Data processing agreement (Stovita)

Version 2026-10 · Swiss Activities AG, Seestrasse 21, 8703 Erlenbach, Switzerland · The German version prevails.

This agreement governs how Swiss Activities AG processes personal data that hosts enter in Stovita or receive through Stovita. It implements Art. 9 of the Swiss Federal Act on Data Protection (FADP).

1. Parties and roles

1.1This agreement applies between the person or company using Stovita (“Host”) and Swiss Activities AG, Seestrasse 21, 8703 Erlenbach (“Swiss Activities”).

1.2For the personal data the Host processes in Stovita, the Host is the controller and Swiss Activities is the processor within the meaning of the FADP.

1.3The Host is responsible for processing the data lawfully, in particular for informing the data subjects (Art. 19 FADP) and for entering only data it needs for its purposes.

1.4This agreement does not cover processing for which Swiss Activities is itself responsible: the Host’s customer account and invoicing to the Host, the data guests enter on the Swiss Activities marketplace and bookings of experiences with Swiss Activities.

2. Conclusion and term

2.1The agreement is concluded by electronic acceptance in Stovita, during onboarding or under “Settings › Data protection”. Stovita stores the version, the time and the person who accepted.

2.2It applies from acceptance for as long as Stovita is used. Obligations that by their nature continue beyond the end (confidentiality, deletion and return) remain in force.

3. Subject matter, nature and purpose of the processing

3.1Swiss Activities provides Stovita, software for hosts and managers of holiday rentals: requests and bookings, prices and invoices with QR-bill, calendar and channels, own website, guest registration and tourist tax, guest app, inbox with the assistant Alpi, cleaning and team app, owner statements and reports.

3.2The processing comprises collecting, storing, organising, displaying, calculating, creating documents, translating, sending messages and e-mails on behalf of the Host, synchronising with the channels the Host connects, exporting and deleting.

3.3The sole purpose is to provide the functions of Stovita to the Host, including operation, security, troubleshooting and support. Swiss Activities does not use the data for its own purposes. Stovita sends recommendations of experiences to guests only if the Host switches them on.

4. Data subjects and categories of data

4.1Processing of sensitive personal data (Art. 5 let. c FADP) is not intended. If a guest provides such data of their own accord, for example about allergies or accessibility in a message, Swiss Activities processes it like all other data under this agreement.

5. Instructions

5.1Swiss Activities processes the data only as instructed by the Host. The instructions result from this agreement, from the Host’s settings and actions in Stovita and from individual instructions in text form sent to privacy@swissactivities.com.

5.2If Swiss Activities is legally required to carry out other processing, it informs the Host beforehand unless the law prohibits this.

5.3If Swiss Activities considers an instruction to infringe data protection law, it informs the Host and may suspend its execution until clarified.

6. Confidentiality

6.1Swiss Activities grants its employees and auxiliary persons access only to the extent necessary for operation, troubleshooting or support and obliges them to confidentiality, also after their employment ends.

6.2Support accesses a Host’s account only with special authorisation, stating a reason, for a limited time and with logging.

7. Data security

7.1Swiss Activities takes the technical and organisational measures under Art. 8 FADP and Arts. 1 to 6 of the Data Protection Ordinance (DPO) described in Annex 2. It adapts them to the state of the art; the level of protection must not decrease.

8. Sub-processors

8.1The Host authorises the use of the sub-processors listed in Annex 1. Services that only work at the Host’s request process data only once the Host activates them.

8.2Swiss Activities informs the Host at least 30 days in advance, in Stovita or by e-mail, of any intended new or replaced sub-processor. Within this period, the Host may object for a significant data protection reason. If the parties cannot find a solution, the Host may switch off the function concerned or stop using Stovita.

8.3Swiss Activities imposes obligations on sub-processors that are equivalent to this agreement and remains responsible for them towards the Host.

8.4Recipients determined by the Host itself are not sub-processors: channels the Host connects, such as Airbnb or Booking.com, authorities and registration offices, services the Host embeds on its website (for example Google Ads or Meta Pixel, which only load after visitors consent) and the recipients of the messages the Host sends.

9. Disclosure abroad

9.1The database and all files are located on a server in Germany. Germany provides an adequate level of data protection (Annex 1 DPO).

9.2Personal data is only disclosed to a country without adequate data protection if appropriate safeguards under Art. 16(2) FADP exist, for example the recipient’s certification under the Swiss-U.S. Data Privacy Framework or standard data protection clauses recognised by the FDPIC, or if an exception under Art. 17 FADP applies. Annex 1 states the location and safeguard for each sub-processor.

10. Assistance to the Host

10.1Stovita provides functions with which the Host can handle data subject requests itself: access and data export per guest (JSON), rectification, anonymisation of a guest, information from guest registration and CSV exports. Where this is not sufficient, Swiss Activities assists the Host on request. Requests received by Swiss Activities are forwarded to the Host.

