Convenience translation. Only the German version is legally binding; in the event of any discrepancy the German text prevails.
Undertaking to maintain professional secrecy (Switzerland)
Undertaking by elunos.ai Labs UG (haftungsbeschränkt)
Annex 5 to the General Terms and Conditions (GTC) for the elunos.ai platform, edition for Professional Secrecy Holders in Switzerland
Version 2026-11 · version 1.0, published on 11.11.2026
Undertaking
by
elunos.ai Labs UG (haftungsbeschränkt)
Neue Mainzer Straße 31, 60311 Frankfurt am Main, Germany
represented by the managing directors Konstantin Leidig and Felix Reuter
(hereinafter “elunos”)
to
the company designated in the customer account upon completion of the order
(hereinafter “Customer”)
Scope and incorporation
This Undertaking is the Swiss edition of Annex 5 to the Software-as-a-Service agreement between elunos and the Customer under the General Terms and Conditions (GTC) for the elunos.ai platform (agreement hereinafter “Main Agreement”; clause references in this Undertaking refer to the GTC). It becomes part of the Main Agreement upon conclusion of the contract (receipt of the order confirmation from elunos in text form, Clause 10.4) and applies to every Customer who is a Professional Secrecy Holder in Switzerland within the meaning of Section 2 para. 2. For these Customers it replaces the Undertaking for Germany (undertaking to maintain professional secrecy under Section 203 of the German Criminal Code); where a Customer is at the same time subject to a professional secret within the meaning of Section 203 para. 1 of the German Criminal Code, both editions apply side by side.
The provisions of the GTC and of Annex 4 that refer to the status of Professional Secrecy Holder or to the application of Annex 5 (in particular Clauses 4.3, 11.3, 20.5 and 24.4 to 24.6) apply accordingly to Professional Secrecy Holders in Switzerland and to this Undertaking. The confirmation of this status, which the Customer gives when placing the order in a separate sentence that must be confirmed specifically (Clause 24.5), is not a precondition for its application; it documents the status, is logged and triggers the executed copy pursuant to Section 11a as well as the activation pursuant to Clause 24.5. Neither a separate agreement nor a signature by the Customer is required.
elunos gives this Undertaking unilaterally and signs it as issuer. The written form within the meaning of Art. 13 et seq. of the Swiss Code of Obligations (OR) is thereby observed, since the Undertaking is signed by elunos as the person bound by it (Art. 13 para. 1 OR). Pursuant to Section 11a, the Customer automatically receives an executed copy issued in its name and signed by elunos.
To the extent that the DPA or any other part of the contract makes reference to an “agreement pursuant to Annex 5” having been concluded or being applicable, the application of this Undertaking in accordance with this section is equivalent to such a conclusion.
In the event of conflicts, this Annex 5 takes precedence over the Main Agreement and Annex 4 with regard to duties of confidentiality under professional law (Clause 12.2).
The applicable version of this Undertaking, its version date and the times of the order and of the order confirmation are documented in the customer account and confirmed to the Customer in text form. Earlier versions remain available, stating their version date, at elunos.ai/de/verschwiegenheitserklaerung-schweiz.
Preamble
(A) The Customer is a Professional Secrecy Holder in Switzerland within the meaning of Section 2 para. 2; it has confirmed this when placing the order (Clause 24.5). The relevant sector module is the one designated in Section 10 below; in all other respects Section 1 para. 4 applies.
(B) elunos operates AI agents for the Customer for the automated answering and handling of incoming telephone calls (telephony channel) and of enquiries via the chat widget embedded in the Customer's website (chat channel), in each case in accordance with Annex 1. Concurrently with the Main Agreement, elunos and the Customer conclude a Data Processing Agreement (Annex 4, hereinafter “DPA”); offer, acceptance and separate confirmation are governed by Clauses 10.4 and 10.6. This Undertaking is Annex 5 to the Main Agreement and supplements the DPA.
(C) In the course of providing the services, elunos and the Further Assisting Persons engaged by elunos (subcontractors and sub-processors) may obtain knowledge of facts that are subject to the Customer's professional secrecy. In doing so, elunos acts as a service provider engaged by the Customer and as a processor within the meaning of Art. 9 of the Swiss Federal Act on Data Protection (DSG). Art. 321 of the Swiss Criminal Code (StGB) extends professional secrecy to the auxiliary persons of the secrecy holders named there; Art. 62 para. 2 DSG covers persons who have learned of secret personal data while working for a person bound to secrecy.
