Last revised: October 29, 2026 · Draft for lawyer review
This agreement forms part of the Terms of Service between Myrax Core GmbH, Hartenfelsstrasse 17, 6030 Ebikon, Switzerland (UID CHE-282.944.227) ("Processor", "we") and the business, association, community or person that uses the Services to deal with personal data of its own customers, members or visitors ("Operator", "you", the "Controller"). It applies under the Swiss Federal Act on Data Protection (revDSG) and, where it applies, Article 28 of the EU GDPR. By using the Services as a business you accept it; a signed copy is available on request at nulllink@myraxcore.com.
We process personal data on your behalf in order to provide the Services (pages, bookings, orders, messages, agents, notifications, translation). The agreement lasts as long as you use the Services and, for deletion and return, until section 10 is completed.
| Nature of processing | Storing, displaying, transmitting, translating and analysing data as needed to run your pages and agents. |
|---|---|
| Purpose | Providing the Services to you and to your customers, as you instruct. |
| Categories of data | Contact details, messages, bookings and orders, preferences, content you or your customers enter, technical data (IP address, device) needed for security and operation. |
| Data subjects | Your customers, members, visitors, employees and contacts. |
You decide which personal data you enter. Special categories of data (for example health data) may only be entered where you have a legal basis and the Service is suitable for it.
We process the data only on your documented instructions, which are these terms, your settings and your use of the Services. If we think an instruction breaks data-protection law we tell you. Where law requires us to process the data otherwise, we tell you beforehand unless the law forbids it.
Everyone who may access the data at our side is bound to confidentiality and gets access only as needed for the Services.
We apply appropriate technical and organisational measures, including: encrypted transmission (HTTPS); encryption of sealed secrets at rest; zero-knowledge encryption of vault content, which we cannot read; role-based access and audit logging for administration; separation of live and test environments; backups; and regular testing of the platform. Details can be provided on request.
You authorise the subprocessors listed in section 8 of the Privacy Policy (hosting in Frankfurt, Germany; OpenAI; fal.ai; Stripe; the IP-address lookup service). We bind them to obligations equivalent to this agreement. We announce a new or replaced subprocessor at least 30 days before it starts processing your data (by notice on the Privacy Policy page and by e-mail to the account address); you may object on reasonable grounds within that time, and if we cannot find a solution either of us may end the affected Service.
We help you, with appropriate measures, to answer requests of data subjects (access, correction, deletion, portability, objection), to meet your security, breach-notification and impact-assessment duties, and to deal with authorities. Where a request reaches us directly, we pass it to you and do not answer it ourselves unless the law requires.
We tell you without undue delay, and in any case within 48 hours, after we become aware of a breach of security that affects your data, with the information we have to assess it and what we do about it.
Our servers are in Germany. Subprocessors outside Switzerland and the EEA are used only under the Swiss-U.S. or EU-U.S. Data Privacy Framework where the provider is certified, or under the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner and the European Commission, with additional measures where needed. These clauses form part of this agreement for such transfers.
At the end of the Services, or earlier on your request, you can export your data for at least 30 days. Afterwards we delete it, apart from backups, which expire on a rolling basis, and data we must keep by law.
We give you the information needed to show that we meet this agreement and allow reasonable audits by you or an auditor you appoint, with 30 days' notice, during business hours, under confidentiality and at your cost, not more than once a year unless there was a breach.
You are responsible for having a legal basis for the data you enter, for informing your customers about the processing, and for the content of the data. You will give us lawful instructions only.
The liability provisions of the Terms apply. Swiss law applies; the courts at our registered office in Switzerland have jurisdiction, unless mandatory law provides otherwise.