Archived version 2.9 of 01.11.2026. Current version: Data Processing Agreement
Version 2.9 · 01.11.2026
Translation provided for information. Only the French version is binding. Read the French version
Scope A only: administration of Kalisme Pro Seats. Contractual template intended for Kalisme’s business clients. Version 2.9 · 01.11.2026
The Client, hereinafter “the Controller”
Company name: (to be completed by the Client)
Registered office: (to be completed by the Client)
Represented by: (to be completed by the Client)
Address of record for contractual notices: (to be completed by the Client)
Contact for personal data breach notifications (email address): (to be completed by the Client)
Telephone number reachable in the event of an incident: (to be completed by the Client)
Data protection officer, if any (name and email address): (to be completed by the Client)
The last four lines above are the designated contact details within the meaning of this agreement. Articles 8 and 13 refer to them expressly. If no contact address for breaches is given, the address of the portal administrator account shall serve in its place, in accordance with the “Form of notices” clause of the General Terms and Conditions of Sale. You shall keep these contact details up to date; Kalisme is under no obligation to seek out a recipient whom you have not designated.
And
Kalisme Kaynar, a sole proprietorship under Swiss law registered in the commercial register of the Canton of Vaud (UID CHE-180.420.792), owned by Hakan Kaynar, Route des Plaines-du-Loup 78, 1018 Lausanne, Switzerland, hereinafter “Kalisme”. Privacy contact: founder@kalisme.com
Kalisme’s representative in the European Union (Article 27 GDPR)
The designation of a representative does not transfer any liability: in accordance with Article 27(5) GDPR, it is without prejudice to legal actions brought against Kalisme itself. Kalisme shall inform you in writing of the identity and contact details of its representative in the Union as soon as one is designated, at your address of record for contractual notices, without this constituting an amendment to this agreement.
This agreement is entered into pursuant to Article 28 GDPR (EU 2016/679) and Article 9 of the revised Swiss FADP, both of which govern the engagement of a processor. For a Client established in the United Kingdom, references to the GDPR are to be read as references to the regulation as it applies in the United Kingdom (UK GDPR) and to the corresponding provisions of that law.
It concerns Scope A only: the administration of Seats. Within that scope, Kalisme processes on your behalf, and solely on your instructions, the data necessary for the assignment, activation and monitoring of the Seats you pay for: business email address, activation token, Seat status, timestamps, administration log, and the responses to the anonymous surveys you launch from your portal. Annex 1 sets out the details. Three related processing operations are carried out by Kalisme on its own account, as controller, and are not subject to your instructions: verification of the proof of status you upload for a reduced rate (Annex 1, A3), the two wellbeing and stress scales in the surveys of a pilot (Annex 1, A4) and the invoicing of Seats (Article 7).
The product relies on a second scope, Scope B: what an employee writes in their Notebook, addresses to the companion Kal or exchanges in Le Cercle. Within that scope, Kalisme is not your processor: you receive nothing, you give no instructions, and Kalisme alone determines the purposes and means of that processing. Kalisme is therefore answerable as controller within the meaning of Article 4(7) GDPR and Article 5 FADP (definitions), directly to the data subject.
Your employees’ personal use of the service falls outside this agreement. It is described in the information notice provided to you together with this agreement. That notice is not a contract, is not signed, creates no obligation on your part and confers on you no right over the processing it describes. You may share it with your employees, their representative bodies and your occupational health service. The same neutrality wording appears in Article 7 and in the “Entire agreement and order of precedence” paragraph of Article 12 of the General Terms and Conditions of Sale: all three documents carry the same rule, namely that the notice neither binds the Client nor grants it any right.
This separation is not an internal policy but a technical property, and it is measured rather than promised. The three measures that underpin it are set out in Annex 2, together with the method of proof for each: two can be verified in the application code, the third is ascertained in the production database and bears the date of that finding.
A consequence you must accept: Kalisme cannot provide you with a dashboard of individual usage, nor any wellbeing indicator per person or per team granular enough to re-identify anyone. If your project depends on this, you must say so now: Kalisme will not provide it.
What the Client does obtain is set out in Annex 2: an engagement page displaying three aggregate figures, and three only, namely the number of activated Seats, the number of purchased Seats and the adoption rate expressing the former as a proportion of the latter, subject to a dual display threshold of 20 activated Seats and 10 persons per cell.
What the Client can rely on internally: the charter of non-managerial use, published at https://kalisme.com/pro/charte/ or at any replacement address, and provided on simple request as a dated document. Under this charter, the Client undertakes not to make use or non-use of the service a criterion of assessment, and Kalisme establishes that no table, no key and no log links a person to any content or to any use of the application, other than the administration data described in Annex 1 (Seat status and its date, date on which each device was opened, actions recorded in the administration log) and subject to the reservation set out in the charter: the count of messages for the day, Seat by Seat, kept by the server that routes messages to Kal in order to enforce its daily limits, which is erased afterwards.
Time limits. Every time limit in this agreement is counted in calendar days, unless it is expressly stated in working days within the meaning of Swiss law. The exception covers only one category, the same throughout the contractual set: short response, receipt or delivery time limits incumbent on Kalisme. The only time limits concerned are Kalisme’s response times provided for in Article 8, second stage, and in Article 11, levels 1 and 2. The reason is stated following the table in Article 11.
Dates. Every date in this agreement and its annexes is written in the form day, month, year (DD.MM.YYYY), including measurement and finding dates. No other form is used, so that a finding date cannot be read differently from a contractual date.
