Data processing agreement

DRAFT — not legal advice. Requires review by a qualified lawyer before use.

• Document: Data Processing Agreement under GDPR Art.28 and UK GDPR, with Turkish KVKK provisions · Language: English · Version: 0.1 draft · Date: 2026-10-26
• Basis: docs/research/06-legal-compliance.md R4, F2, F8, F10, T3. Applies to lead and recipient personal data that a customer uploads or sources, where the customer is controller (veri sorumlusu) and the platform is processor (veri işleyen, 06 F10).
• Company country: Türkiye. The hosting provider and region are not yet selected (ADR-008) and the AI decision (TODO-Faruk 2d-c) is open; Annexes C and D say so instead of naming a provider. All placeholders were closed on 2026-10-27 (F1-64) from docs/decisions/01-defaults-2026-10-27.md and the research reports; sentences marked † still await lawyer confirmation.

1. Parties, roles and subject matter

1.1 This DPA is between the customer (“Controller”) and Faruk Sancak TiklaWeb Bilişim Hizmetleri (sole proprietorship), Türkiye, Atatürk Mahallesi Dilek Sokak No: 12 İç Kapı No: 5, Küçükçekmece / İstanbul (“Processor”), and forms part of the Terms of Service.

1.2 The Processor processes personal data on behalf of the Controller to provide the outreach platform. Subject matter, duration, nature, purpose, data types and data subjects are in Annex A.

1.3 For account, billing and security data about the Controller’s own users, the Processor is an independent controller (see the Privacy Policy). This DPA does not apply to that data.

1.4 The Processor does not reuse lead personal data across customers and does not operate a shared lead database. Platform-level suppression is limited to hard bounces, spam complaints, abuse and requests sent to the Processor itself (06 F10).

2. Definitions

2.1 Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning in GDPR (and UK GDPR). Where KVKK applies, “veri sorumlusu” (controller), “veri işleyen” (processor) and “ilgili kişi” (data subject) have the meaning in Law 6698.

2.2 “Sub-processor” means a third party engaged by the Processor to process Controller personal data. “Transfer” includes making data accessible from abroad (Transfer Regulation art.4/e, 06 F1.3).

3. Processing on documented instructions

3.1 The Processor processes personal data only on the Controller’s documented instructions, including with regard to transfers (GDPR Art.28(3)(a)). The Terms, this DPA and the Controller’s configuration of the Service are the documented instructions.

3.2 Export and AI-client access as instructions. Access to workspace data from a Controller-side AI client (such as through MCP) and data export are off by default. When a workspace owner or administrator enables them, that act is the Controller’s documented instruction to make the data available to that client or recipient. The Controller acknowledges that the AI client’s vendor is the Controller’s own recipient and, for Turkish data, that a KVKK art.9 basis is the Controller’s duty (06 F8).

3.3 The Processor informs the Controller if it believes an instruction infringes data protection law.

3.4 AI processing: by default no lead personal data is sent to AI models; prompts use placeholders filled after generation. Features that must process personal data (for example reply classification) run only where a transfer basis exists for the data subject’s region (06 F8, C-16). Where no transfer basis exists for a region, the feature is switched off for that region (Privacy Policy section 8.2).†

4. Confidentiality

4.1 The Processor ensures that persons authorised to process the data are bound by confidentiality (GDPR Art.28(3)(b)). Platform administrators do not read Controller content except in a logged, time-limited support session started under the Terms.

5. Security of processing

5.1 The Processor implements technical and organisational measures appropriate to the risk (GDPR Art.28(3)(c)). Measures are summarised in Annex B.

5.2 KVKK: under KVKK art.12/2 the Controller and the Processor share responsibility for data security. The Processor’s measures in Annex B form its part of that responsibility, and the Controller remains responsible for its own configuration, user access and credentials.

6. Sub-processors

6.1 The Controller gives a general authorisation for the sub-processors in Annex C (GDPR Art.28(2)). The authorisation is general, with a notice period and a right to object (section 6.3).

