Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between you and Matthias Frank ("we", "us") and governs our processing of personal data contained in your Notion workspace’s structure when you use Yanta Audit ("the Service"). It is written to apply whether you connect on your own behalf or on behalf of an organisation; in both cases the party that controls the workspace is the "controller" and we are the "processor" under Article 28 GDPR.

1. Roles

You (or the organisation you represent) are the controller of the personal data contained in your workspace structure. We are your processor for that data. This DPA does not cover the data we hold about you as an individual account holder (your name, email, and avatar) — for that we are the controller, and our Privacy Policy applies.

2. Subject-matter, nature, and purpose

We process your workspace’s structural schema — the metadata of its databases, properties, options, and relations — for the sole purpose of producing and serving the audit report you requested. We extract and retain only that structural metadata; we do not keep, display, or use the content of your pages, although the scan may pass over page blocks to find databases nested inside them. Processing lasts for as long as a legal basis remains (your active connection, or a related client relationship) and ends when you disconnect and delete or when no basis remains.

3. Categories of data and data subjects

Structural metadata is generally not personal data, but it may incidentally contain personal data — for example, a person’s name used as a database title or option, or the names of workspace members shown against recorded schema changes. The data subjects are therefore the members and collaborators of your workspace whose identifiers happen to appear in its structure.

4. Our obligations

We will:

• process the data only on your documented instructions, which include your configuration and use of the Service (we will tell you if we believe an instruction breaches data-protection law);
• ensure that anyone authorised to process the data is bound by confidentiality;
• implement appropriate technical and organisational security measures (Section 5);
• engage sub-processors only under Section 6;
• assist you, taking into account the nature of processing, in responding to data-subject requests and in meeting your obligations on security, breach notification, and data-protection impact assessments;
• make available the information needed to demonstrate compliance with Article 28, and allow for and contribute to audits (Section 8); and
• at the end of processing, delete or return the data as described in Section 9.

5. Security measures (Article 32)

• least-privilege access: the audit integration is read-only and is used only to read structural metadata, never to keep page content;
• encryption of authorisation tokens at rest, and of the account session under a separate key;
• encryption of all data in transit via TLS;
• hosting within the European Union (Frankfurt, Germany); and
• access controls and separation between this public Service and our internal systems.

6. Sub-processors

You give us general authorisation to engage the sub-processors listed below. We will give at least 30 days’ notice before adding or replacing a sub-processor by updating this list, during which you may object on reasonable data-protection grounds; if we cannot resolve your objection, you may terminate by disconnecting and deleting. We remain responsible for our sub-processors’ performance.

Notion is the source of the data we read, under your own existing relationship with Notion; it is not our sub-processor. Our internal staff sign-in provider authenticates our own team only and does not process your workspace data.

7. International transfers

We store and process the data in the EU (Frankfurt). Netlify, Neon, and Cloudflare are US-incorporated, so onward transfer to or access from outside the EU cannot be wholly excluded; where it occurs, it is covered by the European Commission’s Standard Contractual Clauses.

8. Data-subject requests, breaches, and audits

If we receive a request from one of your data subjects, we will refer them to you and will not respond directly except on your instructions. We will notify you without undue delay after becoming aware of a personal-data breach affecting your data, and will assist your own notification duties. We will make available the information reasonably needed to demonstrate compliance; given the self-serve nature of the Service, audits are ordinarily satisfied by us providing that information on request.

9. Deletion and return

When you disconnect and delete, or when no legal basis for processing remains, we revoke our Notion access and delete the harvested structural data. We retain only the minimal erasure record described in our Privacy Policy, which contains no workspace data. Because the audit is generated from your live workspace, there is no separate copy to return to you.

10. Liability and governing law

This DPA is governed by the laws of the Federal Republic of Germany. The liability provisions of the Terms of Service apply to this DPA. In case of conflict between this DPA and the Terms on the processing of personal data, this DPA prevails.

11. Acceptance

By accepting at connection, you confirm that you are authorised to enter into this DPA on behalf of the controller of your workspace. Questions: hello@matthiasfrank.de.