This mandate governs the service by which Advisorn is the representative in Switzerland of a controller with its registered office or domicile abroad, under articles 14 and 15 of the Federal Act on Data Protection (FADP).
Representative: Advisorn GmbH, Via Valdani 2, 6830 Chiasso, Switzerland, UID CHE-314.881.260 ("Advisorn", "we").
Principal: the organisation with its registered office or domicile abroad that concludes the mandate in the EasyLPD platform, represented by the person who concludes it ("the principal").
1. Subject matter and conclusion
1.1 The principal designates Advisorn as its representative in Switzerland within the meaning of art. 14 FADP, for the processing of personal data concerning persons in Switzerland.
1.2 The mandate is concluded when the principal accepts this text in the platform and pays the first period on the Stripe page. The person concluding it declares that they are authorised to represent the principal. The mandate is valid even if art. 14 FADP does not oblige the principal to designate a representative.
1.3 The general terms of EasyLPD and their annex on processing on behalf of the customer also apply, insofar as this mandate does not provide otherwise.
2. What the representative does
2.1 Point of contact. We are the point of contact for data subjects and for the Federal Data Protection and Information Commissioner (FDPIC) on behalf of the principal (art. 14 para. 2 FADP), and the address to which the FDPIC can send communications intended for the principal.
2.2 Forwarding. Requests from data subjects sent with the principal's request form reach it directly, at the moment they are sent. Communications we receive by post, by e-mail or otherwise are forwarded to the principal within one working day of receipt (working days of the Canton of Ticino), to the e-mail address of the organisation's managers in the platform.
2.3 Record. We keep the principal's record of processing activities (art. 15 para. 1 FADP) in the EasyLPD platform, with the information the principal enters in it, and provide it to the FDPIC on request (art. 15 para. 2 FADP). We do not verify that the information is accurate or complete.
2.4 Information to data subjects. To those who ask us, we explain how to exercise their rights against the principal (art. 15 para. 3 FADP): the principal's address and its request form.
2.5 Documents. In the platform we provide a letter confirming the designation and the paragraph with our name and address to be included in the principal's privacy notice.
3. What the representative does not do
3.1 We do not respond on the merits to requests from data subjects or from the FDPIC: the principal decides and responds. We provide the FDPIC with the principal's information and documents as the principal supplies them to us.
3.2 We do not give advice on the principal's case. Advisorn's consulting is a separate service, under the general terms.
3.3 We do not assume the principal's obligations: it remains the controller and responsible for complying with the FADP and the other applicable laws, including reporting data security breaches to the FDPIC.
3.4 We do not represent the principal in administrative or judicial proceedings, do not accept service of judicial documents on its behalf and are not its representative in the European Union (art. 27 GDPR).
3.5 We do not certify the principal's compliance.
4. Obligations of the principal
4.1 It provides truthful and complete information and keeps the record in the platform up to date with the information required by art. 12 para. 2 FADP.
4.2 It publishes our name and address as its representative (art. 14 para. 3 FADP), as a rule in its privacy notice, with the link to its request form; it removes them when the mandate ends.
4.3 It keeps at least one manager in the platform who can be reached by e-mail and responds to data subjects and to the FDPIC within the statutory time limits.
4.4 When the FDPIC requests information, it provides it truthfully and completely, including through us; it does not ask us to pass on information it knows to be false.
4.5 It declares that neither it nor the persons controlling it appear on a Swiss sanctions list (State Secretariat for Economic Affairs, SECO) and that its activity is lawful; it informs us immediately if this changes.
4.6 It chooses the offer according to the number of its staff and adjusts it if that number grows beyond the band chosen.
5. Check of the principal
5.1 The mandate is active from payment. In the following days we check the principal (sector of activity, sanctions lists).
5.2 If the check has a negative outcome, or if the principal breaches point 4.4 or 4.5, we may withdraw with immediate effect. In that case we refund what was paid for the period not yet elapsed, or in full if the withdrawal takes place within 30 days of the first payment.
6. Fee
6.1 The fee depends on the offer (representative, or representative with EasyLPD Pro) and on the band of staff chosen, according to the prices shown on the page of the service at the time of conclusion. It is paid in advance, monthly or yearly, by card through Stripe, and renews automatically for the same period.
6.2 Swiss VAT is not applied to principals with their registered office abroad.
6.3 The 30-day guarantee of the general terms applies: on request we refund in full the first payment made no more than 30 days ago, and the mandate ends.
6.4 If a payment fails, Stripe tries it again and notifies the principal; if it remains unpaid, the subscription is cancelled and the mandate ends.
7. Duration and end
7.1 The mandate lasts as long as the subscription. The principal can cancel it at any time from the "Plan and billing" page; cancellation takes effect at the end of the period already paid.
7.2 We may terminate the mandate with 3 months' notice to the end of a month, or with immediate effect for good cause, in particular in the cases of point 5.2.
7.3 At the end of the mandate we are no longer the principal's representative. The principal removes our name and address from its publications and, if it is obliged to have one, designates a new representative. For three months we continue to forward to the principal what we receive for it; we may inform the FDPIC and those who write to us that we no longer represent it.
8. Liability
8.1 We are liable in accordance with point 9 of the general terms, for damage caused by the breach of our obligations under point 2, up to the amount paid by the principal for the mandate in the 12 months preceding the event.
8.2 We are not liable for the principal's obligations, for sanctions, fines or measures concerning it, or for the content of the record and of the information we pass on for it.
8.3 The principal indemnifies us against third-party claims and costs, including reasonable legal fees, arising from the breach of its obligations under point 4 or of the law.
9. Data protection
For the personal data we receive or keep for the principal (requests from data subjects, the record, communications from the FDPIC) we process on behalf of the principal, in accordance with the annex to the general terms. The data are stored in Switzerland.
10. Applicable law and place of jurisdiction
Swiss law applies. The place of jurisdiction is Chiasso, Advisorn's registered office. The Italian text prevails.