Data Processing Agreement (DPA)

1. Definitions

Within the scope of this DPA, the following terms shall have the meanings set out opposite them:

2. Subject Matter and Term of the Agreement

This DPA constitutes an annex to the Main Service Agreement (Terms of Use + Pro/Enterprise subscription) concluded between the Controller and the Processor. The DPA is valid for as long as the Main Agreement is in force. Upon termination of the agreement, the data return/erasure provisions in Article 11 apply.

This DPA has been prepared so as to meet the requirements of GDPR (Regulation EU 2016/679) Article 28 and Article 12 of KVKK No. 6698.

3. Nature and Purpose of Processing

4. Data Categories and Data Subjects

4.1. Data Subjects

• Controller's employees: Account users (admin, editor, viewer)
• Controller's B2B customers: Company representatives who make contact (in Enterprise scenarios)
• Controller's website visitors: End users (anonymous/pseudo-anonymous consent data)

4.2. Data Categories

Special Category Data: cerez.io does not process special category data within the scope of GDPR Art. 9 / KVKK Article 6.

5. Processor Obligations

The Processor (cerez.io) undertakes to comply with the following obligations:

1. Instruction: Processes personal data only in accordance with the Controller's written instructions. Does not process data on its own initiative unless required by a legal obligation.
2. Confidentiality: Signs written confidentiality agreements with its personnel; data processing authorization is granted only to identified and necessary persons.
3. Security: Implements and maintains the technical and administrative measures detailed in Article 7.
4. Sub-processor condition: Informs the Controller in advance of the engagement of a new sub-processor (Article 6).
5. Assistance: Assists the Controller in responding to data subject requests, in breach notifications, and in carrying out a DPIA (Data Protection Impact Assessment).
6. Accountability: Keeps processing activities in an Article 30 record and presents it to the Controller during an audit.
7. Return/Erasure: Returns or erases the data upon termination of the agreement (Article 11).

6. Sub-processor List

The Controller grants its general prior authorization to the following sub-processors. In the event of changes to the list, the Controller is informed at least 30 days in advance; the right to object is reserved.

The current sub-processor list is always published on this page. To receive notifications, you can subscribe by sending an e-mail to destek@cerez.io.

7. Technical and Administrative Security Measures

The Processor undertakes to implement the following security measures pursuant to GDPR Article 32 and KVKK Article 12:

7.1. Encryption

• At rest (data at rest): Encryption with AES-256
• In transit (data in motion): TLS 1.3 (TLS 1.2 minimum); HTTP is mandatorily redirected to HTTPS (HSTS)
• Password management: Bcrypt cost 12 (user passwords); API keys hashed + masked

7.2. Access Control

• Role-based access control (RBAC): admin / editor / viewer
• 2FA mandatory for company personnel (TOTP + hardware token optional)
• Principle of Least Privilege (PoLP), access policies

7.3. Audit and Logging

• All admin operations are retained in the AuditLog table for 1 year (who, when, what they did)
• API usage records (90-day retention)
• Anomaly detection (WAF + custom rules)

7.4. Backup and Disaster Recovery

• Regular (at least end-of-day) automated backup; 30-day retention
• Documented disaster recovery plan

7.5. Personnel Security

• An NDA is signed prior to commencement of employment
• Annual KVKK/GDPR awareness training

8. Support for Data Subject Requests

So that the Controller can respond to access, rectification, erasure, portability, and objection requests coming from data subjects, the Processor:

• Provides data export (XLSX/CSV/PDF) from the account panel
• Provides an API to delete/anonymize the data of a single user
• Upon request, the technical support team assists within 5 business days (Pro+); 2 business days for Enterprise

9. Data Breach Notification

In the event that the Processor detects a personal data breach:

1. Provides written notification to the Controller within 72 hours from the moment it detects the breach (e-mail + notification from the DPA panel).
2. The notification includes the following information:
   • The nature of the breach, the affected data categories, and the approximate number of data subjects
   • The likely consequences of the breach
   • The measures taken/recommended
   • Point of contact (DPO)
3. Provides technical support for the Controller to notify the Data Protection Authority (KVKK Board / Lead Supervisory Authority).

10. Audit Right

The Controller has the right to audit the Processor's compliance with this DPA, to a reasonable extent and with prior notice (at least 30 days):

• On-site audit: For Enterprise customers, may be carried out once a year, over 2 business days, at reasonable hours, at the Processor's head office. The costs are borne by the Controller.
• Third-party auditor: May also be carried out by independent auditors, on condition that an NDA is signed.

11. Data Return and Erasure

In the event of termination of the Main Agreement, the Processor, in accordance with the Controller's choice:

1. Data Return: Returns all personal data to the Controller in a structured, machine-readable format (JSON/CSV/XLSX) within 30 days from the end of the agreement.
2. Data Erasure: After the return, or if no return is requested, permanently erases all personal data within 30 days from the end of the agreement (including from backups).
3. Legal Retention Exception: Invoices and financial records that must be retained under tax/commercial laws are kept for 10 years.

Once the erasure is completed, a written certificate of destruction is provided to the Controller.

12. Cross-Border Data Transfer and SCC

As a rule, since data is stored within the borders of Türkiye, in a domestic data center, no cross-border data transfer takes place. In specific cases requiring EU data transfer, the Standard Contractual Clauses (SCC) approved by the European Commission's Decision 2021/914, Module 2 (Controller-to-Processor), are taken as reference.

For Controllers resident in Türkiye, in the event that a cross-border transfer is necessary, reliance is placed on the Letter of Undertaking format published in accordance with the relevant decisions of the Personal Data Protection Board, or on the written undertaking providing adequate protection concluded within the scope of KVKK Article 9/2-b.

Access to the full text of the SCC: eur-lex.europa.eu/eli/dec_impl/2021/914

13. Contact for Signing the DPA

If you would like to obtain a signed DPA or add special provisions, you can reach us through the following channels:

The Standard DPA and SCC Module 2 (PDF) will be provided at the contract stage.

Related pages: Privacy Policy · KVKK Disclosure Notice · Terms of Use

For your questions: destek@cerez.io  ·  This page was last updated on 31 May 2026.