Vocabulary for the status of a Seat, settled for all documents provided to you. A Seat is assigned when it is allocated to an employee you designate, activated when that employee has used it, and released when you end that allocation. These three labels are the only ones used in the General Terms and Conditions of Sale, in this agreement and in the charter of non-managerial use. The internal database values do not leave the technical documentation and therefore do not appear here.
Other terms. The unit of billing and allocation is called a Seat, never a “licence” or a “place”: it is the personal, named right to use the application. The person to whom you assign a Seat is called an employee. What the main contract grants you over the application and its content is called a right of use; the word “licence” is reserved solely for the CC BY-NC-SA 4.0 public licence of the Manifesto, which falls outside the scope of this agreement.
Kalisme undertakes to process the data of Scope A in accordance with this agreement. Annex 1 describes, for each of the four processing operations concerned, the nature, the purpose, the categories of data, the data subjects and the retention period.
Kalisme processes the data of Scope A only on documented instructions from the Controller, including with regard to transfers, unless required to do so by a legal obligation to which Kalisme is subject (Article 28(3)(a) GDPR). In that case, Kalisme shall inform you before processing, unless the law prohibits it.
This agreement, the order and the actions carried out from the portal constitute your documented instructions. Any other instruction shall be given in writing; if it requires a development or work that the service does not include, it is subject to a prior quotation and is carried out only after its written acceptance.
Kalisme shall inform you without delay if, in its opinion, an instruction infringes the GDPR, the FADP or any other applicable provision (Article 28(3), final subparagraph, GDPR). It may then suspend the execution of that instruction until you amend or confirm it in writing; a confirmation does not oblige Kalisme to carry out an instruction that is contrary to applicable law.
Persons authorised to process the data are bound by a contractual obligation of confidentiality (Article 28(3)(b) GDPR). Kalisme currently has no employees: access is restricted to its owner. Any change in this situation will entail the introduction of individual written undertakings and will be brought to your attention.
The technical and organisational measures taken under Article 32 GDPR are set out in Annex 2. They are reassessed at least once a year and upon each significant change in architecture.
Annex 2 also states the limitations of those measures, rather than passing over them in silence.
Kalisme shall assist you, insofar as possible and taking into account the nature of the processing, in responding to requests to exercise the rights provided for in Articles 15 to 22 GDPR and of the corresponding rights that the FADP grants to the data subject, to the extent that they concern Scope A (Article 28(3)(e) GDPR).
Requests concerning Scope B fall outside this agreement and require no action on your part: they are handled directly by Kalisme, in accordance with the information notice referred to in the preamble.
You authorise Kalisme to engage the sub-processors listed in Annex 3, within the meaning of Article 28(2) and (4) GDPR and Article 9(3) FADP. Kalisme imposes on them, by contract, the same data protection obligations as those of this agreement, where appropriate by means of their own data processing agreements, which Kalisme verifies as offering the guarantees of Article 28(4) GDPR. It remains liable to you for their performance, within the limits of Article 10 of the General Terms and Conditions of Sale.
Any change follows the five-stage procedure below.
1. Prior notice. Kalisme shall inform you in writing of any addition or replacement of a sub-processor at least 30 days before it is put into service. The notice states the name of the provider, its role, the categories of data concerned, the hosting location, whether the provider is necessary for the provision of the service (Article 11 of the General Terms and Conditions of Sale) and, in the event of a transfer outside the European Union and Switzerland, the mechanism relied upon under Articles 44 to 49 GDPR.
2. Reasoned objection. You have 30 days from the notice in which to object, in writing and stating your reasons. The objection must be based on a ground relating to data protection: insufficient guarantees within the meaning of Article 28(4) GDPR, a transfer lacking a valid mechanism within the meaning of Articles 44 to 49 GDPR, or an established incompatibility with your own obligations as controller. An objection that states no reasons, or that is based on a ground unrelated to data protection, does not suspend the putting into service; it only opens to you the termination provided for in point 4, within the same period of 30 days from the notice.
3. Search for a solution. A reasoned objection suspends the putting into service of the new sub-processor for your data. The parties then have 30 days to seek a solution: a supplementary measure that removes the ground for the objection, an alternative provider, or retention of the existing provider for your organisation alone. Kalisme shall reply to you in writing and give reasons for its reply.
4. Termination, as a last resort only. If no solution is found within that period, either party may terminate the service concerned on 30 days’ notice. Following an objection that states no reasons, only you may terminate, on the same notice.
5. Emergency replacement. Where the failure, cessation of business or a security breach of a sub-processor requires its immediate replacement, Kalisme shall carry out the replacement without waiting for the period in point 1 and shall inform you in writing within the following 7 days, with the particulars of point 1. Points 2 to 4 then apply as from that information.
Financial consequences of such termination. They are not set out here, and this is deliberate. They are set out in the paragraph “Objection to a sub-processor” of Article 11 of the General Terms and Conditions of Sale, to which this point refers for a termination following a reasoned objection that remains without a solution; any other termination follows the general rules of the same article. It is the General Terms and Conditions of Sale that govern fees, invoicing and the financial effects of a termination. This agreement neither amends nor overrides any of their financial provisions.
Why a cross-reference rather than a derogation. Article 12 of the General Terms and Conditions of Sale allocates precedence by subject matter: this agreement prevails for everything relating to the processing of personal data; the General Terms and Conditions of Sale prevail for rates, fees, term, invoicing, liability and termination, including where the termination arises from a provision of this agreement. A financial counterpart written here would therefore have no effect. It is written where it does have effect.
The data of Scope A are stored and hosted in the European Union: OVH SAS in France, Hetzner Online GmbH in Germany (Falkenstein data centre). Switzerland and the European Union mutually recognise each other as providing an adequate level of protection.
