Remembering settings such as language.
Security, load balancing, storing your cookie choice.
Understanding how visitors use the Website so we can improve it (Google Analytics 4).
Legal
This Data Processing Agreement (“DPA”) sets out how SightPulse AG processes personal data on behalf of its customers when they use the SightPulse platform. It is designed to meet the requirements of Art. 28 GDPR and Art. 9 of the Swiss Federal Act on Data Protection (FADP).
How this DPA applies
This DPA is between the customer that has accepted the Terms, a private offer or an order for the SightPulse platform (“Customer”) and SightPulse AG, Dammstrasse 19, 6300 Zug, Switzerland, UID CHE-344.951.907 (“SightPulse”).
For Customer Personal Data, the Customer is the controller (or, where it acts for its own clients or group companies, a processor) and SightPulse is the processor. CBS Systems d.o.o., Belgrade, Serbia, is SightPulse’s sub-processor. Where the Customer is itself a processor, SightPulse acts as its sub-processor and the Customer confirms that its controller has authorised this DPA.
3.1 The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects, are described in Annex 1.
3.2 SightPulse processes Customer Personal Data only on the Customer’s documented instructions, including with regard to international transfers, unless required to do otherwise by Swiss law, EU or EU Member State law or other law to which it is subject. In that case SightPulse informs the Customer before processing, unless the law prohibits this, and the Customer may suspend the affected processing. The Agreement, the Customer’s configuration of the Platform, and the Customer’s written requests through agreed support channels are the Customer’s documented instructions.
3.3 SightPulse informs the Customer without delay if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend that instruction until the Customer confirms or changes it.
3.4 SightPulse does not process Customer Personal Data for its own purposes. It does not use Customer Personal Data or Outputs to train, benchmark or improve models used for other customers, and does not combine Customer Personal Data with data of other customers.
3.5 Personal data scope. The Order states whether personal data in the Customer’s datasets (for example CRM, loyalty, CDP, e-commerce or respondent-level data) is part of the scope.
4.1 Confidentiality. SightPulse ensures that everyone it authorises to process Customer Personal Data is bound by a written confidentiality obligation or an appropriate statutory duty and has access only as needed to perform the Agreement.
4.2 Security. SightPulse implements and maintains the technical and organisational measures in Annex 2 (Art. 32 GDPR, Art. 8 FADP). It may update them, provided the overall level of protection is not reduced.
4.3 Location. Customer Personal Data contained in Customer Data is stored and processed at one of the following processing locations, as set in the Order:
In both cases that data is not stored in Serbia, and SightPulse and its sub-processors make no copies outside the selected location unless the Customer instructs this in writing. Contact details and support correspondence of the Customer’s staff are processed by SightPulse as controller under its Privacy Policy.
4.4 Remote access and pseudonymisation. CBS Systems d.o.o. personnel access Customer Personal Data remotely, including from Serbia (section 6.2). Personal data in Customer Data is processed in pseudonymised form by default, wherever the use case allows, to minimise the identifiable data accessible remotely. Personnel view direct identifiers, such as names or email addresses, only where needed to debug, provide support or resolve an incident, limited to the data and time that task requires.
4.5 Records. SightPulse keeps a record of the processing it carries out on behalf of the Customer (Art. 30(2) GDPR, Art. 12 FADP) and provides it on request.
5.1 The Customer gives SightPulse general written authorisation to engage the sub-processors listed in Annex 3 and on the Trust & Data Protection page, and any sub-processor named, with its address, in an accepted Order. By accepting an Order that selects the EU Processing Environment, the Customer specifically authorises the hosting provider named in it. Any later addition or replacement follows section 5.2.
5.2 SightPulse informs the Customer at least 30 days in advance of any intended addition or replacement of a sub-processor, by email to the Customer’s designated contact, and by an update to the Trust & Data Protection page. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection in good faith, the Customer may terminate the affected part of the Agreement without penalty and receive a refund of prepaid fees for the remaining term.
5.3 SightPulse imposes on each sub-processor, by written contract, directly or through CBS Systems d.o.o., data protection obligations no less protective than this DPA, and remains fully liable to the Customer for its sub-processors.
6.1 SightPulse is established in Switzerland, which the European Commission recognises as providing an adequate level of data protection. Disclosure of Customer Personal Data by a Customer in the EU or EEA to SightPulse therefore does not require further safeguards.
6.2 CBS Systems d.o.o. accesses Customer Personal Data from Serbia, which is not recognised as adequate by Switzerland or the European Commission. For that onward transfer, SightPulse and CBS Systems have concluded the SCCs (Module Three, processor to processor), with the adaptations required by the FDPIC for transfers subject to the FADP and, for personal data subject to the UK GDPR, the UK International Data Transfer Addendum, and have carried out a transfer impact assessment. This applies equally to data held in the EU Processing Environment: the data stays in Germany, but remote access from Serbia is still a transfer and is covered by the same safeguards. Supplementary measures include: data at rest only at the selected processing location and never stored in Serbia; remote access only; pseudonymisation by default to minimise the identifiable data accessible remotely, with direct identifiers viewed only as set out in section 4.4; multi-factor authentication; and, in the Customer Tenant, logging in the Customer’s Azure Activity Log and the Customer’s option of just-in-time access approval.
