This page summarises annex 3 of the service contract, which governs the processing of personal data on behalf of our clients. The signed annex is what binds; this page exists so you know what you are signing up to before you sign.
The annex is a processing agreement within the meaning of Art. 9 FADP and Art. 28 GDPR. It applies as soon as Hallebardier processes third-party data on the client’s behalf: visitors to their site, people who fill in a form, recipients of an email.
The client is the controller. They decide what data their site collects and why. Hallebardier is the processor and processes that data only on documented instructions, for the purposes of the contract alone. This split is not cosmetic: the client answers to the supervisory authority, and Hallebardier answers to the client.
Processing lasts as long as the service does: building the site, then maintenance if it is subscribed. It stops at the end of the contract, subject to the backup window described below.
Name, email, phone and message of people who fill in the form on the client’s site, kept two years after the last exchange. IP address and timestamp in the server logs, thirty days. Aggregated analytics, six months. Business contact details published on the site, for the duration of the contract.
No sensitive data within the meaning of Art. 5(c) FADP is processed in the standard scope. Should the client’s site come to collect any, this annex must be revised before going live.
The client’s instructions are given in writing; an email is enough. Hallebardier processes the data for no other purpose: no own statistics, no prospecting, no training of an artificial intelligence model. If an instruction appears to breach applicable law, Hallebardier says so and may suspend it until written confirmation.
One person accesses the data, Maxime Perriard, bound to secrecy by the contract itself, with no time limit after it ends. No temporary staff, no resale, no commercial subcontracting.
TLS 1.3 on all traffic, and HSTS. Backups encrypted before they leave the server, with a key that is not on it. Two-factor authentication, SSH keys only, root login disabled. Firewall closed by default, database not exposed. Access logs kept ninety days. Automatic security updates. Each client’s data is kept separate.
The providers below take part in the service. The client accepts them by signing the annex.
| Subprocessor | Role | Location | Transfer |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, security, encrypted backups | EU and global network | SCC |
| Google Ireland Ltd | Email, calendar | EU | — |
| Resend, Inc. | Form relay | United States | SCC |
| Infomaniak Network SA | Sales tracking server | Switzerland | — |
| Bexio AG | Invoicing | Switzerland | — |
| Skribble AG | Electronic signature | Switzerland | — |
| Proton AG | Credential management | Switzerland | — |
| Better Stack | Uptime monitoring | EU | — |
Any new processor is announced to the client thirty days before it starts. The client may object on data protection grounds; if no other solution exists, the affected service is terminated at no cost to them.
The client’s site, its backups and its sales tracking stay in Switzerland or in the European Union. The only transfers outside that area are those marked in the table, covered by the European Commission’s standard contractual clauses as recognised by the Swiss Federal Commissioner, with the Swiss addendum.
Hallebardier has no direct relationship with data subjects: a request that reaches it is forwarded to the client within three working days, without being answered. The extracts, corrections or deletions the client needs in order to answer are supplied within five working days. The same help applies to an impact assessment or a prior consultation, to the extent the information depends on Hallebardier.
At the end of the contract, live data is returned or deleted within thirty days, at the client’s choice.
Backups cannot be selectively purged. They are encrypted and rotate over thirty days. A deletion request is therefore fully effective at the latest thirty days after it has been carried out on live data. This is a real technical limit, stated here rather than discovered during an erasure request.
Hallebardier notifies the client without delay and at the latest twenty-four hours after becoming aware of a breach, with the nature of the incident, the categories and approximate number of people affected, the likely consequences and the measures taken. Notifying the supervisory authority is for the client, as controller, to do.
Once per calendar year, with thirty days’ notice, the client may request the information demonstrating compliance with this annex. An on-site audit is possible at their expense, during business hours.
Swiss law, exclusive jurisdiction in Fribourg. Last updated: September 2026.