Data Processing Agreement
Last updated: 23 October 2026
This Data Processing Agreement (“DPA”) forms part of the Rodarion Terms of Service between Cubera Solutions AG (“Cubera”, processor) and the customer (controller). It applies whenever Cubera processes personal data on the customer’s behalf to provide Rodarion. “Controller” and “processor” are used as in the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR); in that case this DPA is a contract under Art. 28 GDPR.
1. Subject, purpose and duration
Cubera processes personal data only to provide Rodarion under the Terms of Service: hosting and storage, translation management, machine translation on the customer’s instruction, e-mail notifications, backups, security and support. This DPA applies for as long as Cubera processes personal data for the customer, including the deletion period in section 11.
2. Data and data subjects
- Data subjects: the customer’s users of Rodarion (staff, translators and others it invites) and persons who appear in the customer’s content.
- Personal data: names, e-mail addresses, roles and permissions, login and security data (password hashes, two-factor settings, API tokens, connected apps), activity history and comments, content such as texts and screenshots insofar as it contains personal data, and technical data such as IP addresses in server logs.
Rodarion is designed for the texts of software user interfaces. The customer does not store sensitive personal data in it.
3. Instructions
Cubera processes personal data only on the customer’s documented instructions. The Terms of Service, this DPA and the customer’s configuration and use of Rodarion, including connecting a machine translation provider or an AI app, are the customer’s instructions. If Cubera considers an instruction to infringe data protection law, it informs the customer and may suspend it until clarified.
4. The customer’s responsibilities
The customer is responsible for the lawfulness of the processing, in particular for a legal basis and for informing data subjects. It manages its users, permissions and tokens and limits personal data to what is necessary.
5. Confidentiality and security
Cubera binds its staff and contractors to confidentiality, also beyond the end of their engagement. Cubera operates an information security management system certified to ISO/IEC 27001 and applies its technical and organisational measures (TOM, version 2.0, October 2026), summarised in Annex 2; the full TOM is available on request. Cubera may adapt the measures to the state of the art without lowering the level of protection.
6. Sub-processors
The customer gives Cubera general authorisation to engage sub-processors; those engaged today are listed in Annex 1. Cubera binds each sub-processor to data protection obligations at least equivalent to this DPA and remains responsible for it. Cubera announces a new or replacing sub-processor at least 30 days in advance by e-mail to the customer’s administrators. The customer may object within that period for important data protection reasons; if no solution is found, it may terminate the contract with effect from the change. Providers the customer connects itself, such as machine translation providers with its own key or AI apps, are engaged by the customer and are not sub-processors of Cubera. Paddle, as merchant of record for paid plans, processes payment data as an independent controller.
7. Location and transfers abroad
Personal data is stored and processed in Switzerland, which the EU recognises as providing an adequate level of protection. Transfers to other countries take place only as listed in Annex 1, with safeguards under Art. 16 FADP and Chapter V GDPR, in particular the EU standard contractual clauses or a certification under the Data Privacy Framework.
8. Personal data breaches
Cubera notifies the customer of a personal data breach without undue delay, at the latest within 24 hours of becoming aware of it, with the information available at that time; further information follows without delay. Cubera supports the customer in assessing its notification duties; notifications to authorities and data subjects are made by the customer.
9. Assistance
Cubera assists the customer with requests from data subjects, data protection impact assessments and proceedings of authorities, as far as the customer cannot handle them with the functions of Rodarion. Requests that data subjects send to Cubera are forwarded to the customer. Cubera informs the customer of requests from authorities for its data, as far as the law permits. Effort beyond the normal scope is charged.
10. Audits
Cubera demonstrates compliance primarily through its ISO/IEC 27001 certificate, its TOM and reports. If these are not sufficient, the customer may carry out an audit once per calendar year with at least 30 days’ notice, itself or through an independent auditor bound to confidentiality. An audit must not unreasonably disrupt operations and must protect other customers’ data; Cubera’s effort is charged.
11. Deletion and return
The customer can export its translations at any time through the CLI and the API. After the contract ends, Cubera deletes the customer’s personal data from the active systems within 30 days; copies in backups are overwritten as the backups rotate, at the latest after two years. On request, Cubera confirms the deletion in writing. Statutory retention obligations remain reserved.
12. Liability and final provisions
Liability is governed by the Terms of Service. In case of conflict on data protection, this DPA prevails over the Terms of Service. Governing law and jurisdiction follow the Terms of Service. Instructions and data protection questions go to hello@rodarion.com.
Annex 1: Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Akenes SA (Exoscale), Lausanne, Switzerland | Hosting of the application, database, files and backups | Switzerland (Zurich) |
| Microsoft Ireland Operations Ltd. (Microsoft Azure) | Storage of server logs for 90 days | Switzerland (Azure Switzerland North) |
| Twilio Inc. (SendGrid), USA | Sending e-mails: e-mail address, name and content of the e-mail | USA, under the EU standard contractual clauses and the Data Privacy Framework |
Annex 2: Technical and organisational measures
| Area | Measures |
|---|---|
| Access | Company and project roles in Rodarion, optional two-factor authentication for every user, project-scoped API tokens; at Cubera, least privilege, multi-factor authentication for administrative access and separate administrator accounts |
| Separation | Each company’s data is logically separated from every other company’s; production is separated from test and development |
| Encryption | TLS on public networks, encryption of stored data and backups, provider keys stored encrypted |
| Availability | Daily encrypted backups kept separately from production, monitoring and alerting, documented recovery procedures |
| Vulnerabilities | Components of every build monitored for known vulnerabilities, fixes prioritised by severity and exploitability |
| Organisation | Confidentiality obligations and training of staff, documented incident process with a central register, breach notification within 24 hours |