Data Processing Agreement (DPA)

Standard agreement between Data Controller (Customer) and Data Processor (Teknik Danışman) under KVKK Art. 12/5 and GDPR Art. 28.

1. Parties and Definitions

• Data Controller / "Customer": The legal entity (tenant) using the Teknik Danışman panel.
• Data Processor / "Service Provider": Ali Enis Tekin (operator of the Teknik Danışman platform), registered address: ADNAN KAHVECİ MAH. HASBAHÇE CAD.
  HASBAHÇE HASBAHÇE SİTESİ A2 BLOK NO: 1 A İÇ KAPI NO: 3
  Beylikdüzü / İstanbul 34528.
• Data Subject: The natural person whose data is processed (typically the Customer's employee or business partner).
• Personal Data: As defined in KVKK Art. 3 and GDPR Art. 4(1).
• Processing: As defined in KVKK Art. 3 and GDPR Art. 4(2).
• Sub-processor: Third parties engaged by the Service Provider to process data within the scope of the service (hosting, email, payment, etc.).

2. Subject Matter, Duration, Nature and Purpose of Processing

Categories of Personal Data Processed

• Employee identity information (name, Turkish ID no. — only if uploaded by the Customer)
• Contact details (email, phone)
• Employment details (position, department, start/end dates, leave/warning records)
• Hardware/assignment records (device serial, assigned employee)
• Software license information
• System access and audit log data
• Technical access credentials stored on the Customer's behalf — network configuration, modem/router panel and service credentials (AES-256 encrypted)
• Employee software-usage data (Shadow SaaS detection), only where the Customer enables this feature
• Device inventory and installed software details, signed-in user name (inventory agent — only where the Customer installs it)
• Help desk agent performance summaries — agent name, email, departments, daily ticket counts and average response/resolution times, open/on-hold/past-SLA ticket counts taken at each sync (once a day by default, at most every 6 hours as chosen by the Customer) (CRM connection — only where the Customer connects its own CRM help desk; ticket content is not read)

Categories of Data Subjects

• Employees of the Customer
• Business partners / service recipients of the Customer
• Supplier representatives of the Customer

3. Obligations of the Data Processor

The Service Provider commits to:

• Process data only under the Customer's written instructions. This DPA and the Service Agreement count as written instructions.
• Ensure confidentiality of the data and assign only personnel under confidentiality obligations.
• Apply appropriate technical and organisational measures under KVKK Art. 12 and GDPR Art. 32 (details in the Trust Center).
• Assist the Customer in fulfilling Data Subjects' rights requests.
• Reasonably assist the Customer's audit rights (a free self-assessment audit report once a year).
• Notify the Customer of any data breach within 72 hours.
• Upon termination, return or permanently delete the data at the Customer's choice.

4. Obligations of the Customer

The Customer commits to:

• Obtain the necessary explicit consents / privacy notices from Data Subjects under KVKK Art. 10.
• Only upload data that has been lawfully obtained and is appropriate for the processing purpose.
• Protect account access credentials and notify the Service Provider of unauthorised access.
• State in the privacy notice provided to Data Subjects that the Service Provider will process data as a Data Processor.
• Inform the users of the computers on which it installs the inventory agent in accordance with KVKK Art. 10.
• Before connecting its CRM help desk, inform the help desk agents whose performance is measured in accordance with KVKK Art. 10 (a template is published at crm_aydinlatma.php) and not base decisions concerning employees solely on the scorecard.

5. Sub-processors

The Customer generally approves the use of the following sub-processors. When a new sub-processor is added, the Customer is notified at least 30 days in advance and reserves a reasonable right to object.

Browser notifications: when a user turns on browser notifications on their own device, panel notifications are delivered through the push service of the browser maker (Google, Microsoft, Apple or Mozilla). The content is end-to-end encrypted on our server before it is sent (RFC 8291); the push service carries only encrypted data it cannot read and does not process its content. Turning them on is the user's choice.

