Which contracts does a startup really need?
A startup does not need as many documents as possible, but the right documents at the right time. The deciding factor is whether you are currently founding, working with co-founders, hiring your first employees, acquiring customers, commissioning external developers, or processing personal data.
For almost every startup, five groups of documents belong on the short list. First, it requires founding documents such as articles of association, public deed of incorporation, and commercial register documents. Second, it needs clear rules between the founders. Third, it needs customer contracts or general terms and conditions. Fourth, it needs employment contracts or freelancer contracts. Fifth, it needs data protection documents, in particular a privacy policy in Switzerland, if personal data is processed.
The principle is simple. Contracts for startups should not produce paper, but reduce risks. They clarify who owns what, who has to perform what, how money flows, how data is processed, and what happens when someone leaves.
What belong to the founding documents?
For a stock corporation or LLC, the founding documents are prescribed by law. They are the legal starting point of the company and not just a formality for the commercial register.
For a stock corporation, the company is established by a public deed. Therein, the founders declare to establish a stock corporation, determine the articles of association, appoint the corporate bodies, and subscribe for the shares (Art. 629 OR). The articles of association must include, among other things, the business name, registered office, purpose, share capital, number, nominal value, and types of shares, as well as the form of communications to the shareholders (Art. 626 Abs. 1 OR).
For an LLC, it works similarly. It is also established by public deed. The founders declare the establishment, determine the articles of association, appoint the corporate bodies, and subscribe for the shares (Art. 777 OR). The articles of association must include the company name, registered office, purpose, share capital, number and nominal value of the shares, as well as the form of communication (Art. 776 OR).
Depending on the legal form, additional documents are required for registration in the commercial register. For a stock corporation, the Commercial Register Ordinance requires, for example, the public deed, the articles of association, declarations of acceptance of the elected persons, if applicable, documents relating to the auditors, and proof of deposit of cash contributions (Art. 43 HRegV). For the LLC, comparable requirements apply (Art. 71 HRegV).
If you need assistance with the topic of founding, Jurata will be happy to help you at any time: Gründung mit Jurata.
Why is the commercial register entry not enough among founders?
The commercial register entry says that the company exists. But it does not regulate everything that becomes important between founders later on.
Particularly with startups, typical questions arise early. Who works how much? What happens if a founder leaves after six months? Can shares be sold freely? Is there vesting? Who decides on a financing round? How are conflicts resolved?
These questions usually do not belong completely in the articles of association, but in a shareholders' agreement for a stock corporation or in a shareholders' agreement for an LLC. Such contracts are particularly important when several founders are involved or when investors will join soon. Without clear rules, a passive co-founder can hold shares permanently, even though he hardly contributes anymore. For a young company, this can become a real problem in financing, sale, or team leadership.
When does a startup need internal terms and conditions or customer contracts?
You need general terms and conditions or customer contracts at the latest when you offer your performance not only once and individually, but repeatedly to customers. This applies in particular to SaaS products, online shops, consulting services, digital platforms, and recurring services.
Legally, a contract is concluded by matching mutual declarations of intent (Art. 1 OR). General terms and conditions therefore only make sense if they are actually incorporated into the contract. It is not enough to hide a file somewhere on the website. Customers must be able to take note of the terms and conditions before or at the conclusion of the contract.
Good general terms and conditions regulate performance, prices, payment terms, duration, termination, rights of use, liability, support, availability, and jurisdiction. However, they should not overstep. Towards consumers, the use of general terms and conditions may be unfair if they create, in a manner contrary to good faith, a significant and unjustified imbalance between rights and obligations (Art. 8 UWG).
In short: general terms and conditions are not a protective shield for everything. They are a tool to regulate recurring contractual relationships in a clear, comprehensible, and scalable manner.
What needs to be regulated with employees and freelancers?
As soon as someone works regularly for your startup, you must make a clean distinction between whether it is an employee or an external person. An individual employment contract exists when a person and an employer agree to perform work in the service of the employer and the employer pays wages for it (Art. 319 Abs. 1 OR).
Employment contracts should regulate function, workload, salary, place of work, holidays, expenses, confidentiality, secondary employment, notice periods, and rights to work results. It is particularly important that protective provisions of employment law cannot be modified at will. Certain regulations may not be deviated from at all or not to the detriment of the employee (Art. 361 OR, Art. 362 OR).
In freelancer contracts, other points are in the foreground. There, it is primarily about the scope of services, acceptance, remuneration, deadlines, confidentiality, liability, and rights of use. Especially with developers, designers, marketing agencies, or product consultants, it is crucial that the rights to the work results are clearly transferred.
