Data Processing Agreement

1. Roles

The User is the data controller for personal data of its own customers (or, for agencies, its clients' customers) in connected store, ad and analytics accounts. [COMPANY LEGAL NAME] ("Processor") processes such data only on the User's behalf and documented instructions. Agencies must have the necessary agreements and authorisations with their clients.

2. Subject matter and scope

• Data categories: name, e-mail, phone and shipping address in orders; audience lists (e-mail/phone one-way hashed before being sent to platforms); ad engagement and conversion data.
• Data subjects: the User's customers, prospects and website visitors.
• Purpose: reporting, profit analysis, catalog and audience sync, AI-assisted analysis and suggestions.
• Duration: for the membership; section 8 applies on termination.

3. Processor obligations

• Process only on documented instructions and inform the User if an instruction appears unlawful.
• Ensure staff with access are bound by confidentiality.
• Implement appropriate technical and organisational measures under KVKK Art. 12 (TLS, RLS tenant isolation, server-side secrets, role-based admin access with audit logs, backups).
• Reasonably assist with data subject requests.
• Not use the data for its own purposes, sell it or provide it for training general AI models.

4. Sub-processors

The User grants general authorisation for the sub-processors below. The Processor gives at least 30 days' notice of changes; the User may object on reasonable grounds and terminate if the objection cannot be resolved.

• Supabase Inc. – database, authentication, storage ([DATA HOSTING REGION])
• [APPLICATION HOSTING PROVIDER] – application hosting
• OpenAI, L.L.C. – text generation and analysis (USA)
• Runway AI, Inc.; Pollo AI; Stability AI Ltd. – image/video generation (only when used)
• Upstash, Inc. – scheduled job queue
• Resend – transactional e-mail
• Stripe, iyzico, PayTR, Paraşüt – only for the User's own payment and invoice data

5. Cross-border transfers

Some sub-processors are outside Türkiye. Transfers follow KVKK Art. 9 and the related Regulation; absent an adequacy decision, the standard contracts published by the Board or other appropriate safeguards are used and standard contracts are notified to the Board within five business days of signature.

6. Breach notification

The Processor notifies the User without undue delay and at the latest within 24 hours of becoming aware of a breach affecting User data, with its nature, affected categories and measures taken, and provides the information needed for the User to notify the Board within 72 hours.

7. Audit

With reasonable prior notice and confidentiality undertakings, the User may request information and documents on compliance no more than once a year. On-site audit costs are borne by the User.

8. Termination

On termination the Processor enables export on request and, subject to statutory retention, deletes or anonymises the data within 30 days; tokens of connected accounts are deleted immediately.

9. Contact

Data protection requests: [CONTACT E-MAIL] · [KEP ADDRESS] · [REGISTERED ADDRESS].

This English text is provided for convenience; in case of conflict the Turkish version prevails.