Emails sent by the portal (administrator login links, employee invitations, invitations to sign): since 01.10.2026, they are sent through the email service of OVH SAS, in France, without any tracking pixel. They give rise to no transfer.
One reservation applies to a processing operation related to Scope A, and it is stated rather than passed over in silence.
Invoicing of Seats: Kalisme carries it out on its own account, as controller, in order to collect the price and keep its accounts; it is not subject to your instructions, and its providers are not sub-processors within the meaning of Article 6. It is mentioned here for information purposes. Its provider is Stripe Payments Europe, Limited (Ireland), with Stripe Payments UK Ltd for the regulated payment services. Stripe transfers data to Stripe, LLC in the United States. The order of priority declared by Stripe is the Data Privacy Framework (Stripe, LLC is self-certified), followed by the standard contractual clauses of the European Commission, modules 1, 2 and 3. For Switzerland, the standard contractual clauses apply with the Federal Data Protection and Information Commissioner as the supervisory authority.
The conversational companion does not fall within this article: it belongs to Scope B and concerns no data that you entrust to Kalisme. Since 24.09.2026, it has been served by default to your employees in the European Union by Amazon Web Services EMEA SARL. Its providers are mentioned in Annex 3 and described in the information notice referred to in the preamble.
The details of each situation are set out in Annex 3.
Kalisme shall notify you of any personal data breach affecting Scope A in accordance with a three-stage procedure, designed to leave you the margin needed to comply with your own notification obligations (Articles 33 and 34 GDPR, Article 24 FADP).
Awareness of the breach. The countdown for each stage starts from the moment at which Kalisme reaches a reasonable degree of certainty that an incident has compromised, accidentally or unlawfully, the confidentiality, integrity or availability of data of Scope A. An unconfirmed signal does not trigger the first stage, but opens an immediate investigation.
First stage, immediate alert. Kalisme shall notify you without undue delay, and no later than 48 hours after awareness as so defined, at the email address you entered on the line “Contact for personal data breach notifications” of the “Between” block. Kalisme may supplement this with a call to the telephone number you entered there. This first alert states: the nature of the incident as known at that time, the date and time of its discovery, the categories of data and the approximate volume concerned if already identifiable, and the immediate containment measures taken.
Second stage, further information. As soon as additional information becomes available, and no later than 5 working days after the first stage, Kalisme shall send you in writing, at the same address, a supplement setting out: the updated characterisation of the incident (breach confirmed, ruled out, or investigation still in progress), the categories and estimated number of data subjects concerned, the likely consequences, the measures already taken and those envisaged, together with an assessment of the level of risk intended to inform your own decision on whether to notify the data subject.
Third stage, final report. Upon closing its internal investigation, and no later than 30 days after that closure, Kalisme shall send you in writing a final report setting out: the complete chronology of the incident, the established cause, the corrective measures implemented and the lessons learned to prevent its recurrence.
Information of the data protection officer. Where you have completed the line “Data protection officer” of the “Between” block, that officer shall receive a copy of the three stages above, on the same dates.
This procedure covers Scope A only. For Scope B, Kalisme is not a processor within the meaning of Article 28 GDPR or Article 9 FADP: it is answerable directly to the data subject, in accordance with its own record of processing activities, and owes you no alert, supplement or report in that respect. If an incident affects both scopes without distinction, only the part relating to Scope A falls within this article.
| Stage | Trigger | Time limit | Content | Recipient |
|---|---|---|---|---|
| 1 · Immediate alert | Reasonable degree of certainty that an incident has compromised data of Scope A | 48 hours after awareness | Known nature, date and time of discovery, categories and approximate volume if identifiable, containment measures taken | Breach contact address in the “Between” block |
| 2 · Further information | Progress in characterising the incident | 5 working days after the first stage | Updated characterisation, categories and estimated number of data subjects concerned, likely consequences, measures taken and envisaged, risk assessment | Same address, in writing |
| 3 · Final report | Closure of the internal investigation | 30 days after closure | Complete chronology, established cause, corrective measures, lessons learned | Same address, in writing |
No notification time limit other than those in the table above may be invoked against Kalisme under this agreement. This three-stage procedure is calibrated to what a one-person organisation can actually sustain, and it is the only one in the contractual set.
Kalisme shall assist you with your data protection impact assessments and with your prior consultations (Articles 35 and 36 GDPR, Articles 22 and 23 FADP), within the limits of the information available to it. The impact assessment carried out by Kalisme on its own processing may be provided to you on request, under the conditions of level 1 of Article 11.
At the end of the service, and at your choice expressed in writing, Kalisme shall delete or return to you the data of Scope A within 30 days, and shall destroy existing copies, unless a legal obligation requires their retention (Article 28(3)(g) GDPR).
You shall express that choice in writing no later than 15 days after the end of the service. Failing that, the data are deleted. Return takes the form of files in CSV format, sent via a protected, time-limited download link; any other form is subject to a prior quotation.
Two reservations apply to this time limit, one contractual and the other technical.
The administration log is not subject to deletion at 30 days. By signing this agreement, you instruct Kalisme to retain it in full, in a table that cannot be modified, for the period stated in Annex 1. Beyond the end of the service, Kalisme also retains it on its own account, for the purposes of evidencing the performance of the contract and of establishing, exercising or defending legal claims. Access to this log is restricted to the owner of Kalisme. No reduction, no redaction and no partial rewriting of its lines is possible: the same database triggers that give it its evidential value prevent any update. A clause promising to remove lines or fields from this log at a given date would be unenforceable, and no such clause appears in this agreement or in the General Terms and Conditions of Sale.