(D) This Undertaking serves to fulfil the Customer's obligations to select service providers carefully, to instruct them and to bind them to confidentiality, as they arise from the professional law applicable to the Customer and from Art. 9 DSG, and to safeguard the chain of undertakings. Under Art. 9 para. 1 lit. b DSG, the processing of personal data may be assigned to a processor only if no statutory or contractual duty of confidentiality prohibits the assignment; this Undertaking ensures that the Customer's professional secrecy is preserved in the same way at elunos and at the Further Assisting Persons. It supplements the data protection obligations under the DPA; duties of confidentiality under professional law go beyond data protection law and are governed here independently.
(E) This Undertaking is designed as a unilateral undertaking by elunos and is signed by elunos. Requirements under professional law, rules of professional conduct or requirements of supervisory bodies according to which the service provider must be bound to confidentiality in writing are thereby fulfilled: the obligation arises from the Undertaking signed by elunos as the person bound (Art. 13 para. 1 OR); a signature by the Customer is not required for this purpose. Customers whose professional association, supervisory body or internal compliance function requires a version signed by both sides may use the countersignature block at the end of this Undertaking.
Section 1 Subject matter and order of precedence
(1) This Undertaking governs the obligation of elunos to maintain the Customer's professional secrecy within the scope of the services provided under the DPA.
(2) It is Annex 5 to the Main Agreement and applies for the entire term of the DPA. In the event of conflicts between this Undertaking and the DPA, the provisions of this Undertaking take precedence with regard to duties of confidentiality under professional law.
(3) In all other respects, the Main Agreement and its other annexes remain unaffected.
(4) To the extent that provisions of professional law on the engagement of service providers apply to the Customer, this Undertaking is designed to satisfy their requirements, in particular with regard to the obligation in writing or in text form, the instruction on the consequences under criminal and professional law, the restriction of obtaining knowledge to what is necessary, the careful selection and instruction, and the onward obligation of downstream persons; the provisions relevant to the Customer are, where they exist, named in Section 10.
(5) To the extent that the DPA refers to provisions of the General Data Protection Regulation (GDPR), it applies to personal data subject to the DSG mutatis mutandis, observing the corresponding provisions of the DSG, in particular Art. 8 (data security), 9 (processing by processors), 16 and 17 (disclosure abroad) and 24 DSG (notification of data security breaches).
Section 2 Definitions
(1) “Professional secrecy” means facts and secrets that are subject to a statutory professional duty of confidentiality of the Customer under Swiss law and that have been confided to the Customer in the exercise of its profession or that it has observed in the exercise thereof, namely secrets within the meaning of Art. 321 StGB, secret personal data within the meaning of Art. 62 DSG, manufacturing and trade secrets of third parties within the meaning of Art. 162 StGB, and secrets protected under federal or cantonal professional law.
(2) “Professional Secrecy Holder in Switzerland” means a Customer who practises a profession to which a statutory professional duty of confidentiality within the meaning of paragraph 1 applies under Swiss law, in particular a member of a profession named in Art. 321 no. 1 StGB or a person bound to secrecy under Art. 62 DSG.
(3) “Protected Data” means all information subject to professional secrecy that becomes accessible to elunos or to Further Assisting Persons in the course of the services, in particular the content and circumstances of telephone calls and chat conversations, the identity and contact details of callers and chat users, and facts that can be derived therefrom.
(4) “Further Assisting Persons” means natural or legal persons outside elunos's own business that are engaged by elunos for the provision of the services, in particular subcontractors and sub-processors within the meaning of Art. 28 para. 4 GDPR and third parties within the meaning of Art. 9 para. 3 DSG.
(5) “Text form” means a legible declaration on a durable medium in which the person making the declaration is named, in particular an e-mail or a message in the customer account; a signature is not required. It is a form agreed within the meaning of Art. 16 OR.
(6) Statutory references with “Art.” refer to Swiss law unless stated otherwise. “StGB” means the Swiss Criminal Code of 21 December 1937, “DSG” the Federal Act on Data Protection of 25 September 2020 and “OR” the Code of Obligations of 30 March 1911. References to provisions of the GDPR are marked as such.
