Data Processing Agreement

This Data Processing Agreement (“DPA”) is concluded between the customer company that uses Mitves (the “Customer”, controller) and Mitves (Astalyne Studios, owner Oguzhan Günel, Günzburger Str. 37, 89340 Leipheim, Germany) (“Mitves”, processor). It forms part of the Terms of Service and applies to all personal data that Mitves processes on the Customer’s behalf when providing the Service.

It implements Article 28 of the General Data Protection Regulation (GDPR) and, for customers in Türkiye, Article 12 of the Personal Data Protection Law No. 6698 (KVKK). Where this DPA and the Terms differ on data protection, this DPA prevails.

The Customer accepts this DPA together with the Terms when it creates its account. Administrators can also accept it in the dashboard (Settings → Data processing agreement); Mitves then records the version, the language and a fingerprint of the accepted text and sends the text as a PDF.

Subject matter: providing the Mitves time and attendance service (web dashboard, mobile application and API) to the Customer.

Duration: for the term of the Customer’s subscription or trial, and afterwards until the data is deleted or anonymised as set out under “Deletion and return”.

Nature: hosting, storage, recording, organisation, calculation, display, export, transmission and deletion of personal data.

Purpose: recording working time, breaks, leave, excuses and absences; verifying stamps (location, QR code, authorised device); planning shifts; preparing attendance (puantaj) reports and exports; delivering payroll documents, announcements and notifications; securing the Service and keeping an audit trail.

Data subjects: the Customer’s employees, managers and administrators who use the Service or are recorded in it.

• Identity and employment data: name, employee number, position, team, location, manager, role, employment dates.

• Contact data: e-mail address and mobile phone number.

• Attendance data: check-in and check-out events, breaks, leave and excuse requests, shifts and work plans, corrections with their reasons.

• Verification data: the GPS position at the moment of stamping (kept for the period the Customer sets in the company settings, 1 to 90 days, 90 days by default, then erased), distance to the location, the authorised device identifier and the identifier of the scanned QR code.

• Documents and images: payroll documents the Customer publishes and optional profile photos.

• Technical data: IP address, app version, operating system, push tokens and audit log entries.

Special categories of personal data (Article 9 GDPR): health data, namely sick leave recorded as a leave type (the type, its dates and any note or attachment), and data that can indirectly reveal religious beliefs, namely the church tax status that payslips commonly show (CJEU, C-184/20). Mitves does not analyse them: sick-leave details are visible only to the employee and to administrators and managers whose leave scope covers the employee, and payroll documents only to the employee and to administrators and managers whose payroll scope covers the employee. No biometric data is processed. Free-text fields (for example a leave or excuse reason) could contain further health data if users enter it; the Customer instructs its users accordingly. The Customer, as controller, decides the legal basis; in the employment relationship this is typically Article 9(2)(b) GDPR together with national employment law (in Germany § 26(3) BDSG).

Mitves processes the personal data only on the Customer’s documented instructions. The Terms, this DPA and the settings the Customer makes in the Service are the Customer’s complete instructions at the time of signing; further instructions are given in writing (e-mail is sufficient).

Mitves informs the Customer without delay if, in its opinion, an instruction infringes data protection law, and may suspend carrying it out until the Customer confirms or changes it.

Mitves does not use the personal data for its own purposes, does not sell it and does not use it for advertising.

Mitves ensures that the persons authorised to process the personal data are bound to confidentiality by contract or by law and receive only the access they need for their task.

Mitves implements the technical and organisational measures in Annex 2, appropriate to the risk (Article 32 GDPR). Mitves may adapt them to technical progress as long as the level of protection does not fall.

The Customer gives Mitves general authorisation to engage the sub-processors listed in Annex 1. Mitves informs the Customer of any intended addition or replacement at least 30 days in advance, by e-mail or in the dashboard. The Customer may object on reasonable data protection grounds within that period; if no solution is found, the Customer may terminate the affected part of the Service.

The current list, with its version and a dated change log, is published at https://mitves.com/en/legal/subprocessors; where it differs from Annex 1, the published list applies.