Deletion remains for the most part a manual operation. As measured on the Seat administration platform on 26.08.2026, and again on 09.10.2026: only one item of data is erased automatically, the email address used for individual invitations, thirty days after the end of the contract. The other data of Scope A and their export have no automated routine: for them, the 30-day time limit is a contractual commitment honoured manually, not an implemented mechanism. This limitation is declared here rather than discovered later.
Kalisme demonstrates compliance with its obligations under Article 28 GDPR and Article 9 of the Swiss FADP by means of a four-level procedure, from the lightest to the most extensive. Access to a level presupposes that the previous level has been completed and was not sufficient to answer your request, except for level 4 in the cases where it opens directly (an actual personal data breach affecting Scope A, or a legal obligation requiring it).
Level 1, documentation. It is divided into two sets of documents, which are not subject to the same rules.
Public documents, provided without condition or undertaking. The Cloud Security Alliance CAIQ v4.1 self-assessment (283 questions) is published in the Cloud Security Alliance’s public STAR registry, at https://cloudsecurityalliance.org/star/registry/kalisme/services/kalisme. You may consult and download it freely, without prior request, without delay and without consideration. Kalisme attaches no confidentiality obligation to it: such an undertaking could not be enforced in respect of a document that anyone can download.
Internal documents, provided upon written undertaking. Upon simple written request, Kalisme shall provide you with the record of processing activities, the impact assessment relating to Kal AI and the sub-processors annex, within 5 working days. These documents describe Kalisme’s security arrangements and sub-processors: before they are provided, you undertake in writing to use them solely for the purposes of your own compliance assessment, not to disclose them to any third party other than an adviser or auditor bound by the same obligation, and to treat them with the same care as your own confidential information.
This level is not subject to any frequency limit and entails no cost for you: these are documents that have already been drafted and are kept up to date. It gives access to level 2 if, after reading them, a specific question remains unanswered.
Level 2, targeted written questionnaire. You submit in writing specific questions, not covered by the level 1 documents, relating exclusively to Scope A. Kalisme shall answer them in writing, point by point, within 20 working days of their receipt. This level is available once per 12-month period, unless a new event occurs (personal data breach, significant change in architecture). The time spent by Kalisme is borne by Kalisme up to 5 hours; beyond that, the additional time is invoiced at the hourly rate, excluding tax, that Kalisme notifies to you in writing, together with an estimate of the time, before committing it; without your written agreement to that rate, Kalisme does not commit it and the level ends with the 5 hours borne by Kalisme. You undertake in writing to treat the answers received as confidential. This level gives access to level 3 if the written answers leave a reasoned doubt, or if your question calls for a live demonstration rather than a written description.
Level 3, remote verification session. Kalisme shall organise a videoconference meeting with its owner, including a screen share of the technical and organisational controls described in Annex 2 to this agreement, without access to production data and without access to any data of another client. The session is organised within 30 days of your request. This level is available once per 12-month period. Each party bears its own costs of participation; Kalisme’s time beyond two hours of session is invoiced at the hourly rate of level 2. You undertake in writing to maintain confidentiality and not to record the session without Kalisme’s express consent. This level gives access to level 4 if the session reveals a serious and documented doubt as to compliance with an obligation under Article 28 GDPR or Article 9 FADP, or if it follows an actual personal data breach affecting Scope A within the meaning of Article 33 GDPR.
Level 4, inspection or audit by an appointed third party, conducted remotely. On written notice of at least 30 days, you may have an inspection or in-depth audit carried out, by yourself or by a third-party auditor you appoint. This level normally opens after level 3, but opens directly, without going through levels 1 to 3, in the two cases stated at the beginning of this article: an actual personal data breach affecting Scope A, or a legal obligation requiring access to this level. This level is strictly limited to Scope A: the administration of Seats and the systems that serve it. It expressly excludes access to the systems and data of Scope B (Kal AI, Notebook, Le Cercle), and likewise excludes any data relating to another client, as Kalisme operates a shared platform. This level does not give access to the premises of Kalisme’s hosting providers (OVH, Hetzner): Kalisme itself holds no physical access there that it could pass on. As Kalisme operates no business premises, the inspection takes place remotely, on the basis of documents and a shared screen. The costs of this level, including the time spent by Kalisme, at the hourly rate of level 2, are borne entirely by you. This level is available once per 12-month period, save where an actual personal data breach affecting Scope A has occurred within the preceding 12 months, which gives entitlement to one additional occurrence. Before any access, the appointed auditor signs a written confidentiality undertaking; the draft report is submitted to Kalisme for factual correction before any circulation, and the report names no other client of Kalisme.