6.2 The Processor imposes on each sub-processor data protection obligations equivalent to this DPA (GDPR Art.28(4)) and remains liable for them.

6.3 The Processor gives 30 days’ notice of additions or replacements, and the Controller may object on reasonable data protection grounds. If the Processor cannot accommodate the objection, the Controller may stop using the affected feature or end the service concerned before the change takes effect.†

7. Data subject requests

7.1 The Processor helps the Controller answer data subject requests (access, rectification, erasure, objection) through the Service’s request tools and the per-tenant export (GDPR Art.28(3)(e)). If a data subject writes to the Processor about Controller data, the Processor forwards the request to the Controller without answering it on the merits, unless the request concerns the Processor’s own data.

7.2 Response periods the Controller must meet: one month under GDPR and UK GDPR (Art.12(3)), 30 days free of charge under KVKK art.13/2 (06 F1.3, F2).

8. Assistance with DPIAs and consultations

8.1 The Processor assists the Controller with security, breach notification, impact assessments and prior consultation, taking into account the nature of processing (GDPR Art.28(3)(f)). The Service provides legitimate-interests-assessment and notice templates (06 C-06, C-13), and the Controller completes them.

9. Personal data breaches

9.1 The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting Controller data, with the information available. † (06 sets no numeric deadline.)

9.2 The Controller decides whether to notify authorities and data subjects. For KVKK, the allocation of notifications follows the law and this DPA. Under KVKK art.12/5 the Controller notifies the data subject and the Board as soon as possible, and the Processor supports it with the information it holds.†

10. Return and deletion

10.1 After the end of the service the Controller can export its data during the deletion grace period of 30 days. After that the Processor deletes the data, revokes OAuth tokens, and destroys the tenant’s encryption keys (GDPR Art.28(3)(g)).

10.2 The Processor keeps only what the law requires, platform audit logs and hashed global suppression entries (hard bounces, complaints, abuse, requests sent to the Processor). Backups expire after the backup retention period, which is set when the hosting provider is selected.†

10.3 Retention within the active service follows the proposed defaults in the Privacy Policy (lead pool candidates 30 days; non-responders anonymised or deleted 12 months after the last outbound step; consent records valid plus 3 years). The Controller may adjust them within the limits the Service allows.

11. Audits and information

11.1 The Processor makes available the information needed to show compliance and allows audits by the Controller or its auditor (GDPR Art.28(3)(h)), on reasonable prior written notice, at reasonable times, in a way that does not disrupt operations or expose other customers’ data. Each party bears its own costs.†

12. International transfers

12.1 Transfers of Controller personal data to a country without an adequacy decision take place only under a lawful mechanism. The mechanism depends on the origin of the data and on hosting and sub-processor locations (Annex D).

12.2 EU/EEA data: EU Standard Contractual Clauses, Module 2 (controller to processor) between Controller and Processor where the Processor is outside the EEA, and Module 3 (processor to processor) with sub-processors outside the EEA, supported by a transfer impact assessment (06 F8).

12.3 UK data: the UK Addendum to the EU SCCs, or transfers to the EU (the EU has UK adequacy and the UK recognises the EU) (06 F8).

12.4 Turkish data: a transfer under KVKK art.9 requires an art.5 or art.6 basis plus an adequacy decision, appropriate safeguards or an occasional-only exception. The standard contract (Module 2 controller to processor between Controller and Processor, Module 3 processor to processor with sub-processors) is used without any change and is notified within 5 business days of signature (Law art.9/5; Transfer Regulation art.14/3 and 14/5). The exporter notifies unless the parties agree otherwise; the parties agree that each gives the other the information needed to notify in time.† Explicit consent (art.9/6-a) is for occasional transfers only and is not a basis for the product’s regular flows.

