Data Processing Agreement

Last updated 21 October 2026

This agreement is part of the Terms of Service between the Customer and Divhunt GmbH, Chamerstrasse 172, 6300 Zug, Switzerland, UID CHE-297.885.332 ("we"). OneType is a product of Divhunt. It applies whenever we process personal data on the Customer's behalf. It is meant to meet Article 28 of the GDPR and the Swiss Federal Act on Data Protection (FADP).

1. Roles

1.1 The Customer is the controller (or a processor for its own client). We are the processor. In plain words: the Customer decides what happens with its visitors' data; we handle it for the Customer.

1.2 We process the Customer's personal data only to provide OneType, following the Customer's documented instructions. The Terms, this agreement and the Customer's settings in the app are those instructions. We tell the Customer if we believe an instruction breaks data protection law.

1.3 For our own account, billing and security data we are the controller; our Privacy Policy covers it.

2. What we process (Annex 1)

3. Our commitments

3.1 Confidentiality: everyone we allow to process the data is bound to confidentiality.

3.2 Security: we apply the measures in Annex 2 and keep them appropriate to the risk.

3.3 Help with requests: we help the Customer answer data subject requests. The app lets the Customer export everything held about a contact and erase a contact with their conversations.

3.4 Breaches: we notify the Customer without undue delay, and at the latest within 72 hours of becoming aware of a personal data breach affecting the Customer's data. We give the information we have and update it as we learn more.

3.5 No training: we don't use the Customer's personal data to train AI models.

3.6 Information: on request we provide the information needed to show we meet this agreement.

4. Sub-processors

4.1 The Customer authorises the sub-processors listed on our sub-processors page.

4.2 We announce a new or replaced sub-processor at least 30 days in advance, by email to the workspace owner and on that page. The Customer may object on reasonable data protection grounds (for example, if the new company can't protect the data well enough); if we can't address the objection, the Customer may end the affected service.

4.3 We bind each sub-processor to data protection obligations equivalent in substance to this agreement, and we remain responsible for them.

4.4 Own AI keys: when the Customer uses its own AI provider key, those calls run under the Customer's own agreement with that provider, which is then not our sub-processor.

4.5 Integrations: tools the Customer connects (for example Slack, Discord or Google Drive) receive data because the Customer chooses to send it there. They are not our sub-processors.

5. International transfers

The Customer's content is stored in the EU (Germany). Where a sub-processor is outside Switzerland or the EU/EEA and not in a country with an adequacy decision, we use the EU Standard Contractual Clauses (with the Swiss addendum) or the EU-U.S. and Swiss-U.S. Data Privacy Framework.

6. The Customer's obligations

The Customer has a lawful basis for the processing it instructs. It informs its visitors (for example in its privacy policy) that an AI assistant answers them and how their data is used. It does not use agents to collect sensitive data.

7. Deletion

7.1 Conversations: conversations are kept until they are deleted. A setting to delete them automatically after 30, 90, 180, 365 or 730 days is coming to the app. When erased, messages and personal details are removed; a record without personal data stays so usage statistics remain correct.

7.2 Contacts can be erased one by one, together with their conversations.

7.3 Workspace deletion: a deleted workspace can be restored for 30 days. After that, all its content, search data and files are deleted. Invoices are kept as Swiss law requires.

7.4 Backups: daily backups are stored in the EU. Data deleted from OneType remains in backups taken before the deletion until those backups are deleted.

7.5 Before deletion, the Customer can export conversations and contacts.

8. Order of precedence

If this agreement and the Terms conflict on data protection, this agreement prevails. If Standard Contractual Clauses apply and conflict with this agreement, the clauses prevail.

Annex 2: Technical and organisational measures