| Level | What you obtain | Response time | Maximum frequency | Cost | Trigger for the next level | Confidentiality |
|---|---|---|---|---|---|---|
| 1a · Public document | CAIQ v4.1 self-assessment (283 questions), in the Cloud Security Alliance’s public STAR registry | Immediate, freely accessible | Unlimited | None | A specific question remains unanswered | No undertaking, the document is public |
| 1b · Internal documents | Record of processing activities, Kal AI impact assessment, sub-processors annex | 5 working days | Unlimited | Borne by Kalisme | A specific question remains unanswered in these documents | Prior written undertaking: use limited to your compliance assessment, no disclosure to any third party other than an adviser or auditor bound by the same obligation |
| 2 · Targeted written questionnaire | Written answers, point by point, to your questions not covered by level 1 | 20 working days | Once per 12-month period (unless a new event occurs) | Borne by Kalisme up to 5 hours, hourly rate notified in writing and accepted beyond | Reasoned doubt after reading, or need for a live demonstration | Written confidentiality undertaking on the answers received |
| 3 · Remote verification session | Videoconference meeting, screen share of the Annex 2 controls, without access to production data | 30 days to organise it | Once per 12-month period | Each party bears its own costs of participation; beyond 2 hours, level 2 hourly rate for Kalisme | Serious and documented doubt, or audit following an actual breach (Article 33 GDPR) | Written confidentiality undertaking, no recording without Kalisme’s express consent |
| 4 · Inspection or audit by an appointed third party, conducted remotely | Inspection or in-depth audit, limited to Scope A, conducted remotely, on the basis of documents and a shared screen | 30 days’ written notice | Once per 12-month period (plus one occurrence if an actual breach occurred within the preceding 12 months) | Borne entirely by you, including Kalisme’s time | (final level) | Written confidentiality undertaking signed by the auditor, draft report submitted for factual correction, final report anonymised as regards other clients |
Why these two time limits depart from the system of time limits of this agreement. The time limits of 5 and 20 working days are Kalisme’s response times, never time limits imposed on you. They are shorter than the 30 days that govern the rest of the contractual set because they concern documents already drafted or written answers, and they are counted in working days because Kalisme is a one-person organisation whose availability follows working days under Swiss law. The frequency of once per 12-month period is not a time limit but a limit on use.
Powers of the supervisory authority preserved. This four-level procedure does not apply to inspections carried out by a competent supervisory authority under the investigative and corrective powers conferred on it by Article 58 GDPR, or under the power to open an investigation conferred by Article 49 FADP on the Federal Data Protection and Information Commissioner: such an inspection is conducted in accordance with the rules specific to the authority concerned, without notice, without any frequency limit and without the cost sharing described above.
Kalisme does not currently hold any SOC 2 or ISO 27001 certification, as Annex 2 restates among its declared limitations. Such a process will be undertaken if the business warrants it. Level 1 of this procedure is precisely what fills that gap in the meantime.
This agreement applies throughout the term of the service and survives it for as long as Kalisme holds data falling within Scope A, including during the retention period of the administration log provided for in Annex 1.
If the business that is the subject matter of this agreement is taken over by a company under Swiss law to be incorporated, controlled by Hakan Kaynar and carrying on the same business (“the Successor”), the following provisions apply, in addition to the paragraph “Transfer to a company taking over the business” of Article 12 of the General Terms and Conditions of Sale.
1. Continuity of documented instructions. As from the effective date of the transfer, the Successor assumes the position of processor within the meaning of Article 28(1) GDPR under this agreement, on the same terms, for the processing operations of Scope A described in Annex 1. The documented instructions in force on that date remain applicable until the Controller gives new ones.
2. Prior notice. Kalisme shall inform the Controller in writing, at least 30 days before the effective date, at the address of record given in the “Between” block and at that of the portal administrator account, of the legal form, company name, registered office and business identification number (UID) of the Successor, together with the envisaged effective date. This notice constitutes the prior information under the paragraph “Transfer to a company taking over the business” of Article 12 of the General Terms and Conditions of Sale.
3. Right to object. The Controller may object to the transfer in the form and within the time limits of the paragraph “Transfer to a company taking over the business” of Article 12 of the General Terms and Conditions of Sale, which alone apply; Article 6 of this agreement does not apply to this transfer. Failing an objection within those time limits, the transfer is deemed accepted on the announced effective date.
4. Maintenance of technical and organisational measures. The Successor shall maintain, without interruption, the measures described in Annex 2, until they are reassessed or replaced under the conditions of Article 4.
5. Update of the sub-processors annex. Annex 3 is updated to reflect, where applicable, any change of sub-processor resulting from the transfer, in particular a change of hosting provider, in accordance with the procedure of Article 6. The mere change in the identity of the principal processor dealt with in this article does not, in itself, entail any amendment to Annex 3.
6. Information of the data protection officer. Where the Controller has completed the line “Data protection officer” of the “Between” block, that officer is informed on the same date as the notice provided for in point 2.
7. In the event of an objection. This agreement continues with Kalisme for the remaining term provided for in the main contract, under the conditions of the paragraph “Transfer to a company taking over the business” of Article 12 of the General Terms and Conditions of Sale, without renewal.
8. Continuity of prices and commitments. None of the events referred to in this article entails novation, termination, renegotiation or price revision. The new company name and the business identification number of the Successor are shown on invoices as from the effective date.
9. Legal characterisation. Under the GDPR, this agreement, transferred together with the contract, binds the Successor and constitutes the contract required by Article 28(3) GDPR. Under Swiss law, the basis is that of Article 12 of the General Terms and Conditions of Sale: your consent given in advance to the assignment of claims and the assumption of debts (art. 164 para. 1 and 176 CO), or a transfer of assets (art. 69 et seq. MergA).
This agreement and its annexes are drawn up and signed in French. Any translation is provided for information purposes only; in the event of any discrepancy, the French version alone shall prevail.
Scope A comprises four distinct processing operations, whose retention periods are not the same.
| Subject matter | Assignment, activation, monitoring and release of Seats |
| Purpose | To enable your employees to access the service you pay for |
| Data subjects | Employees designated by you, portal administrators |
| Data | Business email address, activation code and token (stored as a hash, never in clear text), Seat status, timestamps of assignment, activation and release, and, for each device on which the Seat is opened (10 at most), the date on which it was opened |
| Seat status | Three values, and three only: assigned, activated, released |
| Sensitive data | None |
| Automated decision-making | None within the meaning of Article 22 GDPR |
| Retention period | Term of the contract, plus 30 days (Article 10 of this agreement, pursuant to Article 28(3)(g) GDPR) |
A single set of labels for the entire contractual set. The three statuses above are defined in the preamble, section “Reading of time limits and vocabulary”, and they are the only ones used in the General Terms and Conditions of Sale, in this agreement and in the charter of non-managerial use. The internal values of the database do not leave the technical documentation and therefore appear nowhere in the documents provided to you.
