Turnoly
LoginTry for free
DeutschEnglishEspañol

Data Processing Agreement for Turnoly

Last updated: September 2026 · Version: 2026-09

This translation is provided for convenience. In the event of any discrepancy, the German version shall prevail.

1. Parties, Scope and Conclusion

This contract processing agreement (DPA) regulates the processing of personal data on behalf of the use of the B2B-SaaS Turnoly exclusively aimed at business customers according to art. 28 GDPR. The contracting parties are the business customer designated in the underlying Turnoly User Agreement as the controller and the following provider as the processor:

Oezer Software
Inhaber: Murat Özer
Pfaffenbrunnenstraße 16c
63456 Hanau
Deutschland
E-Mail: kontakt@turnoly.com

The customer decides on the purposes and essential content of the processing of his employee and user data. Oezer Software processes this data in accordance with this DPA on behalf of the customer (order data). The rights and obligations of the customer as a controller remain unaffected.

Not all processing by Oezer Software is order processing. Insofar as Oezer Software processes data for its own legal obligations, the management of its own contractual relationship or its own billing purposes and decides on its own purposes and means, this is done under its own data protection responsibility. The delimitation depends on the respective actual processing, not only on the data name.

This DPA, including its annexes, becomes part of the Turnoly contractual relationship through a separately documented agreement between the parties. Merely making this text publicly available does not conclude an agreement. The version agreed between the parties is authoritative; this version is version 2026-09. The legally authoritative version is provided in German.

2. Subject matter and duration

The subject matter is the provision of the cloud-based Turnoly software for shift planning, employee management, time recording and absence management, including the associated processing of order data.

The processing takes place for the duration of the underlying usage and contractual relationship, including an agreed free trial phase. This DPA also applies to the extent necessary for the subsequent instruction-based storage, return and deletion of order data.

3. Type and purpose of processing

The processing comprises, in accordance with the functions used, in particular the collection and acquisition, ordering, storing, reading out, queries, use, modification, necessary transmission, provision for export as well as restriction and deletion of order data.

  • Organization and account management, employee management and user and authorization management.
  • Authentication of authorized users and management of their accesses.
  • shift planning, workspace management and assignment of employees.
  • Time recording, time corrections, confirmations, time accounts and evaluations.
  • administration of leave and absence.
  • Internal notifications and transactional communications required for use.
  • Technical provision, security and protection against misuse in the context of order processing.

The processing depends on the agreed scope of services and the documented instructions of the customer. Use of the order data for Oezer Software’s own marketing purposes is not the subject of this order.

4. Data types and data subjects

Depending on the configuration and the input of the customer, in particular the following personal data can be processed:

  • Organisational reference: organisation ID, business assignment and settings.
  • Employee and user data: first name, last name, short name, birthday, e-mail address, telephone numbers, address, free text note, language, roles and permissions, as well as active, archive and login status.
  • Employment and planning data: type of employment, working time arrangements, availability, workspaces, shift assignments, date, start and end, breaks, comments and repetitions.
  • Time data: stamping and stamping times, pauses, time corrections, confirmation status and time account information.
  • Dates of leave and absence: leave entitlements, days of leave, categories and dates of absence, permit status and credit rules.
  • Authentication and security data: Password hashes, session and token information, and terminal and PIN related security information.
  • Communication data: internal notifications, e-mail recipients and necessary transactional message content.

Affected persons are in particular administrators and planners of the customer, employees with or without a user account, invited users as well as deactivated, archived or former employees, as far as their data is still stored permissibly. Payment and credit card data are not Turnoly employee data described here; payment processing is classified separately in Appendix 1.

5. Disease and special categories of personal data

Turnoly contains the fixed absence category “Sick”. Corresponding entries can include health data and thus special categories of personal data by type. 9 GDPR. Free text notes, comments and self-defined absence categories may also contain such data.

Turnoly does not currently collect any diagnoses, certificates or medical documents about structured fields intended for this purpose. However, it does not follow that absence or free text data entered by customers never contain health data.

The customer is for a sufficient legal basis of his processing, including the necessary conditions according to art. 9 GDPR, and responsible for the necessary information to the data subjects. It limits inputs and access authorizations to what is necessary for the respective purpose. Unnecessary diagnoses, medical details or other sensitive information should in particular not be entered in free text fields. Oezer Software considers the possible special data categories in the protective measures.

