Asinora
Sectors
Energy & InfrastructureAgri & FoodTextile & FashionReal Estate & PropertyManufacturing & IndustryMaritime & LogisticsTourism & HospitalityHealthcare & MedicalTechnology & DigitalInvestment & FinanceConstruction & Building MaterialsAutomotive & MachineryChemicals & PlasticsMining & MetalsPackaging & PaperFurniture & Home GoodsDefines processing obligations between Controller and Asinora under Article 28 GDPR (for EU/EEA customers) and equivalent frameworks (including KVKK Art. 12 in Türkiye). Additional local obligations may apply depending on the customer's country.
Last updated: 2026-08-09
This Data Processing Agreement ("DPA") governs the data-processing relationship between Asinora and corporate customers registered on the platform ("Customer") and forms an addendum to the Terms of Service (/legal/terms). Under this DPA, the Customer acts as Data Controller and Asinora as Processor — this relationship applies to the extent the Customer processes, via the platform, personal data belonging to its own business contacts, employees, or customers. This DPA is drafted to meet the minimum contractual requirements of GDPR Article 28 (for Customers in the EU/EEA) and equivalent frameworks (including KVKK Art. 12 in Türkiye). Additional local obligations may apply depending on the Customer's country; in that case, the Customer is responsible for fulfilling its own obligations, with reasonable support from Asinora (see §7).
Subject matter of processing: business contacts, product/service listings, commercial correspondence, and attached documents submitted by the Customer via the platform. Categories of data processed: identity and contact information (name, title, email, phone), commercial transaction data, messaging content; SPECIAL CATEGORY data (such as biometric data) is processed only in the KYC/KYB verification flow, for the data subject's own account, and directly by the verification provider (see §3). Categories of data subjects: the Customer's employees, representatives, business contacts, and other parties it interacts with via the platform. Duration of processing: for as long as the Customer's account remains active, plus statutory retention periods (KYC documents: 10 years; transaction records: 10 years; messaging: 3 years — see Privacy Policy §7). Nature and purpose of processing: automated and/or manual processing for the purpose of providing platform services (matching, messaging, escrow, document generation).
Asinora processes personal data only in accordance with the Customer's documented instructions — which include the use of the platform's standard, documented functionality (account management, matching, messaging, escrow, document generation). Asinora does not process the data for any other purpose without the Customer's instruction, except where required by applicable law; in that case, it informs the Customer in advance, unless prohibited from doing so. Asinora ensures that all of its personnel with access to personal data are bound by a confidentiality obligation (through an employment contract or a separate confidentiality agreement) and limits access to what is strictly necessary for their duties (the "need-to-know" principle).
The Customer grants GENERAL AUTHORIZATION for Asinora to use the following sub-processors; Asinora keeps this list current and notifies the Customer at least 30 days before adding a new sub-processor. The Customer may raise a reasonable objection within the notice period; if the parties cannot reach a reasonable resolution, the Customer may terminate this DPA. Approved sub-processors: • Supabase Inc. (US) — hosting, authentication, database • Vercel Inc. (US) — application deployment, edge cache • Resend Inc. (US) — transactional email • Stripe Inc. (US) — payment processing and fund holding (escrow) • Didit — KYC/KYB identity and business verification (processes identity documents/biometric data; this data is processed on Didit's own infrastructure and is NOT stored in Asinora's database) • OpenAI, L.L.C. (US) — NORA AI assistant infrastructure (processes text/voice input) • Functional Software, Inc. (Sentry) (US) — error tracking and diagnostics Asinora enters into a contract with each sub-processor containing data-protection obligations equivalent to those in this DPA, and is liable to the Customer for a sub-processor's breaches as if they were its own.
Encryption: TLS 1.3 for data in transit; AES-256-GCM for sensitive application-layer fields (e.g. the NORA memory summary). Access control: role-based access control (RBAC) plus database-level row security (Supabase Row Level Security); access is logged in the audit_log. Document storage: access via time-limited signed URLs (30-second validity), with no permanent publicly accessible link generated. Backups: automated daily backups. Breach detection and response: error-tracking infrastructure (Sentry) for real-time anomaly/error detection; once a breach is detected, the response process begins immediately (see §7). These measures may be updated over time as technology and the threat landscape evolve; no update reduces the overall level of protection committed to in this DPA.
With sub-processors located outside the EU/EEA (primarily US-based), the European Commission's Standard Contractual Clauses (SCC, Module 3 — Processor to Sub-processor) apply, together with a Transfer Impact Assessment (TIA) where deemed necessary. Transfers from other countries follow that country's applicable transfer regime (e.g. the mechanisms prescribed by KVKK in Türkiye). The Customer remains responsible for any additional transfer obligations under its own country's law (e.g. notification to a local authority, additional contractual terms); Asinora provides, upon request, the necessary documentation (SCC copies, TIA summary) within a reasonable time.
Asinora assists the Customer in responding to data subject requests (access, rectification, erasure, portability, objection) within a reasonable time, providing technical and organizational support to the extent the platform's own capabilities allow. When Asinora detects a breach affecting the security of personal data, it notifies the Customer without undue delay and as soon as reasonably possible (target: within 72 hours of becoming aware); the notification covers the nature of the breach, the categories of data affected and the approximate number of data subjects, measures taken/planned, and contact details. This notification obligation does NOT remove the Customer's own obligation to notify its supervisory authority/data subjects — the Customer remains responsible for its own notification obligations.
When the Customer closes its account or this DPA terminates, Asinora — at the Customer's choice — either returns the processed personal data to the Customer in a portable format OR deletes it; data subject to a legal retention obligation (e.g. completed transaction records) continues to be retained, solely for that purpose, until the relevant legal period expires. This process is carried out consistent with the general retention/deletion framework described in Privacy Policy §7.
The Customer may, with reasonable notice (at least 30 days), request documentation or an independent audit report to assess Asinora's compliance with this DPA; an on-site audit is conducted only where legally required, subject to confidentiality obligations, and without unreasonably disrupting business operations. Liability under this DPA is subject to the limitation of liability set out in the parties' primary agreement (Terms of Service, §14 — Limitation of Liability); this limitation does not apply to damages arising from willful misconduct or gross negligence, or to types of liability that applicable law does not permit to be limited.
This DPA remains in effect for as long as the Customer's platform account is active and follows the same term as the Terms of Service; termination of the Terms of Service automatically terminates this DPA as well. Subject to the sub-processor objection mechanism described in §4, this DPA may not be separately terminated by the parties.