Public template
This Data Processing Agreement (“DPA”) is intended to supplement the applicable SCP Pilot Agreement, Master Agreement, Terms of Use or other written agreement between the Client Organisation and GILTEACHINGS.
For organisational SCP deployments, the Client Organisation acts as Controller and GILTEACHINGS acts as Processor for SCP platform data processed on behalf of the Controller.
1. Purpose and Scope
This Data Processing Agreement (“DPA”) governs the processing of personal data by GILTEACHINGS on behalf of the Client Organisation in connection with the use of SCP, the Symbolic Cognitive Protocol, in an organisational context.
SCP is a digital system for self-management, structured reflection, guided sessions, symbolic feedback, and aggregated organisational insight. SCP is not a medical device, diagnostic tool, therapy substitute, psychological treatment, emergency service, or crisis intervention system.
2. Roles of the Parties
For organisational SCP deployments, the Client Organisation acts as Controller for the employment-related and organisational context. GILTEACHINGS acts as Processor for SCP platform data processed on behalf of the Controller, except where GILTEACHINGS processes data for its own legal, security, compliance, or operational obligations.
The Controller determines the organisational purpose, participant group, deployment scope, and lawful basis for making SCP available to participants. The Processor processes personal data only according to this DPA, the main agreement, and documented instructions from the Controller.
Documented instructions may be provided through the main agreement, written email, agreed project documentation, or other written communication between the Parties.
3. Subject Matter, Nature, and Purpose of Processing
The subject matter of processing is the provision, operation, support, security, and maintenance of SCP for the Controller’s authorised users.
The nature of processing includes collection, recording, storage, structuring, calculation, aggregation, pseudonymisation, access management, transmission, deletion, anonymisation, and technical support.
The purpose of processing is to provide SSL sessions, SCP feedback, user-level session outputs, aggregated organisational dashboard outputs, participation indicators, reference-state indicators, technical support, and system security.
4. Duration of Processing
Processing begins when the Controller’s users are activated in SCP and continues for the duration of the main agreement.
After termination of the main agreement, B2B session data will be deleted or anonymised within 90 days unless a different period is agreed in writing, required by law, or necessary for the establishment, exercise, or defence of legal claims.
Legal acceptance records may be retained for up to 10 years as compliance evidence. Aggregated or anonymised outputs may be retained where they no longer identify individual users.
5. Categories of Data Subjects
The data subjects may include employees, managers, team leads, pilot participants, authorised organisational users, and support contacts of the Controller.
6. Categories of Personal Data
Account data may include name or pseudonym, email address, user ID, organisation and team assignment, and login and account status.
Session data may include SSL session timestamps, start and end self-ratings, 4E capacity inputs, ΔEnergy values, modulation selections, symbolic feedback data, and session completion and interruption data.
Technical data may include app version, device or browser information, and logs required for security, support, debugging, and system stability.
Legal acceptance data may include accepted Terms version, accepted Privacy Notice version, acceptance timestamp, and app version at acceptance.
7. Special Categories / Sensitive Data
SCP is not designed to diagnose, treat, prevent, or cure medical or psychological conditions.
However, because SCP processes self-reported cognitive and energetic state data, the Parties agree to treat such data with increased care and security.
The Controller is responsible for determining whether the processing qualifies as sensitive personal data or special-category data under applicable law and for ensuring that a valid legal basis exists.
8. Processor Obligations
GILTEACHINGS shall process personal data only on documented instructions from the Controller; not process Controller personal data for advertising, resale, unrelated profiling, or unrelated product purposes; ensure confidentiality obligations; apply appropriate technical and organisational measures; assist with data subject requests, data security, breach assessment and compliance obligations where reasonably required; notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller data; delete or anonymise personal data after termination according to this DPA; and make available information reasonably necessary to demonstrate compliance with this DPA.
GILTEACHINGS shall not disclose individual session inputs to the Controller except where legally required by a statutory obligation or mandatory order from a competent court or supervisory authority.
9. Controller Obligations
The Controller shall ensure that SCP is deployed lawfully in the organisational context; define the participant group, deployment scope and purpose; provide appropriate information to users; ensure that participation is voluntary or otherwise legally justified; respond to data subject requests as Controller; provide documented instructions to the Processor; and ensure that only authorised organisational users receive access to aggregated dashboard outputs.
The Controller shall ensure that SCP outputs are not used for individual surveillance, diagnosis, performance assessment, employment decisions, disciplinary measures, or automated decisions with legal or similarly significant effects.
10. Aggregation and Organisational Outputs
Individual session inputs are not shown to the Controller. The Controller receives only aggregated outputs where reporting thresholds are met.
Reporting thresholds are defined in the SCP aggregation logic, the applicable pilot documentation, or the main agreement. Aggregated outputs may include participation rates, ΔEnergy trends, modulation distribution, reference-state indicators, and other non-individual organisational insights.
The Controller shall not attempt to re-identify users from aggregated outputs or combine SCP outputs with other information in a way that could identify individual users.
11. Sub-Processors
The Controller grants a general written authorisation to GILTEACHINGS to use sub-processors necessary to provide, host, secure, maintain, and support SCP.
