Data processing agreement

Preamble

This agreement (the “Agreement”) forms part of the general terms of use and sale of Maijin Shield (the “Terms”). It governs the processing of personal data that Maijin Sàrl carries out on behalf of its customers when they use the service, in accordance with Art. 9 of the Federal Act on Data Protection of 25 September 2020 (FADP, SR 235.1) and Art. 7 of the Data Protection Ordinance of 31 August 2022 (DPO, SR 235.11). Where the Customer is subject to Regulation (EU) 2016/679 (GDPR), the Agreement serves as the contract within the meaning of its Art. 28.

The Agreement is concluded when the Customer subscribes to a paid plan: the person who subscribes (in a team, an administrator) accepts it on the Customer's behalf, at the same time as the Terms. It also applies, for the remaining retention period, to documents anonymised before the subscription or after the subscription ends.

1. Parties and roles

• The Customer: the company, organisation or person that subscribes to a Maijin Shield plan, identified by the company name and billing address given when subscribing. For the personal data contained in the documents it submits to the service, the Customer is the controller (Art. 5 let. j FADP).
• Maijin Sàrl, Route de Saint-Julien 184, 1228 Plan-les-Ouates, Switzerland, UID CHE-300.778.667, contact@maijin.ch (“Maijin”): processor (Art. 5 let. k FADP) for the same data.

Maijin is, however, the controller, in its own name, of the data needed to manage accounts and the contractual relationship (users' email addresses, sessions, teams, billing, usage statistics without content, audit log, forms) and of the demo without an account. This processing is described in its privacy policy and does not fall under the Agreement.

2. Subject matter and description of the processing

3. The Customer's instructions

1. Maijin processes the data only to provide the service, in accordance with the Customer's documented instructions. These instructions consist of: the Terms and the Agreement; the use that the Customer's users make of the service's functions (upload, corrections in the preview, download, restoration, deletion); the masking settings chosen by the team's administrators (Settings); any additional written instruction sent to contact@maijin.ch and accepted by Maijin.
2. Maijin uses the data for no other purpose: no training or improvement of models, no profiling, no resale, no statistics on the content. Maijin's usage statistics contain only numbers and codes (pages, types of data masked, durations), never any content, file name or detected value.
3. If Maijin considers that an instruction infringes the applicable law, it informs the Customer without delay and may suspend its execution until the Customer confirms or amends it.
4. Maijin discloses the data to a third party only in the cases provided for by the Agreement (sub-processors, section 7) or where an authority obliges it to do so; in the latter case, it informs the Customer beforehand, unless prohibited by law.

4. Retention periods

5. Confidentiality

1. Maijin restricts access to the systems to a limited number of named persons who need it to operate the service, and subjects them in writing to a duty of confidentiality that continues after their engagement ends. They are informed of the penalties under Art. 62 FADP (breach of the duty of confidentiality) and, where applicable, under Art. 321 of the Swiss Criminal Code (SCC).
2. No one at Maijin views a customer's mapping tables or label register, except at the Customer's written request (for example for support) or where required by law. Any such viewing is documented.
3. The real values are never sent to a language model, nor returned to the browser other than in the restored document given to the user who anonymised it.

6. Customers bound by professional secrecy

1. Where the Customer or its users are bound by professional secrecy protected by Art. 321 of the Swiss Criminal Code (in particular doctors, dentists, chiropractors, pharmacists, psychologists, midwives, nurses and other health professions covered by that provision, lawyers, notaries) or by another secrecy rule (official secrecy, secrecy provided for by a cantonal health act or by social insurance law), Maijin acts as the Customer's auxiliary for the provision of the service, within the meaning of Art. 321 no. 1 SCC, to the extent that this status is recognised for it.
2. Maijin undertakes to keep secret all facts of which it becomes aware in this context, to impose the same obligation, in writing, on the persons who have access to the systems, and to disclose them to no one other than its sub-processors named in section 7, within the limits of the Agreement.
3. It is for the Customer to assess whether using the service is compatible with the secrecy rules that apply to it (including cantonal law, professional rules and any requirements to obtain the consent of, or inform, the data subjects), in particular before then entrusting the anonymised document to a third-party artificial intelligence. Maijin does not provide legal advice on this point.

