Documentos legales

Data Processing Agreement (DPA) — EN (GDPR Art. 28 + Turkish KVKK)

Master agreement se fija en su contrato. Controller: se fija en su contrato. Processor: SMARTEDTECH SL. Roles per activity in Annex 1.

D01 Subject matter and duration — processing only for MSA/SOW services, for the term.

D02 Annex 1 — nature, purpose, data categories, data subjects, lawful-basis record (consent_record) per activity (employee portal, CRM sync, AI processing via PAL, document/knowledge management).

D03 Instructions — documented only; recorded via purpose and scope_token; Processor flags unlawful instructions.

D04 Confidentiality — role-based access (RLS, resource_grant); hash-chained audit trail (era.audit_event).

D05 Security (Art. 32) — tenant isolation (FORCE RLS), TLS in transit, provider encryption at rest, vault-managed secrets (never logged), quarantine + scan for uploads, backup/restore, incident response (docs/08).

D06 Sub-processors — Annex 2: hosting Vercel Inc. (web) and Railway Corporation (application servers, EU), database Supabase Inc. (EU, Ireland), LLM gateway se fija en su contrato and model providers se fija en su contrato, payments {STRIPE/IYZICO}, email Resend (email), messaging se fija en su contrato, storage se fija en su contrato; se fija en su contrato days' notice; right to object.

D07 Data-subject rights — support within se fija en su contrato days via export.request and retention service.

D08 Breach notification — within se fija en su contrato hours of awareness.

D09 Return and deletion — within se fija en su contrato days (JSON/CSV export); statutory retention exceptions in Annex 3.

D10 International transfers — SCC se fija en su contrato + supplementary measures; KVKK Art. 9 for Türkiye; se fija en su contrato.

D11 AI-specific — no training on Customer data; purpose-limited PAL payloads; model-provider transfer listed in Annex 2; UNKNOWN usage records are never billed as zero and go to reconciliation.

D12 Audits — se fija en su contrato/year with se fija en su contrato days' notice; remote audit via audit_event export preferred.

_Final text is reviewed by counsel in the merchant entity's jurisdiction._