6. Documented instructions and obligations of the customer

Oezer Software processes order data exclusively on documented instructions of the customer, also with regard to a transfer to third countries or to international organizations. Instructions may result from this DPA, the main contract as well as documented configurations and acts of use of authorized persons in Turnoly. Supplementary instructions are transmitted in documentable form, for example by e-mail.

If Oezer Software is obliged to process by the law of the Union or a Member State, it shall inform the customer of this legal obligation before processing, unless the law in question prohibits such communication for important reasons of public interest.

If Oezer Software holds an instruction for data protection violations, it informs the customer immediately. The processing concerned may be suspended until the lawful clarification; mandatory legal obligations remain unaffected.

The customer ensures lawful instructions, manages the permissions of its users and provides the information necessary for the execution of the order. He remains responsible for the legality of the purposes, data and processing specified by him. This does not exempt Oezer Software from its own legal and contractual obligations.

7. Confidentiality and security

Oezer Software guarantees that persons authorised to process are obliged to maintain confidentiality or are subject to an appropriate statutory duty of confidentiality. Access is limited to the persons and data required for the respective task.

Oezer Software implements the technical and organisational measures required under Article 32 GDPR. Annex 2 describes the technical measures used as a basis and the organisational obligations under this DPA.

The measures may be further developed taking into account the state of the art, the implementation costs, the nature, scope, circumstances and purposes of the processing and the risks to data subjects. The required level of protection must not be reduced unreasonably. Relevant changes are documented and explained to the customer on request.

8. Data subject rights and support

Oezer Software supports the customer in view of the nature of the processing as far as possible with suitable technical and organizational measures in the response to requests under Chapter III GDPR, in particular to access, rectification, deletion, restriction of processing and data portability as well as other relevant data subject rights.

If requests for order data are received directly by Oezer Software, they will be forwarded to the customer immediately. Oezer Software does not decide on its own content, but acts according to the instructions of the customer, as far as there is no legal obligation to act otherwise.

Taking into account the type of processing and the available information, Oezer Software also supports the customer in his obligations according to art. 32 to 36 GDPR, in particular for security measures, notifications and notifications of data breaches, data protection impact assessments and necessary consultations of the supervisory authority. This does not guarantee that the customer fulfils all his own data protection obligations.

9. Personal data breaches

Oezer Software informs the customer without undue delay as soon as he becomes aware of a breach of the protection of order data. The information is not dependent on the fact that Oezer Software already knows the final risk assessment of the customer.

Where available, the notification shall include the nature of the breach, the categories and approximate number of affected persons and data sets, a means of contact for further information, the likely consequences and any measures taken or proposed to remedy and mitigate adverse effects. Any missing information will be added gradually without undue further delay.

Oezer Software takes appropriate measures to contain and clarify the incident and supports the customer with available information in his obligations according to art. 33 and 34 GDPR. The decision on the notifications and notifications to be initiated by the customer remains with the customer, unless the law provides otherwise.

10. Other processors

The customer gives the general written authorization for the use of further processors for the services described in this DPA. The service providers used at the time of conclusion and their functions are listed in Appendix 1; the payment processing, which is separately classified therein, is not lump-sum order processing of employee data.

Oezer Software shall inform the Customer in advance of any intended involvement or replacement of further processors. Before use, the customer receives a reasonable opportunity to object for justified reasons under data protection law.

In the event of a reasoned objection, the parties shall consider appropriate safeguard measures or a reasonable alternative. If the objection cannot be resolved, a lawful solution for the affected performance will be agreed before the affected change. The authorisation shall not be used in such a way as to render the right of appeal ineffective.

Oezer Software contractually obliges other processors to the same data protection obligations relevant for their processing, in particular to provide sufficient guarantees for suitable technical and organizational measures. Oezer Software remains responsible to the customer for the fulfilment of the data protection obligations of these other processors.

11. International processing and transfers from third countries

The service providers used may also process personal data outside the European Union and the European Economic Area. A location of the primary database or a server function does not mean that all associated processing takes place exclusively in Germany.

Transfers of order data to third countries take place only within the framework of the documented instructions and in compliance with the requirements of Chapter V GDPR. Where necessary, Oezer Software uses appropriate transfer mechanisms, such as an adequacy decision applicable for the specific transmission or standard contractual clauses, supplemented by necessary additional protective measures.

The legally appropriate mechanism depends on the specific transmission and the applicable contractual documents. A particular mechanism is not guaranteed irrespective of its continued applicability. Upon request, Oezer Software will provide the customer with the necessary information to assess the transmissions.