7. Sub-processors

The Customer gives Maijin a general authorisation to use sub-processors (Art. 9 para. 3 FADP and Art. 7 DPO). At the date of the Agreement, the authorised sub-processors are as follows:

1. Maijin informs the Customer by email, at the address of the team's administrators, at least 30 days in advance of any addition or replacement of a sub-processor, stating its identity, its country and the data concerned. The Customer may object to the change in writing within that period, on grounds relating to data protection. If no solution is found, the Customer may terminate its subscription with effect from the date of the change and obtain a refund of the unused paid period.
2. Maijin imposes on each sub-processor, by contract, data protection obligations at least equivalent to those of the Agreement, and is liable to the Customer for their compliance.
3. For information: payment for subscriptions goes through Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, LLC, United States). Stripe processes the billing data, for which Maijin is itself the controller; it never receives a document or any data processed on the Customer's behalf. Stripe is therefore not a sub-processor within the meaning of the Agreement.

8. Disclosure of data abroad

The data processed on the Customer's behalf is processed exclusively in Switzerland. Maijin does not disclose it to any foreign state. The only disclosure abroad linked to the service concerns the billing data sent to Stripe (Ireland, a state recognised as adequate by the Federal Council in Annex 1 to the DPO; the United States, for Stripe, LLC, certified under the Swiss-U.S. Data Privacy Framework, recognised as adequate since 15 September 2024), described in the privacy policy.

The Customer remains solely responsible for what it then passes on to a third-party artificial intelligence, including where its provider is located abroad. Likewise, when a user uses email drop-off, the attachment they send and the reply they receive (including a restored document with the real values) remain in their own mailbox, which may be hosted outside Switzerland: this choice is a matter for the Customer.

9. Data security

Maijin implements the technical and organisational measures described in Annex 1, which are appropriate to the risk, in particular to sensitive personal data (Art. 8 FADP, Arts 1 to 4 DPO). It may develop them, provided that it never lowers the level of protection.

10. Assistance to the Customer

1. Data subjects' rights (Arts 25 to 32 FADP). Maijin forwards to the Customer, within 5 working days, any request it receives from a data subject concerning the Customer's documents, without responding to it itself. It assists the Customer in responding, to the extent technically possible: since the mapping tables can be read only by the user who anonymised the document, it is that user who views, restores or deletes their documents from “My documents”. A team administrator can delete any document of the team.
2. Impact assessment (Arts 22 and 23 FADP). Maijin makes available to the Customer an impact assessment file describing the processing, its risks and the measures taken, and answers its further questions.
3. Authorities. Maijin assists the Customer in its dealings with the Federal Data Protection and Information Commissioner (FDPIC) or another competent authority, as regards the service.

11. Data security breaches

1. Maijin notifies the Customer of any breach of data security (Art. 5 let. h FADP) affecting data processed on its behalf, whether or not it is likely to result in a high risk, as soon as possible and at the latest 48 hours after becoming aware of it (Art. 24 para. 3 FADP), by email to the team's administrators and, if known, to the contact person designated by the Customer.
2. The notification contains, to the extent known, the information the Customer needs for any notification to the FDPIC (Art. 15 para. 1 DPO): the nature of the breach; when it occurred and how long it lasted; the categories and approximate number of data and data subjects concerned; the consequences and risks for the data subjects; the measures taken or envisaged to remedy the breach and mitigate its consequences; the name and contact details of a contact person at Maijin. Information not yet known is communicated as soon as it becomes known (Art. 15 para. 2 DPO).
3. It is for the Customer, as controller, to decide whether to notify the breach to the FDPIC and to inform the data subjects (Art. 24 paras 1 and 4 FADP). Maijin does not do so in its place, except on the Customer's written instruction or where it has its own legal obligation to do so.
4. Maijin documents each breach and keeps this documentation for at least two years.

