{"id":9258,"date":"2026-10-16T12:15:38","date_gmt":"2026-10-16T12:15:38","guid":{"rendered":"https:\/\/myls.ch\/sub-processors\/"},"modified":"2026-10-16T12:16:58","modified_gmt":"2026-10-16T12:16:58","slug":"sub-processors","status":"publish","type":"page","link":"https:\/\/myls.ch\/en\/sub-processors\/","title":{"rendered":"Data Processing and Sub-processors"},"content":{"rendered":"\n
\"Close-up<\/span>
\n

Data Processing<\/h1>\n<\/div><\/div>\n\n\n\n
<\/span>
\n
\n
\n

myls AG<\/p>\n\n\n\n

Data Processing and Sub-processors<\/h2>\n\n\n\n

myls AG \u00b7 Version of 1 October 2026<\/p>\n\n\n\n

This is a translation. Only the German version is legally binding.<\/strong><\/p>\n\n\n\n

This overview forms part of the GTC of myls AG (Section 12). It describes which personal data myls processes as processor on behalf of its customers, which sub-processors myls engages for this purpose and how the data is protected. Resellers may refer to this page in their contracts with end customers.<\/p>\n\n\n\n

myls informs customers of changes to the sub-processors by email at least 30 days in advance (Section 12.6 GTC). Questions on data protection: datenschutz@myls.ch<\/a>.<\/p>\n\n\n\n

1. Data processing by product<\/h2>\n\n\n\n

myls App<\/h3>\n\n\n\n
Topic<\/th>Description<\/th><\/tr><\/thead>
Subject matter and purpose<\/td>Management and synchronisation of location and company data, publication on third-party platforms, review and social media management including AI-assisted text suggestions, analyses<\/td><\/tr>
Personal data<\/td>Names and contact details of contact persons and employees in listings, reviews including the name or profile of the reviewer, social media posts, comments and interactions, user accounts and log data<\/td><\/tr>
Data subjects<\/td>Customer and its employees, persons who submit reviews or comments<\/td><\/tr>
Duration<\/td>Term of the contract, thereafter deletion in accordance with Section 12.12 GTC<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

myls Chatbot<\/h3>\n\n\n\n
Topic<\/th>Description<\/th><\/tr><\/thead>
Subject matter and purpose<\/td>Automated answering of enquiries from website visitors by means of AI, capture of contact, quotation, reservation and booking requests (flows), forwarding to the customer’s systems via interfaces, analysis of the conversations for the customer<\/td><\/tr>
Personal data<\/td>Content of chat messages, voluntarily provided contact details (e.g. name, email, telephone), concerns, booking and reservation details, technical data (e.g. IP address, timestamp, browser)<\/td><\/tr>
Data subjects<\/td>Visitors to the customer’s website who use the chatbot<\/td><\/tr>
Duration<\/td>Chat histories are stored for a maximum of 12 months and can be viewed by the customer in the analysis view during this period. They are then deleted automatically, at the latest at the end of the contract in accordance with Section 12.12 GTC<\/td><\/tr>
AI processing<\/td>Messages are processed via the API of an AI provider (see section 2). Inputs are not used to train AI models.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Websites and website service<\/h3>\n\n\n\n
Topic<\/th>Description<\/th><\/tr><\/thead>
Subject matter and purpose<\/td>Creation, hosting, technical operation, updates and data backup of websites, email mailboxes, contact forms and booking functions<\/td><\/tr>
Personal data<\/td>Server log files (e.g. IP address, time, pages accessed), form and booking data, content of email mailboxes, website user accounts<\/td><\/tr>
Data subjects<\/td>Visitors to the website, persons who communicate with the customer by form or email, the customer’s employees<\/td><\/tr>
Duration<\/td>Term of the contract, server log files for a maximum of 30 days, thereafter deletion in accordance with Section 12.12 GTC<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Across all products: support and customer service<\/h3>\n\n\n\n

Where customers transmit personal data in the course of support (e.g. screenshots, forwarded enquiries), myls processes such data in its ticket and customer system solely for the purpose of handling the request.<\/p>\n\n\n\n

