Data Processing Agreement

Effective date: [DOLDURULACAK] · Last updated: [DOLDURULACAK]

This Data Processing Agreement (the "DPA") forms an integral part of the Terms of Service and Subscription Agreement (the "Agreement") and enters into force upon electronic acceptance of the Agreement, without the need for a separate signature.

Parties

Controller: the business that accepts the Agreement and subscribes to the Service (the "Customer").
Processor: [DOLDURULACAK] (Leadivo), MERSIS no. [DOLDURULACAK], address [DOLDURULACAK], email [DOLDURULACAK], KEP [DOLDURULACAK] (the "Company").

1. Definitions

Terms used but not defined in this DPA have the meaning given in the Agreement. In addition:

Personal Data, Data Subject, Processing, Controller, Processor, Explicit Consent: have the meanings given in Art. 3 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where applicable, Art. 4 of Regulation (EU) 2016/679 ("GDPR").
Data Protection Law: KVKK and its secondary legislation, the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad (the "Transfer Regulation"), decisions of the Turkish Personal Data Protection Board (the "Board") and, where applicable, the GDPR and the relevant laws of EU Member States.
Message Law: Turkish Law No. 6563 on the Regulation of Electronic Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages (the "Message Regulation").
Customer Personal Data: the personal data processed by the Company on behalf of the Customer in providing the Service, as described in Annex 1.
Sub-processor: a third-party processor engaged by the Company to process Customer Personal Data.
Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data; including the acquisition of data by others through unlawful means within the meaning of Art. 12(5) KVKK.
Turkish Standard Contract: the standard contract texts published by the Board under Art. 9(4) KVKK and the Transfer Regulation.
EU SCCs: the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

2. Scope and precedence

2.1. This DPA applies to the Company's processing of Customer Personal Data on behalf of, and on the instructions of, the Customer in providing the Service.

2.2. Customer account, User and subscription data, which the Company processes as controller, are outside the scope of this DPA and are processed under the Privacy Policy.

2.3. For matters concerning personal data protection, this DPA prevails over the Agreement. In the event of conflict between the EU SCCs incorporated under Annex 4 and this DPA, the EU SCCs prevail.

3. Roles of the parties

3.1. The Customer is the controller, deciding on the purposes and essential means of processing Customer Personal Data, namely which persons in which industries, job titles, company sizes and regions are contacted with which offer. The Company is the processor, processing such data solely on behalf of and on the instructions of the Customer.

3.2. The Company's review of Targeting Segments for compliance with law and deliverability rules is part of its duty not to follow unlawful instructions and does not make the Company a controller.

3.3. Data source (Apollo.io). Business contact data about Recipients is obtained by the Company on behalf of the Customer, on the Customer's instruction, from the database of ZenLeads, Inc. d/b/a Apollo.io ("Apollo"). Apollo is an independent controller that compiles and processes its own database for its own purposes and on its own legal bases; it is not a processor of the Customer or the Company. The Customer is the controller in respect of the use of data obtained from Apollo within the Service.

3.4. Customer's own service providers. Cal.com, used by the Customer under its own account, and any Slack workspace connected by the Customer to receive notifications, are services chosen by and contracted directly with the Customer; they are not Sub-processors of the Company. When transmitting data to or receiving data from these services, the Company acts on the Customer's instructions. Transfer obligations relating to these services rest with the Customer.

3.5. Payment provider. LemonSqueezy is an independent controller for payment and billing data and is outside the scope of this DPA.

4. Customer obligations

The Customer agrees and undertakes:

a) that a legal basis under Data Protection Law exists for processing Customer Personal Data, and that it has reviewed the legitimate interest assessment in Annex 5 and adopted it, adapted to its own activity; b) that it instructs the Company to fulfil the information duty under Art. 10 KVKK and Art. 14 GDPR by means of the Recipient Privacy Notice published by the Company on the Customer's behalf and the link included in each email; and that it will check that the notice accurately reflects its processing and request changes if necessary; c) to assess whether it is required, as controller, to register with the Turkish Data Controllers' Registry (VERBIS) and, if so, to register; d) to fulfil its obligations as service provider under the Message Law, including IYS registration, registering merchant/tradesperson addresses with IYS, checking and notifying opt-outs, and record keeping, in accordance with Section 7 of the Agreement; e) that its instructions to the Company comply with Data Protection Law and the Message Law; f) not to include special categories of personal data in targeting criteria or content entered into the Platform; g) to respond to data subject requests made directly to it within the periods set by Data Protection Law.

