Data processing agreement

Version 1.0 · Last updated: 6 November 2026

This Data Processing Agreement ("DPA") is between the company that operates Alvara AI (the "Company" or "Data Processor") and the customer that uses the Platform (the "Customer" or "Data Controller"). It forms an integral part of the Terms of use (the "Main Agreement") and takes effect when the Customer accepts the Main Agreement. Terms not defined here have the meaning they have in the Main Agreement and in Law No. 6698 on the Protection of Personal Data ("KVKK").

1. Scope and roles

1.1. This DPA applies only to the processing by the Company, on the Customer's behalf, of personal data contained in Customer Data.

1.2. For Customer Data, the Customer is the data controller and the Company is the data processor. The subject matter, nature, purpose and duration of the processing, the categories of personal data and the groups of data subjects are set out in Annex 1.

1.3. The following are outside the scope of this DPA:

• the Company's processing of account, billing, security and usage data of the Customer's representatives and users for its own purposes (the Company is the data controller),
• the Company's compiling, storing and updating of Platform Data in its central database and making it available to more than one customer (the Company is the data controller). Company and people details obtained from third-party services in response to the Customer's search, enrichment and verification requests are Platform Data, not Customer Data; they are not processed on the Customer's behalf and may also be made available to other customers,
• the Customer's use of Platform Data for its own purposes after obtaining it (the Customer is an independent data controller),
• the Company's use of the Customer's corrections to Platform Data to keep the data accurate, without disclosing the Customer's identity to other customers.

1.4. The Customer's target customer profiles, search criteria, uploaded lists and lead lists are Customer Data and are not shown to other customers. Passing search criteria and enrichment inputs to the data provider gateway and data providers listed in Annex 2 is necessary to carry out the relevant operation.

2. Customer's obligations and representations

2.1. As data controller, the Customer represents and undertakes that:

• Customer Data has been lawfully obtained and the legal bases (including explicit consent where required) exist for transferring it to the Company and having it processed under this DPA,
• data subjects have been informed as required by KVKK Article 10, including about the transfer to the Company and transfers abroad,
• Customer Data contains no special categories of personal data, no data of anyone under 18 and no data prohibited by the Acceptable use policy,
• answering data subject requests, VERBIS registration and the Customer's other data controller obligations are its own responsibility.

2.2. Instructions. The Main Agreement, this DPA and the Customer's configurations and actions on the Platform (such as search, enrichment, preparing campaigns, export and deletion) are the Customer's complete and final instructions to the Company. Additional instructions are given in writing; instructions that go beyond the scope of the service or create extra cost are carried out only if the parties agree separately.

2.3. The Customer instructs the Company to process Customer Data to provide and secure the service, to fix errors and give support, to prevent misuse and to develop the service. The Company may use Customer Data in anonymised or aggregated form; anonymised data is not personal data.

2.4. Sending. The Company does not contact anyone on its own on the Customer's behalf; the service produces drafts. Where email sending features are offered, sending takes place only on the Customer's instruction and with the Customer's own account and domain; the content, the choice of recipients, commercial message consent and registry records, and the legal basis are the Customer's responsibility. Measurement of message opens and link clicks, where offered, may be carried out and the Customer can turn it off in its settings; the Customer is responsible for ensuring that it complies with the laws of the recipients' countries and for giving the required notices.

3. Company's obligations

3.1. The Company processes Customer Data only on the Customer's documented instructions. If it believes an instruction violates the law, it informs the Customer and may refuse to carry it out; it has no duty to check the lawfulness of instructions.

3.2. The Company protects confidentiality of Customer Data with appropriate administrative measures.

3.3. Under KVKK Article 12, the Company takes the technical and organisational measures in Annex 3 and may update them provided it does not materially reduce the general level of protection.

3.4. Taking the nature of the processing into account, the Company reasonably assists the Customer in answering data subject requests and meeting its other KVKK obligations, mainly through the tools on the Platform (viewing, correction, export, deletion, suppression list). For support that these tools cannot provide, the Company may charge the Customer its reasonable costs.

