Terms

These terms govern the use of EasyLPD, the data protection platform available at easylpd.ch and easydsg.ch, and the consulting purchased through the platform.

Provider: Advisorn GmbH, Via Valdani 2, 6830 Chiasso, Switzerland, UID CHE-314.881.260 VAT, contact@easylpd.ch ("Advisorn", "we").

Customer: the business, body or organisation that opens an account on EasyLPD, represented by the person who opens it ("the customer"). EasyLPD is a service for those carrying on a professional or commercial activity, not for consumers.

1. Conclusion of the contract

1.1 The contract is concluded when the customer opens an account and accepts these terms. The person opening the account declares that they are authorised to represent the organisation.

1.2 A paid subscription is concluded with payment on the Stripe page; a package of hours or a quote with payment or with acceptance in the platform.

1.3 The following form part of the contract: these terms, the annex on processing on behalf of the customer (at the bottom of this page), the privacy notice, the prices shown in the platform at the time of purchase and, for consulting, the accepted quote.

2. The service

2.1 EasyLPD helps the customer to comply with the Federal Act on Data Protection (FADP) and, where it applies, with the General Data Protection Regulation of the European Union (GDPR): a self-assessment, an action plan, document templates, registers, the handling of breaches and requests, staff training and the dossier documenting the status reached. The features of each plan are described in the platform.

2.2 It is not consulting. The scores, the action plan, the guidance, the guides and the templates are general tools, written for many organisations. They do not assess the customer's specific case and do not replace consulting. The customer decides what to do and adapts the documents to its own situation; it remains responsible for complying with the law. An assessment of the specific case is consulting (point 6).

2.3 We do not certify. The compliance status, the dossier and their PDFs describe what the customer has recorded in the platform: they do not attest that the organisation complies with the law. Training certificates state that a person has completed a course on the platform; they are issued by the customer through EasyLPD.

2.4 Signatures and proofs of existence. The signature in the platform and that of external people through BA Scribe are simple electronic signatures, not qualified ones: under Swiss law only a qualified electronic signature with a qualified time stamp is equivalent to a handwritten one. Proofs of existence (BA Stamp) show that a file with a certain hash existed at a certain time; they are not qualified time stamps. A signed copy uploaded by the customer is not verified.

2.5 Availability. We do our best to keep the platform reachable and working without errors, but we do not guarantee uninterrupted availability. We may interrupt it for maintenance, announcing it where possible. We may improve and change the features; we do not remove from a running subscription an essential feature of its plan.

2.6 Third-party services. For some features we use providers (listed in the privacy notice). If a third-party service is unavailable, the feature that depends on it may be missing for that time; a proof of existence or a signature that was not possible can be requested again.

3. Account and use

3.1 The customer keeps the sign-in details confidential, invites only authorised people and is liable for them as for itself. It can make two-step verification mandatory (Business plan).

3.2 The customer enters only content it has the right to process and to entrust to us; in particular it informs the people whose data it enters, in accordance with its own privacy notice. It does not use the platform for unlawful purposes, does not attempt to access other customers' data and does not impair its operation.

3.3 We may suspend an account, after a warning if circumstances permit, if it is used in breach of these terms or endangers the security of the platform or of other customers.

4. Plans and prices

4.1 Free is free of charge and without expiry, for one person. Pro and Business are monthly or yearly subscriptions. Pro includes up to 3 people; Business an unlimited number of people, the features indicated for that plan and the option of adding other companies of the group.

4.2 Prices (in Swiss francs, VAT included for customers in Switzerland and Liechtenstein; abroad Swiss VAT is not applied):

The prices shown in the platform at the time of purchase prevail.

4.3 The subscription is paid in advance by card through Stripe and renews automatically for the same period until the customer cancels it. An additional company is an item of the Business subscription of the main company and is paid for the same period.

4.4 The customer changes plan or cancels from the "Plan and billing" page. Cancellation takes effect at the end of the period already paid; a change of plan is prorated by Stripe for the remaining period.

4.5 30-day guarantee. If the first payment of a subscription was made no more than 30 days ago, on request we refund it in full and the subscription ends. The guarantee does not apply to renewals, packages of hours or consulting.

4.6 We may change the prices for the following period, announcing it at least 30 days before the current one expires; a customer who does not accept them cancels by the expiry.

4.7 Invoices are issued by Advisorn GmbH and remain available in the platform.

5. End of the subscription and deletion

5.1 At the end of a paid subscription the organisation moves to the Free plan. The content of the paid modules remains available for viewing and export, read-only, for 12 months; then we delete it, with notice 30 and 7 days before. The account, the assessment, the action plan, the invoices and the change log remain.

5.2 The customer can at any time export the organisation's data and delete the organisation or its own account from the platform. Deletion becomes final after 15 days, during which it can be cancelled. Encrypted backups are kept for 30 days; invoices for 10 years, as required by law. What is anchored on a public blockchain (only file hashes) cannot be deleted.

5.3 The customer can terminate the contract for the Free plan at any time by deleting the organisation. We can terminate it with 3 months' notice, or without notice for good cause; a subscription already paid continues until its expiry, except in the case of good cause.

6. Consulting

6.1 Consulting on the customer's specific case is provided by Advisorn through the platform. It is a service separate from the subscription, charged according to the price list shown in the platform (currently CHF 250 per hour plus VAT) or according to an accepted quote.