5. Instructions

5.1. The Company processes Customer Personal Data only on the Customer's documented instructions. The Agreement, this DPA, Targeting Segments approved on the Platform, campaign and notification settings, and the Customer's written instructions (including by email) constitute the Customer's documented instructions.

5.2. If the Company considers that an instruction infringes Data Protection Law or the Message Law, it informs the Customer without delay and may suspend the relevant processing until the instruction is clarified or changed.

5.3. Where the Company is required to process data by Turkish law or other law to which it is subject, it informs the Customer of that requirement before processing, unless that law prohibits such information.

6. No processing for the Company's own purposes

6.1. The Company does not use Customer Personal Data for its own purposes; it does not sell or rent it, share it with other customers or combine it with other customers' data.

6.2. The Company may produce anonymised, aggregated statistics from Customer Personal Data, which do not allow identification of any data subject or the Customer, for the purpose of improving and securing the Service. Anonymised data is not personal data.

6.3. The Company does not use Customer Personal Data to train AI models and works with AI Sub-processors on terms under which content submitted through the API is not used for model training by default.

7. Confidentiality and personnel

7.1. The Company restricts access to Customer Personal Data to personnel who need to know it to provide the Service and who are under written confidentiality obligations or a statutory duty of confidentiality.

7.2. The Company informs its authorised personnel about data protection and removes access rights without delay upon a change of role or departure.

8. Sub-processors

8.1. General authorisation. The Customer gives the Company general authorisation to use the Sub-processors listed on the Sub-processors page and in Annex 3.

8.2. Notice of changes. At least 15 days before adding or replacing a Sub-processor, the Company informs the Customer by updating the Sub-processors page and sending a notice to the Customer's registered email address. Where an urgent change is necessary for the continuity or security of the Service, notice is given immediately and the objection period runs from the change.

8.3. Objection. The Customer may object in writing, on reasonable grounds relating to Data Protection Law, within 15 days of the notice. The Parties consider the objection in good faith. If the Company cannot offer a reasonable alternative, the Customer may terminate the Agreement in respect of the part of the Service requiring the objected Sub-processor and request a refund of the prepaid fee for the unused period (Cancellation and Refund Policy Section 6).

8.4. Flow-down. The Company enters into a written contract with each Sub-processor, or accepts the Sub-processor's standard terms, imposing data protection obligations no less protective than those in this DPA.

8.5. Liability. The Company remains liable to the Customer for its Sub-processors' failure to fulfil their data protection obligations as for its own acts, within the limits of Section 19 of the Agreement.

8.6. Sub-processors' sub-processors. Some Sub-processors use their own sub-processors (e.g. Instantly.ai hosting Sending Mailboxes on Google LLC's Google Workspace infrastructure; mailbox service: Instantly.ai DFY (Google Workspace)). Significant sub-processors in this chain are listed on the Sub-processors page.

9. International transfers

9.1. KVKK. Customer Personal Data is transferred outside Türkiye (in particular to the United States) because of the Sub-processors listed in Annex 3. The Customer instructs these transfers. Under Art. 9 KVKK and the Transfer Regulation, the Company relies on:

a) an adequacy decision of the Board for the destination country or sector, where one exists; b) in the absence of an adequacy decision, the Turkish Standard Contract for transfers from processor to processor, signed unchanged with each foreign Sub-processor and notified to the Turkish Personal Data Protection Authority within five business days of signature; c) the required notifications in case of amendment, change of parties or termination of a Turkish Standard Contract.

The Company provides the Customer with information on the relevant transfer safeguards on request.

