// dpa

Data processing agreement (DPA)

Last updated: 14 October 2026 · Version 1

Parties: the business that uses 7brain, as controller (“you”), and 7Cloud AG, Bahnhofstrasse 19, 9100 Herisau, Switzerland, as processor (“we”). This agreement meets the requirements of Art. 9 of the Swiss Federal Act on Data Protection (FADP) and, where applicable, Art. 28 of the EU General Data Protection Regulation (GDPR).

1. Subject matter and duration
2. Nature and purpose
3. Types of personal data
4. Data subjects
5. Instructions and your obligations
6. Confidentiality
7. Technical and organisational measures
8. Sub-processors
9. Support with data subject rights
10. Notification of data breaches
11. Deletion and return
12. Audit rights
13. Learning across companies
14. Liability and final provisions

1. Subject matter and duration

The subject matter is the processing of personal data by us on your behalf when we provide 7brain to you under the terms and your offer or order confirmation. This DPA applies for as long as that contract. Our obligations under this DPA continue until all data has been deleted or returned in accordance with section 11.

This DPA does not cover data that we process as a controller in our own right, for example for contract administration and invoicing. Our privacy policy applies to that data.

2. Nature and purpose

Nature: retrieving data via the interfaces of the services you approve; storing, organising, analysing (including with AI models), displaying and deleting it; transferring it to the sub-processors listed in section 8.

Purpose: to give you analyses, alerts, recommendations, tasks and reports, to run the chat with Sevi, to carry out changes in your accounts that you have approved and – if you connect Slack – to send and receive messages in your Slack. We do not process the data for any other purpose unless you agree under section 13.

3. Types of personal data

• User data: name, email address, role and company of the people who use 7brain, and login data.
• Usage data: what is typed in the chat with Sevi, approvals and log data (who approved or changed what, and when).
• Shop data: order and product data such as amounts, quantities, discounts, refunds, dates and shipping country. Without the names or email addresses of your customers.
• Advertising data: campaigns, ads, spend and metrics from the platforms; no data about individual people who have seen your ads.
• Email marketing data: statistics and structure of campaigns and flows; no recipient data.
• Slack (only if connected): the messages addressed to Sevi and the details needed for them, such as user and channel IDs.

Sensitive personal data (Art. 5(c) FADP) and special categories of personal data (Art. 9 GDPR) are not intended for 7brain.

4. Data subjects

• your employees and agents who use 7brain;
• your customers, only indirectly via order data without names or email addresses;
• people in your Slack workspace who write to Sevi, if you connect Slack.

5. Instructions and your obligations

• We process the data only on your documented instructions. Instructions are the terms, your offer, this DPA, your settings and approvals in the app, and instructions sent by email.
• If the law requires us to process the data differently, we will inform you beforehand unless the law prohibits this.
• If we consider an instruction to be unlawful, we will inform you without delay. We may suspend it until you confirm or change it.
• You are responsible for ensuring that the processing is lawful, in particular that there is a legal basis and that the data subjects have been informed.

6. Confidentiality

Everyone at our company who has access to your data is bound to confidentiality. This obligation continues after their work ends and after this contract ends.

Requests from public authorities. We disclose your data to public authorities only where we are legally obliged to. We review every request for its legality, challenge requests we consider unlawful, disclose only the minimum that may lawfully be demanded, and document every request together with our response and legal reasoning. Where legally permitted, we inform you beforehand.

7. Technical and organisational measures

We protect the data with the following measures:

• Encryption in transit (TLS) and at rest.
• Credential vault: the access credentials for your accounts are kept in a dedicated, encrypted vault.
• Strict tenant separation in the database (row-level security): each company sees only its own data. This is verified by automated tests.
• Role-based permissions: access only to the extent a role requires it.
• Logging (audit log) of approvals and changes.
• Backups: encrypted every night, with a restore test every week.
• Data minimisation: read-only access as a rule; no names or email addresses of your customers.
• Deletion after the contract ends (section 11).

We adapt these measures to the state of the art. The level of protection must not decrease as a result.

8. Sub-processors

You authorise the use of the following sub-processors:

• Transfers to the USA: based on the Data Privacy Framework (including the Swiss-US Data Privacy Framework) where the provider is certified, otherwise on standard contractual clauses.
• We contractually bind every sub-processor to a level of protection that corresponds to this DPA. We are liable for them as for our own actions.
• We will notify you of changes by email at least 30 days in advance. Within this period you can object for an important data protection reason. If we cannot find a solution, you may terminate the contract with effect from the date of the change.
• The services you connect yourself (for example Shopify, Meta, Google, Klaviyo, TikTok, Pinterest) are not our sub-processors. You have your own contracts with them.

9. Support with data subject rights

• We support you with appropriate measures so that you can respond to requests from data subjects, for example for access, rectification, erasure, restriction, data portability or objection.
• If a data subject contacts us directly, we forward the request to you without delay.
• Where necessary, we also support you with data protection impact assessments and consultations with supervisory authorities.

10. Notification of data breaches

If we become aware of a breach of data security affecting your data, we will notify you without undue delay and no later than 48 hours after becoming aware of it. As far as known, the notification includes what happened, which types and roughly how much data and how many people are affected, the likely consequences and what we are doing about it. We take immediate measures to limit the damage and keep you informed.

11. Deletion and return after the contract ends

• After the contract ends, we delete all personal data we have processed on your behalf within 30 days. On request, we hand it over to you beforehand in a common format.
• Encrypted backups expire within 30 days and are then deleted automatically.
• This does not apply to data we are required by law to retain. On request, we confirm the deletion by email.
• How to request deletion during the term is described under Data deletion.

12. Audit rights

• We make available to you all information you need to demonstrate compliance with this DPA, for example a description of the measures in section 7.
• In addition, after giving reasonable notice, you may check compliance yourself or have it checked by an auditor who is bound to confidentiality and does not work for a competitor. Audits should disrupt operations as little as possible.
• We support audits by a competent supervisory authority.

13. Learning across companies (only with your consent)

• Only if you explicitly agree (see terms, section 11) do you thereby instruct us to derive abstract craft knowledge from your use – for example on how email flows are built, account structure, tracking and funnel mechanics – and to anonymise it and combine it with that of other companies.
• Brand-related content (design of ads, messages, tone of voice, personas) and personal data are never included. No conclusions can be drawn about you, your shop or any individual.
• The result no longer contains personal data and, once anonymised, is no longer covered by this DPA.
• Without your consent, this does not happen. You can withdraw your consent at any time with effect for the future, by email to info@7cloud.ai.

14. Liability and final provisions

• Liability is governed by the terms, unless the law mandatorily provides otherwise.
• In the event of contradictions, this DPA takes precedence over the terms in matters of data protection.
• Swiss law applies; the place of jurisdiction is Herisau, Switzerland. Mandatory provisions of the GDPR remain unaffected.
• This DPA is available in German and English. In the event of any discrepancy, the German version prevails.

Last updated: 14 October 2026, version 1.

Questions? info@7cloud.ai · Imprint · Privacy · Terms