Sub-processors
Effective date: [DOLDURULACAK] · Last updated: [DOLDURULACAK]
This page lists the third-party service providers ("Sub-processors") that process personal data for [DOLDURULACAK] (the "Company") in providing the Leadivo service. The list is binding under Section 8 and Annex 3 of the Data Processing Agreement (the "DPA"). The Turkish version (Alt İşleyenler) is authoritative.
Notice of changes: at least 15 days before a Sub-processor is added or replaced, this page is updated and a notice is sent to Customers' registered email addresses. Customers may object in writing to [DOLDURULACAK] within 15 days of the notice under Section 8.3 of the DPA.
1. Sub-processors
In the table below, "Customer data" means Recipient data processed by the Company as processor on behalf of the Customer; "Company data" means Customer account and User data processed by the Company as controller.
| Sub-processor | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase Inc. (US) | Database, authentication, file and backup storage | Customer data (all) and Company data (all) | Database: [DOLDURULACAK]; support and operations access: US | KVKK: Turkish Standard Contract (processor to processor) + notification to the Authority within 5 business days. GDPR: EU SCCs Module 3 (Supabase DPA) |
| Vercel Inc. (US) | Application hosting, serverless functions, scheduled jobs, content delivery | All data passing through the Platform (in transit/processing), IP address, server logs | Function region: [DOLDURULACAK]; global edge network; US | KVKK: Turkish Standard Contract + notification. GDPR: EU SCCs and/or EU-US Data Privacy Framework (DPF) |
| Instantly.ai (Foo Monk, LLC, US) | Procuring sending domains and mailboxes, warm-up, sending, receiving and forwarding replies, block list | Recipient name, business email, job title, company, email contents, replies, sending events; Customer's sender identity details | US; mailboxes on Google Workspace infrastructure | KVKK: Turkish Standard Contract + notification. GDPR: EU SCCs Module 3 (Instantly DPA) |
| ↳ Google LLC (Google Workspace; sub-processor of Instantly.ai — mailbox service: Instantly.ai DFY (Google Workspace)) | Hosting sending mailboxes | Emails sent and received | Provider's data centres (US and other) | Contract between Instantly.ai and the provider; GDPR: EU SCCs / DPF |
| Anthropic PBC (US) and/or OpenAI, L.L.C. (US)* | Personalising email texts; classifying replies | Recipient name, job title, company and industry; Customer's offer and topic texts; reply texts | US | KVKK: Turkish Standard Contract + notification. GDPR: EU SCCs and/or DPF. Under commercial API terms, content is not used for model training by default; providers' limited-duration abuse-monitoring retention applies. |
| Resend (Plus Five Five, Inc., US) | Positive-reply and meeting notifications to the Customer; login and service emails | Customer notification email address; Recipient name, company and reply excerpt in notification content | US | KVKK: Turkish Standard Contract + notification. GDPR: EU SCCs (Resend DPA) and/or DPF |
| Slack Technologies, LLC (US) | The Company's internal administrator alerts (error notices, segment approval requests) | Limited Company data; exceptionally limited Customer data for debugging | US | KVKK: Turkish Standard Contract + notification. GDPR: EU SCCs / DPF |
* The Company may switch AI provider between these two for quality and continuity; both are listed as approved Sub-processors.
2. Third parties that are not Sub-processors
The following parties are not Sub-processors of the Company and are listed for information:
| Party | Role | Description |
|---|---|---|
| ZenLeads, Inc. d/b/a Apollo.io (US) | Data source — independent controller | Business contact data is queried from Apollo's database on the Customer's targeting instruction. Apollo compiles and processes its data for its own purposes and on its own legal bases. Targeting criteria (industry, job title, company size, region) are sent to Apollo in queries. |
| Lemon Squeezy, LLC (US) | Merchant of Record — independent controller | Handles payment, card data, invoicing and tax under its own terms. Only customer, order and subscription IDs and subscription status are passed to the Company. |
| Cal.com | Customer's own account — Customer's service provider | Meetings are created in the Customer's own account; on the Customer's instruction the Company receives booking notifications (attendee name, email address, meeting time). The relationship between the Customer and the provider is independent. |
| Slack (Customer's workspace) | Notification channel chosen by the Customer | If the Customer chooses Slack, positive-reply notifications are delivered to the Customer's own workspace on the Customer's instruction. |
3. Transfers under KVKK
Under Art. 9 KVKK as amended by Law No. 7499 and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad of 10 July 2024, regular transfers to countries for which the Turkish Personal Data Protection Board has not issued an adequacy decision may be made where one of the processing conditions in Art. 5 or 6 KVKK exists and an appropriate safeguard is provided. For the foreign Sub-processors above, the Company signs the standard contracts published by the Board without modification and notifies them to the Turkish Personal Data Protection Authority within five business days of signature. Customers may request information on these safeguards at [DOLDURULACAK].
4. Change log
| Date | Change |
|---|---|
| [DOLDURULACAK] | Initial publication |