(7) In all other respects, the definitions of the DPA and of the GTC (Clause 14) apply.
Section 3 Involvement of elunos as assisting person
(1) The engagement of elunos as service provider and processor of the Customer and the authority to obtain knowledge of Protected Data to the extent necessary for the proper provision of the services arise from the Main Agreement and the DPA (Clause 24). elunos accepts this involvement and binds itself in accordance with this Undertaking. To the extent that elunos and the persons acting for elunos qualify as auxiliary persons within the meaning of Art. 321 no. 1 StGB or as persons within the meaning of Art. 62 para. 2 DSG, they submit to the obligations arising therefrom; in all other respects elunos binds itself contractually as if the Customer's duty of confidentiality applied to elunos directly.
(2) The involvement takes place exclusively for the purposes specified in the DPA and in the Main Agreement. elunos processes Protected Data only in the way the Customer itself would be permitted to do (Art. 9 para. 1 lit. a DSG). Any obtaining of knowledge or use going beyond this is not permitted.
Section 4 Duty of confidentiality
(1) elunos undertakes to maintain silence about all Protected Data and neither to disclose them without authorisation nor to exploit them. The obligation applies to elunos and to all persons employed by elunos and working for elunos.
(2) elunos discloses Protected Data to third parties only to the extent that the Customer has given prior consent in text form or a statutory duty of disclosure, testimony or information exists. In the case of a statutory duty, elunos informs the Customer in advance without undue delay, to the extent this is legally permissible.
(3) The obligation exists independently of the data protection obligations and applies in addition to them.
(4) elunos informs the Customer without undue delay of any unauthorised disclosure, obtaining of knowledge, alteration or destruction of Protected Data that has become known to it or is specifically imminent, as well as of any suspicion of such an occurrence, irrespective of whether there is at the same time a data security breach within the meaning of Art. 24 DSG or a personal data breach within the meaning of Art. 33 GDPR. The notification is made in text form and covers the nature, extent and time of the incident, the Protected Data affected, and the remedial measures taken and planned; elunos supports the Customer in fulfilling its own notification obligations towards the Federal Data Protection and Information Commissioner (FDPIC) and its obligations under professional law. A notification pursuant to Section 5 of the DPA is at the same time deemed to be a notification pursuant to this paragraph and a notification within the meaning of Art. 24 para. 3 DSG, to the extent that it covers the content thereof; in all other respects this obligation applies independently in addition.
(5) Protected Data are not used, either by elunos or by Further Assisting Persons, for the training, improvement or evaluation of artificial intelligence models. For Protected Data, this prohibition takes precedence over the approval exception in Clause 20.3; in all other respects Clause 20.3 remains unaffected.
(6) Before they commence their activity, elunos binds its staff who receive access to Protected Data, in writing or in text form, to maintain professional secrecy, also beyond the end of their employment or service relationship, and instructs them on the consequences of a breach pursuant to Section 9.
Section 5 Principle of necessity and restriction of access
(1) elunos restricts the obtaining of knowledge of Protected Data to what is necessary for the provision of the services (Art. 6 paras. 2 and 3 DSG).
(2) Access to Protected Data is granted only to persons who need it to perform their tasks and who are bound pursuant to Section 4 para. 6 or Section 6 of this Undertaking or pursuant to elunos's internal undertaking.
(3) elunos takes precautions to ensure that Protected Data are not stored beyond what is necessary. elunos furthermore takes technical and organisational precautions to prevent data identifying patients or data identifying clients from entering permanently stored agent configurations (system prompts, knowledge bases), since these are not covered by the zero retention mode, and points out to the Customer in the Software that such data must not be entered there.
Section 6 Onward obligation of Further Assisting Persons
(1) If elunos engages Further Assisting Persons for the provision of the services, elunos binds them, before they commence their activity, in text form and to the same extent as in this Undertaking, to maintain professional secrecy and, to the extent they process personal data, to data security and confidentiality (Art. 8 and 9 DSG, Art. 28 para. 3 lit. b and para. 4 GDPR).