12.5 Hosting the platform in the EU makes Turkish tenant data a KVKK art.9 transfer. Hosting in Türkiye makes EU tenants’ data a GDPR Chapter V transfer (Türkiye has no adequacy decision). Region-pinned hosting avoids both. The hosting provider and region are not yet selected (ADR-008) and the first release has no region pinning; for Turkish tenant data the KVKK standard contract path applies.†

12.6 The Processor’s AI provider DPA incorporates EU SCC Modules 2 and 3, the UK Addendum and a Swiss Addendum; it does not offer the KVKK standard contract or a DPF listing. Whether any AI vendor would sign the KVKK standard contract is DOĞRULANAMADI (06 F8).

13. KVKK-specific provisions

13.1 Where KVKK applies, the Controller is the veri sorumlusu and carries the notice duty (art.10), the VERBİS duty if applicable (art.16) and data subject responses (art.13). The Processor assists as set out in sections 7 to 9.

13.2 The Processor acts only on the Controller’s instructions and does not process for its own purposes, except for the platform-level suppression described in section 1.4.

13.3 VERBİS: each party assesses its own registration duty under KVKK art.16. Domestic controllers are exempt below 50 employees and an annual balance-sheet total of 100 million TL unless special-category data is their main activity, and controllers established abroad are listed as obliged to register regardless of size (06 F1.3). Whether the Processor must register is for the lawyer to confirm.†

14. Liability, term and precedence

14.1 Liability under this DPA follows the Terms of Service (section 14), subject to mandatory law, including data subject rights that cannot be limited.†

14.2 This DPA lasts as long as the Processor processes Controller personal data. The parts that must survive (deletion, confidentiality) survive.

14.3 If the SCCs, the UK Addendum or the KVKK standard contract conflict with this DPA, those instruments prevail for the transfers they cover. Otherwise this DPA prevails over the Terms for data protection matters.

15. Annex A: Description of processing

16. Annex B: Technical and organisational measures

16.1 The measures below are checked against the accepted architecture decisions before the Service goes live.† Summary of the measures planned in the architecture decisions (not yet final; ADR status is “proposed”):

• tenant isolation in the database with forced row-level security and mandatory tenant context;
• encryption of stored credentials with per-tenant data keys wrapped by a platform key;
• administrators cannot read content without a logged support session;
• append-only audit logs;
• no secrets in logs;
• retention jobs and deletion lifecycle as in section 10.

17. Annex C: Sub-processor list

18. Annex D: Transfer mechanisms by data origin

19. Notes for the reviewing lawyer

• Hosting residency and the AI transfer basis are open (TODO-Faruk 2d-b, 2d-c); Annexes C and D name no provider until then.
• Confirm that the tenant-admin switch is a sufficient “documented instruction” for GDPR Art.28(3)(a) and for KVKK purposes (06 F8).
• Confirm KVKK art.12/2 joint security responsibility wording and who files the standard-contract notification (06 R4).
• Breach-notice period, audit conditions, liability allocation and sub-processor change process have no figures in 06; the lawyer sets them.
• Confirm whether a Swiss Addendum is needed for the product’s customers.
• Filled 2026-10-27 (F1-89) from content-input/company.md: name, tax office and number, address and e-mail addresses. It is a sole proprietorship, so there is no MERSIS number; the tradesperson or trader status is for the accountant to confirm. The mailboxes hello@, support@, privacy@, billing@ and security@gondero.com are open. legal@, abuse@, postmaster@, dmarc@ and no-reply@ do not exist yet, so hello@gondero.com is used for legal notices and abuse reports until they do. Statements in the header that the company country is unknown are superseded (Türkiye); the options were decided on 2026-10-27. All placeholders were closed on 2026-10-27 (F1-64); the status table is in README.md.
• † Clauses awaiting lawyer confirmation: 3.4, 6.3, 9.1, 9.2, 10.2, 11.1, 12.4, 12.5, 13.3, 14.1, §15, 16.1.