Data processing agreement

Last updated: 10.09.2026

This agreement governs the processing of the personal data you entrust to us when you use our services. You are its controller; we act as processor. It supplements our contractual terms and applies within the meaning of art. 9 of the Swiss Federal Act on Data Protection (FADP) and art. 28 of the General Data Protection Regulation (GDPR).

01 · Parties and subject matter

This agreement is concluded between you, hereinafter “the client”, as controller, and James Benone, Unrecon, a sole proprietorship, Rue Hoffmann 8, 1202 Geneva, Switzerland, hereinafter “Unrecon”, as processor.

It covers the personal data Unrecon processes on the client's behalf in the provision of web hosting, virtual private servers and game servers. It does not cover the data the client sends us as a counterparty — identity, contact details, billing — which we process as controller and which falls under our privacy policy.

02 · Duration

This agreement takes effect when the service is ordered and remains in force for as long as Unrecon processes data on the client's behalf. It ends with the main contract, subject to the deletion obligations set out in article 13 and to the confidentiality obligations, which survive it.

03 · Nature and purpose of the processing

Unrecon hosts and operates the infrastructure on which the client deploys its own services. The operations consist of storing, hosting, routing and making data available, and of deleting it on the client's instruction.

The client alone determines what data it places on the infrastructure. Unrecon does not consult it and knows neither its nature nor its content, except insofar as strictly necessary for operation, security or the execution of an instruction.

The categories of data and of data subjects depend on how the client uses the service. They may include data of its own users, customers, employees or visitors: identification data, contact details, login data, uploaded content, access logs.

04 · Client instructions

Unrecon processes data only on the client's documented instruction. The contractual terms and normal use of the service constitute the initial instruction. Any subsequent instruction is sent in writing to customer-service@unrecon.ch.

Unrecon informs the client if an instruction appears to it to infringe applicable law, and may suspend its execution until confirmation.

Where a Swiss legal obligation requires processing outside the client's instructions, Unrecon informs the client before proceeding, unless the law prohibits that information.

05 · Confidentiality

Everyone authorised to access the data is bound to confidentiality, by contract or by a statutory duty, and that obligation survives the end of their work with Unrecon.

Access is limited to those who need it for operations, and withdrawn as soon as that need ends.

06 · Technical and organisational measures

Unrecon implements the following measures, within the meaning of art. 32 GDPR and art. 8 FADP:

Encryption of disks at rest, so that the loss or theft of a medium does not expose the data it holds.

Two-factor authentication on all administrative access, including the panel and the client area.

Logging of administrative access to the infrastructure, retained for thirty days.

Encrypted transport: services are exposed over HTTPS only, the TLS certificate being installed on the Geneva server. Traffic stays encrypted from the user's browser to Unrecon's machines; the link between the anti-DDoS tunnel and Geneva runs over WireGuard.

Separation of client environments through virtualisation, each instance being isolated from the others.

The primary node in Geneva is operated on the holder's premises, not open to the public, physical access to which is restricted to the holder himself. Those premises are not a data centre and offer neither power redundancy nor badge-controlled access.

This list describes the state of the measures at the date shown at the top. Unrecon may change them, provided the level of protection achieved is not lowered.

07 · Backups

Unrecon performs no backup of the data the client hosts on the infrastructure. It is for the client to put its own backups in place, at a frequency and retention suited to its obligations.

Consequently, the ability to restore the availability of the data after an incident, within the meaning of art. 32(1)(c) GDPR, rests with the client. Unrecon restores the service, not the data.

The client is invited to take this into account in its risk assessment: the primary node has no failover to a second site.

08 · Sub-processors

The client authorises Unrecon to use the following sub-processors:

Artaun Hosting, a declared association under French law (SIREN 104 908 496, RNA W523005685), 1 rue des Aziaux, 52410 Eurville-Bienville, France — routing and anti-DDoS filtering of all traffic bound for the client's services. Since the TLS certificate is installed on the Geneva server, this provider has access only to the IP addresses, ports and volume of the traffic it routes, never to its content.

Qoriz Hosting, at the Equinix PA5 data centre in Aubervilliers, France — the infrastructure on which Artaun Hosting operates the tunnel. Unrecon has no direct contractual relationship with that provider.

Contabo GmbH, Welfenstraße 22, 81541 Munich, Germany, whose machine is operated in Lauterbourg, France, by Contabo France SAS — hosting of Unrecon's code repository. That machine is not in the path of the client's traffic and no operational data from its services resides there; the source code kept there may incidentally contain some, which is why it is declared here.

Each sub-processor is bound by a contract imposing data protection obligations equivalent to those of this agreement. Unrecon is liable for their failures as for its own.

Unrecon informs the client of any addition or replacement of a sub-processor at least thirty days in advance. The client may object on data protection grounds within that period; failing an acceptable solution, it has an extraordinary right of termination at no cost.

09 · Rights of data subjects

Unrecon assists the client, as far as possible and taking into account the nature of the processing, in responding to requests for access, rectification, erasure, restriction, objection and portability.

If a data subject contacts Unrecon directly, the request is forwarded to the client without delay and not acted upon, unless instructed otherwise.

10 · Security breaches

Unrecon informs the client of any security breach affecting its data without undue delay, and at the latest forty-eight hours after becoming aware of it.

The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Unrecon assists the client with its own notification duties within the meaning of art. 24 FADP and art. 33 and 34 GDPR.

11 · Assistance and impact assessment

Unrecon makes available to the client the information needed to demonstrate compliance with the obligations of this agreement, and assists it, taking into account the information at its disposal, in carrying out a data protection impact assessment and in any prior consultation of the supervisory authority.

12 · Verification

The client may verify compliance with this agreement by sending Unrecon a written questionnaire or a request for documentation. Unrecon replies within thirty days and provides the up-to-date description of its technical and organisational measures.

As the primary node is operated on the holder's private premises, no on-site visit is provided for. If a competent supervisory authority requires an inspection, Unrecon submits to it and informs the client.

13 · End of the agreement

At the end of the main contract, the client has thirty days to retrieve its data. After that period, Unrecon deletes all of the client's data from its infrastructure.

In the event of termination for a serious breach of the acceptable use obligations set out in the terms and conditions, that period may be reduced to seven days, or removed where keeping the data is itself unlawful.

Unrecon keeps no copy beyond that period, save for data that a statutory retention obligation requires it to keep, which remains subject to the confidentiality obligations of this agreement until deletion.

14 · Governing law and jurisdiction

This agreement is governed by Swiss law. The place of jurisdiction is Geneva, subject to the mandatory places of jurisdiction provided by law.

In the event of a discrepancy between this agreement and the general contractual terms, this agreement prevails in all matters relating to the processing of personal data.