Rechtsdokumente

Data Processing Agreement (DPA) — EN (GDPR Art. 28 + Turkish KVKK)

Master agreement wird im Vertrag festgelegt. Controller: wird im Vertrag festgelegt. Processor: SMARTEDTECH SL. Roles per activity in Annex 1.

D01 Subject matter and duration — processing only for MSA/SOW services, for the term.

D02 Annex 1 — nature, purpose, data categories, data subjects, lawful-basis record (consent_record) per activity (employee portal, CRM sync, AI processing via PAL, document/knowledge management).

D03 Instructions — documented only; recorded via purpose and scope_token; Processor flags unlawful instructions.

D04 Confidentiality — role-based access (RLS, resource_grant); hash-chained audit trail (era.audit_event).

D05 Security (Art. 32) — tenant isolation (FORCE RLS), TLS in transit, provider encryption at rest, vault-managed secrets (never logged), quarantine + scan for uploads, backup/restore, incident response (docs/08).

D06 Sub-processors — Annex 2: hosting Vercel Inc. (web) and Railway Corporation (application servers, EU), database Supabase Inc. (EU, Ireland), LLM gateway wird im Vertrag festgelegt and model providers wird im Vertrag festgelegt, payments {STRIPE/IYZICO}, email Resend (email), messaging wird im Vertrag festgelegt, storage wird im Vertrag festgelegt; wird im Vertrag festgelegt days' notice; right to object.

D07 Data-subject rights — support within wird im Vertrag festgelegt days via export.request and retention service.

D08 Breach notification — within wird im Vertrag festgelegt hours of awareness.

D09 Return and deletion — within wird im Vertrag festgelegt days (JSON/CSV export); statutory retention exceptions in Annex 3.

D10 International transfers — SCC wird im Vertrag festgelegt + supplementary measures; KVKK Art. 9 for Türkiye; wird im Vertrag festgelegt.

D11 AI-specific — no training on Customer data; purpose-limited PAL payloads; model-provider transfer listed in Annex 2; UNKNOWN usage records are never billed as zero and go to reconciliation.

D12 Audits — wird im Vertrag festgelegt/year with wird im Vertrag festgelegt days' notice; remote audit via audit_event export preferred.

_Final text is reviewed by counsel in the merchant entity's jurisdiction._