Data processing agreement (DPA)

When you use the iso-easy ISMS platform, notivia GmbH processes personal data on your behalf — for example the names and contact details of your staff, training records or reports in the whistleblowing module. For that purpose we conclude a data processing agreement under Art. 28 GDPR with every customer.

Download

How to conclude the agreement

  • When ordering: During checkout you confirm the terms and conditions and the data processing agreement with a tick box.
  • In your customer account: Existing customers accept the agreement in the platform under Settings. The company administrator can do this.
  • With a signature: If you need a signed version, fill in the customer field on page 1 and send the signed agreement to service@iso-easy.de. You will receive it back countersigned.

The main points in brief

  • The platform runs on notivia GmbH’s own server in Stuttgart, Germany, without a data centre service provider.
  • At notivia, only the management has access to customer data.
  • Sub-processors: Anthropic for the AI functions (only when a user triggers them) and Microsoft 365 for e-mail and file exchange in consulting work. We announce new sub-processors 30 days in advance.
  • We report personal data breaches within 24 hours.
  • After the contract ends you receive your data on request within 30 days; we delete it after 60 days at the latest.

We answer questions about the agreement at service@iso-easy.de.

Language: This is a convenience translation of our German Vereinbarung zur Auftragsverarbeitung. The German version is the legally binding one; in the event of any discrepancy, the German text prevails.