A current list of sub-processors is available upon request at scp-support@gilteachings.ch. GILTEACHINGS shall notify the Controller of any intended changes or replacements of sub-processors at least fourteen (14) days in advance. The Controller may object to such changes on reasonable data protection grounds within this period.
12. International Transfers
SCP data is primarily hosted on secure servers in Switzerland.
Where personal data is accessed from or transferred to countries outside Switzerland or the EU/EEA, GILTEACHINGS shall ensure that appropriate safeguards are in place, specifically including the European Commission’s Standard Contractual Clauses (SCCs), supplemented by the mandatory Swiss modifications required by the Swiss Federal Data Protection and Information Commissioner (FDPIC).
13. Security Measures
GILTEACHINGS shall apply appropriate technical and organisational measures, including where applicable: role-based access control, restricted operator access, pseudonymisation, secure hosting, access logging, password-protected accounts, separation of user-level and aggregated organisational outputs, secure backup and recovery procedures, technical monitoring for security and stability, and internal access limitation based on need-to-know principles.
Further technical and organisational measures may be described in Annex B.
14. Data Subject Requests
If GILTEACHINGS receives a request from a corporate user relating to access, deletion, correction, restriction, objection, or portability, GILTEACHINGS may direct the user to the Controller in the first instance.
GILTEACHINGS shall reasonably support the Controller in responding to data subject requests where required and technically possible.
15. Personal Data Breaches
GILTEACHINGS shall notify the Controller without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a personal data breach affecting Controller data.
The notification shall include, where available: nature of the breach, categories of data affected, approximate number of affected users, likely consequences, measures taken or proposed, and contact point for further information.
Such notification does not constitute an admission of fault or liability by GILTEACHINGS. The Controller remains responsible for assessing and fulfilling any notification obligations to authorities or affected data subjects.
16. Audit and Compliance Support
GILTEACHINGS shall make available information reasonably necessary to demonstrate compliance with this DPA.
Assistance beyond ordinary operational support may be charged at reasonable rates unless required due to a material breach by GILTEACHINGS.
Audits, inspections, or detailed security reviews must be reasonable, proportionate, subject to strict confidentiality, and agreed in advance. Unless required by a supervisory authority, the Controller shall bear all costs arising from its audit requests, unless the audit reveals a material compliance breach by GILTEACHINGS.
17. Return, Deletion, and Anonymisation
Upon termination of the main agreement, GILTEACHINGS shall delete or anonymise B2B session data within 90 days unless a different period is agreed in writing or retention is legally required.
Upon request, GILTEACHINGS shall confirm deletion or anonymisation in writing. Aggregated or anonymised outputs may be retained where they no longer identify individual users.
Backup copies may remain for a limited period according to technical backup cycles, provided they are protected and not actively used except for recovery, legal, or security purposes.
18. Confidentiality
Each Party shall keep confidential all non-public information received in connection with this DPA, including personal data, security information, business information, and technical documentation. This obligation continues after termination of the main agreement.
19. Priority
In case of conflict between this DPA and the main agreement regarding personal data processing, this DPA prevails unless the Parties expressly agree otherwise in writing.
In case of conflict between this DPA and mandatory data protection law, mandatory law prevails.
20. Governing Law and Jurisdiction
This DPA is governed by Swiss law, unless mandatory data protection law provides otherwise.
Place of jurisdiction is Chur, Switzerland, unless mandatory law provides another jurisdiction.
Annex A — Processing Details
Client Organisation
GILTEACHINGS
SCP organisational deployment
Provision of SCP sessions, feedback, aggregated organisational dashboard outputs, support, security, and operational maintenance.
Employees, managers, team leads, pilot participants, authorised organisational users, and support contacts.
Account data, session data, technical data, legal acceptance data.
SCP is not medical or diagnostic. Self-reported cognitive and energetic state data is treated with increased care.
B2B session data deleted or anonymised within 90 days after termination of the main agreement unless otherwise agreed. Legal acceptance records retained up to 10 years. Aggregated or anonymised outputs may be retained.
Aggregated outputs only where reporting thresholds are met. No individual session inputs are disclosed to the organisation unless legally required.
Annex B — Technical and Organisational Measures
Authorised users access SCP through individual accounts. Access is role-based and limited according to user type.
GILTEACHINGS operator access is limited to authorised persons with operational need.
Where appropriate, user-level data is handled through user IDs or pseudonymous structures rather than direct identification.
Organisational dashboard outputs are provided only at aggregated level where reporting thresholds are met.
Personnel or service providers with access to personal data are subject to confidentiality obligations.
SCP data is primarily hosted on secure servers in Switzerland. Hosting and infrastructure providers are selected according to security and operational suitability.
Technical logs may be used for security, debugging, support, and system stability.
Backup and recovery processes are maintained to support service continuity and data protection.
Data is deleted or anonymised according to agreed retention periods and legal obligations.
Individual session inputs are separated from organisational dashboard outputs. Employers receive aggregated outputs only.
Security and access controls may be reviewed and updated as SCP develops.
Execution
This public template may be incorporated into or executed with the applicable SCP Pilot Agreement, Master Agreement, Terms of Use, or other written agreement between the Client Organisation and GILTEACHINGS.