Data Processing Agreement

Between the customer named in the tapr.ch account (the "Customer", controller) and Grynn GmbH, Neuweg 24, 8222 Beringen, Switzerland (UID CHE-191.106.578), "Grynn" (processor), operating the tapr.ch e-invoicing service.

This agreement is intended to address Art. 9 revFADP and, where the GDPR applies, Art. 28(3) GDPR. It forms part of the tapr.ch Terms of Service (the "Service Agreement") and applies from the moment the Customer accepts them.

1 Subject matter and duration

Grynn processes personal data for the Customer to send, receive, validate, transform, store and deliver e-invoices over the Peppol network, to publish the Customer's Peppol participant capabilities in Grynn's SMP, and to provide the related ERP and support services. The agreement runs for the term of the Service Agreement and until deletion or return under section 9.

2 Roles

For e-invoice transport Grynn acts as processor on the Customer's documented instructions. As a Peppol Access Point and SMP operator Grynn also has its own duties under the Peppol agreements. Grynn acts as controller for the processing its own duties as a Peppol Access Point and SMP operator require, and for its own security logs. Delivery of an invoice to the recipient's Peppol access point happens on the Customer's instruction; the recipient's provider is not Grynn's sub-processor.

3 Data and data subjects

Category	Data subjects
E-invoice content: names, addresses, VAT IDs, IBANs, contact persons, amounts	The Customer's trading partners and their staff (sole traders are natural persons)
Peppol participant IDs and SMP records (published to the Peppol network by design)	Businesses; may identify sole traders
AS4 transport metadata: sender and receiver IDs, message IDs, IP addresses	Senders and receivers
Tenant user accounts: name, email, login history, IP	The Customer's staff
Documents the Customer submits for AI-powered OCR, sent whole, and the extracted output	As for e-invoice content

Special categories of personal data are not sought.

4 Instructions

The Service Agreement, the Customer's configuration of the service and this agreement are the Customer's instructions. Grynn informs the Customer if it considers an instruction unlawful, and of any legal requirement to process otherwise, unless the law forbids this.

5 Confidentiality and security

Persons processing the data are bound by confidentiality (signed agreement before access). Grynn applies the security measures in operation listed on its Security page, which states only measures that are in place.

6 Sub-processors

The Customer authorises the sub-processors in Annex A. Grynn gives 30 days' notice of an addition or replacement; the Customer may object on reasonable data protection grounds. If Grynn cannot reasonably accommodate the objection, the Customer may end the affected service before the change takes effect and receives a pro-rata refund of prepaid fees. Grynn imposes equivalent obligations on each sub-processor and remains responsible for it.

Grynn gives this notice by email to the account owner of each tapr.ch account and in the change log at the end of this page.

7 Assistance with data-subject rights

Grynn forwards any request it receives about the Customer's data to the Customer within 5 working days, does not answer it for the Customer, and helps the Customer answer.

8 Breaches of data security

Grynn notifies the Customer without undue delay after becoming aware of a breach affecting the Customer's personal data, and in any case within 48 hours, with the information the Customer needs for its own notifications (revFADP Art. 24; GDPR Art. 33–34), and supports containment and investigation. The Customer decides its own notifications to authorities and data subjects.

9 Deletion and return

At the end of the Service Agreement Grynn keeps the Customer's data for 180 days, during which the Customer may export it, and then deletes it. Backups expire on their normal cycle and are not restored for other purposes. The Customer keeps its own statutory archive (e.g. Swiss CO Art. 958f) unless Grynn has contracted to archive for it.

10 Information and audit

Grynn provides the information needed to demonstrate compliance with this agreement. Grynn first provides documentation. If the Customer still needs an audit, it is held by the Customer or an auditor bound by confidentiality, on 30 days' written notice, at most once a year, at the Customer's cost. Grynn does not currently hold an ISO/IEC 27001 or other security certification; its ISMS records are the main source of information.

11 International transfers

Grynn hosts the service in Finland (EEA) with Hetzner. Transfers to countries without adequate protection recognised by Switzerland happen only through the sub-processors marked in Annex A: Anthropic under its data processing agreement, which includes the EU Standard Contractual Clauses and a Swiss addendum; OpenAI and Google only once their data processing agreement is in place; Grynn Advanced with the EU Standard Contractual Clauses and the Swiss addendum, being put in place. Transfer impact assessments are in draft.

12 Liability, precedence, law

Liability follows the Service Agreement. On data protection this agreement prevails. Swiss law applies. The courts of Schaffhausen, Switzerland, have exclusive jurisdiction.

Annex A: Sub-processors

The same list appears in our Privacy Policy, Section 6.1.

Change log

• Version 1.0 (new customers from 7 October 2026; existing customers from 26 October 2026): first published version, with the sub-processors in Annex A.

Contact

Questions about this agreement: contact@grynn.ch. Grynn GmbH, Neuweg 24, 8222 Beringen, Switzerland.