CRM connection: when the Customer connects its own CRM help desk (e.g. Zoho Desk), the platform reads only summary figures and the agent/department list, read-only, with the authorisation the Customer grants on the CRM's own screen. The CRM provider is the Customer's own service provider under the Customer's agreement and is not a sub-processor of the Service Provider. When a Customer administrator requests AI recommendations, the month's summary figures are sent to the AI sub-processors listed in the Privacy Policy with each agent replaced by a code; agent name, email and agent ID are not sent and the code is matched to the agent only on the platform. The data is deleted in full when the Customer disconnects the CRM.

6. International Data Transfers

The following safeguards apply for transfers under KVKK Art. 9 and GDPR Chapter V:

• EU hosting (Hetzner, Germany): The application and all tenant databases are hosted within the EU. Transfer is safeguarded by the provider's data processing agreement (AV-Vertrag) and the EU Standard Contractual Clauses (SCC 2021/914); appropriate safeguards under KVKK Art. 9 apply.
• US transfers (Groq, Microsoft, Google email, Sentry, Cloudflare, Meta): Signed EU Standard Contractual Clauses (SCC 2021/914)
• Amazon Web Services (Amazon S3, Amazon Bedrock): AWS data processing addendum incorporating the EU Standard Contractual Clauses; storage and processing in the EU (Frankfurt)
• Google (Gemini API): Google's data processing addendum incorporating the EU Standard Contractual Clauses
• NVIDIA (API catalog, semantic search — question text only): no separate data processing agreement; governed by the provider's standard terms of use
• Sensitive (special-category) data is not transferred abroad

The KVKK Board Standard Contract filing for the EU hosting transfer is being completed; this section will be updated with the reference once filed.

7. Data Security — Minimum Standards

The Service Provider applies at minimum the following measures:

• Encryption: TLS 1.2+ for data in transit; AES-256-CBC for sensitive fields at rest.
• Access control: Role-based access (RBAC), mandatory 2FA on admin accounts, detailed audit log.
• Isolation: Multi-tenant database isolation — each Customer has its own database.
• Backups: Hourly database backups + daily full backup (databases and files); encrypted (AES-256) off-site copies at two separate providers within the EU (Hetzner, AWS Frankfurt), the second immutable for 30 days. Restores are tested automatically every month.
• Incident response: 24/7 monitoring, reporting channel via security@teknikdanisman.net.
• Personnel: All personnel with access have signed confidentiality agreements.

8. Data Breach Notification

Upon detecting a breach affecting personal data security, the Service Provider will:

• Notify the Customer within 72 hours via email and panel notification.
• Include: nature of the breach, affected data categories, estimated number of Data Subjects affected, measures taken and planned.
• Share contact information for follow-up.

9. Audit and Transparency

The Customer's audit rights:

• May request a self-assessment audit report free of charge once a year.
• Enterprise customers may additionally conduct one on-site audit per year with 5 business days' prior notice (auditor must sign an NDA).
• SOC 2 Type 1 report (in preparation) will be provided free of charge once completed.

10. Termination

Upon termination, at the Customer's choice:

• Return: Data delivered within 30 days in machine-readable format (JSON, CSV).
• Deletion: All active data permanently deleted after 60 days; deleted from backups within 90 days.

If the Customer does not indicate a preference, the account is suspended 15 business days after the end of the paid period and the data is permanently deleted 60 days after suspension.

11. Liability

Party liability is subject to the limits set forth in the Service Agreement. Liability under KVKK Art. 12/5 and GDPR Art. 82 is reserved.

12. Governing Law and Jurisdiction

This DPA is governed by Turkish law. Istanbul Çağlayan Courts and Enforcement Offices have jurisdiction over disputes. The Customer's right to sue in its country of residence under GDPR is reserved.

13. Acceptance and Effect

By accepting the Service Agreement, the Customer is deemed to have accepted this DPA. Customers wishing to receive a signed copy can contact legal@teknikdanisman.net.

Note: This document is a legally binding template, but for specific needs (e.g. enterprise SSO integration, industry-specific compliance) a bespoke DPA can be signed between the parties.