Data processing agreement
1. Parties and subject matter
This agreement under Art. 28 GDPR applies between the customer as controller (“controller”) and Cihan Cavusoglu Webservices, owner Cihan Cavusoglu, Ruppinstraße 9a, 15749 Mittenwalde, Germany, as processor (“processor”). It forms part of the terms and is concluded upon registration. Its subject matter is the processing of personal data that the controller enters or uploads in Kamvara. The agreement applies for as long as the processor processes such data.
2. Nature and purpose, data and data subjects
The purpose is to operate Kamvara for the controller: storing, displaying, evaluating, transmitting (e.g. as an export) and deleting its data. Data subjects are in particular employees and applicants, customers and contact persons as well as suppliers of the controller. Depending on the modules used, the data processed includes master and contact data, working hours, rosters and availability, absences including sick notes (without diagnosis – nevertheless health data under Art. 9 GDPR), payroll and bank details, contract and payment data, receipts, documents and messages.
3. Instructions
The processor processes the data only on documented instructions from the controller – the settings and actions in Kamvara and this agreement count as instructions – unless it is legally required to process them; in that case it informs the controller beforehand where permitted. If it considers an instruction unlawful, it informs the controller without delay. It does not use the data for its own purposes.
4. Confidentiality
The processor only uses persons who are bound to confidentiality. It only accesses the controller’s data where necessary for operation, security or a support request from the controller.
5. Technical and organisational measures
The processor takes measures under Art. 32 GDPR, in particular: encrypted transmission (TLS) and encrypted storage in data centres in Frankfurt am Main; strict separation of data per business through access rules in the database (row level security); private file storage separated per business; sign-in with hashed passwords at the service provider and limits on sign-in attempts; secret keys only on the server; daily backups at the database provider; processor access to administration only via a personal, protected account; ongoing updates of the software used. The measures may be developed further as long as the level of protection does not decrease.
6. Sub-processors
The controller agrees to the use of the following sub-processors: Supabase Inc. (database, sign-in and file storage; data centre in Frankfurt am Main), Vercel Inc., USA (hosting of the application; server functions in Frankfurt am Main, delivery via a worldwide network), IONOS SE, Montabaur, Germany (sending account emails). Transfers to third countries only take place on the basis of an adequacy decision (e.g. EU-US Data Privacy Framework) or EU standard contractual clauses. The processor announces new or changed sub-processors by email at least four weeks in advance; the controller can object for an important data protection reason and then terminate the contract with effect from the date of the change. The processor contractually binds sub-processors to an equivalent level of protection.
7. Assistance to the controller
The processor assists the controller with appropriate measures in responding to requests from data subjects (access, rectification, erasure, restriction, data portability – Kamvara offers editing, deletion and export for this) and with the obligations under Art. 32 to 36 GDPR. If a data subject contacts the processor directly, it forwards the request to the controller.
8. Notification of breaches
The processor informs the controller without undue delay, if possible within 24 hours of becoming aware, of a personal data breach, with the information known to it under Art. 33(3) GDPR, and supports it in notifying and investigating.
9. Deletion and return
The controller can download its data as a backup at any time and delete individual data or the entire account. When the account is deleted, all data and files of the business are removed immediately; backups at the service provider are overwritten after 7 days at the latest. After the contract ends, the processor deletes the data no later than six months after prior notice, unless there is a legal obligation to retain it.
10. Evidence and audits
On request, the processor provides the controller with the information necessary to demonstrate compliance with these obligations, in particular a current description of the measures and the evidence of the sub-processors (e.g. certifications). On-site inspections are possible after timely notice during business hours insofar as the information is not sufficient; the controller bears its own costs.
11. Final provisions
Liability is governed by Art. 82 GDPR; otherwise the provisions of the terms apply. In the event of contradictions, this agreement takes precedence over the terms insofar as the protection of personal data is concerned. The processor answers data protection questions at info@kamvara.de. The German version is authoritative.
Last updated: 10/19/2026
Back to home