9.2. Transfer from the Customer to the Company. If the Customer is established in Türkiye, transfer from the Customer to the Company is domestic. If the Customer is established outside Türkiye, it is responsible for providing the transfer mechanism required by its own law; for Customers established in the European Economic Area, Switzerland or the United Kingdom, Annex 4 applies.

9.3. Place of processing. The database in which Customer Personal Data is primarily stored is located in the [DOLDURULACAK] region. Sub-processors' processing locations are listed in Annex 3.

10. Security

10.1. Under Art. 12 KVKK and Art. 32 GDPR, the Company implements the technical and organisational measures in Annex 2, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risk of varying likelihood and severity for the rights and freedoms of data subjects.

10.2. The Company may update these measures in line with technological developments, provided that updates do not reduce the overall level of security.

10.3. Under Art. 12(2) KVKK, the Company is jointly responsible with the Customer for taking measures to secure Customer Personal Data.

11. Assistance with data subject requests

11.1. The Company assists the Customer in responding to requests under Art. 11 KVKK and Arts. 15–22 GDPR through Platform features (viewing, export, adding to the Suppression List) and, where necessary, by providing the relevant records within 5 business days of a request.

11.2. Requests concerning Customer Personal Data received directly by the Company are forwarded to the Customer within 2 business days, to the extent the relevant Customer can be identified. The Company does not answer the substance of such requests without the Customer's instruction, but may inform the data subject that the request has been forwarded to the relevant controller.

11.3. Opt-outs and objections. The Customer instructs the Company to apply immediately, without seeking the Customer's prior approval, Recipients' requests to opt out of emails and objections to processing for marketing purposes, through whatever channel they are received. The Company adds them to the Suppression List and the sending provider's block list and informs the Customer.

11.4. For erasure requests, the Company deletes the Recipient's data on the Customer's instruction but keeps the minimum Suppression List record (one-way hash of the email address, date and channel) needed to ensure the data subject is not contacted again.

12. Personal Data Breach

12.1. The Company notifies the Customer of a Personal Data Breach affecting Customer Personal Data without undue delay and in any case within 48 hours of becoming aware of it.

12.2. The notification includes, to the extent then known, the nature of the breach, the categories of data and approximate number of data subjects concerned, the likely consequences, the measures taken or proposed and a contact person. Where information cannot be provided at once, it is provided in phases without undue delay.

12.3. Under Art. 12(5) KVKK and the Board's Decision No. 2019/10 of 24 January 2019, the obligation to notify the Board within 72 hours and data subjects as soon as reasonably possible rests with the Customer as controller; the same principle applies to notifications under Arts. 33–34 GDPR. The Company provides the information and documents necessary for the Customer to make these notifications and cooperates reasonably. The Company does not notify data subjects or authorities on the Customer's behalf without the Customer's instruction or a legal requirement.

12.4. The Company immediately takes the measures necessary to mitigate the effects of the breach and keeps records of the breach.

12.5. Notification of a breach by the Company does not constitute an acknowledgement of fault or liability.

13. Other assistance

Taking into account the nature of processing and the information available to it, the Company provides reasonable assistance to the Customer with data protection impact assessments, prior consultation with the Board or supervisory authorities and information requests from such authorities. For assistance beyond the ordinary scope, the Company may request reimbursement of its reasonable costs.

14. Retention, deletion and return

14.1. During the Agreement, Customer Personal Data is retained according to the periods in Annex 1 and automatically deleted or anonymised at the end of those periods.

14.2. Upon termination of the Agreement, the Customer may export its data or request its return from the Company within 30 days. Within at most 30 days after the end of that period, the Company deletes Customer Personal Data from its live systems; copies in backups are deleted within the normal backup cycle, at most 30 days.

14.3. To support the evidentiary obligation under Art. 13 of the Message Regulation and to prevent messages being sent again to persons who opted out, the Customer instructs the Company to reduce Suppression List records, within 60 days of termination at the latest, to minimal form (one-way hash of the email address, opt-out date and channel) and to retain them for 3 years from termination. The Customer may request in writing the export and earlier deletion of these records; in that case responsibility for the evidentiary obligation rests with the Customer.