12. End of the Agreement and deletion

1. The Agreement ends with the Customer's last retained document, at the latest when its account or team is deleted.
2. Throughout the term of the Agreement, the user can delete each document themselves, and delete their account with all its tables, from the application.
3. When the account or team is deleted, or at the Customer's written request after the subscription ends, Maijin deletes the mapping tables, the anonymised versions and the label register within 30 days. The backups (in which the mapping tables remain encrypted) are deleted at the end of their 14-day cycle. The audit log, which contains no document content, is kept until the end of its 13-month period.
4. Since the mapping tables cannot be returned in a useful form outside the service (they serve only for restoration), a Customer who wishes to keep them must restore its documents before the Agreement ends. On request, Maijin confirms the deletion in writing.

13. Review and audit

1. Maijin makes available to the Customer the information needed to demonstrate compliance with the Agreement: this Agreement and its annex, the impact assessment file, the record of processing activities (processor part), the list of sub-processors and a completed security questionnaire, on request to contact@maijin.ch, free of charge once a year.
2. The Customer may have an on-site audit carried out, at its own expense, by itself or by an independent auditor bound by secrecy, with 30 days' notice, during business hours, at most once a year, except after a breach of data security or at the request of an authority. The audit may not compromise the security of the service or give access to other customers' data. Infomaniak's data centres cannot be visited by the Customer; Maijin provides Infomaniak's documentation about them.

14. Liability

1. Each party is responsible for complying with the obligations that data protection law imposes on it in its own role.
2. Maijin's liability under the Agreement is governed by the “Liability” section of the Terms, subject to the mandatory provisions of Swiss law (in particular Art. 100 of the Code of Obligations): it is in no case excluded or limited in the event of intentional misconduct or gross negligence.
3. Automatic anonymisation greatly reduces the risk of identification without eliminating it. Maijin is not liable for data left in clear that the user could see and mask in the preview, nor for the use the Customer makes of the anonymised document, in particular with a third-party artificial intelligence.

15. The Customer's obligations

1. The Customer ensures that it may lawfully process the data it submits to the service and, where applicable, that it informs the data subjects (Art. 19 FADP).
2. It ensures that its users review the preview before downloading the anonymised document and entrusting it to a third-party artificial intelligence, use email drop-off only with a mailbox whose level of security it accepts, and keep their access credentials confidential.
3. It chooses the categories of data to mask (Settings) in full knowledge of the consequences: unticking a category leaves it in clear in all of the team's documents.
4. It carries out, if necessary, its own impact assessment (Art. 22 FADP).

16. Changes, governing law and jurisdiction

1. Maijin may amend the Agreement in accordance with the procedure for changing the Terms (announcement by email at least 30 days in advance, right to cancel); changes of sub-processors follow section 7.
2. In the event of any conflict, the Agreement prevails over the Terms as regards the protection of the data processed on the Customer's behalf.
3. The Agreement is governed by Swiss law. The place of jurisdiction is Geneva, subject to mandatory places of jurisdiction provided by law.

Annex 1 — Technical and organisational measures

Measures in place at the date of this version, arranged according to the objectives of Art. 2 and the controls of Art. 3 DPO.

A. Confidentiality

Data access control (Art. 3 para. 1 let. a DPO)

• Password-free user authentication, by a single-use sign-in link, valid for 15 minutes, stored hashed. Sessions last 7 days, extended with use (at most once a day), with a “__Secure-”, “HttpOnly”, “SameSite=Lax” cookie; neither the IP address nor the browser of the session is recorded. Team invitation: random 32-byte token, hashed, single-use, valid for 7 days.
• Every request concerning documents and settings checks the session on the server side.
• Strictly personal restoration: only the user who anonymised a document can get its real values back, and only for as long as they are a member of the team; never a colleague or an administrator.
• Team administrators see the anonymised name of the file, its date and its author's email address, and can delete it; they never see the real values.
• Mapping tables, file names and label register encrypted with AES-256-GCM, random initialisation vector per value, associated data (AAD) binding each ciphertext to its row and its owner (a ciphertext copied elsewhere becomes undecryptable). Master key outside the database (server environment variable, file readable by the administrator only), sub-keys derived per use (HKDF-SHA-256). A copy of the database alone reveals no value.
• Values looked up by keyed fingerprint (HMAC-SHA-256, specific to each user), never in clear.
• Maijin's internal dashboard (statistics without content): separate subdomain, named accounts, hashed password (scrypt), 5 attempts per 15 minutes, 12-hour session; no access to the mapping tables.
• Maijin staff: access to the servers limited to the persons designated in the processing regulations, prohibition on viewing the tables except at the Customer's written request.

