Data Processing Agreement (DPA)
Effective Date: October 13, 2026. This version is effective as of October 13, 2026. You will be notified in good time in the event of any material changes to this Data Processing Agreement. This Data Processing Agreement ("DPA") governs the data protection obligations of the parties in connection with the processing of personal data in the context of the use of the Lokbox services. It meets the legal requirements under Art. 28 GDPR as well as under the Swiss Federal Act on Data Protection (revFADP / nFADP). Change history: Version 2026-10-13 – Removal of Infisical from § 4: the service for managing connector credentials is not in use; it currently stores or processes no customer credentials and no personal data. Version 2026-10-10 – Alignment of § 4 with the privacy policy and lokbox.ch/subprocessors (addition of Google Cloud Vertex AI with Gemini as an option only and Anthropic Claude via Vertex AI announced and not yet active, of Plus Five Five, Inc. (Resend) and of Infisical) and rewording of the international transfers in § 5 (Standard Contractual Clauses for Google and Resend; GDPR and FADP legal bases). Version 2026-09-28 – Correction of § 4 (Supabase: Switzerland/Zurich) and § 5 (customer data is stored in Switzerland, Zurich); both were announced with version 2026-09-03 but not carried into those sections. Version 2026-09-04 – Change of the Processor's firm, registered seat and domicile address (now: Kubilé IT, Chratzernstrasse 2b, 4803 Vordemwald, Canton of Aargau; previously: bubloo, Kubilé, Pfaffnau/St. Urban LU; UID unchanged) and the corresponding change to the place of jurisdiction (§ 11). Version 2026-09-03 – Update of the subprocessors and processing locations (Infomaniak Network SA, Zurich; Supabase Zurich; §§ 4, 5), clarification of Claude processing via the AWS Bedrock EU geographic inference profile (§ 4), editorial changes (Swiss spelling, brand name Lokbox). Version 2026-07-06 – Addition of the categories of personal data and the categories of data subjects (§ 2), clarification of EU data residency (§ 5), inclusion of a jurisdiction clause (§ 11), clarifications regarding instructions and subprocessors (§§ 3, 4). Version 2026-06-16 – Initial version.
Last updated: 13 October 2026
1. Parties
Controller (Customer): The user of the Lokbox services who processes personal data within their account. Processor (Provider): Kubilé IT, Chratzernstrasse 2b, 4803 Vordemwald, Switzerland (UID: CHE-190.821.402).
2. Subject Matter, Nature and Purpose of Processing
The Processor processes personal data on behalf of and according to the documented instructions of the Controller in order to provide the Lokbox services (AI-assisted browser automation, text processing, and API integrations). The processing comprises the collection, recording, storage, retrieval, querying, and deletion of data. Categories of personal data: client master data (names, addresses, contact details, company and legal-form information); identifiers (e.g. UID, commercial-register, tax and social-security numbers, insofar as entered by the Controller); as well as portal task data (the task texts issued by the Controller, uploaded documents, access context, and the result and log data generated by the agent). Categories of data subjects: the Controller's clients and their authorised representatives or contact persons, the Controller's employees and end users, as well as other natural persons whose data the Controller enters in the course of a task.
3. Instructions and Confidentiality
The Processor processes personal data exclusively on the documented instructions of the Controller. If the Processor is of the opinion that an instruction infringes the GDPR, the revFADP, or other data protection provisions, it will inform the Controller without undue delay (Art. 28(3) subpara. 2 GDPR). The Processor ensures that all persons authorised to process the data (employees) have committed themselves to confidentiality or are subject to an appropriate statutory obligation of confidentiality.