(2) elunos binds Further Assisting Persons that it engages directly in accordance with paragraph 1 and requires them to impose corresponding onward obligations. In the case of providers of standardised platform services whose internal organisation is not subject to the control of elunos, elunos owes the careful selection, the contractual obligation of the provider to maintain professional secrecy, the regular review and the provision of evidence to the Customer; elunos cannot promise a particular form or a particular wording of the obligation which the provider uses vis-à-vis its own employees. For ElevenLabs, as currently the only provider of this kind through which Protected Data pass, the obligation of professional confidentiality has been contractually agreed; at the same time, the permanently activated zero retention mode (Annex 4-D Clause 5 to the DPA) ensures that no conversation content of which knowledge could be obtained is stored there. A Further Assisting Person may in turn involve further persons only if these are also bound accordingly.
(3) Chain of undertakings as at the version date: elunos GmbH, Neue Mainzer Straße 31, 60311 Frankfurt am Main, carries out the operation, set-up and support of the platform as subcontractor (Annex 4-C to the DPA). It is bound vis-à-vis elunos to maintain professional secrecy by a separate undertaking at supplier level; this obligation includes binding the personnel deployed by it in text form before they commence their activity (internal level). elunos extends this obligation to professional secrets under Swiss law. The chain of undertakings thus runs from the Customer via elunos (this Undertaking) and elunos GmbH (supplier level) to the personnel directly performing the work.
(4) In all other respects, the engagement of Further Assisting Persons is governed by the provisions of the DPA on sub-processing; the Customer's rights of approval and objection provided for therein apply accordingly and at the same time constitute prior authorisation within the meaning of Art. 9 para. 3 DSG.
(5) Upon request, elunos provides the Customer with evidence that the Further Assisting Persons have been bound.
Section 7 Technical and organisational measures
(1) elunos takes the technical and organisational measures necessary to maintain professional secrecy and to ensure data security appropriate to the risk (Art. 8 DSG); these are set out in the TOMs annex to the DPA (Annex 4-D).
(2) elunos discloses Protected Data that are subject to the DSG abroad only under the conditions of Art. 16 and 17 DSG. To the extent that Protected Data are processed in a state whose legislation does not ensure adequate protection according to the determination of the Federal Council, elunos works towards ensuring adequate protection by appropriate safeguards within the meaning of Art. 16 para. 2 DSG and complies with any requirements under professional law as to the comparability of the protection. The obligations under Art. 44 et seq. GDPR remain unaffected.
Section 8 Evidence and monitoring
(1) elunos provides evidence of compliance with the obligations under this Undertaking at the Customer's request, in particular by submitting the evidence of the obligations pursuant to Sections 4 and 6, a current overview of the Further Assisting Persons engaged, and suitable evidence of the technical and organisational measures taken. This evidence also enables the Customer to satisfy itself pursuant to Art. 9 para. 2 DSG that elunos is able to guarantee data security.
(2) The Customer's monitoring and audit rights under the DPA (Art. 28 para. 3 sentence 2 lit. h GDPR, Section 7 DPA) apply accordingly to the review of compliance with this Undertaking.
(3) elunos maintains a current overview of the Further Assisting Persons bound to professional secrecy and makes it available to the Customer upon request.
Section 9 Instruction on criminal liability and other legal consequences
(1) elunos is aware that under Art. 321 StGB the auxiliary persons of the secrecy holders named there are also liable to a custodial sentence not exceeding three years or a monetary penalty if they disclose a secret that they have observed in the course of their activity, and that criminal liability continues after the activity has ended.
(2) elunos is furthermore aware that under Art. 62 DSG any person who wilfully discloses secret personal data of which they have obtained knowledge in the exercise of a profession that requires knowledge of such data, or while working for a person bound to secrecy, is liable on complaint to a fine of up to 250,000 Swiss francs, also after the activity has ended, and that under the conditions of Art. 64 DSG a fine may also be imposed on the business undertaking.
(3) elunos is furthermore aware that under Art. 162 StGB any person who betrays a manufacturing or trade secret that they are under a statutory or contractual duty to keep, or who exploits such betrayal for themselves or another, is liable to a penalty.
(4) elunos is aware that a breach of this Undertaking may have consequences for the Customer under professional and supervisory law. The obligation to impose onward obligations on Further Assisting Persons under Section 6 exists contractually, irrespective of whether its breach is subject to criminal penalties.
