Translation provided for information only. The French version alone is authoritative. Read the French version
Version of 8 October 2026Data processing agreement
Parties and scope
This agreement binds Saviano Sàrl, Route du Grand-Lancy 53, c/o COFIGEST SA, 1212 Grand-Lancy, Genève, Suisse ("the processor"), and the business customer who uses Helvedrive for its organisation ("the controller"). It forms part of the terms of use as soon as an organisation is created for business purposes. It meets article 9 of the Swiss Federal Act on Data Protection (FADP) and, where the European regulation applies, its article 28 (GDPR). A signed version is provided on request to [email protected].
Subject matter and duration
The processor stores, syncs, shares, scans and backs up the files and data that the controller and its users place in Helvedrive, for the duration of use of the service and until deletion or return as provided below.
Data and data subjects
The data is what the controller chooses to store: documents, file and folder names, client-portal cases and documents received, as well as data of the organisation's users and portal guests (name, email address, access log). It may include sensitive data or data covered by professional secrecy; the controller decides what it stores.
Instructions
The processor processes the data only on documented instructions from the controller, as resulting from the use of the service, its settings and this agreement. It does not use the data for any other purpose, in particular not for its own account, for advertising or to train a model. If it considers that an instruction breaches the law, it informs the controller.
Confidentiality
Persons authorised to work on the infrastructure are bound by confidentiality. They access file content only at the controller's request, to resolve an incident it reports, or where required by law. The content of encrypted vaults is inaccessible to them.
Security measures
Hosting in Switzerland; encrypted connections (TLS 1.2 or higher); encryption of files at rest with a key specific to each file, protected by a separate key service; end-to-end encrypted vaults; separation of organisations in the database; antivirus scanning; passkeys and two-factor authentication; per-organisation security log; continuous database backup and encrypted file copies at two hosting providers, with copies locked against deletion for 30 days; verified restorations; monitoring and alerts. These measures may evolve without reducing the level of protection.
Sub-processors
The controller authorises the use of the sub-processors listed in the data protection policy: Infomaniak Network SA (hosting, Switzerland), Cloudflare, Inc. (encrypted backup copy in the European Union, DNS), Resend, Inc. (service emails). The processor imposes equivalent obligations on them. Any change is announced at least 30 days in advance; the controller may object on legitimate grounds and, failing agreement, terminate without charge.
Transfers abroad
Files are processed in Switzerland. The encrypted backup copy outside Switzerland is in the European Union, recognised as providing an adequate level of protection. Data transmitted to US companies (email addresses and content of service emails, technical data) is transmitted on the basis of their contractual safeguards; no file is stored there unencrypted.
Data subject rights
The processor helps the controller respond to requests from data subjects: the service makes it possible to export, correct and delete data; otherwise, it responds to the controller's requests within a reasonable time.
Security breaches
The processor informs the controller as soon as possible, and no later than 48 hours after becoming aware of it, of any data security breach affecting it, with the available information on its nature, likely consequences and the measures taken.
End of the agreement
At the end of use, the controller exports its data. The organisation's data is then deleted: immediately in the service when the organisation is deleted, and in backups at the end of their 35-day retention period, after which no copy can be read any more.
Audit
The processor makes available the information needed to demonstrate compliance with this agreement (description of measures, Status page, audit reports where they exist) and allows an audit by the controller or an auditor bound by secrecy, on reasonable notice and at the controller's expense.
Governing law
This agreement is governed by Swiss law. The place of jurisdiction is Geneva. In case of conflict, this agreement prevails over the terms of use as regards data protection.