What Kalisme does not collect in this processing operation: no job title, department, reporting line, working hours, content or individual usage statistics.
| Subject matter | Log of administration actions: assignment and release of a Seat, sending of an invitation, administrator login |
| Purpose | To demonstrate compliance with security and traceability obligations, and to establish evidence of performance of the contract |
| Data subjects | Portal administrators, employees holding a Seat |
| Data | Organisation identifier, identifier of the person performing the action, nature of the action, target, timestamp, IP address of the person performing the action |
| Retention period | 5 years from the recording of the line |
Why a period distinct from that of processing operation A1, and why this one. Two grounds apply cumulatively, both of them named.
Two points were weighed, and the period of 5 years is adopted. First, the ordinary limitation period under Article 127 CO is 10 years: it would apply to a claim for damages based on the performance of this agreement, and would lead to a period twice as long. The choice between 5 and 10 years sets evidential value against the minimisation required by Article 5(1)(c) and (e) GDPR; the period of 5 years is adopted because it is the only one of the two that rests on a basis compatible with that minimisation, and because Kalisme’s liability is in any event capped (Article 10 of the General Terms and Conditions of Sale). Secondly, the log is not an accounting record: the accounting records are the invoices, which are themselves subject to the 10-year retention requirement of Article 958f para. 1 CO, at Kalisme and at its invoicing provider, outside this agreement.
Declared technical limitation, measured on 26.08.2026. The log table is strictly non-modifiable: database triggers prevent updating, deleting and truncating, including by the application role that owns the table, so that the hash chain that gives it its evidential value cannot be rewritten. Two consequences follow, stated rather than passed over in silence. First, no reduction of the log over time is possible: no removal of email addresses, no removal of personal identifiers, and no partial redaction of lines already recorded. The log is kept either in full or not at all, and access to it is restricted to the owner of Kalisme. Secondly, purging at the end of the period adopted above requires a database administration operation, using a privileged account; no such purge exists at present, so that the period above is a commitment and not a mechanism in place.
| Subject matter | Document uploaded by the Client in support of an application for a reduced rate (non-profit organisation, educational institution, healthcare institution) |
| Purpose | To verify eligibility for the reduced rate after the fact, in accordance with Article 4 of the General Terms and Conditions of Sale |
| Data subjects | Persons named in the uploaded document: signatories, directors, officers mentioned |
| Data | File name, type, size, hash, upload date, date and outcome of the decision, and the content of the document itself, the composition of which Kalisme does not control since it is the Client who chooses it |
| Sensitive data | Possible, depending on the uploaded document. A healthcare licence or the articles of association of an association may reveal data falling under Article 9 GDPR |
| Retention period | Document never linked to a subscription: 7 days. Linked document: term of the contract, plus 12 months |
Time limit for verification. Article 4 of the General Terms and Conditions of Sale sets the time limit for and the effects of verification, which may be repeated in each period; this processing operation follows them without restating them.
Basis for the two periods, stated because they depart from the system of time limits of the contractual set. The 7 days are a measure in place, measured on 26.08.2026: an administration command erases the file and its line when the document has been claimed neither by a purchase intent nor by an organisation, after that period. A document that no one claims has no reason to wait 30 days. The 12 months after the end of the contract correspond to the last invoiced period that the document supports, so that a challenge to the rate applied can still be answered; beyond that, there is no longer any reason to retain the document having regard to Article 5(1)(c) and (e) GDPR.
Measures specific to this processing operation, verified in the code on 26.08.2026: the database holds only a reference and a hash, the file resides in a private storage space with no possible public URL, it is served only by an application endpoint reserved to Kalisme, and it is never exposed on the organisation’s dashboard. No purge is in place for linked documents: the 12-month period is, like that of the log, a commitment and not a mechanism.
Legal characterisation: Kalisme is the controller for this processing operation. Verification of the proof of status serves Kalisme’s own interest (applying the correct price), and Kalisme alone determines its purposes and means: this is the role of controller within the meaning of Article 4(7) GDPR, not of processor. This processing operation therefore does not fall under Article 28 GDPR, and the instructions under Article 2 do not apply to it. It is described here, in the document you sign, for information purposes, because it is you who upload the document and you need to know what becomes of it; it is entered in Kalisme’s record of processing activities.
| Subject matter | Voluntary and anonymous surveys that you launch from your portal (at launch, at thirty and at ninety days during a pilot, or on the date of your choice), via a shared link, without login or email address |
| Purpose | To report back to you, in aggregate form, how your employees have received the service, and, during a pilot, to establish whether the success criteria agreed with you have been met |
| Data subjects | Employees who choose to respond, portal administrators who launch a survey |
| Data | Answers to closed questions (scales and choices), two free-text answers of no more than 1,000 characters each, language of the response and day of the response, never the time; for each survey, the organisation, the launch and closing dates, the administrator who launched it and the number of invited persons that you declare |
| Sensitive data | Yes for the launch and ninety-day surveys of a pilot, which include two optional wellbeing and stress scales; possible in addition in the free-text answers, the content of which Kalisme does not control: a person may write whatever they wish there, about themselves or about a third party |
| Automated decision-making | None within the meaning of Article 22 GDPR |
| Retention period | Individual responses: 90 days after the survey closes. Aggregate result and summary: together with the other data of Scope A (Article 10) |
What Kalisme does not record in this processing operation: Kalisme records in the database no IP address, no identifier of a person, Seat, device or session, and no time of response. The number of responses per address is limited to prevent abuse, by means of a key derived from the address, held in temporary memory and which expires of its own accord; it is never written to the database.