Section 10 Sector-specific additional obligations
(1) The sector module whose requirements are met in the Customer's case applies; modules that are not relevant do not apply. Neither a separate agreement nor a deletion is required.
(2) Healthcare professions (medical practices and other health professions): The Customer is subject to professional secrecy under Art. 321 StGB and to the duties of confidentiality under the federal and cantonal professional and health law applicable to its profession. elunos complies accordingly with the requirements resulting therefrom. Data concerning health are sensitive personal data within the meaning of Art. 5 lit. c DSG; elunos treats them as such.
(3) Pharmacies: Data from the pharmacy context may constitute health data as soon as they permit conclusions as to the state of health by way of mental combination or deduction (on the GDPR: CJEU, Case C-21/23, Lindenapotheke). elunos treats such data as sensitive personal data within the meaning of Art. 5 lit. c DSG and as a special category of personal data within the meaning of Art. 9 GDPR.
(4) Fiduciary services and tax advice: The Customer is subject to the statutory and contractual duties of confidentiality applicable to its activity, in particular Art. 62 DSG and, to the extent it acts as an auditor, Art. 321 StGB. To the extent that professional law, rules of professional conduct or requirements of supervisory bodies impose special requirements on the engagement of third parties and on the outsourcing of data processing, elunos complies with them.
(5) Other Professional Secrecy Holders: For Customers who are subject to a professional secret under Swiss law that is not separately listed in paragraphs 2 to 4, for instance attorneys, notaries or patent attorneys, this Undertaking applies in accordance with Section 1 para. 4.
Section 11 Term and continuing effect
(1) This Undertaking applies for the term of the DPA.
(2) The duty of confidentiality continues to exist beyond the termination of the contractual relationship without limitation in time.
(3) After termination, elunos returns or deletes Protected Data in accordance with the DPA and binds Further Assisting Persons accordingly.
Section 11a Executed copy for the Customer
(1) Concurrently with the order confirmation, elunos automatically generates an executed copy of this Undertaking issued in the Customer's name as a PDF document. The executed copy states the version date of this Undertaking, the company name and address of the Customer, the date of the order, the order reference and the date of issue, and is signed by elunos.
(2) The executed copy is made available to the Customer for retrieval in the customer account and is attached to the order confirmation as an attachment in text form. It also serves the Customer as evidence vis-à-vis professional associations and supervisory bodies and for its own documentation obligations.
(3) A countersignature by the Customer is not required for this Undertaking to be effective. The countersignature block at the end of this Undertaking remains unaffected.
Section 12 Liability
The liability provisions of the Main Agreement (Clause 25) and of the DPA apply, including the separate maximum liability limit for data protection-related claims pursuant to Section 10 para. 4 of the DPA (Clause 25.5), unless mandatory Swiss law provides otherwise.
Section 13 Final provisions
(1) Amendments and supplements to this Undertaking require text form (Section 2 para. 5). This also applies to any amendment of this text form requirement.
(2) Vis-à-vis a Customer to whom this Undertaking applies, amendments become effective only with that Customer's express consent in text form; an amendment procedure with announcement and deemed consent does not apply to this Undertaking. A reissue by elunos that is exclusively more favourable to the Customer remains permissible (Clause 28.3).
(3) Should any provision be or become invalid, the validity of the remaining provisions remains unaffected.
(4) This Undertaking is governed by Swiss law, excluding the conflict of laws rules of the Federal Act on Private International Law (IPRG). In all other respects, Clause 30.1 continues to apply to the Main Agreement. Liability (Section 12) and the place of jurisdiction (Clause 30.2) are governed by the Main Agreement, unless mandatory Swiss law provides otherwise. Mandatory provisions of the professional law applicable to the Customer remain unaffected.
Signature of the issuer
Frankfurt am Main, [date of the executed copy; inserted automatically in the executed copy pursuant to Section 11a]
────────────────────────────
Konstantin Leidig, managing director, for elunos.ai Labs UG (haftungsbeschränkt)
Countersignature by the Customer (optional)
The countersignature is not required for this Undertaking to be effective (Section 11a para. 3). It is available to Customers whose professional association, supervisory body or internal compliance function requires a version signed by both sides; in that case the Customer countersigns the executed copy pursuant to Section 11a with its wording unchanged.
Place, date: ────────────────────────────
────────────────────────────
[Name], [Position], for the Customer