Your content,
processed on your behalf.

This Agreement is concluded between:

• the User who creates an Erabox account and adds content to it (hereinafter the “User” or “Owner”), as controller of the capsule contents and the Beneficiaries’ data;
• Erabox SA, Via delle Fornaci, 6 — 6826 Riva San Vitale (TI), Switzerland (hereinafter “Erabox”), as processor.

Whereas:

1. the User uses the Erabox service, governed by the Terms and Conditions of Use (hereinafter the “Terms”), to keep content in capsules and deliver it to the Beneficiaries they choose when the events they select occur, including after their death;
2. in providing the Erabox service, Erabox processes the capsule contents and the Beneficiaries’ data on the User’s behalf. The processing that Erabox carries out for its own purposes, as controller (account, payments, security, verification of the event that starts the delivery, Guardians’ data, identity verification and electronic signature), is described in the Privacy Policy and falls outside this Agreement;
3. when the User adds content for purely personal or household purposes, the processing they carry out falls within the exemption in Art. 2(2)(c) of Regulation (EU) 2016/679 (hereinafter the “GDPR”) and Art. 2(2)(a) of the Swiss Federal Act on Data Protection (hereinafter the “FADP”). In that case, this Agreement applies as the contractual framework for the service, and Erabox undertakes to comply with its clauses in any event.

1.1 The recitals form an integral and essential part of this Agreement.

1.2 By accepting this Agreement, the User appoints Erabox as processor within the meaning of Art. 28 GDPR and Art. 9 FADP for the processing described in Art. 2, and Erabox accepts the appointment.

1.3 This Agreement supplements the Terms. If the two documents conflict, this Agreement prevails as regards the processing of personal data.

3.1 The following constitute the User’s documented instructions within the meaning of Art. 28(3)(a) GDPR: (i) the settings of each capsule (content, Beneficiaries, delivery event, date, period of inactivity, how the Beneficiary is informed); (ii) the Terms; (iii) this Agreement. The User can change the instructions in the app until delivery.

3.2 Erabox processes the data only on the User’s documented instructions, unless required to do so by EU, Member State or Swiss law; in that case, it informs the User of that legal requirement before processing, unless the law prohibits this.

3.3 Erabox immediately informs the User if, in its opinion, an instruction infringes the GDPR, the FADP or other data protection provisions.

3.4 Instructions to be carried out after the User’s death. The delivery instructions remain effective after the User’s death. Because of the nature of the mandate, which consists in delivering the content precisely when the death occurs, the mandate does not end with the death of the principal (Art. 405(1) of the Swiss Code of Obligations). Erabox carries out the instructions until delivery, within the retention periods in Art. 10, and does not change them at the request of third parties, except by order of an authority or where required by law.

3.5 Erabox does not use the capsule contents or the Beneficiaries’ data for its own purposes, nor to train artificial intelligence models.

4.1 It is for the User, as controller, to decide whether and when the Beneficiary is informed of their designation. For each Beneficiary, the User chooses between the two modes offered in the app.

4.2 Notice mode. The User instructs Erabox to send the Beneficiary, on the User’s behalf and within one month of the designation, the privacy notice about the processing of their data. The notice does not reveal the content of the capsule.

4.3 Confidential mode. The User instructs Erabox to provide the privacy notice to the Beneficiary at the time of delivery, together with the content. The User chooses this mode when informing the Beneficiary in advance would undermine the purpose of the delivery, and is responsible for that choice as controller.

4.4 In both modes, Erabox keeps published, and available without an account, the privacy notice for third parties, which describes the processing of the data of Beneficiaries and of the people who appear in the content.

4.5 Guardians are chosen by the User, but their data is processed by Erabox as controller, to verify the event that starts the delivery: this processing is not governed by this Agreement, and Erabox informs Guardians directly with the invitation, which contains the link to the privacy notice for third parties.

5.1 Erabox ensures that the persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR).

5.2 Erabox adopts the technical and organisational measures required by Art. 32 GDPR and Art. 8 FADP, with the minimum requirements of Arts. 1–5 of the Data Protection Ordinance (DPO), including: encryption of content at rest with AES-256 and in transit with TLS 1.3; staff access to systems restricted to authorised persons, for maintenance, security and support; logging of data operations and access, with logs kept for 12 months separately from production systems (Art. 4 DPO); two-factor authentication available to the User.

5.3 Health data in advance healthcare directive capsules is stored in Switzerland or the European Union.

6.1 The User gives Erabox general authorisation to engage sub-processors (Art. 28(2) GDPR; Art. 9(3) FADP). Those that process capsule contents or Beneficiaries’ data at the date of this Agreement are listed in Annex 1; the full list of Erabox’s providers is in section 05 of the Privacy Policy.

