المستندات القانونية

Data Processing Agreement (DPA) — EN (GDPR Art. 28 + Turkish KVKK)

Master agreement يُحدَّد في عقدك. Controller: يُحدَّد في عقدك. Processor: SMARTEDTECH SL. Roles per activity in Annex 1.

D01 Subject matter and duration — processing only for MSA/SOW services, for the term.

D02 Annex 1 — nature, purpose, data categories, data subjects, lawful-basis record (consent_record) per activity (employee portal, CRM sync, AI processing via PAL, document/knowledge management).

D03 Instructions — documented only; recorded via purpose and scope_token; Processor flags unlawful instructions.

D04 Confidentiality — role-based access (RLS, resource_grant); hash-chained audit trail (era.audit_event).

D05 Security (Art. 32) — tenant isolation (FORCE RLS), TLS in transit, provider encryption at rest, vault-managed secrets (never logged), quarantine + scan for uploads, backup/restore, incident response (docs/08).

D06 Sub-processors — Annex 2: hosting Vercel Inc. (web) and Railway Corporation (application servers, EU), database Supabase Inc. (EU, Ireland), LLM gateway يُحدَّد في عقدك and model providers يُحدَّد في عقدك, payments {STRIPE/IYZICO}, email Resend (email), messaging يُحدَّد في عقدك, storage يُحدَّد في عقدك; يُحدَّد في عقدك days' notice; right to object.

D07 Data-subject rights — support within يُحدَّد في عقدك days via export.request and retention service.

D08 Breach notification — within يُحدَّد في عقدك hours of awareness.

D09 Return and deletion — within يُحدَّد في عقدك days (JSON/CSV export); statutory retention exceptions in Annex 3.

D10 International transfers — SCC يُحدَّد في عقدك + supplementary measures; KVKK Art. 9 for Türkiye; يُحدَّد في عقدك.

D11 AI-specific — no training on Customer data; purpose-limited PAL payloads; model-provider transfer listed in Annex 2; UNKNOWN usage records are never billed as zero and go to reconciliation.

D12 Audits — يُحدَّد في عقدك/year with يُحدَّد في عقدك days' notice; remote audit via audit_event export preferred.

_Final text is reviewed by counsel in the merchant entity's jurisdiction._