6.3 SightPulse provides a copy of the relevant SCCs (commercial terms may be redacted) and a summary of the transfer impact assessment on request.
6.4 If a Customer is located outside Switzerland, the EU and the EEA, the Customer is responsible for meeting any transfer requirements of its own law; SightPulse will cooperate reasonably.
7.1 SightPulse notifies the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach.
7.2 The notice describes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. SightPulse supplements the notice as more information becomes available.
7.3 SightPulse does not notify supervisory authorities or data subjects on the Customer’s behalf unless the Customer instructs it or the law requires it.
8.1 SightPulse promptly forwards to the Customer any request from a data subject concerning Customer Personal Data and does not respond itself unless authorised. Taking into account the nature of the processing, SightPulse assists the Customer with appropriate technical and organisational measures in responding to requests for access, rectification, erasure, restriction, portability and objection.
8.2 SightPulse assists the Customer, taking into account the information available to it, with security, breach notification, data protection impact assessments and prior consultation of supervisory authorities (Art. 32 to 36 GDPR, Art. 22 to 24 FADP). This includes a description of the processing and measures for any assessment the Customer makes of individual-level consumer data processing.
8.3 SightPulse makes available all information necessary to demonstrate compliance with this DPA and allows audits, including inspections, by the Customer or an independent auditor bound by confidentiality, on 30 days’ written notice, during business hours, at most once a year unless a Personal Data Breach or a supervisory authority requires otherwise. SightPulse may first answer an audit request with documentation, completed questionnaires and current certifications, including the ISO/IEC 27001:2022 certificate of CBS Systems d.o.o. and its Statement of Applicability. Each party bears its own audit costs unless the audit reveals a material breach by SightPulse.
9.1 When the Customer deletes the Managed Application, the Managed Resource Group and the platform resources in it are deleted in the Customer Tenant. Data in the Customer’s own source systems is not affected.
9.2 After the end of the Agreement, SightPulse personnel do not access the Managed Resource Group, except at the Customer’s request to assist with deletion.
9.3 At the end of the Agreement, or earlier on the Customer’s instruction, SightPulse deletes Customer Personal Data held in the EU Processing Environment and any other copies held outside the Customer Tenant when the project ends and at the latest within 30 days after the end of the Agreement, with residual backup copies deleted in the normal backup cycle, or returns them first if the Customer asks, unless law requires retention. SightPulse confirms deletion in writing on request.
10.1 The Customer is responsible for the lawfulness of the processing it instructs, including the legal basis, transparency towards data subjects, consents and any data protection impact assessment, in particular where it links or matches consumer records across sources.
10.2 The Customer does not make special categories of personal data (such as health data) or data about criminal convictions available to the Platform unless the parties have agreed this in writing with added safeguards.
10.3 The Customer uses pseudonymised identifiers where its use case allows and connects only the personal data the use case needs. Where personal data is not in scope under section 3.5, the Customer does not connect datasets that contain it.
11.1 Each party’s liability under this DPA is subject to the limitations of liability in the Agreement, except where mandatory law does not allow a limitation.
11.2 This DPA applies for as long as SightPulse processes Customer Personal Data for the Customer. Sections 7, 8 and 9 survive until all Customer Personal Data has been deleted or returned.
11.3 On the processing of personal data, this DPA prevails over the Terms and over any Private Offer or Order. A data processing agreement signed by both parties prevails over this DPA.
11.4 This DPA is governed by the law that governs the Agreement (Swiss law, with Zug as the place of jurisdiction), without prejudice to the rights of data subjects under Applicable Data Protection Law.
11.5 SightPulse may update this DPA to reflect changes in law or in its services, provided the level of protection for Customer Personal Data is not reduced. Material changes are notified to customers at least 30 days in advance.
