Data Processing Addendum
Version 2026-10-24 · SHA-256 5cd5f9bf0f04f21ce4c634eb1591f7df58f97e2ac16b088150076558177e7971
1. Scope and roles
This Data Processing Addendum ("DPA") forms part of the Terms of Service between CUMHUR YILMAZ ("Provider") and the Customer. It applies to personal information contained in Customer Data. The Customer is the business (controller) and Provider is its service provider (processor), including as a "service provider" under the California Consumer Privacy Act as amended (CCPA) and similar US state laws. The Customer is responsible for having a lawful basis, notices and any consents needed for the personal information it enters in the Service.
2. Processing instructions
Provider processes Customer Data only to provide, secure and support the Service in line with the Agreement, the Customer's use of the Service and its documented instructions, and as required by law (in which case Provider will inform the Customer unless the law forbids it). The Agreement and the Customer's configuration of the Service are its complete instructions; additional instructions require written agreement. Nature and purpose: hosting, storage, backup, display, calculation, export and e-mail delivery of business records. Categories of people: the Customer's users, customers, vendors, contractors and employees. Categories of data: contact details, business and transaction records, invoices and payments, time and HR records the Customer chooses to enter. The Customer will not enter special categories of data, health information or government identity numbers except in fields designed for them. Duration: the term of the Agreement plus the deletion period below.
3. Service provider commitments
Provider will not: sell or share Customer Data; retain, use or disclose it for any purpose other than the business purposes in the Agreement or outside the direct business relationship with the Customer; or combine it with personal information received from others, except as the law allows for service providers. Provider will comply with applicable obligations under the CCPA, provide the same level of privacy protection it requires, and notify the Customer if it can no longer meet them. The Customer may take reasonable steps to stop and remediate unauthorized use.
4. Confidentiality of personnel
Provider grants access to Customer Data only to personnel who need it for the purposes above and who are bound by confidentiality obligations. Support staff can see a workspace summary only while the Customer has turned on support access, and each view is logged.
5. Security measures
Provider maintains appropriate technical and organizational measures, including: database-level tenant isolation (row-level security); encryption in transit; hashed passwords and optional two-factor sign-in; role-based permissions; audit logging of sign-ins, exports and sensitive changes; regular backups; restricted and logged administrative access; and dependency and security updates. Provider may update these measures as long as the overall level of protection is not reduced. The Customer is responsible for the security of its own accounts, devices and user permissions.
6. Sub-processors
The Customer authorizes Provider to use the following sub-processors: OVHcloud (server hosting and backups, Canada), Brevo / Sendinblue SAS (e-mail delivery, European Union) and Paddle.com Market Limited and its affiliates (online ordering, payment, sales tax and billing support, United Kingdom and other countries). Provider binds each sub-processor to written data-protection terms at least as protective as this DPA in substance and remains responsible for them. Provider will give at least 30 days' notice by e-mail before adding or replacing a sub-processor that processes Customer Data; if the Customer reasonably objects on data-protection grounds, it may terminate the affected Service and receive a pro-rata refund of prepaid fees as its sole remedy.
7. International transfers
Customer Data is hosted in Canada and may be accessed from the Republic of Türkiye and from sub-processor locations. Provider applies the protections of this DPA to Customer Data wherever it is processed and, where the law requires it, uses an approved transfer mechanism such as standard contractual clauses.
8. Assistance and requests
Taking into account the nature of the processing, Provider will help the Customer respond to requests from individuals (for example access, correction or deletion), mainly through the Service's own features, and will forward requests it receives about Customer Data to the Customer rather than answer them itself. Assistance beyond the Service's features may be charged at reasonable rates.
9. Security incidents
Provider will notify the Customer without undue delay, and in any case within 72 hours after confirming a security incident affecting Customer Data, with the information reasonably available, and will take reasonable steps to contain and remediate it. Notification is not an admission of fault or liability. Unsuccessful attempts that do not compromise Customer Data (such as pings, port scans or failed sign-ins) are not security incidents.
10. Return and deletion
The Customer can export Customer Data at any time during the subscription. After termination Provider keeps Customer Data for 60 days for export on request, then deletes it from active systems; backups are overwritten in the normal cycle, unless the law requires longer retention.
11. Audits
On written request no more than once a year (or after a security incident), Provider will provide information reasonably needed to demonstrate compliance with this DPA, such as answers to a security questionnaire, subject to confidentiality. On-site audits are not included unless required by law, in which case they will be at the Customer's cost, on reasonable notice and without access to other customers' data.
12. Precedence and liability
For personal information in Customer Data, this DPA prevails over the Terms of Service. Each party's liability under or in connection with this DPA is subject to the exclusions and limitations of liability in the Terms, which apply in aggregate with all other claims under the Agreement.