In the case of employees, inventions and designs that they create in the performance of their professional activity and in fulfilment of their contractual obligations basically belong to the employer (Art. 332 Abs. 1 OR). For computer programs in employment relationships, the employer is entitled to exercise the exclusive rights of use if the program was created in the course of professional activity and in the fulfilment of contractual duties (Art. 17 URG). In the case of external persons, you should not rely on this, but expressly regulate the transfer of rights.
Why is the privacy policy in Switzerland so important?
The privacy policy in Switzerland is one of the first legal documents for many startups that becomes publicly visible. It explains which personal data you collect, why you process it, to whom you pass it on, and what rights data subjects have.
The Data Protection Act requires the controller to inform the data subject appropriately about the collection of personal data (Art. 19 Abs. 1 DSG). At least the identity and contact details of the controller, the purpose of processing, and, if applicable, the recipients or categories of recipients must be communicated (Art. 19 Abs. 2 DSG). If data are disclosed abroad, information must also be provided on the country or international body and, if applicable, on guarantees (Art. 19 Abs. 4 DSG).
The privacy policy in Switzerland must match the actual data processing. The Federal Data Protection and Information Commissioner states that privacy policies should be understandable and show which personal data are processed for which purposes and whether data are disclosed to third parties. General formulations that do not match reality do little to help. The privacy policy should also be easily accessible from every page of a website, as the EDÖB explains on its page on Datenschutzerklärungen im Internet.
For startups this is particularly relevant because even simple tools can process personal data. These include contact forms, newsletters, analytics, CRM systems, payment providers, hosting, application forms, or support tools.
Which additional data protection documents does a startup need?
The privacy policy in Switzerland is only the visible surface. Behind it, further data protection documents are often needed.
If a startup uses service providers who process personal data on behalf, a regulation on order processing is required. Processing by a data processor is permissible if the data is only processed as the startup itself would be allowed to do, and no statutory or contractual obligation of secrecy prevents this (Art. 9 Abs. 1 DSG). The startup must also ensure that the processor can guarantee data security (Art. 9 Abs. 2 DSG). Subprocessors may only be involved with prior authorization (Art. 9 Abs. 3 DSG).
Technical and organizational measures are also part of this. Controllers and processors must guarantee data security appropriate to the risk (Art. 8 Abs. 1 DSG). Furthermore, personal data must be processed lawfully, in good faith, in a proportionate manner, and for a specific purpose (Art. 6 Abs. 1 DSG, Art. 6 Abs. 2 DSG, Art. 6 Abs. 3 DSG).
A record of processing activities can also be relevant. In principle, controllers and processors keep such a record (Art. 12 Abs. 1 DSG). However, companies with fewer than 250 employees are exempt from this, unless they process sensitive personal data on a large scale or carry out profiling with high risk (Art. 24 DSV).
In what order should you create the documents?
At the beginning are the founding documents. Without articles of association, public deed of incorporation, and commercial register entry, there is no proper corporate law foundation for a stock corporation and LLC.
Immediately afterwards, the founders should regulate their internal relationship. The right time for this is not the first dispute, but the phase in which everyone is still optimistic together. This is followed by customer contracts or general terms and conditions as soon as initial revenues are planned. You need employment contracts or freelancer contracts as soon as people actively work for the startup. You should provide the privacy policy in Switzerland at the latest when your website, your product, or your sales force collects personal data.
The correct sequence is therefore not purely legal, but practical. What your startup does first externally should be properly documented first.
Frequently asked questions about contracts for startups
Does every startup need general terms and conditions immediately?
No. If you only conclude individual performance-negotiated contracts, a good individual contract can be sufficient. General terms and conditions become important as soon as you repeatedly sell standardized services, for example with SaaS, online shops, or recurring services.
Is a privacy policy mandatory in Switzerland?
A privacy policy is always practically necessary if you collect personal data and must inform affected persons about it. The duty to inform under Art. 19 DSG requires transparent details on data processing. For websites, apps, newsletters, or contact forms, a privacy policy in Switzerland is therefore regularly required.
Is one template enough for all startup contracts?
A template can be a good starting point, but does not replace customization. Contracts must fit the business model, legal form, team, customers, and data processing. Especially with IP rights, founder rules, and data protection, a standard template is often too imprecise.
What is more important: shareholders' agreement or general terms and conditions?
That depends on the phase. With several founders, the shareholders' agreement is important very early on, as it regulates the handling of shares, exit, and decision-making rights. General terms and conditions become particularly important as soon as you sell to customers in a standardized way.
