Data Processing Agreement

This Data Processing Agreement ("DPA") supplements the Terms of Service ("Agreement") between you (the "Customer", acting as controller) and Yasin Mustafa Yilmaz, trading as Yilmaz - Einzelunternehmen, Inh. Yilmaz, Yasin ("noryas", the "Processor"), whenever noryas processes personal data on the Customer’s behalf as part of providing the Service. This DPA is incorporated by reference into, and forms part of, the Agreement. If your organization requires a separately countersigned copy, contact support@noryas.com.

Subject matter: the processing of personal data that the Customer inputs into, or generates through use of, the noryas application (procedures, object records, free-text notes such as "Besonderheiten", checklist/completion records, and any associated images or files), for the purpose of noryas providing the Service to the Customer. Duration: for as long as the Agreement is in effect, plus any period noryas retains data afterward as described in §7 (Deletion and return of data) below.

Nature and purpose: hosting, storage, display, and transmission of Customer content in order to operate the procedure-documentation and execution-tracking features of the Service, including the no-login public QR-code access described in the Privacy Policy §3.

Categories of data subjects: the Customer’s own personnel (e.g. an account holder’s first name), and any third parties the Customer chooses to name in content it creates — for example a site contact referenced in an object’s "Besonderheiten" field, or a colleague named in a procedure note.

Categories of personal data: names, contact details, and any other personal data the Customer chooses to include in procedures, notes, or uploaded images/files; completion metadata (timestamps, which account completed a procedure run, if signed in); and, for anonymous QR scans, a random per-device identifier that is not itself linked to a name or contact detail (see Privacy Policy §2). No special categories of data (Art. 9 GDPR) are intentionally collected by the Service, and the Customer should not enter special-category data into noryas.

noryas processes personal data only on the Customer’s documented instructions, which consist of: (a) the Agreement and this DPA, and (b) the Customer’s own configuration and use of the Service’s features (e.g. what content it creates, what it exposes via a public QR page, and any support requests it sends us). noryas will inform the Customer if, in its view, an instruction infringes the GDPR or other applicable data protection law.

• Ensure that anyone authorized to process the data (i.e. noryas’s operator) is bound by confidentiality.
• Implement appropriate technical and organizational measures under Art. 32 GDPR, including: Row-Level Security policies scoping data access to the Customer’s own workspace; hashed (never plaintext) password storage; private storage buckets for uploaded files/images, accessed only via short-lived signed URLs; and encryption in transit (HTTPS/TLS) — see Privacy Policy §9 for the current state of these measures.
• Taking into account the nature of the processing, assist the Customer by appropriate technical and organizational measures, insofar as reasonably possible, with fulfilling data subject requests under Chapter III GDPR that the Customer cannot fulfill using the Service’s own self-service features (e.g. Settings → Delete Account).
• Assist the Customer in ensuring compliance with its Art. 32–36 GDPR obligations, taking into account the information available to noryas, including notifying the Customer without undue delay after becoming aware of a personal data breach affecting the Customer’s data.
• At the Customer’s choice, delete or return all personal data to the Customer after the end of the provision of Service-related processing, and delete existing copies, subject to §7 below.
• Make available to the Customer the information reasonably necessary to demonstrate compliance with this Article and Art. 28 GDPR, and allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer — subject to reasonable advance notice, confidentiality of other customers’ data, and no more than once per 12 months absent a specific reason (e.g. a suspected breach).

The Customer authorizes noryas to engage the sub-processors currently listed in the Privacy Policy §5 (Supabase, Vercel, Resend, Zoho, Paddle, and Geoapify, as of this DPA’s last update date above), which is the authoritative, current list — this is a general authorization, not a case-by-case one. Every sub-processor is bound by data protection obligations consistent with this DPA. Where a sub-processor is located outside the EU/EEA, transfers rely on Standard Contractual Clauses or another valid GDPR transfer mechanism, as stated in the Privacy Policy.

If noryas intends to add or replace a sub-processor, it will update the Privacy Policy (which bumps its stated version date and, for existing accounts, triggers a re-consent prompt on next sign-in) and, on request, notify the Customer directly at the email address on file. The Customer may object on reasonable data-protection grounds within 14 days of that change by contacting support@noryas.com; if the objection can’t be resolved, either party may terminate the affected part of the Service.

Deleting the Customer’s account from Settings permanently removes its workspace, procedures, executions, and uploaded files from noryas’s systems — this is immediate and, since the underlying hosted database currently runs without automated backups, there is no residual backup copy to separately purge. The Customer can request an export of its content before deletion — see Terms of Service §7. The one exception is billing/invoice records, which noryas or Paddle (as merchant of record) retain for up to 10 years after the relevant calendar year, as required under German tax and commercial law (§ 147 AO, § 257 HGB), even after account deletion.

Liability arising under this DPA is subject to the limitations set out in the Agreement’s Terms of Service, §11 (Limitation of liability).

In the event of a conflict between this DPA and the Terms of Service on a matter of data protection, this DPA prevails. On all other matters, the Terms of Service prevail.

Questions about this DPA, or to request a countersigned copy: support@noryas.com