Data Processing Agreement

Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between JetManager AG ("Processor") and the Customer ("Controller") for use of the platform ("Service"). It sets out the terms under which we process personal data on your behalf in compliance with Swiss FADP and, where applicable, GDPR.

Definitions

• –Controller: the Customer who determines the purposes and means of processing personal data.
• –Processor: JetManager AG, which processes personal data on behalf of the Controller.
• –Personal Data: any information relating to an identified or identifiable natural person.
• –Customer Data: personal data uploaded into the CRM platform by the Controller.

Subject Matter and Duration

The Processor will process Customer Data as necessary to provide the Service. Processing duration corresponds to the subscription term and any retention periods specified in the Privacy Policy.

Nature and Purpose of Processing

Customer Data is processed solely to provide the Service to the Controller: authentication, storage, backups, support, monitoring, and system maintenance. The Processor does not use Customer Data for its own purposes, including analytics, benchmarking, marketing, or AI model training, and does not combine it with data of other customers.

Personnel Access

Processor personnel access Customer Data only (a) to resolve a support request initiated by the Controller, (b) to perform maintenance or resolve an incident, or (c) where required by law. Access is limited to authorised personnel bound by confidentiality, restricted to the minimum necessary, and logged.

Categories of Data and Data Subjects

• –Records uploaded by the Controller, such as client, passenger, crew, employee, and partner details.
• –Special categories: passenger health information, where recorded by the Controller.
• –Data subjects include clients, passengers, crew, employees, or partners whose information is stored in the Service.

Obligations of the Processor

• –Process Customer Data only on Controller instructions.
• –Ensure authorized personnel are bound by confidentiality.
• –Implement technical and organizational measures, including encryption, access control, and monitoring.
• –Assist Controller in responding to data subject requests and breaches.
• –Not use Customer Data for its own purposes, including AI model training.
• –Notify Controller without undue delay, and no later than 48 hours, in case of a personal data breach affecting Customer Data.

Subprocessors

• –Supabase – database and authentication services
• –AWS – cloud hosting and storage
• –Vercel – frontend hosting, which may collect technical metadata
• –ChatGPT – AI features; no use of Customer Data for training

Subprocessors are contractually bound to process Customer Data only as instructed and to comply with data protection laws. The Processor will notify the Controller at least 30 days before adding or replacing a subprocessor. The Controller may object on reasonable data protection grounds. If no solution is found, the Controller may terminate the affected Service.

International Data Transfers

Customer Data is stored in the North EU (Stockholm). Technical metadata collected by Vercel and data processed by AI providers may be processed outside Switzerland and the EU/EEA, including in the United States. Appropriate safeguards, such as Swiss/EU adequacy decisions or Standard Contractual Clauses, are applied.

Data Retention and Deletion

Customer Data is retained only for the subscription term. Upon termination, data can be exported within 60 days and will be securely deleted thereafter unless legally required. Deletion is confirmed in writing on request.

Security Measures

Encryption in transit (TLS) and at rest, logical separation between customers, role-based access control, access logging, regular security updates, and backups.

Audit Rights

Controller may audit Processor's compliance, subject to reasonable notice and confidentiality.

Governing Law and Jurisdiction

This DPA is governed by Swiss law. Exclusive jurisdiction is Zurich, Switzerland.

Contact

• –JetManager AG
• –Weinbergstrasse 20A, CH-8802 Kilchberg, Switzerland
• –mail@jetmanager.aero