14.4. On request, the Company confirms in writing that deletion has been completed.

14.5. Data that must be retained by law is kept only for the period and purpose required by that obligation and is not processed for other purposes.

15. Audit and information

15.1. The Company provides the Customer on request with the information necessary to demonstrate compliance with this DPA (summary of security measures, Sub-processor list, transfer safeguards, policies and procedures).

15.2. Where the Customer reasonably demonstrates that such information is insufficient, a Personal Data Breach has occurred or a competent authority so requires, the Customer may, on at least 30 days' written notice, no more than once a year, during business hours and without disrupting the Company's operations, carry out an audit itself or have it carried out by an independent auditor bound by confidentiality. Audit costs are borne by the Customer; if the audit reveals a material breach by the Company, the Company bears its own reasonable costs.

15.3. Audits do not extend to other customers' data, the Company's trade secrets or Sub-processors' facilities. For Sub-processors, audit rights are satisfied by the audit reports and certifications they publish.

15.4. The audit and investigation powers of the Board and supervisory authorities are reserved.

16. Liability

16.1. The Parties' liability under this DPA is subject to Sections 19 and 20 of the Agreement. These limitations do not restrict liability owed directly to data subjects under mandatory Data Protection Law.

16.2. Each Party is liable for its own breaches of Data Protection Law. The Customer is liable for damage arising from its instructions or from its failure to fulfil its obligations as controller or service provider.

17. Term

This DPA remains in force for as long as the Agreement is in force and, after its termination, for as long as the Company continues to process Customer Personal Data.

18. Governing law and jurisdiction

This DPA is governed by Turkish law; Section 26 of the Agreement applies to disputes. The governing law and jurisdiction provisions of the EU SCCs incorporated under Annex 4 are reserved.

The Turkish version of this DPA (Veri İşleme Sözleşmesi) is authoritative; this English version is for information. For Customers to whom Annex 4 applies, the official English text of the EU SCCs governs.

Annex 1: Details of processing

Item	Description
Subject matter	Finding decision makers in the target market defined by the Customer, sending them personalised emails on behalf of the Customer, processing replies and recording meetings, for the business promotion of the Customer's own goods and services
Duration	Term of the Agreement and the deletion and retention periods in Section 14
Nature of processing	Obtaining (querying Apollo.io), recording, storage, organisation, AI-assisted text generation, transmission by email, receiving replies and AI-assisted classification, sending notifications, adding to the Suppression List, reporting, export, erasure
Purpose	The Customer's B2B sales development and direct marketing; applying opt-outs and objections; supporting compliance with the Message Law
Categories of data subjects	(i) Recipients: decision makers and employees at merchant/tradesperson businesses targeted by the Customer; (ii) other employees named in or forwarding Recipients' replies; (iii) persons booking meetings through the Customer's Cal.com account
Categories of personal data	Identity: first name, last name. Professional: job title, department, seniority, company name, industry, company size, company domain, LinkedIn profile URL where available. Contact: business email address. Location: city/country and time zone (for send timing). Marketing/transaction: campaign and segment information, sending status, email texts sent, send, open (where measured by the provider), bounce and reply events, reply texts and classification (positive/neutral/negative), opt-out/objection date. Meeting: attendee name, email address, meeting date and time, status.
Special categories	Not processed. If Recipients spontaneously disclose special-category data in a reply, it is stored only as part of the reply text and not processed for any other purpose.
Frequency	Continuous
Sub-processors	Annex 3

Retention periods (Customer's default instruction)

Data	Period
Recipient identity, professional and contact data	While the Recipient is active in a campaign and for 12 months after the last interaction (last send, reply or meeting); in any case the period in Section 14.2 after termination
Email texts sent and sending records	12 months from sending
Reply texts and classifications	12 months from receipt
Meeting records	12 months from the meeting date
Suppression List records	During the Agreement, as long as necessary to apply the opt-out/objection; minimum data (email address or one-way hash, date, channel). No later than 60 days after termination only the one-way hash, date and channel; 3 years from termination (Section 14.3)
Email address on the sending provider's block list	As long as the Company uses this sending infrastructure (to apply the opt-out permanently); email address only
Copies at the Sending Mailbox provider	Upon the Company's deletion instruction after the campaign or the Agreement ends, within the provider's deletion timelines
Content sent to AI providers	Not stored permanently by the Company; subject to the providers' limited-duration abuse-monitoring retention

