ArchX

Data Processing Terms under Article 28 UK GDPR (United Kingdom)

Last updated: 12 October 2026
Annex to the ArchX Licence Terms (United Kingdom), version 2026-10-12

Parties: the customer under the Licence Terms as controller, and TYTOS GmbH, Arsenalstrasse 40, 6010 Kriens, Switzerland, UID CHE-351.360.864 (‘TYTOS’), as processor. Contact: support@frontierx.ch

How these terms apply: these terms form part of the Licence Terms. They apply once the Licence Terms are accepted, without a signature, including during the trial and for free seats; electronic form is sufficient. For the processing of personal data in support, they take precedence over the Licence Terms.

1. Subject matter and scope

1.1 Subject matter: TYTOS processes personal data only to the extent that the customer sends it to TYTOS for a support case, in particular:

  • as the text of a report with ‘Report a problem’;
  • as an attachment with ‘Report a problem’, that is, a screenshot of the app window or selected messages;
  • by email to support, with attachments;
  • in a screen share during remote help, using a video tool the customer chooses.

1.2 Not covered:

  • the project data the app passes directly to each person’s AI provider, through their ChatGPT account to OpenAI or with an API key to the provider of that key; TYTOS takes no part in this;
  • the account, licence, purchase, billing, update and error data TYTOS processes as a controller in its own right (Privacy Notice).

1.3 Legal basis: these terms govern processing on behalf of the customer under Article 28 UK GDPR. The Swiss Federal Act on Data Protection (Art. 9 FADP) also applies to TYTOS.

2. Nature, purpose and duration

  • Purpose: to understand the support case, to find and fix errors and to answer the request.
  • Nature of the processing: receiving, storing, viewing, classifying, preparing an answer, deleting.
  • Types of personal data: everything in the reports, attachments and emails of the support case, for example names, contact details and roles of clients, designers and contractors, project and site details, drawings and photographs.
  • Categories of data subjects: the customer’s staff, its clients, people involved in the project and other third parties who appear in the documents.
  • Duration: the service will delete attachments 30 days after they are forwarded to a support inbox, and in any event no later than 90 days after receipt; it will delete reports 24 months after receipt. TYTOS will delete emails to support once they are no longer needed for the support case, and in any event no later than 24 months after receipt. The customer instructs TYTOS to keep reports and emails for this long, so that follow-up questions and recurring errors can be traced; on request, TYTOS will delete them earlier (section 10).

The customer should not send special categories of personal data (Article 9 UK GDPR), for example health data. If documents contain such data, the customer should redact it beforehand where possible.

3. Instructions

3.1 Only for the support case: TYTOS processes the data only to resolve the support case and only on documented instructions from the customer, including with regard to transfers to third countries (Article 28(3)(a) UK GDPR). The report itself counts as an instruction. The customer gives further instructions by email. If the law to which TYTOS is subject requires it to process the data otherwise, TYTOS will tell the customer beforehand, unless that law prohibits this.

3.2 No purposes of its own: TYTOS does not use the data for its own purposes. In particular, it does not train AI models with the data and does not pass it on for training.

3.3 Concerns: if TYTOS considers an instruction unlawful, it will tell the customer without delay (Article 28(3), final subparagraph, UK GDPR).

4. Confidentiality

Only people at TYTOS who deal with the support case have access to the data. They are bound by a duty of confidentiality, which continues after the contract ends (Article 28(3)(b) UK GDPR). TYTOS does not record screen shares.

5. Technical and organisational measures

TYTOS will take the technical and organisational measures set out in Annex 1 (Article 28(3)(c) and Article 32 UK GDPR). It may replace measures with equivalent or better ones.

6. Sub-processors

6.1 Authorisation: the customer authorises the sub-processors listed in Annex 2 (Article 28(2) UK GDPR).

6.2 New sub-processors: TYTOS will announce a new or replaced sub-processor at least 30 days in advance by email to the admin and amend Annex 2. Within this period, the customer can object for good cause. If the parties do not agree, the customer can terminate the Licence Terms with effect from the change. If the customer does not object, the new sub-processor is deemed authorised.

6.3 Same obligations: TYTOS will impose on every sub-processor, by contract, data protection obligations that correspond to those in these terms (Article 28(4) UK GDPR).

7. Transfers outside the United Kingdom

TYTOS has its registered office in Switzerland. The United Kingdom recognises Switzerland as providing an adequate level of protection (Data Protection Act 2018, Schedule 21, paragraph 5). People at TYTOS access the data only from Switzerland, the United Kingdom, the EU or the EEA, or from countries the United Kingdom recognises as adequate. TYTOS uses sub-processors in other countries only if one of the following conditions is met:

  • the United Kingdom recognises the country as adequate; for the USA, this means the recipient is certified under the Data Privacy Framework with the UK Extension (Data Protection (Adequacy) (United States of America) Regulations 2023);
  • or the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses has been agreed.