What you receive, and what you do not receive. You never read an individual response. The portal shows you an aggregate result, and no result for an indicator with fewer than ten respondents. Free-text answers are never passed on to you: Kalisme alone reads them, and provides you with a thematic summary, written by a person, of no more than 4,000 characters.
Measures specific to this processing operation, verified in the code on 16.10.2026: the deletion of individual responses at 90 days is an administration command, scheduled to run every day on the server; until its execution has been ascertained in production, this period is a commitment, like that of the log.
Legal characterisation: Kalisme is the processor for this processing operation, except for the two wellbeing and stress scales described below. You launch the survey, and both the reading of the free-text answers and their summary are the service you order: Kalisme performs them on your behalf (Article 4(8) GDPR). During a pilot, establishing whether the success criteria have been met also serves Kalisme’s interest, but it concerns only the aggregate result, which exists only from ten respondents upwards: that result does not allow anyone to be identified, and its use is not a separate processing of personal data.
The two wellbeing and stress scales do not fall within the processing on your behalf. They are included in the launch and ninety-day surveys of a pilot, each optional for the person responding. You receive no result from them: no average, no distribution, no threshold. Kalisme processes the answers to these two scales on its own account, as controller within the meaning of Article 4(7) GDPR and Article 5(j) FADP, for the sole purpose of publishing averages calculated across all pilots, without naming any organisation. Kalisme calculates those averages before the erasure of individual responses provided for above, publishes none below the threshold of ten respondents, and includes these two scales only after a written answer from the cantonal research ethics committee that allows them to be used. Your organisation’s responses are excluded from those averages if you refuse in writing, as provided for in the pilot agreement. Kalisme enters this processing operation in its record of processing activities.
Measures applicable to Scope A. The measures that protect Scope B are not obligations that you could enforce under Article 28 GDPR: they are described in the information notice referred to in the preamble.
| Area | Measure |
|---|---|
| Encryption in transit | TLS on all access points |
| Access control | Key-based access to the infrastructure, restricted to the owner. Two-factor authentication on the providers’ consoles. Portal administrators log in by a single-use link, expiring after 15 minutes, of which only the hash is stored, or by password; where the administrator has added a second factor, it is required at each login, including by link, except on a device the administrator has declared trusted |
| Tokens and secrets | No secret stored in clear text in the database: invitation codes and access tokens stored as hashes. The access token is rotated at each renewal, which makes the replay of an old token detectable |
| Segregation of identifiers | Non-guessable identifiers in all tables, organisation identifier randomly generated and not derived from a name |
| Administration log | Append-only log, hash-chained, protected by database triggers that prevent updating, deleting and truncating, including by the application role |
| Segregation of the two scopes | Three measures, of which two are established by reading the code and one by a counter-test in the production database: the two methods of proof are not of equal weight and are not presented as equivalent. Verified in the code on 26.08.2026: the Seat activation call transmits only the code and the renewal call only the token (Seat activation module of the application); the installation identifier used for audience measurement does not leave the telemetry module, it appears in no other file of the application, and that module has no knowledge of Seats or organisations (audience measurement module of the application). Ascertained in the production database on 25.08.2026: the only column that could link a Seat to a device has been deleted from the production database, the column being absent and existing Seats intact. This third measure cannot be read in the code: reading code shows what the repository requests, not what production has executed, and it is the counter-test in the database that attests to it |
| Backup and restoration | Daily backup of the Seat administration platform, encrypted and accompanied by a hash. Weekly restoration exercise: the latest backup is decrypted and restored to a disposable database, the key tables and their volumes are checked, freshness is verified, and the database is then deleted. A failure triggers an alert rather than silence |
| Automated checks | A suite of static checks rerun every night on the published version, and a suite of automated tests run on the same basis |
| Minimisation in display | See the reference text below the table: it lists the three surfaces of the portal, what each one displays and what it does not display. The Scope B information notice describes the same three surfaces, the same three personal data elements and the same three aggregate figures, from the employee’s point of view |
Minimisation in display, reference text. The portal has three surfaces, and three only.
(1) The named Seat table. For each Seat, it displays three elements: the employee’s business email address, the status of their Seat (assigned, activated, released) and the date of that status. A fourth is added, solely for a Seat opened on more than one device: the number of those devices and the date on which each was opened, so that the Client can close a lost device without releasing the Seat. Where the Seat was opened by means of a team link rather than a named invitation, no address is shown: the line bears only the words “Employee (team link)”. It does not contain: any content written or dictated by the employee, duration of use, frequency of opening, login times, topics discussed, score, mood, wellbeing or risk indicator, or any usage column of any kind whatsoever.
The sending of an invitation is not a fourth element of this table, and its absence here is not an oversight: it is an administration action, recorded in the log of processing operation A2 in Annex 1, access to which is restricted to the owner of Kalisme in accordance with Article 10. This is why processing operation A1 in Annex 1 does not list it among the Seat administration data either: this text and that annex list the same elements.