3.5. A data subject request about Customer Data that reaches the Company directly is forwarded to the Customer within a reasonable time. The Company does not answer such requests on the merits without the Customer's instruction.

4. Sub-processors

4.1. The Customer gives the Company general authorisation to use sub-processors to provide the service. The sub-processors in use are listed in Annex 2.

4.2. Before adding or replacing a sub-processor, the Company gives at least 15 days' notice by publishing the updated list on this page and/or by email. The Customer may object in writing within that period on reasonable data protection grounds. If no solution is found within a reasonable time, the Customer's sole and exclusive remedy is to cancel the affected service by notice, effective at the end of the current period; fees are not refunded.

4.3. The services of sub-processors are subject to their own terms of service and data protection arrangements.

5. Transfers abroad

5.1. The Customer acknowledges that some sub-processors in Annex 2 are located outside Türkiye, that Customer Data may be transferred to those countries to provide the service, and instructs those transfers.

5.2. Transfers abroad are assessed under KVKK Article 9 and the related regulation. Transfers to servers in the European Union are also transfers abroad under KVKK.

5.3. It is the Customer's responsibility to have a legal basis for the transfer (KVKK Article 5 or 6) and to inform data subjects about transfers abroad.

6. Personal data breach notification

6.1. When the Company becomes aware of a security breach that affects Customer Data and results in personal data being obtained unlawfully by third parties, it informs the Customer without undue delay.

6.2. The notice describes, as far as known at the time, the nature of the breach, the categories of data and the approximate number of records affected, the likely consequences, and the measures taken or proposed. If all information cannot be given at once, it is given in stages.

6.3. The duty to notify the Personal Data Protection Board and data subjects lies with the Customer. The Company's notice is not an admission of fault or liability.

7. Audit

7.1. On request, the Company provides reasonable information and documents showing compliance with this DPA (a summary of security policies, any independent audit reports, answers to security questionnaires). The audit right is exercised primarily in this way.

7.2. If that information is insufficient or a competent authority requests it, the Customer may audit, at most once a year, with at least 30 days' written notice, during normal working hours, without disrupting the service and through an independent auditor bound by confidentiality. The Customer bears all costs. The audit does not extend to other customers' data, the Company's trade secrets or sub-processors' premises.

8. Term, deletion and return

8.1. This DPA remains in force for the term of the Main Agreement and for as long as the Company continues to process Customer Data.

8.2. When the Main Agreement ends, Customer Data is deleted or anonymised at the Customer's request; deleted data can remain in encrypted backups for up to 37 days and is then deleted automatically. Data that must be kept by law is outside this scope.

9. Liability and conflict

9.1. The parties' liability under this DPA is subject to the limitations of liability and indemnity provisions of the Main Agreement; this DPA does not create a separate or additional limit.

9.2. If joint and several liability arises under KVKK Article 12/2, each party is liable between themselves in proportion to its fault. Damage arising from the Customer's instructions, from the unlawfulness of Customer Data or from the Customer's breach of its data controller obligations is borne by the Customer between the parties.

9.3. If this DPA conflicts with the Main Agreement on the processing of personal data, this DPA prevails; on all other matters the Main Agreement prevails.

Annex 1: Details of the processing

Annex 2: Sub-processors

The list shows the providers used in the version of this page you are reading; the page is updated when it changes.

Annex 3: Technical and organisational measures

Technical measures

• Encryption in transit (TLS) and encryption at rest at provider level,
• separation of data by account; authorisation checks in the application layer and row-level access control in the database,
• role-based authorisation,
• encrypted storage of provider keys and storage of API keys as hashes,
• masking of sensitive data in logs; credentials are not recorded in plain text,
• access and activity logs and audit records,
• rate limiting,
• regular backup and restore; backups are encrypted and stored with a provider separate from the main infrastructure,
• minimising data sent to the AI model: data the task does not need is not added to prompts; API keys, passwords and authentication details are not sent,
• using pseudonymous identifiers instead of customer and workspace details in the labels of calls to the data provider gateway,
• keeping Platform Data and Customer Data logically separate.

Organisational measures

• Taking appropriate organisational measures to prevent unauthorised access to Customer Data and to prevent and handle data breaches.