Data Processing Agreement (DPA)

This agreement is the contract required by GDPR art. 28(3) between the Subscriber as controller and Nivorbit as processor.

1. Parties and their roles

• Controller — The Subscriber (employer). They decide why and how their employees' personal data is processed.
• Processor — Nivorbit Teknoloji Limited Şirketi ("Nivorbit"). Processes only on the Subscriber's documented instructions and only to provide the Service.

Account data that Nivorbit processes in its own capacity as controller falls outside this agreement; the Privacy Policy governs it.

2. Subject matter, duration, nature and purpose

• Subject matter: Processing of personal data concerning the Subscriber's employees through Vardify.
• Duration: The subscription term and until the destruction process in clause 8 is complete.
• Nature and purpose: Shift planning, availability collection, clock-in/out records, leave and swap approvals, labour cost reporting, tip distribution, payroll preparation output, personnel file storage and — where the Subscriber has enabled it — aggregated reporting to a franchise network.

2.1 Categories of data

Identity and contact details; employment information (job, pay, contract type, length of service); working records (shifts, clock-ins, leave, absence); personnel documents; bank account (IBAN); a location read at the moment of a clock-in (consent-based); device identity and anomaly signals; notification token; special category data under art. 9 (health data such as blood type and disability degree, trade-union membership) — only where the Subscriber has a lawful basis under art. 9(2), which the product records as explicit consent; the names and identity numbers of employees' dependants.

2.2 Categories of data subject

The Subscriber's employees, former employees and — to a limited extent — employees' dependants.

3. Nivorbit's obligations (art. 28(3))

1. Processes only on documented instructions, including with regard to transfers to a third country, unless required to do so by Union or Member State law to which it is subject; in that case it informs the Subscriber before processing, unless the law prohibits it. It does not process personal data for its own purposes. Only measurements aggregated so that neither a person nor a business is identifiable are used to improve the product.
2. If it considers an instruction infringes the GDPR, it informs the Subscriber immediately.
3. It ensures that persons authorised to process the data have committed themselves to confidentiality and limits access to what the role requires.
4. It applies the technical and organisational measures in clause 4 (art. 32).
5. It engages sub-processors under the rules in clause 5 (art. 28(2) and (4)).
6. It assists the Subscriber, taking into account the nature of the processing, with responding to data subject requests (chapter III) and with the Subscriber's obligations under art. 32 to 36.
7. It notifies breaches in accordance with clause 7.
8. At the end of the services it deletes or returns the data as clause 8 provides.
9. It makes available the information necessary to demonstrate compliance and allows for and contributes to audits as clause 9 provides.

4. Technical and organisational measures

These measures are built into the product; this is not marketing copy:

• Tenant isolation — PostgreSQL row-level security (RLS) plus a tenant context on every request. One tenant's query cannot see another's rows at database level.
• Encryption in transit — All client–server and server–sub-processor traffic over TLS.
• Encryption at rest — Database and backups encrypted at disk level.
• Column-level encryption — Special category data under art. 9 and dependants' identity numbers are additionally encrypted in the database.
• Role-based access — Pay and identity fields are masked by role; a branch manager cannot see pay.
• Explicit-consent gate — Special category data is not written at all without a live explicit consent record; withdrawing consent clears the fields.
• Audit log — Access to and changes in personal data are written to an audit log; for special category fields only a "changed" flag is kept.
• Document access — Personnel documents are held in object storage and downloaded only through a short-lived (5-minute) signed link.
• Data minimisation — Location is read only at the moment of the scan and only with consent — there is no continuous tracking. No biometrics and no facial recognition.
• Anti-fraud — Device binding and anomaly signals; not biometric verification.
• Erasure — Anonymisation: deletes the employment link, scrubs the person's profile if they work for no other employer, and destroys documents whose retention period has expired.

5. Sub-processors

1. The Subscriber gives general written authorisation (art. 28(2)) for Nivorbit to use sub-processors. Current list: Sub-processor List.
2. Nivorbit imposes on each sub-processor, by contract, the same data-protection obligations as in this agreement (art. 28(4)) and remains fully liable to the Subscriber for the performance of that sub-processor's obligations.
3. Adding or replacing a sub-processor is notified at least 30 days in advance. If the Subscriber objects on reasonable grounds within that period, the parties seek a solution; failing one, the Subscriber may terminate without penalty.

6. Transfers to third countries

Vardify's servers are hosted in the European Union (Falkenstein, Germany). Two transfers outside the Union nevertheless take place:

1. Nivorbit's own access from Türkiye to operate and support the Service. No adequacy decision exists for Türkiye; the transfer is made under the European Commission's Standard Contractual Clauses (module two, controller to processor; Decision (EU) 2021/914), which the parties incorporate into this agreement by reference, with the supplementary measures in clause 4.
2. Mobile notification delivery through Google LLC (USA), under the SCCs (module three, processor to processor) and, while Google LLC is certified, the EU-US Data Privacy Framework.
3. No transfer rests on the employees' consent, and the Subscriber need not obtain any: a continuous hosting arrangement is not an occasional transfer within art. 49.
4. Encryption (TLS + disk + column) is a security measure, not the transfer mechanism. The two are provided separately.

7. Breach notification

1. Nivorbit informs the Subscriber without undue delay, and within 24 hours at the latest, of becoming aware of a personal data breach (art. 33(2)).
2. The notification covers the nature of the breach, the categories of data and approximate number of people affected, its likely consequences and the measures taken or to be taken.
3. The obligation to notify the supervisory authority within 72 hours (art. 33) and the data subjects (art. 34) rests with the controller, that is, the Subscriber. Nivorbit supplies the information and support needed for that notification.

8. End of the agreement: return and destruction

1. When the subscription ends, a 30-day window opens in which the Subscriber can export its data; export is done from the panel and is free of charge.
2. At the end of that period personal data is deleted or anonymised; removal from backups completes at the end of the backup cycle.
3. The only exception is records that Union or Member State law requires to be retained. Those are kept only for the relevant statutory period and only for the purpose of retention; they are not processed for any other purpose during that time.
4. An erasure request does not destroy personnel documents whose statutory retention period has not expired (art. 17(3)(b)). In that case the employee row is anonymised; what remains is paperwork the system can no longer attribute to anyone.

9. Audit

1. Nivorbit provides the Subscriber with the information needed to demonstrate compliance with art. 28.
2. Once a year, on at least 30 days' notice, during working hours and without disrupting the Service, the Subscriber may audit or have an independent auditor audit. The Subscriber bears the cost; if the audit finds a non-compliance, the cost passes to Nivorbit.
3. Nivorbit may satisfy the audit obligation by providing an independent audit report.

10. Franchise network sharing — whose decision it is

When the Subscriber enables the franchise network feature, it decides which fields are shared with the network centre and the Subscriber is the controller for that sharing; Nivorbit merely performs the transfer. Employee names, pay, hourly costs, identity and social security numbers, per-person working hours and location records are never sent to the network centre at any sharing level.

11. Liability

Liability under this agreement is subject to the limits in clause 9 of the Terms of Use. However, liability towards data subjects and supervisory authorities under art. 82 remains as the GDPR allocates it between controller and processor and cannot be narrowed by contract.

12. Conflict

If this agreement conflicts with the Terms of Use or the Privacy Policy, this agreement prevails on matters concerning the processing of personal data. If it conflicts with the Standard Contractual Clauses, the Clauses prevail.