4. Subprocessors
The Processor uses in particular the following subprocessors to provide the services: Infomaniak Network SA (frontend & backend hosting, Switzerland/Zurich); Amazon Web Services (AWS) (Bedrock inference platform). For current Claude processing, Lokbox uses AWS Bedrock's EU geographic inference profile with Frankfurt as the primary source Region. AWS may process requests in the European destination Regions documented for that profile. For the current Claude processing path through Amazon Bedrock, AWS states that model providers do not have access to customer prompts or completions. Any retention by AWS depends on the configured Bedrock data-retention mode and AWS's documented exceptions. Google Cloud Vertex AI — Region: EU Member States, excluding Switzerland (Gemini: europe-west4, Netherlands; Claude: EU multi-region, announced). Purpose: Resolver and answer synthesis with Gemini models. Gemini: optional, only when enabled; not active by default at present. Anthropic Claude via Vertex AI: announced, not yet active. Plus Five Five, Inc. (Resend) — Region: USA; sending via the EU region (Ireland) according to the account configuration, account and main processing in the USA. Purpose: Account, billing and workspace notifications (verification, password reset, invitations, document requests, digests). Supabase (database & storage, Switzerland/Zurich); Stripe (payment processing, EU/Ireland); Sentry (error monitoring, EU de.sentry.io). The complete and current list of subprocessors is available at lokbox.ch/subprocessors and is authoritative for the scope of the consent granted; the Controller hereby consents to the use of the subprocessors listed there. The Processor contractually binds each subprocessor to data protection obligations that are substantially equivalent to those agreed in this DPA (Art. 28(4) GDPR). The Processor will inform the Controller in good time about any intended change (addition or replacement); the Controller may object for an important data protection reason.
5. International Data Transfers (Third-Country Transfer)
Lokbox is a Swiss provider. Customer data is stored in Switzerland (Zurich). AI processing, payment processing, email delivery and error monitoring are performed by the subprocessors listed in § 4 and may take place outside Switzerland. Insofar as the use of certain integrations (e.g. Notion) results in data being transferred to the USA, the Processor relies on the Standard Contractual Clauses (SCC) of the EU Commission (Art. 46(2)(c) GDPR; Art. 16(2)(d) FADP, with the Swiss adaptations) or, where the recipient is certified, on the EU-U.S. or Swiss-U.S. Data Privacy Framework (DPF; adequacy decision, Art. 45 GDPR; Art. 16(1) FADP). Insofar as the subprocessors Google Cloud Vertex AI and Plus Five Five, Inc. (Resend) listed in § 4 transfer data to the USA, the Processor relies on the Standard Contractual Clauses for this (Art. 46(2)(c) GDPR; Art. 16(2)(d) FADP, with the Swiss adaptations). Processing in EU/EEA states takes place in states with an adequate level of data protection (Annex 1 DPO); no additional transfer instrument is required for this.
6. Technical and Organisational Measures (TOMs)
The Processor has taken appropriate technical and organisational measures pursuant to Art. 32 GDPR to ensure a level of protection appropriate to the risk. These include, among others: Encryption: All data transfers (TLS/SSL) as well as stored data (data at rest) are encrypted; Isolation: Browser automations run in short-lived, isolated sandbox environments; Access and access control: Physical and logical access is restrictively regulated.
7. Support Obligations and Breach Notification
The Processor appropriately supports the Controller in responding to requests to exercise data subject rights (access, rectification, erasure, etc.). In the event of a personal data breach (data breach), the Processor notifies the Controller without undue delay after becoming aware of it and supports the Controller in its statutory notification and communication obligations (Art. 33, 34 GDPR) as well as in data protection impact assessments.
8. Control and Audit Rights
The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA. The Controller (or an independent auditor mandated by it) has the right, after timely notice, to carry out reasonable reviews (audits).
9. Data Retention and Deletion
On termination, the user account and owned workspaces are first deactivated. Memory conversation turns are soft-deleted and scheduled for hard deletion after a 30-day grace period. Other personal data is deleted or returned where the available export and deletion functions support it and no legal or audit retention obligation applies. Lokbox shows the current status and available options in the workspace settings.
10. Term of the Agreement
This DPA is concluded for an indefinite period and ends automatically upon termination of the main agreement for the use of the Lokbox services.
11. Applicable Law and Jurisdiction
This DPA is governed exclusively by Swiss law, to the exclusion of its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods. The exclusive place of jurisdiction for all disputes arising out of or in connection with this DPA is Zofingen (Canton of Aargau), Switzerland, unless mandatory statutory places of jurisdiction preclude this.