12. Return, maintenance and deletion

Upon completion of the processing services, order data shall be returned or deleted at the choice of the customer; existing copies shall be deleted unless further storage is required by Union or Member State law. A return, for example via a technically available export, does not replace the subsequent deletion of the order data remaining with Oezer Software and its other processors. The customer can send a documented instruction to kontakt@turnoly.com.

Unless otherwise lawful instruction is given, the contract shall include the following follow-up regulation agreed upon with the usage relationship:

  • Test phase without subsequent subscription: After the end of the three-month free trial phase, access is generally restricted or restricted. Reading. The organization and associated customer data are generally kept for 90 days from the end of the test phase.
  • Terminated paid subscription: The regular use remains in principle until the end of the paid billing period. After this, the access is fundamentally restricted or limited. Reading. In principle, the data is kept for 90 days from the effective end of the contract, i.e. the end of the last billing period.
  • The follow-up time serves for the instruction-oriented fuse or fuse-off time. Return of available data and possible reactivation. Before final deletion, reactivation by a new valid subscription is possible in principle, as far as account and data still exist.
  • After the expiry of the retention period, the organization and associated order data will be deleted, as far as no statutory storage obligations are contrary. A deviating instruction from the customer for earlier return or deletion remains possible.
  • A mere payment disruption or arrears does not only trigger the 90-day extinction run described for a regular test or contract end.

The deletion does not have to be done in every technical copy at the same second. Insofar as order data is still temporarily contained in backup copies or technical provider logs, they are protected against further regular use and removed within the framework of the relevant deletion cycles, insofar as there is no statutory storage obligation. Until then, they may only be processed for necessary protection and restoration measures or mandatory legal purposes. During a restoration, deletions that have already been initiated are taken into account again. The obligations of Oezer Software also extend to its other processors.

Data downloaded by the customer himself and e-mails already delivered in the recipient's mailbox, on the other hand, are no longer solely in the area of Oezer Software's disposal. For your own lawfully stored contract and billing documents as well as processing of the payment service provider under your own responsibility, the relevant legal obligations apply. This does not give rise to a general exception to the deletion of the order data.

13. Information, controls and inspections

Oezer Software provides the customer with all necessary information to prove compliance with the obligations according to art. 28 GDPR and enables and contributes to reviews, including inspections, by the Customer or an auditor appointed by the Customer.

Where possible, checks shall be carried out with reasonable prior notice during normal business hours. In the event of an urgent need, a shorter or omitted advance notice may be required. The scope and implementation shall take into account the purpose of the audit, confidentiality, security and data of other customers, and the avoidance of unnecessary disruption of operations.

Existing suitable documentation, test reports and certifications can first be used for demonstration. This results neither in the assertion of actual certification nor in the exclusion of further necessary examinations or legal control rights. Instructions which, in the opinion of Oezer Software, violate data protection law will be reported to the customer immediately.

14. Relationship to the main contract and liability

This DPA and its annexes specify the data protection obligations of the parties. In the event of contradictions to other agreements, this DPA takes precedence with regard to the processing of orders. In addition, the permissible agreements of the main contract and the Terms and Conditions as well as the statutory provisions remain applicable.

No independent comprehensive liability regime is introduced. Legal liability claims, in particular according to art. 82 GDPR, and mandatory rights of affected persons remain unaffected.

Further information on the processing under your own responsibility is contained in the separate data protection declaration. It does not replace this DPA.

General terms and conditions

Data protection declaration

Imprint

Appendix 1 – Service providers and processing framework

This Appendix describes the use of the service provider used for production. The respective contracting provider entity, other subcontractors and applicable transfer regulations are based on the actually applicable provider contract documents. Oezer Software must ensure the necessary data protection agreements and guarantees for use; the mere mention here does not replace them.

A. IONOS – hosting infrastructure

Service provider: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Function: provision of the virtual server for the public website, the Turnoly SaaS application and the primary PostgreSQL application database. The server is operated by Oezer Software via Coolify with Docker and Traefik. The application, employee, database, connection and protocol data required for operation are processed.

The productive IONOS VPS is located in Spain within the European Union according to the operator configuration. On it, the website and application as well as PostgreSQL 17 run in the private Coolify infrastructure; the PostgreSQL port is not publicly accessible. This location refers to the configured productive server and is not a further guarantee for all support, contract, billing or backup processing of IONOS. Decisive are the actually agreed IONOS contractual and data protection documents.

