YelmeAtlas
Back to home

This translation is provided for convenience. Only the German version is legally binding.

Data Processing Agreement (DPA)

Agreement on the processing of personal data on behalf of the customer under Art. 28 GDPR · As of: 22 August 2026 · Courtesy translation — the German version („Auftragsverarbeitung“) is the contractual instrument.

This agreement is deemed offered and takes effect upon registration of a business account, without requiring a signature (Art. 28(9) GDPR permits an electronic format). On request we issue a countersigned version as a PDF: info@yelme.de. This page prints cleanly and corresponds in substance to the contractual version.

§ 1 Parties and roles

The controller is the customer. The processor is YELME, owner Younes EL Mestari, Frankfurter Str. 104, 63263 Neu-Isenburg, Germany (the “Provider”).

§ 2 Subject matter and scope

The Provider processes, on the customer's behalf, the personal data that arises from the use of YelmeAtlas: account data (e-mail addresses of the customer's users, passwords exclusively as Argon2id hashes), session data, watchlists (observed app identifiers) and support communication.

Not covered by this agreement are the publicly accessible store reviews that YelmeAtlas analyses. For their retrieval and analysis the Provider is a controller in its own right within the meaning of Art. 4(7) GDPR — that processing is not carried out on the customer's behalf and cannot be captured by a processing agreement. Details are governed by the privacy policy.

§ 3 Categories of data subjects

  • Employees and agents of the customer who use YelmeAtlas.

§ 4 Duration

The term follows the usage contract (Terms § 7). After termination, the commissioned data is deleted within 30 days unless a statutory retention duty prevents this; on request, the data is handed over beforehand in a common format.

§ 5 Obligations of the Provider (Art. 28(3) GDPR)

  • Processing only on the customer's documented instructions (lit. a); the customer's use of the features counts as an instruction.
  • Confidentiality obligation of all persons involved in the processing (lit. b). The Provider is a sole proprietorship; the processing person is the owner.
  • Implementation of the technical and organisational measures per Annex 1 (lit. c, Art. 32).
  • Engagement of further processors only under § 6 (lit. d).
  • Support with data-subject rights (lit. e) and with the duties under Art. 32–36 (lit. f), including notification of personal-data breaches without undue delay, at the latest within 48 hours of becoming aware, to the customer.
  • Deletion or return after the end of the contract (lit. g, § 4).
  • Evidence and audit rights under § 7 (lit. h).

§ 6 Sub-processors

The customer grants general authorisation (Art. 28(2) GDPR) for the sub-processors listed in Annex 2. Changes are announced by e-mail at least 30 days before they take effect; the customer may object for an important data-protection reason. In case of an objection, either party may terminate at the effective date.

§ 7 Evidence and audits

The Provider satisfies evidence duties primarily through up-front documentation: Annex 1 (TOM), the sub-processor list, and, on request, the record of processing activities under Art. 30(2) GDPR. On-site audits are possible after scheduling with reasonable notice (at least 14 days) during business hours; they take place at the customer's expense and must not unreasonably disrupt operations. A sole proprietorship cannot serve unannounced parallel audits of several customers — transparency is therefore established through documentation, not presence.

§ 8 Place of processing

Processing takes place exclusively in a data centre in Germany (Annex 2). No transfer to third countries occurs within the scope of this agreement.

§ 9 Liability, final provisions

Art. 82 GDPR applies. In all other respects the liability rules of the Terms apply. German law governs; where permissible, the place of jurisdiction is Neu-Isenburg. Should any provision be invalid, the remainder stays in force.

Annex 1 — Technical and organisational measures (Art. 32 GDPR)

As of: 20 August 2026 · Every statement was checked against the actual system state before publication.

Physical and environmental control

  • Operation on a dedicated virtual server of IONOS SE in a data centre in Germany; physical security per the data-centre operator's ISO 27001 certification.

System access control

  • Server access exclusively via SSH with keys; password login is disabled server-side.
  • Firewall (ufw) active; only SSH, HTTP and HTTPS are open.
  • Automatic operating-system security updates (unattended-upgrades) are enabled.

Data access control

  • Passwords are stored exclusively as Argon2id hashes (memory-hard); plain-text passwords never exist server-side.
  • Sessions via random, server-side revocable identifiers in HttpOnly cookies; no client-readable token.
  • Confirmation links are stored only as SHA-256 hashes and are single-use.
  • Tenant separation at the database level: every tenant-related query is bound to the tenant identifier; automated tests enforce the isolation.
  • Registration rate limiting against automated abuse.

Transfer control

  • All access via TLS (Let's Encrypt, automatic renewal); unencrypted HTTP is redirected.
  • E-mail delivery via the hosting provider's mail server (Annex 2).

Input and change control

  • Every deployment is versioned (Git); the deployed state is recorded on the server as a checksum.
  • System logs via systemd-journald.
  • Changes pass an automated pipeline (static analysis, type checking, currently more than 450 automated tests) before every deployment.

Availability control

  • Daily database backup (compressed full dump, 14-day retention) on the server; services restart automatically on failure (systemd).
  • Tested rollback procedure for faulty deployments.
  • Geographically separate copy: the backups are additionally pulled to a separate system of the operator on working days (pull model — the server holds no access to the copies and cannot delete them); retained there for 30 days. There is no entitlement to uninterrupted availability (Terms).

Separation control and data minimisation

  • Commissioned data (accounts, watchlists) and review data live in separate tables; review data is tenant-free and contains no data of the customer's employees.
  • No analytics, advertising or tracking services are embedded; exactly one technically necessary cookie exists.

Annex 2 — Sub-processors

As of: 20 August 2026 · Changes are announced 30 days in advance (§ 6).

  • IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany — server hosting (data centre in Germany) and e-mail delivery. A data-processing agreement under Art. 28 GDPR with the Provider is in place.
  • Anthropic Ireland, Ltd., 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland — only when the customer explicitly enables the optional AI assessment (opt-in in the settings; default: off). Only review texts from public app stores, topic labels and counted metrics are transmitted — never account, payment or tenant data. Processing on servers in the USA under the EU Standard Contractual Clauses; Anthropic does not use the data for training under its terms. Announced on 13 September 2026; effective no earlier than 13 October 2026 (30-day notice under § 6).

No further sub-processors exist. Unless the AI assessment is enabled, no cloud AI services are used; no analytics services and no external font or CDN providers are used.