Mitves imposes on every sub-processor by written contract data protection obligations no less protective than those in this DPA and remains liable to the Customer for its sub-processors.

Customer data is hosted in the European Union. Where a sub-processor processes personal data outside the EU/EEA, Mitves ensures an adequacy decision (for example the EU–US Data Privacy Framework for certified recipients) or the EU standard contractual clauses as the transfer safeguard.

For customers in Türkiye, hosting in the EU is a transfer abroad under Article 9 of the KVKK. The Customer, as controller, chooses the transfer mechanism (for example the standard contract notified to the Personal Data Protection Authority); Mitves signs the required documents.

The safeguard for each sub-processor is named in the published sub-processor list (https://mitves.com/en/legal/subprocessors).

Mitves assists the Customer with the requests of data subjects through the functions of the Service (export of personal data, correction, deactivation, erasure by anonymisation or deletion) and, where these are not enough, on request.

Mitves assists the Customer with security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR), taking into account the information available to Mitves.

Mitves notifies the Customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the Customer’s data. The notification describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken or proposed (Article 33(3) GDPR).

After the subscription ends the Customer can export its data from the Service. Mitves deletes or anonymises the Customer’s personal data within 90 days, unless the law requires Mitves to keep it. Encrypted backups are overwritten within their rotation period of 14 days and are not restored for other purposes in the meantime.

Mitves makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR and allows audits, including inspections, by the Customer or an auditor it mandates who is bound to confidentiality. Audits are announced at least 30 days in advance, take place during business hours, at most once a year unless a breach gives cause, and at the Customer’s cost.

• Hosting and infrastructure: virtual private servers in the Netherlands (EU). All Service data, files and backups.

• Cloudflare, Inc. (United States): DNS, TLS and reverse-proxy edge protection for all traffic; Cloudflare Turnstile bot check at sign-up.

• Google (Firebase, United States): Firebase Crashlytics crash reports and Firebase Cloud Messaging push notifications for the mobile application; on iPhones push is delivered through Apple Push Notification service (APNs).

• Amazon Web Services EMEA SARL (Luxembourg), Amazon SNS in the Frankfurt region (EU): one-time codes and setup links by text message.

• Amazon Web Services EMEA SARL (Luxembourg), Amazon SES in the Frankfurt region (EU): account, notification and digest e-mails.

• Amazon Web Services EMEA SARL (Luxembourg), Amazon S3 in the Frankfurt region (EU): off-site copy of the encrypted database and file backups, deleted after 14 days.

• Zoho Corporation B.V. (Netherlands), Zoho Mail in the EU data centre: Mitves support and billing mailboxes, where a request contains Customer data.

Not sub-processors of Customer data but listed for transparency: the OpenStreetMap Foundation (United Kingdom) serves map tiles to administrators’ browsers in the web dashboard; the payment providers Stripe Payments Europe, Ltd. (Ireland) and PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) process the Customer’s own payment data as independent controllers; the European Commission’s VIES service receives the Customer’s VAT ID for the check before reverse charge is applied.

• Hosting in the EU; production, staging and backups separated; least-privilege server access for named administrators only.

• Encryption in transit (TLS) for all connections; encrypted daily database and file backups with a restore drill on every backup run.

• Separation of customers: every record belongs to one company and is filtered by company on every request (fail-closed).

• Access control: roles (admin, manager, employee) and manager scopes by team, location and group; API tokens with scopes, expiry and revocation; idle sessions end.

• Special categories: sick-leave type, dates, notes and attachments are shown and exported only to the employee and to administrators and managers whose leave scope covers the employee; payroll documents only to the employee and to the payroll scope.

• Device authorisation: stamps only from devices an administrator approved; devices can be revoked.

• Integrity and accountability: corrections keep the previous values with actor, time and reason; an audit log of administrative actions.

• Data minimisation: GPS only at the moment of stamping and erased after the period the Customer sets; no continuous tracking, no biometrics; API answers carry only allow-listed fields; secrets and payroll content are never written to logs.

• Availability and resilience: monitored services with health checks and alerts; rate limits on sign-in and sensitive endpoints.

• Development: dependency security updates, automated tests and code review before release.