B. Resend – transactional e-mail delivery

Function: Send required transactional emails. In particular, name, e-mail address, company reference and necessary message content including activation and reset links as well as billing communication are processed for this purpose. According to the currently used functional status, no complete shift plans, illness periods, diagnoses or disease documents are sent via Resend.

Resend is owned by Plus Five Five, Inc. provided and can store and process data in particular in the USA. The deployment takes place under the relevant Resend data protection agreement and the transfer mechanisms applicable for the specific transfer. Not every shipment is used for order processing; own billing communication must be classified separately according to its actual purpose.

For transactional messages, only the data required for the respective dispatch are transmitted. The e-mail delivery may involve other providers in the transmission path and the e-mail system used by the recipient.

C. ALL-INKL – Domains, DNS and Business Email

Function: Management of domains and DNS entries as well as provision of the normal business e-mail inboxes of Oezer Software by ALL-INKL.COM – Neue Medien Münnich. In particular, domain and DNS data as well as sender, recipient, header and content data of business e-mail communication can be processed. ALL-INKL does not host the Turnoly application or its PostgreSQL database and does not send the automated transactional application emails.

Insofar as customer data is processed on behalf in the context of business e-mail communication, ALL-INKL will be included in accordance with the actual performance and the applicable contractual documents. Domain and DNS management alone does not automatically lead to the processing of employee data stored in Turnoly.

D. Stripe – separate payment and billing service provider

Stripe is not a blanket additional processor for all Turnoly employee data. In the context of billing, Stripe receives in particular company and administrator billing information, e-mail address, organization ID as metadate as well as tariff and subscription information. Payment information is provided directly via Stripe Checkout or Stripe Checkout. The customer portal is processed. Turnoly does not store full card numbers, CVC or IBAN.

Depending on the specific processing, Stripe acts under its own responsibility or as a processor. Decisive are the Stripe contractual documents and the actual processing purposes. According to the current operating status, no employee shift or disease data are transmitted to Stripe. For international transfers, the necessary data protection and transfer regulations apply.

Appendix 2 – Technical and organisational measures

The following technical measures describe the tested implementation status on which they are based. The organizational measures mentioned below are obligations of this DPA and not a claim of already proven certifications or certain internal organizational structures.

A. Authentication and access protection

  • Passwords and terminal PIN are protected by salted scrypt hashing.
  • Session IDs and credential tokens are generated cryptographically randomly.
  • Session cookies are HMAC-signed; authentication cookies use HttpOnly and SameSite=Lax as well as Secure in the production environment.
  • Sessions are validated on the server side, rotated and revoked when the password is changed.
  • Activation and reset tokens are earmarked and limited in time.
  • Terminal PIN inputs are subject to trial limits and blocking times.

B. Permissions and organisational segregation

  • Roles and permissions are checked on the server side.
  • Client and organization assignments limit access to the respective organization.
  • Access to resources is checked against the associated organization.

C. Integrity and technical interfaces

  • Database accesses are via prism and parameterized accesses; database constraints and transactions support integrity. PostgreSQL 17 runs within the private Coolify infrastructure, without a publicly accessible PostgreSQL port.
  • Stripe webhooks are checked based on their signature.
  • Scheduled server tasks use authentication that denies access if authorization is missing or invalid.
  • The tested email templates use HTML escaping.
  • The production URLs use HTTPS.

D. Organisational obligations

  • Oezer Software limits authorized access to the required extent and obliges persons authorized to access to confidentiality, insofar as they are not already subject to a suitable statutory duty of confidentiality.
  • Instructions, relevant security measures and their changes are documented to an extent appropriate to the processing.
  • Recognised security incidents shall be handled appropriately; information and support obligations under this DPA shall be fulfilled.
  • When using further processors, the necessary data protection agreements, protective measures and transfer guarantees are ensured.
  • The effectiveness of protective measures shall be periodically reviewed, assessed and, where necessary, adjusted in a risk-based manner; availability and recoverability shall be carried out within the limits laid down by type. 32 GDPR takes the necessary measures into account.
  • Return, limited storage and deletion of order data will be implemented, including necessary coordination with other processors in accordance with Section 12.

The measures do not create absolute security against data loss, no specific level of availability and no fixed recovery times. Neither a complete own encryption of all stored data by Turnoly nor an own ISO certification or exclusively German processing is guaranteed. The risk-appropriate obligation to take appropriate measures in accordance with art. 32 GDPR remains unrestricted.