(2) The engagement page. It appears only for an organisation with 20 or more purchased Seats, displays its figures only from 20 activated Seats upwards and shows no cell relating to fewer than 10 persons. Both thresholds are displayed to the Client on the page itself. It displays three aggregate figures, and three only: the number of activated Seats, the total number of purchased Seats, and the adoption rate expressing the former as a proportion of the latter. No data derived from audience measurement is connected to it, the corresponding reporting layer not being connected. No status, mood, wellbeing or risk indicator appears on it, and Kalisme undertakes not to add any. Kalisme further undertakes not to connect the reporting layer derived from audience measurement, and not to present you with any value from it, for the entire term of the contract.
(3) The Surveys tab. It holds the optional and anonymous surveys that the Client launches among its employees, via a shared link: without login, without address, without Seat, person or device identifier, without any recorded IP address, and with only the day of the response, never its time. The number of responses to a survey cannot exceed the number of invited persons. Results appear only when the survey closes, statement by statement, except for the two wellbeing and stress scales, of which no result is reported to the Client (Annex 1, A4), as a distribution of responses, never as an average, and no box relating to fewer than 10 persons is given a figure. Free-text responses are never shown to the Client: Kalisme reads them and provides it only with a thematic summary. Raw responses are erased 90 days after closing; only the aggregate results of the survey are retained.
Declared limitations, rather than passed over in silence. Kalisme is a one-person organisation. There is no 24-hour on-call service, no segregation of duties and no dedicated security team. Continuity relies on backup and on the reproducibility of the infrastructure, not on human redundancy. The Scope A backup is tested every week by an actual restoration, which is not a recovery plan but is better than a backup that has never been restored. No automated purge is in place for the end of the contract (Article 10), for the log or for linked proof-of-status documents (Annex 1). Kalisme does not currently hold any SOC 2 or ISO 27001 certification; a CAIQ v4.1 self-assessment is published in the Cloud Security Alliance’s public STAR registry (https://cloudsecurityalliance.org/star/registry/kalisme/services/kalisme), freely accessible and provided without any confidentiality undertaking under level 1 of Article 11.
This table is authoritative as at the date of signature. It changes only in accordance with the procedure of Article 6; the up-to-date list, provided with this agreement, reproduces its current state.
Two sub-processors concern Scope A, and they alone fall within the scope of this agreement:
| Sub-processor | Role in respect of Scope A | Hosting | Transfer outside the EU and outside CH |
|---|---|---|---|
| OVH SAS | Hosting of the website and collection points, email service and portal emails | France | No |
| Hetzner Online GmbH | Seat administration platform (Seats, organisations, log) | Germany | No |
Invoicing of Seats is carried out by Stripe Payments Europe, Limited (Ireland), with Stripe Payments UK Ltd, on Kalisme’s own account (Article 7). Stripe is Kalisme’s provider, and not a sub-processor within the meaning of this agreement. The transfer to Stripe, LLC in the United States and its mechanism are described in Article 7.
The other providers on that list, in particular Amazon Web Services EMEA SARL, Anthropic PBC and Apple Inc., are involved in Scope B only. They process no data that you entrust to Kalisme and are not sub-processors within the meaning of this agreement. They are mentioned here for information purposes, and are described in the information notice referred to in the preamble.
Google is likewise involved in Scope B only, for the Android app, where it takes Apple’s place. It processes no data that you entrust to Kalisme and is not a sub-processor within the meaning of this agreement. On Kalisme’s behalf, Firebase Cloud Messaging provides the phone’s notification token and carries the message that wakes Le Cercle, with no sender, no text and no first name; according to Google, this service may process that data wherever Google or its agents maintain facilities, including in the United States, and the transfer relies on Google LLC’s certification under the EU-U.S. and Swiss-U.S. Data Privacy Framework. Google Play handles purchases, under its own policy; for the referral programme, Kalisme’s server has Google verify the purchase tokens that the app sends to it and, for the free month of a subscribed referrer, has Google defer the billing of that referrer’s subscription. Play Integrity, a Google Play service, gives the app a token attesting that it is the genuine app, recognised by Google Play. The app requests it before sending messages to the companion Kal without a Kalisme Pro Seat, and Kalisme’s server has Google decrypt it; with an activated Seat, the request carries the Seat’s token and Play Integrity is not called upon for the companion. The app also attaches it to its exchanges with the referral server. That token carries neither the person’s name nor their email address, nor anything they write. Android’s backup may carry the encrypted Notebook, never its key. It may also carry the app’s preferences, including the history of the conversation with Kal, without application-level encryption. For Google Play, which covers the verification of purchases and the deferral of billing, and for Play Integrity, Google acts, under its own terms, as a controller independent of Kalisme, and not as a processor. For people located in the European Economic Area or in Switzerland, the end controller on Google’s side is Google Ireland Limited, in Ireland, an adequate country: under those terms, what Kalisme sends to it does not require standard contractual clauses. For its own transfers to the United States, Google relies on Google LLC’s certification under the Data Privacy Framework and on the standard contractual clauses of the European Commission.
The conversational companion, since 24.09.2026. For your employees, it is served by default in the European Union, by Amazon Web Services EMEA SARL (Luxembourg, Amazon Bedrock service), without retention of messages or responses. The contractual mechanism is the AWS data processing addendum, incorporated into its service terms, which applies the standard contractual clauses of the European Commission (June 2021 version) to any transfer outside the European Economic Area, with a Swiss addendum. One reservation accompanies this processing: AWS belongs to a United States group that is subject to the Cloud Act. Anthropic PBC receives your employees’ messages, in the United States, only if your organisation withdraws the European option, a choice that falls within the configuration of the subscribed service and not within an instruction concerning this processing.