6.2 Prepaid hours. A question is paid for with a package of hours purchased beforehand. The time of each answer is counted in units of 15 minutes, at least 15 minutes, and deducted from the package that expires first. A package is valid for 12 months from purchase; hours not used within that period lapse. Packages are not refundable. The first introductory call and a data breach in progress do not require a package purchased beforehand: the time is counted in the same way and, if no package covers it, invoiced.

6.3 Quotes. The review of documents and ongoing services are offered with a quote, valid for the period stated. Once accepted, it becomes an invoice, payable on receipt by card or by bank transfer (QR-bill).

6.4 The external advisor (ongoing service) includes the hours per year stated in the quote; hours beyond the package are shown and invoiced separately.

6.5 Consulting is a mandate (art. 394 et seq. CO): Advisorn provides it with due care on the basis of the information received from the customer, without guaranteeing a result. The customer can grant a consultant read-only access to its data for a limited period; every consultation is recorded in the customer's change log, and the customer can revoke access at any time.

7. Content and rights

7.1 The content entered by the customer remains the customer's. It grants us the right to process it only to provide the service.

7.2 The platform, the texts, the guides, the courses and the document templates belong to Advisorn or to those who have licensed them to us. The customer may use the generated documents and the courses for its own organisation, also after the end of the contract, but may not resell them or make them available to third parties as its own product.

8. Data protection and confidentiality

8.1 For the data of those who use the website and the platform, Advisorn is the controller: the privacy notice applies. For the data the customer enters about other people, Advisorn processes on behalf of the customer: the annex at the bottom of this page applies.

8.2 We treat as confidential the customer's information that comes to our knowledge, also after the end of the contract.

9. Liability

9.1 We are liable for damage caused intentionally or through gross negligence. For slight negligence we are liable only for direct damage, up to the amount paid by the customer in the 12 months preceding the event for the service from which the damage arose; we are not liable for loss of profit, for loss of data that the customer could have avoided with the exports, or for penalties or third-party claims arising from the customer's decisions.

9.2 We are not liable for damage due to interruptions or errors of third-party services, to force majeure or to use of the platform contrary to these terms.

9.3 The limitations do not apply where the law excludes them, in particular for damage to life and physical integrity.

10. Changes to these terms

We may change these terms. We announce a change that is to the customer's disadvantage at least 30 days before it takes effect, by e-mail or in the platform; a customer who does not accept it can cancel the subscription as of the date on which it takes effect and receives a refund of the part already paid for the following period. If the customer continues to use the platform after that date, the change is deemed accepted.

11. Applicable law and place of jurisdiction

Swiss law applies, excluding the United Nations Convention on Contracts for the International Sale of Goods (Vienna Convention). The place of jurisdiction is Chiasso, Advisorn's registered office; we may also sue the customer at its registered office. If a clause is invalid, the others remain valid.

The Italian text prevails.

Annex: processing on behalf of the customer

This annex is the contract required by art. 9 FADP and, where the GDPR applies, by art. 28 GDPR. It applies to the personal data the customer enters into the platform about other people.

A.1 Roles. The customer is the controller; Advisorn processes the data on its behalf (processor).

A.2 Subject matter and duration. Advisorn stores the data and processes them to provide the features of the platform chosen by the customer, for the duration of the contract and for the retention periods of point 5.

A.3 Data and persons. The categories depend on what the customer enters: as a rule identification and contact data, contractual and professional data, data relating to requests and breaches, and, if the customer records them, sensitive personal data. The persons are those whose data the customer processes: staff, applicants, clients, vendors, people exercising a right, signers.

A.4 Instructions. Advisorn processes the data only in accordance with the customer's instructions, given by this contract and by the customer's use of the platform, except for a legal obligation, which it communicates to the customer if the law permits. If it considers that an instruction infringes the law, it says so.

A.5 Confidentiality. The people who can access the data are bound to confidentiality. Advisorn staff do not read the customer's content, except for access granted by the customer (point 6.5) or for a necessary technical intervention.

A.6 Security. Advisorn takes technical and organisational measures appropriate to the risk, in particular: encrypted connections; data separated by organisation; database and files in Switzerland; backups encrypted with a key that is not on the servers, stored in Switzerland; passwords stored in unreadable form; two-step verification and passkeys; roles and permissions in the platform; change log for every organisation; staff access limited to what is necessary. Uploaded files are not scanned for malicious software.

A.7 Subprocessors. The customer authorises the subprocessors listed on the "Subprocessors" page of the website, which reproduces point 4 of the privacy notice. Advisorn binds them to the same data protection obligations and announces a new subprocessor on that page at least 30 days in advance; the customer may object on grounds related to data protection and, if no solution is found, terminate the contract as of the date of the change.

A.8 Transfers abroad. The customer's data are stored in Switzerland. Where a subprocessor processes them in another country, this is to countries with adequate protection or with the safeguards provided for by law, as described in the privacy notice.

A.9 Assistance. Advisorn helps the customer, with the tools of the platform and on request, to respond to requests from data subjects, to ensure security, to handle a breach and to carry out an impact assessment. A request from a data subject that reaches Advisorn is forwarded to the customer.

A.10 Breaches. Advisorn informs the customer without undue delay of a data security breach that concerns it, with the information available to it.

A.11 End of processing. At the end of the contract the customer can export the data; Advisorn deletes them in accordance with point 5, unless the law requires them to be retained.

A.12 Audits. Advisorn provides the customer with the information needed to demonstrate compliance with this annex. An on-site audit is possible with reasonable notice, at the customer's expense, if the information provided is not sufficient.