GDPR & Data Processing

1. Roles

Hermes365 is operated by dotCLOUD Consulting (Schweiz) GmbH, Bahnhofstrasse 9, 8952 Schlieren ZH, Switzerland. For the email content migrated on your behalf, we act as a processor under the Swiss FADP and Art. 28 GDPR, and you remain the controller. For account, billing and security data, we are the controller.

2. Processing on Your Behalf

• Subject matter: transfer of mailbox content from your source system to your Exchange Online tenant
• Duration: for the duration of the migration you start
• Nature: in-memory pass-through; email content is never stored on Hermes365 infrastructure
• Categories of data: email messages, attachments, folder structure of the selected mailboxes

3. Technical and Organisational Measures

• Strict separation of customer workspaces (multi-tenancy)
• Encryption in transit (TLS) and at rest
• Source credentials encrypted and destroyed after cutover
• Microsoft 365 access only via OAuth 2.0 admin consent, no passwords
• Audit log of all administrative actions, including support access

4. Support Access

dotCLOUD support can only enter a workspace for a limited time, with a documented reason, visibly to the customer and with every action recorded in the audit log. Support cannot buy licenses or change access rights.

5. Sub-processors

• Microsoft Azure, Switzerland North (hosting, database, key management)
• Microsoft Entra ID, Microsoft Graph and Exchange Online (sign-in, transfer into your tenant, system emails)
• Stripe (payment processing)

6. Data Subject Requests and Incidents

We support you in answering data subject requests and notify you without undue delay if a personal data breach affects your data.

7. Contact

For a data processing agreement or questions about this statement, please contact us through our contact page.