Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the terms of service between AI Ekip Limited (“AI Ekip”, the “Processor”) and the client that uses AI Ekip Agentic Marketing (the “Client”, the “Controller”). It applies whenever AI Ekip processes personal data on the Client's behalf. It meets the requirements of Türkiye's Personal Data Protection Law No. 6698 (“KVKK”, in particular Article 12) and, where they apply, Article 28 of the EU GDPR and the UK GDPR (together, “Data Protection Law”). If you need a signed copy, email info@aiekip.com.

1. Scope and roles

The Client is the data controller (veri sorumlusu) and AI Ekip is the data processor (veri işleyen) for the Client Personal Data described in Annex 1. AI Ekip is a separate controller for its own account, billing and security data, as described in its privacy policy.

2. Processing on instructions

AI Ekip processes Client Personal Data only to provide the Services and on the Client's documented instructions. The terms, the Client's Order and the Client's settings in the platform (for example connecting a platform, switching on conversion uploads or lead follow-up) are those instructions. If AI Ekip believes an instruction breaks Data Protection Law, it will tell the Client. If the law requires AI Ekip to process data otherwise, it will tell the Client first unless the law forbids that.

3. The Client's responsibilities

The Client is responsible for the lawfulness of the processing it instructs: having a legal basis, giving privacy notices to its leads, customers and website visitors, obtaining consent where required (including for the pixel and for sending conversions to ad platforms), and the accuracy of the data it provides.

4. Confidentiality

AI Ekip ensures that everyone it authorises to process Client Personal Data is bound by confidentiality and gets access only as far as needed.

5. Security

AI Ekip takes the technical and organisational measures in Annex 2 to protect Client Personal Data, appropriate to the risk, and keeps them up to date. AI Ekip may update the measures as long as the overall level of protection doesn't decrease.

6. Sub-processors

The Client authorises AI Ekip to use the sub-processors in Annex 3. AI Ekip will tell the Client at least 30 days before adding or replacing a sub-processor. The Client may object on reasonable data protection grounds within that period; if we can't resolve it, the Client may end the affected Services without penalty. AI Ekip imposes data protection obligations on each sub-processor that are no less protective than this DPA and remains responsible for their performance.

7. International transfers

Client Personal Data is hosted in Türkiye. Where a sub-processor processes it outside Türkiye, the EU or the UK, AI Ekip uses a transfer mechanism recognised by Data Protection Law: for transfers from Türkiye, the safeguards in KVKK Article 9, such as the standard contracts published by the Personal Data Protection Authority; for transfers from the EU or UK, the European Commission's Standard Contractual Clauses (with the UK addendum), or the EU–US Data Privacy Framework where the recipient is certified.

8. Helping the Client

• Data subject requests: AI Ekip passes on any request it receives about Client Personal Data without undue delay and helps the Client answer it, mostly through the platform's own export and delete functions.
• Impact assessments and authorities: AI Ekip gives the Client reasonable information to carry out data protection impact assessments and to consult authorities, where required.

9. Personal data breaches

AI Ekip notifies the Client without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Client Personal Data. The notice describes what happened, the data and people affected as far as known, the likely consequences and the measures taken. AI Ekip helps the Client meet its own duties, including notifying the Personal Data Protection Board within 72 hours under KVKK Article 12(5) and the Board's decision, or the supervisory authority under the GDPR.

10. Deletion or return

When the Services end, AI Ekip deletes Client Personal Data within 30 days, after providing an export if the Client asks for one within that period. Copies in encrypted backups expire within 35 days. This doesn't apply to data AI Ekip must keep by law, which stays protected under this DPA.

11. Information and audits

AI Ekip makes available the information needed to show compliance with this DPA and allows reasonable audits by the Client or an independent auditor it appoints, with 30 days' notice, during business hours, at most once a year (unless an authority requires more, or after a breach), at the Client's cost and subject to confidentiality. AI Ekip may first answer with written information and documents where that is enough.

12. Liability and term

The liability terms of the terms of service apply to this DPA, to the extent Data Protection Law allows. This DPA lasts as long as AI Ekip processes Client Personal Data.

Annex 1: Details of processing

• Subject matter and duration: providing the Services under the terms, for the term of the Client's plan and up to 30 days after.
• Nature and purpose: collecting, storing, organising, analysing, displaying and transmitting data to manage and report on the Client's advertising, handle its leads, attribute leads and sales to campaigns, send conversions the Client chooses to ad platforms, follow up on leads where the Client switches this on, and produce AI summaries and suggestions.
• Data subjects: the Client's leads and prospects, customers, website visitors, callers, CRM contacts, and the Client's own staff and users of the platform.
• Categories of data: contact details (name, email, phone, company), form answers, call details and recording links, lead status and notes, consent choices, campaign and attribution data (UTM parameters, ad click IDs, pixel visitor and session IDs, landing pages, referrer), order and deal values, and hashed identifiers sent to ad platforms. Aggregated ad performance data is generally not personal data.
• Special categories: none are intended. The Client must not use lead forms or the platform to collect special categories of personal data (for example health data) unless agreed in writing with appropriate safeguards.

Annex 2: Technical and organisational measures

• Encryption in transit (HTTPS/TLS) for the website, platform, APIs and email delivery; access tokens and API keys encrypted at rest; encrypted backups.
• Tenant separation: each client's data is scoped to its own workspace, with role-based access (Owner, Admin, Media Buyer, Analyst, Client Approver, Client Viewer).
• Rate-limited sign-in, hashed passwords, expiring and rotating session tokens, password reset by signed link.
• Audit log of changes to campaigns and approvals; change requests require approval where configured; AI never changes campaigns without approval.
• Server hardening: firewall, only necessary ports open, services run as unprivileged users with memory limits, administrative access by SSH key only.
• Nightly backups to separate storage that the server can't delete, each restored into a scratch database to test it; backups expire after 35 days.
• Monitoring of connection health and errors; staff access to client data only when needed for support, security or the law.

Annex 3: Sub-processors

The ad and business platforms the Client connects (for example Google, Meta or HubSpot) receive data on the Client's instruction under their own terms with the Client. They are not AI Ekip's sub-processors.