DRAFT — not legal advice. Requires review by a qualified lawyer before use.
- Document: Sub-processors page (website route
/{l}/legal/subprocessors/, landing.md route 18) · Language: English · Version: 0.1 draft · Date: 2026-10-27 - Basis:
docs/research/13-hosting.md(Summary and Hostinger locations);docs/research/01-stack.md§15 and risk R7 (Anthropic);docs/research/15-payments-tr.mdF18 (PayTR);docs/research/06-legal-compliance.mdF8, F10, C-16;docs/decisions/ADR-004-lead-providers.mdD3;docs/decisions/ADR-006-sending-model.mdD1, D8;docs/decisions/ADR-007D9;content-input/company.md. Nothing here goes beyond those sources. All placeholders were closed on 2026-10-27 (F1-64) fromdocs/decisions/01-defaults-2026-10-27.mdand the research reports; sentences marked † still await lawyer confirmation. - Transfer mechanisms in the table (KVKK art.9, GDPR Chapter V) are labelled “lawyer to confirm”: this draft proposes none as final.
- Companion of the Data Processing Agreement, Annex C (
dpa.en.mdsection 17). Both lists must say the same thing.
1. Purpose and scope
1.1 This page lists the companies that process personal data for Faruk Sancak TiklaWeb Bilişim Hizmetleri (sole proprietorship) (“we”) when we provide the website and the platform, and the companies that look similar but are not our sub-processors. We update it before a change takes effect (section 4).
1.2 Status words used below: chosen (a provider is selected), not yet selected (no provider chosen; the row shows what the decision depends on) and not our sub-processor (the customer’s own relationship, or an independent controller).
2. Providers
| # | Provider | Service and purpose | Data categories | Location | Transfer mechanism (KVKK art.9 / GDPR Chapter V) | Status | Source |
|---|---|---|---|---|---|---|---|
| 1 | Hostinger | Hosting of the static marketing website; DNS of gondero.com. Mailboxes are planned on the same plan (to be confirmed) | Server logs: IP address, time, requested page, browser data; e-mails you send us | Not confirmed (DOĞRULANAMADI). Hostinger’s published VPS locations are FR, DE, LT, UK, IN, ID, MY, US and BR; none is in Türkiye. The data centre of the website plan is chosen at publication. | If the data centre is outside Türkiye the transfer rules apply. Mechanism: the KVKK standard contract path for data subject to KVKK, and the transfer rules of the visitor’s region otherwise (lawyer to confirm)† | Chosen (website not yet published) | 13 (Hostinger locations); company.md (DNS, mailboxes) |
| 2 | Anthropic | AI features (for example drafting text, classifying replies) | By default no lead personal data: prompts use placeholders filled after generation. Personal data only where a transfer basis exists for the person’s region | Inference region can only be global or us; there is no EU option | Anthropic’s DPA covers EU SCC Modules 2 and 3, the UK Addendum and Swiss law, not KVKK and not the Data Privacy Framework. Mechanism: for EU and UK data, the SCCs and the UK Addendum in its DPA; for KVKK none is known, so Turkish personal data is not sent unless the standard contract can be signed (DOĞRULANAMADI) (lawyer to confirm)† | Planned first AI adapter (AI decision: TODO 2d-c) | 01 §15, R7; 06 F8, C-16 |
| 3 | PayTR | Payment for subscriptions and credit packs | Buyer name, e-mail, phone, address and IP sent in the payment request; card data is typed on the PayTR page and does not reach our servers | PayTR names no foreign recipient in its notice | Not a sub-processor: PayTR acts as an independent data controller and no processor agreement is expected. Our disclosure basis contract performance (KVKK art.5/2-c) (proposed; lawyer to confirm)† | Not our sub-processor (independent controller) | 15 F18 |
| 4 | Product hosting provider | Hosting of the platform (application, database, storage) | All customer data | Not yet selected: it will be determined with ADR-008 | Not yet selected | Not yet selected | 13 Summary item 5; TODO 2m |
| 5 | Customer’s own mail provider (Google Workspace, Microsoft 365, or the customer’s SMTP/IMAP host) | Sending and reading the customer’s campaign e-mail through the customer’s own mailbox | Campaign content, recipient addresses, replies | Set by the customer’s own provider | Not a sub-processor: the customer’s own relationship; the platform acts on the customer’s instruction and never sends customer traffic through its own IPs or ESP accounts | Not our sub-processor | ADR-006 D1, Option A |
