Data Processing Addendum

1. What this is, and how it is accepted

1. This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Neuvikon, a şahıs şirketi (sole proprietorship) established in Türkiye (“Neuvikon”, “Processor”) and the organization using Source (“Customer”, “Controller”).
2. It takes effect automatically when the Customer accepts the Terms of Service, and applies whenever we process personal data on the Customer’s behalf. No signature is required and none is withheld: a Customer who needs a countersigned copy for its own records can get one under clause 17.
3. Where this DPA and the Terms of Service conflict on the processing of personal data, this DPA wins. Where this DPA and the Standard Contractual Clauses incorporated by clause 14 conflict, the Clauses win.
4. This DPA covers only personal data we process as processor. Data we handle as controller in our own right — account records, billing, support correspondence — is governed by the Privacy Policy instead, and clause 3.2 draws the line.

2. Definitions

GDPR means Regulation (EU) 2016/679, and where it applies, the UK GDPR as incorporated by the Data Protection Act 2018. KVKK means Türkiye’s Law No. 6698 on the Protection of Personal Data. SCCs means the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914. Customer Personal Data means personal data contained in the content the Customer and its users put into Source. “Controller”, “processor”, “sub-processor”, “data subject”, “processing” and “personal data breach” carry their GDPR meanings.

3. Roles and scope

1. For Customer Personal Data, the Customer is the controller and we are the processor. Where the Customer is itself a processor for someone else, we are a sub-processor and this DPA is read accordingly.
2. We are an independent controller, not a processor, for: account and authentication records of individual users; billing and subscription records; support correspondence; and the service’s own security and operational logs. We process those for the limited purposes set out in the Privacy Policy — running, securing, supporting and billing for the service — and for nothing else.
3. The subject matter, duration, nature, purpose, data categories and data subject categories of the processing are described in Annex I.

4. We process only on your instructions

1. We process Customer Personal Data only to provide Source in accordance with the Terms of Service, this DPA, and any further lawful written instruction the Customer gives. The Customer’s use of the service’s own features is itself an instruction.
2. We will not sell Customer Personal Data, use it for advertising or profiling, or use it to train machine-learning models.
3. If we believe an instruction breaches the GDPR or other applicable data protection law, we will tell the Customer without undue delay and may suspend that instruction until it is resolved.
4. If we are legally compelled to process Customer Personal Data otherwise than on the Customer’s instructions, we will inform the Customer beforehand unless the law forbids it — and where it does, we will challenge the prohibition where there are reasonable grounds to.

5. Confidentiality and personnel

1. We keep Customer Personal Data confidential, and limit access to those who need it to deliver, secure or support the service.
2. Everyone with such access is bound by a duty of confidentiality that survives the end of their engagement, and is informed of the confidential nature of the data.
3. Access to production data is on the principle of least privilege and is used for operational purposes only — not to browse a Customer’s content.

6. Security

1. We implement appropriate technical and organisational measures under GDPR Art. 32, having regard to the state of the art, the cost of implementation and the risks involved. Those measures are described in Annex II.
2. We may change individual measures as the service evolves, provided the overall level of security is not reduced.

7. Your obligations as controller

1. The Customer is responsible for having a lawful basis for the personal data it puts into Source, for giving the notices its own data subjects are owed, and for the accuracy of what it uploads.
2. The Customer is responsible for configuring the workspace appropriately — who is an owner, who is a member, who is only a viewer, which projects a team can see — and for revoking access when someone should no longer have it.
3. Source is not built for special categories of personal data under GDPR Art. 9, for criminal-offence data under Art. 10, for payment card data, or for government identifiers. The Customer undertakes not to put such data into it. Annex II describes measures appropriate to a project-management workspace, not to a clinical or financial system of record.

8. Data subject requests

1. Taking account of the nature of the processing, we assist the Customer in responding to requests from data subjects exercising rights under GDPR Arts. 15–22 or KVKK Art. 11.
2. In practice the Customer can satisfy most such requests itself: the service lets an owner read, correct and delete any content in the organization, and export the whole organization as a complete archive. Where that is enough, we do not need to be involved at all.
3. If a data subject approaches us directly about Customer Personal Data, we will not respond on the merits ourselves. We will tell them to approach the Customer and — unless forbidden — tell the Customer they asked.
4. Assistance beyond what the service’s own features provide is given at no charge where it is reasonable in scope.

9. Sub-processors

1. The Customer gives us general written authorisation to engage sub-processors. Those engaged today are listed, with what each does and where, on the sub-processor page, which forms Annex III of this DPA.
2. We will give at least 30 days’ notice before a new sub-processor begins processing Customer Personal Data, by publishing it in the “announced in advance” section of that page and updating its date. A Customer who wants notice pushed to it rather than published can ask to be added to the notice list.
3. Within that notice period the Customer may object on reasonable grounds relating to data protection by writing to neuvikon@gmail.com. We will work with the Customer in good faith to find a way forward. If none can be found, the Customer may terminate the affected part of the service without penalty and receive a refund of the unused portion of any prepaid fees.
4. We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain fully liable to the Customer for a sub-processor’s performance.
5. Where it is necessary to keep the service available or secure, we may replace a sub-processor on shorter notice, and will update the sub-processor page as soon as practicable and explain why.