Annex 2: Technical and organisational measures

Access control and authorisation

Row Level Security is enabled on all Customer tables in the database; Users can only see records linked to their own Customer ID.
Administrator access is restricted by role-based permissions and an allowlist defined in the server environment (least privilege).
The privileged database service key is used server-side only and is never sent to the browser or client code.
Login is via the authentication provider using a one-time link (magic link) or password; session cookies are set with the SameSite=Lax attribute, the Platform is served over HTTPS only, and session tokens are refreshed regularly.
Access rights are removed without delay upon change of role or departure.

Interface and integration security

Payment webhooks are verified with an HMAC-SHA256 signature and sending-provider webhooks with a shared secret; comparisons use timing-safe methods and requests are rejected if no secret is configured.
Scheduled job endpoints are protected with a secret bearer token.
Webhook events are de-duplicated against replay (idempotency).
Rate limiting keyed by IP address or email is applied at endpoints.
Webhook URLs entered by Customers are filtered against requests to local networks, private IP ranges and link-local addresses (SSRF).
Inputs pass schema-based validation; internal details are not shown to users in error messages.
AI outputs are validated by automated rules before sending (allowed link list, ban on link shorteners, length and content checks).

Encryption

All data transfers are encrypted with TLS.
Data at rest is encrypted at disk level by the database and hosting providers.
Secrets are not kept in source code; they are stored in the hosting provider's encrypted environment variables.

Data minimisation and segregation

Only business, professional contact data is processed; special-category data is not used for targeting.
Only the minimum data necessary for the task is sent to AI models.
Each Customer's data and Suppression List are logically separated; no data is shared between Customers. The only exception: the email address of a person who opts out, objects or replies negatively is also added to the workspace-level block list of the sending infrastructure provider (Instantly.ai DFY (Google Workspace)). That list applies to every Sender using the Company's sending infrastructure and prevents any message to that person through this infrastructure on behalf of any Sender; it holds only the email address, without any information about which Customer the opt-out was addressed to.
Reply texts in logs are limited to short excerpts.

Logging and monitoring

Critical operations (account creation, setup, segment approval, payment events, notifications, error states) are written to event and audit logs, retained for 12 months.
Errors and query failures are automatically reported to administrators.

Continuity and backup

Regular backups are performed by the database provider.
Setup and sending steps run independently; a failure in one step does not stop the others and is recorded.

Organisational measures

Personnel and advisers are under written confidentiality obligations; access is granted on a need-to-know basis.
A personal data breach response procedure is applied (detection, containment, assessment, notification to the Customer within 48 hours, record keeping).
Sub-processors are selected for their security and data protection safeguards, and a data processing agreement is concluded with each.
Data whose retention period has expired is deleted through a periodic destruction process.
Measures are reviewed at least annually and upon material changes.

Annex 3: Sub-processors and transfer safeguards

The current and binding list is on the Sub-processors page. As of publication, the Sub-processors processing Customer Personal Data are:

Sub-processor	Purpose	Location	KVKK transfer safeguard	GDPR transfer safeguard
Supabase Inc.	Database, authentication	[DOLDURULACAK]; support access from the US	Turkish Standard Contract (processor to processor) + 5-business-day notification	EU SCCs Module 3 / provider's DPA
Vercel Inc.	Application hosting, serverless functions	[DOLDURULACAK] and US	Turkish Standard Contract + notification	EU SCCs / EU-US Data Privacy Framework (DPF), where available
Instantly.ai (Foo Monk, LLC)	Sending domains and mailboxes, warm-up, sending, reply ingestion, block list	US; mailboxes on Google Workspace infrastructure (mailbox service: Instantly.ai DFY (Google Workspace))	Turkish Standard Contract + notification	EU SCCs Module 3
Anthropic PBC and/or OpenAI	Email text generation, reply classification	US	Turkish Standard Contract + notification	EU SCCs / DPF, where available
Resend (Plus Five Five, Inc.)	Positive-reply and meeting notification emails	US	Turkish Standard Contract + notification	EU SCCs / DPF, where available
Slack Technologies, LLC	The Company's internal administrator alerts (error and approval notices; limited data)	US	Turkish Standard Contract + notification	EU SCCs / DPF, where available