10.2Swiss Activities notifies the Host of a data security breach as quickly as possible after becoming aware of it (Art. 24(3) FADP), with the information available to it: nature of the breach, data and persons concerned, if possible their number, possible consequences and measures taken or proposed. It assists the Host with notifications to the FDPIC and to the data subjects.

10.3Swiss Activities provides reasonable assistance to the Host with a data protection impact assessment (Art. 22 FADP) and with requests from authorities insofar as they concern Stovita.

11. Audits

11.1On request, Swiss Activities provides the Host with the information it needs to verify compliance with this agreement.

11.2The Host, or an independent auditor appointed by it and bound to confidentiality, may audit compliance at most once a year and after a data security breach, with at least 30 days’ notice, during business hours and without disrupting operations. Data of other customers and business secrets remain protected. Each party bears its own costs.

12. End: return and deletion

12.1Until the end of use, the Host can download its data with Stovita’s export functions. On request, Swiss Activities provides a complete export in a common format within 30 days after the end.

12.2Swiss Activities deletes the Host’s personal data no later than 90 days after the end of use, unless a statutory retention obligation applies. On request, it confirms the deletion in text form.

13. Liability

13.1Each party is liable for damage it causes by breaching this agreement or data protection law. To the extent permitted by law, the liability of Swiss Activities is limited to intent and gross negligence.

13.2The Host indemnifies Swiss Activities against third-party claims based on the Host having collected data unlawfully or having given instructions that infringe data protection law.

14. Final provisions

14.1In the event of conflict, this agreement takes precedence over other agreements between the parties on data protection matters.

14.2Swiss Activities announces changes at least 30 days in advance. A new version applies as soon as the Host has accepted it in Stovita.

14.3If a provision is invalid, the remainder remains valid. It is replaced by a rule that comes as close as possible to its purpose.

14.4The German version prevails. The French, Italian and English versions are translations.

14.5Swiss law applies. The place of jurisdiction is Erlenbach (Canton of Zurich), the registered office of Swiss Activities AG.

Annex 1: Sub-processors

As of version 2026-10. “Always” means: when the Stovita function concerned is used.

For operating Stovita

Only if the Host activates them

Annex 2: Technical and organisational measures

As of version 2026-10. Only measures implemented in Stovita are described.

Confidentiality

• Since July 2026, Stovita has been running on its own server used only for Stovita. The database has no public access and can only be reached within the application’s internal network.
• All connections are encrypted with TLS; the domains send HSTS.
• Every record belongs to exactly one host, and every query is restricted to that host’s data.
• API keys are stored only as a hash with a secret addition (pepper) and have restricted permissions. The Swiss Activities gateway authenticates itself with its own secret.
• Guests, team and owners open their pages with random personal links. Links for team and owners are stored only as a hash and can be revoked at any time.
• Support access to a host account requires special authorisation and a reason, is limited to 5 to 60 minutes and is recorded in an append-only log.
• Anyone who views or exports registration form data is logged with time and reason; the log is deleted after 24 months.
• Credentials for third-party services are kept only on the server, not in the code. The Exa key is available only to the background service.

Integrity

• All input is validated on the server. Incoming webhooks are verified by signature or secret (SendGrid, Customer.io, Channex, Adyen).
• Uploaded images are checked for their file type; metadata such as GPS coordinates is removed.
• Changes to Stovita reach the server only through the pipeline with automated tests, never by hand.

Availability

• The services are continuously health-checked and restarted automatically after a crash. If a new version fails, the deployment automatically returns to the previous one.
• The database is backed up every hour, and each backup is checked for readability when it is created. Hourly backups are deleted after 48 hours, daily backups after 30 days.

Traceability

• The application logs requests without access keys. Personal links are masked in the server’s access logs; no access log is kept for the guest pages. Logs are rotated by size (3 × 50 MB).
• Contract acceptances are stored with version, time and person.

Data minimisation and deletion

• Registration form without images of identity documents: the machine-readable zone is read in the browser, and only the necessary fields reach Stovita. The personal details are deleted when the municipality’s period ends, by default 12 months after departure.
• Requests to OpenAI contain no access codes and are sent with “store: false”.
• Website statistics work without cookies and without storing IP addresses; the daily key used for this is deleted after two days. Advertising pixels on hosts’ websites only load after visitors consent.
• The raw text of incoming e-mails is removed after processing, at the latest after 30 days. Profiles at Customer.io are removed again via a dedicated deletion ledger.
• The Host can anonymise a guest. What the Host must keep (booking records, registration form until the period ends) is retained and shown.

Organisation

• Only employees who need it for operation, troubleshooting or support have access to hosts’ data; they are bound to confidentiality.
• Data protection contact: privacy@swissactivities.com.