The basis for each provider is given in Annex 2. TYTOS also observes the rules of the Swiss FADP for disclosures abroad (Art. 16 FADP).

8. Assistance

TYTOS will assist the customer as far as it can (Article 28(3)(e) and (f) UK GDPR):

  • with requests from data subjects, for example for access, rectification or erasure (Articles 12 to 22 UK GDPR);
  • with the security of processing (Article 32 UK GDPR);
  • with notifying breaches and communicating them to data subjects (Articles 33 and 34 UK GDPR);
  • with a data protection impact assessment and a prior consultation (Articles 35 and 36 UK GDPR).

If a request from a data subject reaches TYTOS directly, TYTOS will forward it to the customer without delay.

9. Personal data breach

TYTOS will notify the customer of a personal data breach without undue delay after becoming aware of it (Article 33(2) UK GDPR). It will provide the following information, as far as it is known at the time:

  • the nature and extent, where possible with the categories and approximate number of data subjects and records concerned;
  • the likely consequences;
  • the measures taken or proposed;
  • a contact point for further information.

10. Deletion and return

After the support case is closed, TYTOS will delete the data it received at the end of the periods in section 2. At the customer’s request, it will delete the data earlier or return it, and will confirm the deletion (Article 28(3)(g) UK GDPR). This does not affect statutory retention obligations.

11. Evidence and audits

TYTOS will make available to the customer the information the customer needs to demonstrate compliance with the obligations in these terms, and will allow audits by the customer or by an auditor appointed by the customer who is bound to confidentiality (Article 28(3)(h) UK GDPR). The parties will agree on-site audits with at least 30 days’ notice, at most once a year, except after a personal data breach. The customer will bear the costs.

12. Liability, duration, law

12.1 Liability: liability is governed by the Licence Terms, in particular by section 18 of those terms.

12.2 Duration: these terms apply as long as TYTOS holds data from the customer’s support cases.

12.3 Law and jurisdiction: these terms are governed by the law of England and Wales, so that they are a contract under the law of the United Kingdom as Article 28(3) UK GDPR requires. The Licence Terms, including their section 18 on liability, remain governed by Swiss law. The courts named in section 24.2 of the Licence Terms (Kriens, Switzerland) have exclusive jurisdiction, also over disputes about these terms. Mandatory provisions of the UK GDPR remain unaffected.

Annex 1: technical and organisational measures

Transmission and storage:

  • The service accepts reports only over HTTPS/TLS. Emails are encrypted as far as the mail servers involved support it.
  • The service stores reports and attachments in its database in Zurich.

Access:

  • Nothing can be read through Supabase’s public interface: every table has row-level security, with no access granted to public roles. Only the service and TYTOS’s administrator account with the provider have access.
  • An internal interface of the service delivers reports only with a secret key that only TYTOS holds. A tool or AI that reads reports through it is added only under section 6.2.
  • Only named people at TYTOS can reach the internal administration pages, with a sign-in link sent by email that is valid for 15 minutes and can be used only once.
  • The service’s secret keys for signatures, payment, email and the database are kept only in the service, never in the app.

Data minimisation:

  • Attachments only if the person reporting chooses them, after a preview, at most 2 per report; messages only selected one by one, at most 40.
  • Logs of the Codex core, conversations, project files, the specification catalogue and sign-in details are never included automatically.
  • The service’s logs contain no email addresses and no content.
  • The email confirming receipt contains only the number of the report.

Deletion: automatically, by a daily run, at the end of the periods in section 2.

Incidents: notification under section 9.

Annex 2: authorised sub-processors

  • Vercel Inc., USA: running the service that receives the reports. Functions in Frankfurt (Germany); Vercel also processes data in the USA. Basis: Vercel’s DPA and UK transfer addendum; its UK Extension certification applies to transfers covered by the UK-US data bridge. Vercel DPA.
  • Supabase Pte. Ltd., Singapore: database of the service with reports and attachments, stored in Zurich at Amazon Web Services; occasional access from other countries, for example by Supabase, Inc. (USA) for support. Basis: Schedule 2 of the Supabase DPA incorporates the UK Addendum to the standard contractual clauses for relevant onward transfers. Supabase DPA.
  • Infomaniak Network SA, Geneva: email mailbox of support. Place of storage Switzerland (adequate under UK law); no transfer to further countries.

The AI providers with which the customer uses ArchX are not sub-processors of TYTOS (section 1.2).

TYTOS uses other tools or AI services that process support data only if they are listed in this annex; it will announce new ones under section 6.2. Help Scout PBC (USA) is planned as a support inbox but not currently used. For remote help, TYTOS does not use a provider of its own; the customer chooses the video tool.