Juridiske dokumenter

Data Processing Agreement (DPA) — EN (GDPR Art. 28 + Turkish KVKK)

Master agreement fastsatt i kontrakten din. Controller: fastsatt i kontrakten din. Processor: SMARTEDTECH SL (NIF B66970831, Carrer Agricultura, 16, 1º, 9ª, 08320 El Masnou (Barcelona), Spain). Roles per activity in Annex 1.

D01 Subject matter and duration — processing only for MSA/SOW services, for the term.

D02 Annex 1 — nature, purpose, data categories, data subjects, lawful-basis record (consent_record) per activity (employee portal, CRM sync, AI processing via PAL, document/knowledge management).

D03 Instructions — documented only; recorded via purpose and scope_token; Processor flags unlawful instructions.

D04 Confidentiality — role-based access (RLS, resource_grant); hash-chained audit trail (era.audit_event).

D05 Security (Art. 32) — tenant isolation (FORCE RLS), TLS in transit, provider encryption at rest, vault-managed secrets (never logged), quarantine + scan for uploads, backup/restore, incident response (docs/08).

D06 Sub-processors — Annex 2: hosting Vercel Inc. (web) and Railway Corporation (application servers, EU); database and authentication Supabase Inc. (EU, Ireland); LLM gateway: the SET Labs LiteLLM gateway (hosted on Railway), model providers fastsatt i kontrakten din; payments Stripe (active); iyzico (Türkiye) is available but not active and is only used after re-activation with the notice below; transactional email via authenticated SMTP (Google Workspace, Google); error monitoring Sentry (Functional Software, Inc.; personal fields scrubbed before sending); messaging fastsatt i kontrakten din and object storage fastsatt i kontrakten din only where enabled for the Customer; fastsatt i kontrakten din days' notice; right to object.

D07 Data-subject rights — support within fastsatt i kontrakten din days via export.request, the retention service and the queued deletion request (Settings → Privacy and data; handled within one month, no automatic deletion).

D08 Breach notification — within fastsatt i kontrakten din hours of awareness.

D09 Return and deletion — within fastsatt i kontrakten din days (JSON/CSV export); statutory retention exceptions in Annex 3 (invoices and accounting records are kept for the period required by accounting and tax law, in Spain up to 6 years).

D10 International transfers — SCC fastsatt i kontrakten din + supplementary measures; KVKK Art. 9 for Türkiye; fastsatt i kontrakten din.

D11 AI-specific — no training on Customer data; purpose-limited PAL payloads; model-provider transfer listed in Annex 2; UNKNOWN usage records are never billed as zero and go to reconciliation.

D12 Audits — fastsatt i kontrakten din/year with fastsatt i kontrakten din days' notice; remote audit via audit_event export preferred.

_Final text is reviewed by counsel in the merchant entity's jurisdiction._