Control of access to premises and facilities (let. b)

• Server in an Infomaniak data centre in Geneva (physical access controls of the provider). Maijin operates no server on its own premises.
• Staff workstations: encrypted disk and automatic locking required by the processing regulations; no copy of the production database is kept on them.

Usage control (let. c)

• Database not exposed to the Internet (no published port); firewall limiting open ports to SSH, HTTP (redirection) and HTTPS.
• SSH access by key only, without password and without “root” login; automatic deployment by a dedicated key restricted to a single command.
• Secrets (encryption, API and payment keys) outside the code repository, in a server file with restricted permissions.

B. Availability and integrity

Data carrier control (Art. 3 para. 2 let. a DPO)

• The original document is never written to a storage medium: it is read and processed in memory, in an isolated worker thread (memory capped at 768 MB, duration limited to 20 seconds), then discarded. Only its anonymised version is stored, encrypted, in the database.
• Backups: files readable only by the server administrator; the mapping tables remain encrypted in them (AES-256-GCM, key outside the database).

Storage control (let. b)

• Only the data listed in section 4 of the Agreement is retained, and it is purged automatically when it expires (hourly purge of expired tables and orphaned labels, and of expired sessions, links and invitations).

Transport control (let. c)

• HTTPS mandatory, TLS 1.3, HSTS (2 years, preload), permanent redirection from HTTP to HTTPS.
• Requests to Infomaniak's language models over HTTPS; they contain neither the file name nor the identity of the account.
• Email (IMAP, SMTP) always encrypted with TLS, never in clear.

Recovery (let. d)

• Daily database backup, kept for 14 days on the server, in Switzerland.
• Automatic check of each backup (full copy, otherwise three further attempts), email alert if a backup fails or if there has been no backup for 26 hours; quarterly restore test provided for by the processing regulations.

Availability, reliability, integrity (let. e)

• Limits on uploaded files checked before decompression (20 MB, 200 MB uncompressed, 5,000 entries), dangerous XML constructs rejected; rate limits on sensitive routes.
• Integrity of encrypted data guaranteed by AES-GCM authentication (any tampering is detected).
• PDF: genuine removal of the text (never just a rectangle drawn over it) and a check that no original value remains before delivery.

System security (let. f)

• Automatic security updates of the operating system; software dependencies kept up to date.
• Strict content security policy (CSP): scripts authorised by nonce, no third-party resources, no trackers or analytics tools, fonts served by the site; “X-Frame-Options”, “X-Content-Type-Options”, “Referrer-Policy” and “Permissions-Policy” headers.
• Technical logs limited in volume (3 × 10 MB per service); the web server writes neither IP addresses, nor headers (browser, cookies), nor URL parameters to them; no document content or email address in the application logs.

C. Traceability

Input and disclosure control (Art. 3 para. 3 let. a and b DPO)

• Append-only audit log (Art. 4 DPO): analysis of a document (with its recipient, Infomaniak AI Tools), creation of an anonymised document, restoration, manual or automatic deletion, viewing of the team's history by an administrator, sign-in to the internal dashboard and exports; for each entry: who (identifier and email address of the account), what (action, document identifier), when; never any content or value. Kept for 13 months, copied every day to a file separate from the database, accessible only to the persons responsible for security.

Detection and remediation (let. c)

• Breach management procedure (detection, assessment, notification to the Customer within 48 hours, documentation kept for at least 2 years).
• Alert if a backup fails.

D. Organisational measures

• Processing regulations (Art. 5 DPO) kept up to date and reviewed at least once a year.
• Record of processing activities (Art. 12 FADP).
• Data protection by design and by default (Art. 7 FADP): all categories are masked by default; minimisation of the data sent to the language models.