DPA

Data processing agreement (DPA) under revDSG between the advertiser (advertising client or agency) as the controller and Quartiero as the processor. It applies together with the main contract and, in the event of conflicts on data protection matters, takes precedence.

Subject matter and duration

Quartiero operates the advertiser portal through which the advertiser creates, books and plays out campaigns on the screen network. Processing on behalf of the advertiser lasts as long as the main contract and ends when it ends.

Nature and purpose of processing

Quartiero processes the data to provide and operate the advertiser portal: managing the advertiser account, storing campaign content and targeting, reviewing and approving campaigns, delivering them to the assigned devices, and technical operation and troubleshooting.

The anonymous counts from the screens (movement and click without any link to a person) are not personal data and are not covered by this agreement. See the privacy policy.

Categories of data subjects and data

Affected are the users of the advertiser portal (staff of the advertiser) with their account data such as email address and name, as well as persons whose details appear in the advertising content supplied by the advertiser, for example a name shown or a contact detail.

Instructions of the advertiser

Quartiero processes the data only on the documented instructions of the advertiser and for the agreed purposes. As a rule, the advertiser gives instructions through the use of the advertiser portal and its settings, otherwise in text form to the contact point named below. If Quartiero considers an instruction unlawful, it informs the advertiser and may suspend execution until the matter is clarified.

Obligations of the processor

The persons entrusted with the processing are bound to confidentiality. Quartiero supports the advertiser with requests for access, rectification and erasure by data subjects, and in meeting its own data protection obligations, as far as this is possible with the technical means of the portal.

Technical and organisational measures

Quartiero takes appropriate technical and organisational measures to protect the data. The measures are structured by protection goal and are kept in line with the state of the art.

Confidentiality. Access limited to authorised persons, controlled through sign-in (Amazon Cognito) and role-based permissions per advertiser. Separation of the data per advertiser (tenant separation). Encryption of the data in transit and at rest. Device authentication via cryptographic keys, so that only paired devices receive their content.

Integrity. Control of data transfer and input through the advertiser portal and the programming interfaces. Logging of security-relevant events, so that processing remains traceable.

Availability and resilience. Operation on a managed cloud infrastructure (Amazon Web Services) with redundancy, automatic backups and the ability to recover after an outage.

Procedures for regular review. Regular updates of the software in use, the principle of data minimisation, and anonymous capture of the sensor data without any reference to a person.

Sub-processors

The advertiser authorises Quartiero to engage the following sub-processors (as of July 2026):

• K-I-Soft IT&Holding GmbH, Bernstrasse 27b, 3122 Kehrsatz (Switzerland): development, technical operation, maintenance and support of the advertiser portal on behalf of Quartiero.
• Amazon Web Services, eu-central-2 region (Zurich, Switzerland): hosting, database, storage and delivery of the content.
• Amazon Web Services, eu-central-1 region (Frankfurt, Germany): technical real-time connection of the devices. Only technical and anonymous data is transmitted there in real time, such as device status and control commands. No data is stored in eu-central-1. It merely passes through the region for the moment of delivery and is neither written nor retained there.
• Amazon Cognito (Amazon Web Services, eu-central-2 region, Zurich): sign-in and account management.
• Amazon Simple Email Service (SES) (Amazon Web Services, eu-central-2 region, Zurich): sending transactional email, for example for sign-in and account confirmation.

Quartiero obliges every sub-processor to an equivalent level of data protection and keeps this list up to date. Quartiero notifies the advertiser of further sub-processors in advance, for example a payment provider once billing is introduced, so that the advertiser can object.

Place of processing

Processing takes place as a rule in Switzerland (AWS region eu-central-2, Zurich). For the technical real-time connection of the devices, the eu-central-1 region (Frankfurt, Germany) is also used. Only technical and anonymous data is transmitted there in real time, such as device status and control commands. No data is stored in eu-central-1. It merely passes through the region for the moment of delivery and is neither written nor retained there. From a Swiss perspective, Germany provides adequate data protection.

Notification of data security breaches

If Quartiero becomes aware of a data security breach affecting data processed on behalf of the advertiser, it notifies the advertiser without delay and supports them with the available information so they can meet their own notification obligations.

Rights of the advertiser

The advertiser may verify compliance with this agreement. On request, Quartiero provides the necessary information and evidence for this. An on-site check is possible by prior arrangement and without disrupting operations; the costs of a check initiated by the advertiser are borne by the advertiser.

Return and deletion

After the end of the contract, Quartiero deletes the data processed on behalf of the advertiser or, at the advertiser's request, returns it in a common format. Statutory retention obligations remain reserved.

Contact

The advertiser directs questions and instructions on data protection to Quartiero GmbH, Bernstrasse 27b, 3122 Kehrsatz, media@quartiero.ch.