Skip to content
The AI Lab
Legal

Data processing agreement

When our automations, the chat, the channels or the document area process personal data of your customers or your staff, we process it on your behalf. This agreement (Art. 9 FADP and, for customers in the European Union, Art. 28 GDPR) says how. It forms part of our terms of sale and applies once you accept the proposal.

Last updated: 8 October 2026

Roles

You, the customer, are the controller: you decide why and how the data is processed. Mundus Code CH di Gianpiero Cirillo is the processor: it processes the data only to provide you with the services in the proposal.

What data, and whose

It depends on the automations you use: usually names, contact details (email, phone), messages and conversations, appointments, documents and billing data of your customers, your contacts and your staff. Sensitive personal data (for example about health) we process only if the proposal provides for it, with extra measures.

Your instructions

We process the data only on your instructions: the proposal, the configuration of the automations you approve and your written requests. If an instruction seems unlawful to us, we tell you before carrying it out. We do not use your data for our own purposes, we do not sell it and we do not use it to train models.

Confidentiality of staff

Anyone working on the data is bound by confidentiality and sees only what their task requires.

Sub-processors

We rely on these sub-processors, each for the stated purpose and with data protection obligations no lower than these; those tied to a channel or a connection only come in if you use that service. You accept them with the proposal. Before adding or changing one we notify you: you can object on justified grounds within 30 days and, if we find no solution, cancel the service concerned.

  • IONOS (Fasthosts Internet Ltd), United Kingdom: the server hosting the website, the platform, the database, the files and the backups. Safeguard: country with adequate protection (Annex 1 of the Swiss Data Protection Ordinance).
  • Zoho Mail, European Union: the store's mailbox (hello@theailab.ch): the emails you write to us arrive there. Safeguard: country with adequate protection (Annex 1 of the Swiss Data Protection Ordinance).
  • Anthropic, United States: the language model behind the AI consultant, the analyses and the automatic replies. It does not use the data to train its models. Safeguard: standard contractual clauses or Swiss-U.S. Data Privacy Framework.
  • Google (Chrome browser), United States: the browser's speech recognition when you talk to the consultant: your voice goes to Google and comes back as text. Safeguard: standard contractual clauses or Swiss-U.S. Data Privacy Framework.
  • Mailgun, United States and European Union: sending emails (confirmations, proposals, invoices, reminders). Safeguard: standard contractual clauses or Swiss-U.S. Data Privacy Framework.

Where the data is

On our IONOS server in the United Kingdom, a country with adequate protection from a Swiss point of view. Data goes to the United States only with the safeguards stated for each sub-processor.

Security measures

  • two-factor sign-in to the management system for staff and blocking of repeated attempts;
  • secrets (keys and tokens of channels and connections) encrypted on the server, never in clear text in the logs;
  • encrypted connections (HTTPS) and data separated by store and by customer;
  • automatic, verified backups, currently on the same server;
  • a log of operations, with no personal data in the technical logs;
  • access only for those who need it, with separate roles.

Assistance

We help you, as far as we can, to answer requests from individuals (access, correction, deletion, export), to assess risks and to deal with the authorities. Extraordinary work is agreed in advance.

Data security breaches

If we discover a security breach affecting your data, we tell you without delay, with what we know and the measures taken, so you can decide whether to report it to the FDPIC (Art. 24 FADP) or to the people concerned.

End of the contract

When the service ends we return the data to you in a common format (for example CSV or JSON) if you ask within 30 days; then we delete it, except for what the law requires us to keep. Backups are deleted in their normal cycle.

Audits

You can ask us for the information needed to show compliance with this agreement. An on-site audit, by you or by an auditor bound to secrecy, is agreed in writing with reasonable notice, is at your expense and does not touch other customers' data.

Term and precedence

The agreement applies as long as we process data on your behalf. On these matters it prevails over the terms of sale. Swiss law, place of jurisdiction Lugano.