Sub-processor List

This list shows the service providers through which Nivorbit has personal data processed while providing Vardify. The sub-processors in section 1 process Business Data (data about the Subscriber's employees) and are subject to §5 of the Data Processing Agreement. Those in section 2 process only the account and contact data for which Nivorbit is the controller; that data is described in the Privacy Policy.

When this list changes, Subscribers are notified at least 30 days before the change takes effect (Data Processing Agreement §5.3).

1. Sub-processors processing Business Data

• Hetzner Online GmbH — Service: Server, database and backup hosting · Data processed: All Business Data and account data · Location: EU, Falkenstein (Germany) · Transfer mechanism: None (within the EU)
• Hetzner Online GmbH (Object Storage) — Service: Storage of documents, photos and encrypted backup copies · Data processed: Personnel documents, attached sick notes and photos, profile photos, encrypted database backups · Location: EU, Falkenstein (Germany) · Transfer mechanism: None (within the EU)
• Google Ireland Ltd. / Google LLC (Firebase Cloud Messaging) — Service: Mobile notification delivery · Data processed: Device notification token, notification title and text · Location: EU / USA · Transfer mechanism: Standard Contractual Clauses; EU-US Data Privacy Framework while certified
• Resend — Service: Sending notification and transactional email · Data processed: Recipient's name and email address, email content · Location: Headquartered in the USA; sending infrastructure in the EU (Ireland) · Transfer mechanism: Standard Contractual Clauses (art. 46(2)(c))
• Functional Software, Inc. (Sentry) — Service: Error tracking for the server, web panel, kiosk and mobile app · Data processed: Error type and stack trace, app and device version, page transitions and request addresses immediately before the error; names, email addresses and IP addresses are not sent · Location: Headquartered in the USA; data kept in the EU (Germany) · Transfer mechanism: Standard Contractual Clauses; EU-US Data Privacy Framework while certified
• Google Ireland Ltd. / Google LLC (Google Analytics for Firebase) — Service: Usage measurement in the mobile app, only if the user allowed it in the app · Data processed: Screens viewed, names of completed actions, the account's opaque identifier, role and business identifier, device and app version; the advertising identifier is not read · Location: EU / USA · Transfer mechanism: Standard Contractual Clauses; EU-US Data Privacy Framework while certified
• Nivorbit Teknoloji Limited Şirketi (Nivorbit, Türkiye) — Service: Operation and support of the Service by the processor's own staff · Data processed: What a support case requires · Location: Türkiye · Transfer mechanism: Standard Contractual Clauses, module two

A note about notification content. The title and text of a notification pass through Google's infrastructure and may contain personal data such as an employee's name or a shift time. Notifications can be turned off in the app settings; once they are off, no data enters this channel.

2. Service providers processing account and contact data

• Google Ireland Ltd. / Google LLC (Google Maps Platform, Places API) — Service: Searching for the business name while setting up a business or branch (the request is sent from Vardify's server) · Data processed: Search text, session token, language and country code; if the location permission was granted, the device's location to order the results · Location: USA · Transfer mechanism: Standard Contractual Clauses; EU-US Data Privacy Framework while certified
• Google Ireland Ltd. / Google LLC (Google Analytics) — Service: Usage measurement in the web panel and on the website, only if analytics cookies were allowed · Data processed: Pages viewed, names of completed actions, the account's opaque identifier, role and business identifier, truncated IP address, browser information · Location: EU / USA · Transfer mechanism: Standard Contractual Clauses; EU-US Data Privacy Framework while certified
• Cloudflare, Inc. — Service: Domain name service (DNS) for vardify.com and forwarding of email sent to @vardify.com addresses · Data processed: The sender address and content of email sent to us · Location: USA · Transfer mechanism: Standard Contractual Clauses; EU-US Data Privacy Framework while certified

Cloudflare provides only DNS and email forwarding; web panel, mobile app and API traffic does not pass through Cloudflare.

3. Parties that are not sub-processors

The following are not sub-processors of Nivorbit. For the service they provide they are independent controllers; Nivorbit is not responsible for their processing, and their own privacy policies apply to you.

• Google and Apple — Role: Identity provider (signing in to Vardify) · Why it is not a sub-processor: They verify your identity through your own account; only verified identity information is returned to Nivorbit.
• Paddle.com Market Ltd — Role: Online reseller and Merchant of Record for subscription orders · Why it is not a sub-processor: Paddle sells in its own name and processes the payment and billing data as a controller in its own right; it has no access to Business Data.
• Meta Platforms Ireland Ltd. — Role: Advertising measurement (Meta Pixel), only if marketing cookies were allowed · Why it is not a sub-processor: It processes pixel data under its own terms; it has no access to Business Data.
• Google (Google Maps), OpenStreetMap Foundation (map images), komoot GmbH (Photon address search) — Role: Map display and address search in the web panel · Why it is not a sub-processor: Your browser connects to these services directly; they receive your IP address and your map or search request under their own terms.
• Accountant, auditor, legal counsel — Role: Nivorbit's own obligations · Why it is not a sub-processor: They relate to Nivorbit's account data; they have no access to Business Data.

4. Technologies used and not used

The following are deliberately not used:

• Biometric data and facial recognition: special category data under art. 9; clock-in verification uses device binding, location at the moment of clock-in, the branch Wi-Fi network, a QR code or NFC tag, and anomaly signals.
• Background and continuous location tracking: location is taken only while the app is open and during the related action.
• Advertising identifier and cross-app tracking: the mobile app shows no advertising and does not read the Android Advertising ID or Apple IDFA.
• Session replay and screenshots: error tracking and usage measurement take no screen recordings or screenshots.
• Personalised advertising: advertising features and Google signals are off in Google Analytics.

The following are used and described above:

• Usage measurement in the mobile app: with Google Analytics for Firebase; turned on only if the user allowed it when the app asked or in its settings; names, email addresses and free text are not sent.
• Analytics and marketing cookies in the web panel and on the website: Google Analytics and the Meta Pixel; loaded only with consent. Details: Cookie Policy.