Data Processing Agreement

This Data Processing Agreement (the "DPA") is part of the Terms of Use between AVİOS DANIŞMANLIK VE TİCARET ANONİM ŞİRKETİ (the "Processor") and the organisation that uses AviosXR CRM (the "Controller"). The member who creates or joins the organisation, or who uploads Customer Data, accepts it on the Controller's behalf. It applies to personal data in Customer Data under KVKK (Art. 12) and, where applicable, GDPR (Art. 28).

1. Subject, nature and purpose

The Processor stores and processes Customer Data only to provide the Service to the Controller: keeping original transcript files, structuring them into transcripts, producing AI-assisted analysis drafts on the Controller's request, showing them to authorised members, recording reviews and approvals, and deleting data when instructed.

2. Data and data subjects

• Data subjects: meeting participants, the Controller's customers and their staff, other persons mentioned in meetings, and the Controller's members.
• Personal data: names, job titles, company details, contact details and any information said in the meeting and contained in the transcript; speaker names and timestamps; customer names; member names on reviews and approvals.
• Special categories: not intended. The Controller must not upload them without a specific legal basis.

3. Duration

This DPA lasts as long as the Processor processes Customer Data for the Controller.

4. Controller's obligations

The Controller confirms that it:

• has a lawful basis for the processing, including the upload of transcripts and their AI analysis;
• has informed meeting participants and other data subjects as the applicable law requires (for KVKK, Art. 10; for GDPR, Art. 13 and 14) and obtained consent where consent is required, including for recording the meeting;
• uploads only data that it is entitled to provide;
• handles requests from data subjects concerning Customer Data.

5. Processor's obligations

The Processor will:

• process Customer Data only on the Controller's documented instructions, which are given through the use of the Service, these Terms and this DPA, unless the law requires otherwise; in that case it informs the Controller unless the law forbids it;
• ensure that persons authorised to process Customer Data are bound by confidentiality;
• implement appropriate technical and organisational measures (Annex);
• assist the Controller, as far as reasonably possible, in answering data subject requests, in security matters, in data protection impact assessments and in consultations with authorities;
• notify the Controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Customer Data, so that the Controller can meet its own notification duties (72 hours under KVKK Board Decision 2019/10 and GDPR Art. 33);
• make available the information necessary to demonstrate compliance and allow reasonable audits, with reasonable notice and at most once a year unless a breach or an authority requires otherwise;
• at the end of the Service, delete Customer Data within 30 days, unless the law requires storage. Before closing the organisation the Controller can ask for a copy of its Customer Data.

6. Sub-processors

The Controller authorises the sub-processors listed in the Privacy Notice: DigitalOcean (servers and database, Frankfurt), Cloudflare (network proxy and R2 object storage, Western Europe), OpenAI (AI analysis), Resend (email) and Sentry (error tracking, Frankfurt). The Processor binds each sub-processor to data protection obligations no less protective than this DPA and remains responsible for them. The Processor will announce a new or replacement sub-processor in the Service at least 14 days in advance; the Controller may object on reasonable data protection grounds and, if no solution is found, terminate the Service.

7. International transfers

Some sub-processors are located outside Türkiye and the EEA. Transfers are made under the safeguards described in the Privacy Notice (KVKK standard contracts under Art. 9; EU Standard Contractual Clauses or an adequacy decision under GDPR). [PLACEHOLDER: where KVKK standard contracts are signed between the Controller and the Processor, or between the Processor and its sub-processors, the Processor notifies the Authority within five business days as required.]

8. Liability and precedence

Liability under this DPA follows the Terms of Use, except where the law does not allow it to be limited. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data.

Annex: technical and organisational measures

• Access to an organisation's data requires an authenticated session, verified email address and current membership with the right role; every request is checked on the server.
• Transport encryption (HTTPS) between browsers and the Service in production.
• Passwords stored only as one-way hashes; email payloads with sign-in links encrypted at rest in the outbox.
• Original files are immutable and identified by checksum; every processing step is scoped to the organisation that owns the data.
• Rate limits and quotas on sign-in, uploads, processing and email.
• AI requests are sent with provider-side storage disabled, and only the transcript text, the organisation's questions and its context are sent.
• Daily database backups and a backup before every deployment, deleted after 30 days; administrative tools behind authenticated, TLS-protected access.
• Servers and database in Frankfurt, Germany; transcript files in Cloudflare R2 in Western Europe.
• [PLACEHOLDER: encryption at rest, staff access policy, logging and monitoring, business continuity.]