engage the subprocessors listed on our Subprocessors page. We impose data-protection terms on each and remain responsible for their performance. We give notice before adding a new subprocessor.
We maintain end-to-end encryption of session content, encryption in transit, least-privilege access, and regular independent testing. A summary is on our security overview.
We will promptly inform you of any request we receive relating to your data and assist you in responding.
We will notify you without undue delay after becoming aware of a personal data breach affecting your data.
We will make available the information necessary to demonstrate compliance and allow for reasonable audits, subject to confidentiality.
On termination, we will delete or return personal data as you choose, except where retention is required by law.
Where data is transferred outside Switzerland or the EEA, we rely on appropriate safeguards such as standard contractual clauses.
This DPA is governed by Swiss law. To request a signed copy, contact dpa@hyperlogin.com.