| 6 | Platform transactional e-mail provider (ESP) | Invitations, password resets, 2FA and billing or abuse alerts, from a separate platform domain; never customer campaign content | Platform user e-mail addresses | Not yet selected (candidates in ADR-006 D8: SES, Postmark, Resend, or the operator’s own SMTP relay) | Not yet selected | Not yet selected (TODO 2m-f, 2a-b) | ADR-006 D8 |
| 7 | Error monitoring provider | Technical error reports | Technical data, no secrets | Not yet selected (TODO 2m-e) | Not yet selected | Not yet selected | 13 Summary item 5; DPA Annex C |
| 8 | Lead data providers (commercial data APIs) | Finding leads, connected with the customer’s own account or key | Lead data that the provider returns to the customer | Set by each provider | Not a sub-processor of the platform: the customer is the provider’s customer and an independent controller; the platform processes on the customer’s documented instruction and records provenance | Not our sub-processor | ADR-004 D3; 06 F10 |
| 9 | Phone verification provider | One-time code to verify the workspace owner’s phone before the first send | Phone number of the workspace owner | Not yet selected. Candidates in ADR-007 D9: a domestic licensed provider for +90 numbers (Netgsm is the example read) and Twilio Verify for other numbers; a +90 number never goes to Twilio | Not yet selected (TODO 2l-f) | Not yet selected | ADR-007 D9 |
| 10 | Hostinger (unsubscribe mailbox) | Mailbox that receives “mailto” unsubscribe requests during the pilot, read by the platform over IMAP | Sender address and content of the unsubscribe e-mail | Not confirmed (DOĞRULANAMADI); same Hostinger data-centre question as row 1 | Same as row 1 (lawyer to confirm)† | Chosen for the pilot (decision 2026-10-27; own mail server later, subject to approval) | 01-defaults 16-3; 13 |
| 11 | Hyperping (status page) | Public status page with general components only | No customer personal data | Not assessed | Not applicable: no personal data is sent | Chosen (decision 2026-10-27); not a sub-processor for personal data | 01-defaults 17-1, 17-2 |
3. Notes on the rows
3.1 Rows 5 and 8 are listed so that you can see the whole picture. A customer who connects a mailbox or a data provider chooses that provider and is responsible for that relationship; the platform does not hold those accounts.
3.2 Row 2: our AI features are designed so that lead personal data is not sent to the model by default (Privacy Policy section 8; DPA section 3.4).
3.3 Row 3: card data is entered on PayTR’s page; we store only the references PayTR returns (token, last four digits, expiry, brand) (15 F18).
4. Changes to this list
4.1 We tell customers by e-mail 30 days before a new sub-processor starts or one is replaced (default of 2026-10-27; lawyer to confirm).† A customer may object on reasonable data protection grounds; the outcome is set in the DPA (DPA, section 6.3). The same value is used in DPA section 6.3 (30 days).
4.2 Rows marked “not yet selected” are filled in when the provider is chosen, with the notice in 4.1.
5. Contact
5.1 Faruk Sancak TiklaWeb Bilişim Hizmetleri (sole proprietorship), Atatürk Mahallesi Dilek Sokak No: 12 İç Kapı No: 5, Küçükçekmece / İstanbul, privacy@gondero.com.
6. Notes for the reviewing lawyer
- This draft is a proposal.
privacy@gondero.comis an open mailbox; the other addresses of the plan (legal@, abuse@) do not exist yet. - Confirm the transfer mechanism for every foreign row (KVKK art.9; GDPR Chapter V). Hostinger’s website data centre is DOĞRULANAMADI. Whether Anthropic or Hostinger would sign the KVKK standard contract is DOĞRULANAMADI (06 F8; 13 Summary item 4).
- Confirm that PayTR is an independent controller (15 F18 reads this from PayTR’s own notice; no statement makes PayTR a processor) and the disclosure basis.
- Confirm the notice period and objection outcome, and align DPA Annex C (
dpa.en.md) with this list. - No ADR note on the synthetic or masked data rule for AI was found; the rule comes from Privacy Policy section 8.1 and DPA section 3.4 (06 F8, C-16). Confirm it is binding on product design.
- Row 1 mailboxes: company.md mentions a Hostinger plan limit for mailboxes; whether the mailboxes are hosted there is to be confirmed.
- † Clauses awaiting lawyer confirmation: §2, 4.1.
Faruk Sancak TiklaWeb Bilişim Hizmetleri
Atatürk Mahallesi Dilek Sokak No: 12 İç Kapı No: 5, Küçükçekmece / İstanbul
hello@gondero.com
https://gondero.com/en/legal/subprocessors/