6.2 Erabox informs the User, by email or by a notice in the app, of the addition or replacement of a sub-processor at least 30 days before it starts processing the data. Within the same period, the User may object on legitimate grounds and, if the objection is not upheld, terminate without penalty and with a refund of the unused portion of the subscription.

6.3 Erabox imposes on each sub-processor, by written contract, data protection obligations equivalent to those in this Agreement, and remains liable to the User for the performance of those obligations (Art. 28(4) GDPR).

7.1 Erabox transfers data to third countries only under the conditions of Chapter V of the GDPR and Arts. 16 and 17 FADP: to the United States, under the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795) and the Swiss-U.S. Data Privacy Framework (Annex 1 DPO); in other cases, by means of standard contractual clauses (Implementing Decision (EU) 2021/914) or model clauses recognised by the FDPIC. Between Switzerland and the European Union, data flows on the basis of Decision 2000/518/EC and Art. 16(1) FADP.

8.1 Erabox assists the User with appropriate technical and organisational measures, insofar as this is possible, in responding to requests to exercise data subjects’ rights (Arts. 15–22 GDPR; Arts. 25–32 FADP). The app allows the User to view, edit, export and delete the content and the Beneficiaries’ data.

8.2 If a data subject contacts Erabox about data that Erabox processes on the User’s behalf, Erabox forwards the request to the User within 5 working days and assists them in responding. If the User has died, or does not respond within 15 days, Erabox examines the request directly and acts on it within the limits of the law and of the instructions received.

8.3 This is without prejudice to notices of illegal content under Art. 16 of Regulation (EU) 2022/2065, which Erabox examines in accordance with the Terms, informing the User of the measures taken.

8.4 Taking into account the nature of the processing and the information available to it, Erabox assists the User in ensuring compliance with the obligations under Arts. 32–36 GDPR.

9.1 Erabox informs the User without undue delay after becoming aware of a personal data breach affecting capsule contents or Beneficiaries’ data (Art. 33(2) GDPR; Art. 24(3) FADP), describing the nature of the breach, the categories of data and data subjects concerned, the likely consequences and the measures taken or proposed.

9.2 This is without prejudice to Erabox’s obligation to notify breaches affecting the processing for which it is controller, in accordance with the Privacy Policy.

10.1 This Agreement lasts for the duration of the relationship governed by the Terms and continues, after the User’s death, until the delivery instructions have been carried out.

10.2 Before the relationship ends, the User can export their content from the app (Profile → Privacy → Export my data). When the processing ends, Erabox deletes the data according to the following periods, unless the law requires it to be kept:

• subscription expired and not renewed: 30-day grace period, then the account is suspended in read-only mode for 12 months, then permanent deletion;
• the User’s death reported or confirmed by the Guardian: capsules that are already scheduled are not deleted because of non-renewal and remain until delivery, up to a maximum of 10 years;
• delivered content: available for the 30 days for which the delivery link is valid, then deleted within 30 days;
• account deleted by the User: deletion after 30 days.

11.1 On written request to privacy@erabox.ch, Erabox makes available to the User the information needed to demonstrate compliance with the obligations under Art. 28 GDPR, including through documentation of security measures, certifications or third-party audit reports.

11.2 Given the nature of the service, which is offered in a standardised form to a large number of users, inspections at Erabox are agreed in terms of timing and method, with reasonable notice, at the User’s expense and with due respect for the confidentiality of other users’ data.

12.1 The User is responsible for the lawfulness of the content they add and of the choices they make as controller, including the choice of how the Beneficiary is informed. Erabox is responsible for fulfilling the obligations that this Agreement and the law place on the processor (Art. 82(2) GDPR).

12.2 The limitations of liability in the Terms do not apply in cases of intent or gross negligence on the part of Erabox and do not affect the rights that the law grants the User as a consumer.

12.3 Erabox keeps a record of the categories of processing activities carried out on behalf of controllers (Art. 30(2) GDPR; Art. 12 FADP).

13.1 Erabox may change this Agreement in the manner and with the notice provided for in the Terms. Changes may not reduce the guarantees of Art. 28(3) GDPR.

13.2 This Agreement is governed by Swiss law, without prejudice to the application of the GDPR and the FADP to the processing and to the mandatory consumer protection rules of the User’s country of residence. The competent court is the one indicated in the Terms.

13.3 The User accepts this Agreement by ticking a dedicated box when creating their account. Acceptance is recorded with the date, time and version of the text. Without acceptance, the storage and delivery service cannot be provided.