| Subject matter | Provision, operation, support and maintenance of the SightPulse platform for the Customer. |
|---|---|
| Duration | The term of the Agreement, plus the deletion period in section 9.3. |
| Nature of processing | Connection to Customer data sources; harmonisation; storage within the Customer Tenant or, where selected, the EU Processing Environment; statistical and machine-learning modelling; generation of scores, segments, recommendations, target lists and narratives; monitoring, troubleshooting, updates and support. |
| Purpose | Delivering the Platform’s analysis and recommendations to the Customer under the Agreement. |
| Scope | Where the Order does not put personal data in scope (section 3.5): Authorised Users and Authorised User Data only. Where it does: the categories below, as confirmed in the Order. |
| Categories of data subjects | Authorised Users of the Customer; the Customer’s consumers, shoppers, loyalty members and online customers; survey and panel respondents; contact persons at outlets, retailers and distributors contained in Customer Data. |
| Types of personal data | User account data and activity logs; customer and loyalty identifiers (pseudonymised where possible); transaction and basket data; channel and engagement data; segment, propensity and value scores; demographic or geographic attributes present in Customer Data; respondent-level survey answers; outlet contact details. The exact data depends on the sources the Customer connects and the plan (individual-level data is processed mainly under the Pro plan). |
| Special categories | None intended. See section 10.2. |
| Frequency | Continuous during the Agreement, at the refresh cadence agreed in the private offer or order. |
| Location | Customer Tenant, in the Azure region selected by the Customer, or, where the Order selects it, the EU Processing Environment in Germany. Not stored in Serbia. Remote access by sub-processors as listed in Annex 3. |
These measures are implemented by SightPulse and by CBS Systems d.o.o. under the CBS Information Security Policy.
| Area | Measures |
|---|---|
| Governance | Information security management system of CBS Systems d.o.o. certified to ISO/IEC 27001:2022 by TÜV NORD CERT GmbH (certificate no. 44 121 26430130, valid until 2 September 2029), owned by top management, with an Information Security Manager, risk assessment, objectives register and management review. Policy reviewed at least yearly. |
| Data location and isolation | Platform deployed as an Azure Managed Application in the Customer Tenant; Customer Data stays in the Customer’s subscription and region, or in a dedicated EU Processing Environment in Germany where the Order selects it; no storage of Customer Personal Data in Serbia; each customer’s data kept separate and used only for that customer. |
| EU Processing Environment | Where selected: dedicated to the Customer, located in Germany, administered by named CBS Systems personnel with multi-factor authentication; the same encryption, minimisation, incident and deletion measures as in this Annex. |
| Access control | Least-privilege access limited to named, trained personnel; multi-factor authentication; access limited to the Managed Resource Group; standing operational access or just-in-time access approved by the Customer; control-plane operations logged in the Customer’s Azure Activity Log; access reviewed at defined intervals. |
| Encryption | Encryption of data in transit and at rest, with controlled management of keys and secrets (Azure Key Vault in the Customer Tenant where the deployment uses it). |
| Data minimisation | Personal data in Customer Data processed only where the Order puts it in scope and a use case requires it; pseudonymised form by default where the use case allows; direct identifiers viewed only to debug, support or resolve incidents, limited to the data and time needed. |
| Secure development | Security requirements, peer code review, separate development, test and production environments; no Customer production data in development or test without the Customer’s approval. Automated dependency and vulnerability scanning and an external penetration test are being introduced in Q1 2027. |
| Trustworthy AI | Statistical and machine-learning models produce the analysis; language models do not generate numbers; every output traceable to its source data and validated before release; inferred results flagged; no training on Customer Data for other customers; language model endpoint set in the Order (Customer-provided, or provided by SightPulse with the provider listed as sub-processor); data sent to language models limited to what the task needs and pseudonymised where the use case allows. |
| Monitoring and incidents | Security events logged and monitored; incidents reported, investigated and documented; Customers notified as set out in section 7. |
| Resilience | Backup, business continuity and disaster recovery arrangements defined, maintained and tested. |
| People | Background checks as permitted by law, confidentiality undertakings, security awareness training at onboarding and at regular intervals, disciplinary process for violations. |
| Suppliers | Suppliers and subcontractors with access to information assessed before engagement and bound by confidentiality, security and data protection obligations. |
| Return and deletion | Return and deletion of Customer Data at the end of the Agreement, with written confirmation on request. |
| Sub-processor | Location | Service | Safeguard |
|---|---|---|---|
| CBS Systems d.o.o., Karađorđeva 43, 11000 Belgrade, Serbia | Serbia (remote access only; data remains in the Customer Tenant or the EU Processing Environment) | Engineering, platform operations, maintenance and support | EU SCCs, Module Three, with Swiss adaptations; transfer impact assessment; measures in section 6.2 |
| Hosting provider of the EU Processing Environment (only where the Order selects it) | Germany | Virtual servers for the EU Processing Environment, engaged by CBS Systems d.o.o. | Named, with address, in the Order, which counts as specific authorisation (section 5.1); listed on the Trust & Data Protection page once first used for any customer; EU location; obligations flowed down through CBS Systems d.o.o. |
For the Customer Tenant, Microsoft provides the Azure infrastructure under the Customer’s own agreement with Microsoft and is not a sub-processor of SightPulse for Customer Data. Where the EU Processing Environment runs on a cloud provider, that provider is the hosting sub-processor above. The same applies to any language model endpoint or AI service the Customer provides or connects itself, such as Azure OpenAI, Microsoft Fabric data agents or Databricks Genie. Where SightPulse provides the model service, the provider is named in the Order, which counts as specific authorisation under section 5.1. The current list is maintained on the Trust & Data Protection page.