Data Processing Agreement

1. Parties and scope

This Data Processing Agreement (the DPA) is made between the Customer who accepts the Terms of Use (the Controller) and Henartech Yazılım Ltd. Şti. (the Processor or Mesaifix), and meets the requirements of Art. 28(3) GDPR and of comparable provisions of other Data Protection Law. Accepting the Terms of Use also accepts this DPA.

The DPA applies to personal data Mesaifix processes on the Customer's behalf while providing the Services. Data Mesaifix processes as controller in its own right (such as account and invoice data) is outside this DPA.

Terms not defined in this DPA have the meaning given in the Terms of Use and the GDPR.

2. Subject matter and nature of processing

3. Controller's obligations

• ensuring a legal basis exists for processing End User data (Arts. 6 and, where relevant, 9 GDPR),
• informing End Users (Arts. 13 and 14 GDPR); assessing whether the short notice Mesaifix shows on the booking page and website assistant is sufficient, and if needed making its own notice available to End Users,
• obtaining End Users' consent where required, including for marketing messages,
• ensuring its instructions to Mesaifix (including panel settings, questions in the booking flow and information given to the assistant) comply with Data Protection Law,
• answering End Users' requests to exercise their rights,
• keeping its own records of processing activities and, where required, carrying out a data protection impact assessment.

4. Processor's obligations

• processing personal data only on the Customer's documented instructions, including with regard to international transfers. The Terms of Use, this DPA and the Customer's settings and actions in the panel count as the Customer's instructions. If we believe an instruction breaches Data Protection Law, we will tell the Customer immediately,
• not using the data for its own purposes, not selling it and not using it to train AI models without the Customer's written instruction,
• ensuring persons authorised to process the data are bound by confidentiality and that access is limited to what the work requires,
• taking and keeping up to date the measures listed in Technical and organisational measures, as required by Art. 32 GDPR,
• assisting the Customer, taking into account the nature of the processing, in answering End User requests, in meeting its security, breach-notification and impact-assessment obligations (Arts. 32 to 36 GDPR) and in proceedings with supervisory authorities,
• keeping a record of the processing it carries out on the Customer's behalf (Art. 30(2) GDPR),
• making available, on the Customer's request, the information necessary to demonstrate compliance with this DPA.

5. Sub-processors

The Customer gives Mesaifix general written authorisation to engage sub-processors of the types set out in the Privacy Policy to provide the Services. The current list with the sub-processors' names and locations is sent to the Customer by e-mail on request.

Mesaifix will inform the Customer by e-mail or in the panel at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable grounds within that period; if the objection cannot be resolved, the Customer may terminate the Agreement and request a pro-rata refund of the unused period.

Mesaifix imposes on sub-processors by contract the same data protection obligations as in this DPA, and remains fully liable to the Customer for their performance.

6. International transfers

Mesaifix processes End User data from Türkiye, and some sub-processors are located in the USA and other countries. With this DPA the Customer instructs these transfers.

Where the Customer is subject to the GDPR, the UK GDPR or Swiss data protection law, and the transfer is not covered by an adequacy decision, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated into this DPA by reference: Module Two (controller to processor) between the Customer and Mesaifix. For those clauses, the details in Subject matter and nature of processing form Annex I.B, the measures in Technical and organisational measures form Annex II, clause 7 (docking) applies, clause 9 option 2 (general authorisation, 30 days) applies, the optional wording in clause 11 does not, and clauses 17 and 18 are governed by and subject to the courts of Ireland. For UK data the UK International Data Transfer Addendum applies; for Swiss data, references to the GDPR are read as references to the Swiss Federal Act on Data Protection.

For onward transfers to sub-processors, Mesaifix uses Module Three of the same clauses or another valid transfer mechanism. Information about these safeguards is provided on the Customer's request.

If the Standard Contractual Clauses conflict with this DPA, the clauses prevail.

7. Data subject requests

If an End User's request reaches Mesaifix directly, Mesaifix does not answer it itself; it forwards it to the Customer within 5 business days at the latest and tells the End User that the request has been passed on to the Customer.

The panel lets the Customer view, correct and delete End User data. For requests that cannot be handled in the panel, Mesaifix assists within a reasonable time on the Customer's written request.

8. Data breaches

When Mesaifix becomes aware of a personal data breach affecting End User data, it informs the Customer without undue delay and within 48 hours at the latest. The notice includes, as far as known at the time, the nature of the breach, the categories and approximate number of data subjects and records affected, its likely consequences and the measures taken or proposed.

The obligation to notify the supervisory authority and data subjects lies with the Customer as controller. Mesaifix provides the information needed for the Customer to meet the 72-hour notification deadline (Art. 33 GDPR).

9. Information and audit

Mesaifix provides the information needed to demonstrate compliance with this DPA on the Customer's written request. If that information is insufficient, the Customer may carry out an audit, including an inspection — with at least 30 days' written notice, no more than once a year unless a supervisory authority requires it or there has been a breach, during business hours, through an auditor bound by confidentiality and at its own cost. An audit may not endanger the confidentiality of other customers' data or the security of the Platform. The powers of supervisory authorities are reserved.

10. Deletion and return

When the Terms of Use end, the Customer may request a copy of End User data within 30 days. After that period Mesaifix deletes or anonymises End User data; copies in backups are deleted within 90 days at the latest. If the Customer deletes their account themselves in the panel, the data is deleted without waiting.

During the agreement, conversations the Customer removes in the panel leave the Customer's panel; they may be kept for support and security, and are permanently deleted at the Customer's request.

Data the law requires to be kept is outside these periods and kept only for that purpose.

11. Liability and term

Liability between the parties and its limits are governed by the Terms of Use; each party's liability towards data subjects under Art. 82 GDPR is unaffected.

The DPA remains in force while the Terms of Use are in force and in any case while Mesaifix continues to process personal data on the Customer's behalf.

12. Technical and organisational measures

Mesaifix applies at least the following measures, which it reviews regularly against the state of the art.

Technical measures

• encryption of data in transit and at rest,
• isolation of each Customer's data from other Customers' data,
• additional protection for secrets such as access credentials; passwords stored irreversibly,
• the website assistant working only on sites the Customer allows and being protected against abuse,
• verification of the source of data received from channels,
• regular backups, kept for a limited time, so that availability can be restored after an incident,
• keeping and monitoring system and error logs,
• keeping software dependencies up to date and fixing security vulnerabilities.

Organisational measures

• administrative access to data limited to authorised staff and business need,
• confidentiality undertakings from staff and contractors,
• contracts with sub-processors containing data protection obligations,
• defined processes for retention and deletion of personal data,
• a data breach response procedure,
• data minimisation: processing only the data the service needs.