2. Sub-processors<\/h2>\n\n\n\n
Provider<\/th>Registered office<\/th>Purpose \/ product<\/th>Place of processing<\/th>Safeguards<\/th><\/tr><\/thead>
Google Cloud EMEA Ltd. (Google Cloud)<\/td>Dublin, Ireland<\/td>Hosting and databases for myls App, myls Chatbot and websites, email<\/td>myls App: Switzerland (Zurich); myls Chatbot, websites and email: Belgium<\/td>Switzerland\/EU, adequate level of data protection; any access by Google LLC (USA): DPF and standard contractual clauses<\/td><\/tr>
SiteGround Spain S.L. (SiteGround)<\/td>Madrid, Spain<\/td>Hosting of individual websites (being phased out and replaced)<\/td>Germany (Frankfurt)<\/td>EU, adequate level of data protection<\/td><\/tr>
OpenAI Ireland Ltd.<\/td>Dublin, Ireland<\/td>AI processing for myls Chatbot and myls App (API) as well as support and internal analyses (ChatGPT Business)<\/td>EU \/ USA<\/td>Standard contractual clauses (OpenAI Data Processing Addendum); no use for training; storage for abuse monitoring generally for a maximum of 30 days, subject to legal obligations; stored content (e.g. knowledge bases) until deleted by myls<\/td><\/tr>
BunnyWay d.o.o. (Bunny CDN)<\/td>Ljubljana, Slovenia<\/td>Content delivery (Content Delivery Network)<\/td>Storage in the EU; delivery via locations worldwide<\/td>EU, adequate level of data protection; for locations outside Switzerland and the EU: standard contractual clauses<\/td><\/tr>
Cloudinary Ltd. \/ Cloudinary Inc.<\/td>Israel \/ USA<\/td>Storage and delivery of images (myls App, websites)<\/td>USA<\/td>Cloudinary Inc.: DPF-certified; additionally standard contractual clauses; Israel: adequate level of data protection<\/td><\/tr>
Zoho Corporation B.V.<\/td>Utrecht, Netherlands<\/td>Customer management, support tickets, invoicing (all products)<\/td>EU data centre; support access from India possible<\/td>Standard contractual clauses<\/td><\/tr>
Google Workspace (Google Cloud EMEA Ltd.)<\/td>Dublin, Ireland<\/td>Email and documents of myls (all products)<\/td>EU \/ USA<\/td>DPF and standard contractual clauses<\/td><\/tr>
Anthropic Ireland, Limited (Claude)<\/td>Dublin, Ireland<\/td>AI-assisted software development, support and analyses (all products)<\/td>USA \/ EU<\/td>Standard contractual clauses (Anthropic Data Processing Addendum); no use for training<\/td><\/tr>
DeepL SE<\/td>Cologne, Germany<\/td>Translation of content (websites, myls App)<\/td>EU<\/td>EU, adequate level of data protection; texts are deleted after translation (DeepL Pro)<\/td><\/tr>
Freelance software developers<\/td>Pakistan<\/td>Development, maintenance and support of the myls App (remote access)<\/td>Pakistan<\/td>Standard contractual clauses<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Third-party platforms to which content is transmitted on the customer’s instructions (e.g. Google Business Profile, Apple, Bing, Meta, directories) are not sub-processors of myls. They process the data under their own responsibility (Section 6.1.2 GTC).<\/p>\n\n\n\n

3. Technical and organisational measures (overview)<\/h2>\n\n\n\n
    \n
  • Encryption:<\/strong> transmission exclusively in encrypted form (TLS), encryption of stored data and data backups (\u2018at rest\u2019)<\/li>\n\n\n\n
  • Access control:<\/strong> access only for authorised employees and agents, two-factor authentication for the central administrative access points (e.g. cloud and server administration)<\/li>\n\n\n\n
  • Hosting:<\/strong> data centres of the providers named above with recognised security certifications (e.g. ISO 27001)<\/li>\n\n\n\n
  • Availability:<\/strong> daily data backups with a retention period of 14 days, security and system updates<\/li>\n\n\n\n
  • Organisation:<\/strong> confidentiality undertaking by all employees and agents, contractual obligation of the sub-processors, deletion concept after the end of the contract<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div><\/div>\n\n\n\n
    <\/span>
    \n
    \n

    Time for your website to be found on Google!<\/h2>\n\n\n\n