10. Personal data breaches

1. We will notify the Customer without undue delay, and in any case within 72 hours, of becoming aware of a personal data breach affecting Customer Personal Data. Notice goes to the email addresses of the organization’s owners.
2. The notification will describe, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where we cannot provide all of it at once, we will provide it in stages without further undue delay.
3. We will assist the Customer with its own notification obligations under GDPR Arts. 33–34 or KVKK Art. 12. Notifying supervisory authorities and data subjects remains the Customer’s decision and responsibility as controller; we will not make it on the Customer’s behalf.
4. A notification under this clause is not an admission of fault.

11. Impact assessments and prior consultation

On request, we will provide the information reasonably available to us that the Customer needs for a data protection impact assessment or a prior consultation with a supervisory authority under GDPR Arts. 35–36, to the extent it concerns our processing and is not already answered by this DPA, the Privacy Policy or the sub-processor page.

12. Deletion and return

1. The Customer can export its organization in full at any time during the term, and should do so before ending the service — the archive is the return mechanism, and it is available without asking us.
2. Deleting an organization deletes its Customer Personal Data — projects, tickets, pages, whiteboards, attachments, notifications and audit log — in the same operation. It is not reversible and there is no hidden retained copy.
3. On termination of the service, Customer Personal Data still held is deleted within 30 days, except where applicable law requires us to keep it, in which case we keep only what the law requires and only for as long as it requires.
4. Routine encrypted backups held by our database provider expire on that provider’s own cycle rather than being surgically edited. They are not accessed for any purpose other than disaster recovery.
5. On request we will certify in writing that deletion has been carried out.

13. Audits and information

1. On reasonable request we make available the information necessary to demonstrate compliance with this DPA — ordinarily this DPA, the sub-processor page, Annex II, and written answers to a security questionnaire.
2. Where documentation is genuinely not enough, the Customer may audit once in any twelve-month period, on at least 30 days’ written notice, during business hours, without disrupting the service, and subject to confidentiality. The Customer bears its own costs; we may charge reasonably for significant time spent on an audit beyond the documentation route.
3. A supervisory authority exercising its own powers is not limited by this clause.

14. International transfers

1. We are established in Türkiye, which is outside the EEA and is not the subject of an adequacy decision. Several sub-processors process in the United States. The safeguards below are what make that lawful.
2. Where we process Customer Personal Data protected by the GDPR, the SCCs are incorporated into this DPA by reference and apply to that transfer, with Module Two (controller to processor) — or Module Three (processor to processor) where the Customer is itself a processor. The following elections apply:
   1. Clause 7 (docking): included, so a further party may accede.
   2. Clause 9(a): Option 2, general written authorisation, with the notice period set at 30 days as provided in clause 9 above.
   3. Clause 11(a): the optional independent dispute resolution language is not included.
   4. Clause 13 and Annex I.C: the competent supervisory authority is the one of the EEA Member State in which the Customer is established; where the Customer is not established in the EEA but is subject to the GDPR under Art. 3(2), it is the authority of the Member State in which the Customer’s Art. 27 representative is established.
   5. Clause 17 (governing law): the law of Ireland. The SCCs require the law of an EU Member State, which is why this differs from clause 16 of the Terms of Service.
   6. Clause 18(b) (forum): the courts of Ireland.
   7. Annexes I, II and III of the SCCs are the Annexes of this DPA.
3. Where the UK GDPR applies, the SCCs apply as amended by the UK International Data Transfer Addendum (Version B1.0), with Tables 1 to 3 completed from this DPA and its Annexes, and Table 4 selecting that neither party may end the Addendum as permitted by Section 19. For Switzerland, references to the GDPR are read as references to the Swiss FADP, and the Swiss Federal Data Protection and Information Commissioner is the competent authority.
4. Under the KVKK, transfers abroad rest on the mechanisms Art. 9 provides following the 2024 amendments — principally a standard contract of the form published by the Kurul, notified to it as required.
5. If a transfer mechanism relied on here is invalidated, we will adopt a valid alternative without undue delay rather than continue the transfer.

15. Liability

The limitations and exclusions of liability in the Terms of Service apply to this DPA and form a single aggregate cap across both — this DPA does not create a second one. Nothing here limits a data subject’s rights under the SCCs or under applicable data protection law.

16. Term and changes

1. This DPA runs for as long as we process Customer Personal Data, and the clauses that have to outlive it — confidentiality, deletion, transfers — do.
2. We may update this DPA where a change in law, in a transfer mechanism, or in the service requires it, provided the Customer’s protections are not materially reduced. Material changes are notified at least 30 days in advance by email to the organization’s owners, and the date at the top of this page changes with them.

17. Getting a signed copy

This DPA is already in force without a signature. If procurement needs a countersigned PDF — with the Customer’s own entity details in Annex I — write to neuvikon@gmail.com with the legal name and address to put on it, and we will return it signed. Nothing about the terms changes; only the paperwork does.

Annex I — Description of the processing

A. Parties

Data exporter / controller: the Customer — the organization using Source, as identified by its account. Its role is controller (or processor, under Module Three). Contact: the email addresses of its owners, as held in the service.

Data importer / processor: Neuvikon, a şahıs şirketi (sole proprietorship) established in Türkiye. Activities relevant to the transfer: providing Source as described in the Terms of Service. Contact: neuvikon@gmail.com.

B. Description of the processing

C. Competent supervisory authority

Determined as set out in clause 14.2(d).

Annex II — Technical and organisational measures

These are the measures actually in place, not an aspirational list. Clause 6.2 permits them to change provided the overall level of security is not reduced.

Annex III — Sub-processors

The sub-processor page is Annex III, and is dated so that a particular version of it can be relied on. It states, for each sub-processor, its name, what it does, the categories of data that reach it, and where it processes.