Data Processing Agreement
Last updated: 29 September 2026
Where NormHarbor processes personal data on your behalf as a processor within the meaning of Art. 28 GDPR, the following terms summarise our commitments. A signed agreement is available on request.
Subject matter and duration
Providing the NormHarbor accessibility scanning and monitoring service for as long as you use it.
Nature, purpose, data and data subjects
Nature and purpose: analysing publicly reachable web pages you instruct us to scan and storing the results. Types of data: URLs, page markup excerpts and account contact data; personal data of your website visitors is not intentionally collected. Data subjects: your users and your website's visitors, to the extent their data appears in scanned content.
Instructions and confidentiality
We process personal data only on your documented instructions, including this agreement and your use of the service, and ensure that persons authorised to process it are bound by confidentiality. We inform you without delay if, in our opinion, an instruction infringes data protection law.
Security
We implement appropriate technical and organisational measures under Art. 32 GDPR, including encrypted transport, hashed credentials, access restrictions and logging.
Sub-processors
You authorise the sub-processors listed below. We inform you of intended changes so that you can object on reasonable grounds, and we bind sub-processors to equivalent obligations.
Assistance and incidents
We assist you, taking into account the nature of processing, in answering data subject requests and in meeting your obligations under Art. 32-36 GDPR. We notify you without undue delay after becoming aware of a personal data breach affecting your data.
Deletion and return
At the end of the service, or on request, we delete or return personal data processed on your behalf, unless the law requires retention. Deleting your account removes this data from the live system immediately; backup copies are overwritten within 14 days.
Audits and transfers
We make available the information necessary to demonstrate compliance and allow for audits within reason. Transfers outside the EU/EEA rely on Standard Contractual Clauses or an adequacy decision.
Authorised sub-processors
| Provider | Purpose | Location and safeguards |
|---|---|---|
| Hetzner Online GmbH | Hosting of the application, database and server logs | Germany (EU) |
| Creem | Merchant of Record: payment processing, invoicing, VAT and refunds. It acts as an independent controller for payment data | See the provider's own privacy policy; may involve transfers outside the EEA under its safeguards |
| Resend | Sending transactional and newsletter emails | United States; Standard Contractual Clauses / EU-US Data Privacy Framework |
| Telegram | Internal operational alerts to our team (e.g. new sign-up, sale, cancellation); no email addresses are included | Outside the EEA, no adequacy decision; for this reason only the plan, the event type and a short internal ID (first 8 characters of an internal user ID) are sent, never an email address |
| Optional sign-in with Google; used only if you choose it, we receive your email address | Google acts as an independent controller for its sign-in service; transfers under its own safeguards |
Payment provider and Telegram alerts act on the terms described in our Privacy Policy.
Request a signed DPA
To receive a signed Data Processing Agreement, email hello@normharbor.com with the subject "DPA request" and your company name and address.