Annex 4: Additional terms for Customers in the European Economic Area, Switzerland and the United Kingdom

GDPR Art. 28(3). This DPA contains the minimum elements listed in Art. 28(3) GDPR: processing on instructions (Section 5), confidentiality (Section 7), security (Section 10, Annex 2), sub-processor conditions (Section 8), assistance with data subject rights (Section 11), assistance with Arts. 32–36 obligations (Sections 12, 13), deletion or return (Section 14), information and audits (Section 15).
Incorporation of the EU SCCs. As there is no EU adequacy decision for Türkiye, Module 2 (controller to processor) of the EU SCCs is incorporated by reference into this DPA and deemed concluded between the Customer (data exporter) and the Company (data importer). Selections: Clause 7 (docking clause) does not apply; Clause 9(a) Option 2 (general authorisation, 15 days' prior notice); the optional language in Clause 11(a) does not apply; Clause 13: the supervisory authority of the Member State in which the Customer is established or, where the Customer is not established in the EU but falls under Art. 3(2) GDPR, the supervisory authority of the Member State in which its representative is located; Clause 17: Irish law; Clause 18: the courts of Ireland. Annexes I and II of the EU SCCs are deemed completed by Annexes 1 and 2 of this DPA, and Annex III by Annex 3.
Onward transfers. For onward transfers to Sub-processors in the United States, the Company relies on Module 3 (processor to processor) of the EU SCCs or the relevant Sub-processor's certification under the EU-US Data Privacy Framework.
Switzerland. For transfers subject to the Swiss Federal Act on Data Protection, the EU SCCs apply with the adaptations that the term "Member State" includes Switzerland and the competent supervisory authority is the Federal Data Protection and Information Commissioner.
United Kingdom. For transfers from the United Kingdom, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner applies.
Transfer impact assessment. The Company provides reasonable information for the Customer's transfer impact assessment under Clause 14 of the EU SCCs.
Electronic marketing. The Customer is responsible for checking whether the rules transposing Directive 2002/58/EC in the targeted Member States require prior consent for messages to business recipients.

Annex 5: Legitimate interest assessment summary

This summary is prepared as a basis for the Customer's assessment under Art. 5(2)(f) KVKK and Art. 6(1)(f) GDPR. The Customer is responsible for adapting it to its own activity.

1. Purpose test. The Customer's legitimate interest is to present its goods and services to relevant decision makers at businesses likely to have a reasonable business interest in them and to build new business relationships. Recital 47 GDPR recognises direct marketing as a possible legitimate interest; in Turkish law, Art. 6(3) of the Message Regulation does not require prior consent for messages to merchants and tradespeople.

2. Necessity test. Processing is limited to what is necessary for that purpose: only professional contact data (name, job title, company, business email address) is used; no special-category data is processed; at most three messages (first email and two follow-ups) are sent per person; targeting is limited to industries and job titles relevant to the Customer's service.

3. Balancing test.

Reasonable expectations: persons involved in purchasing or business development decisions by virtue of their professional role can reasonably expect to receive business offers relevant to their area at their business email address.
Impact: processing is low-risk; no decision with legal effects is taken about the person; the number of messages is limited.
Safeguards: the first message includes the sender's identity and a link to the Recipient Privacy Notice; every message includes a one-click opt-out link and the option to reply "unsubscribe"; opt-outs and objections are applied immediately and permanently; data is deleted after 12 months; no data is shared between Customers; strong security measures apply.
Vulnerable groups: consumers, children or vulnerable groups are not targeted.

Conclusion: As long as these safeguards are applied, the Customer's legitimate interest is not overridden by the interests or fundamental rights and freedoms of the data subjects. The assessment must be repeated if the targeting scope is widened, the number of messages increased or new data categories added.