Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Ajansify ("Ajansify", "we") and the customer that uses the Ajansify service ("Customer", "you"). It applies whenever Ajansify processes Customer Personal Data on the Customer's behalf. By accepting the Terms, the Customer accepts this DPA; no separate signature is needed. It meets the requirements of article 28 GDPR, article 28 UK GDPR and article 12 of the Turkish Personal Data Protection Law No. 6698 (KVKK).

1. Definitions

• Applicable Data Protection Law: KVKK, the GDPR, the UK GDPR and any other data protection law that applies to the processing.
• Customer Personal Data: personal data contained in content that the Customer or its users upload to, create in or connect to the service, which Ajansify processes on the Customer's behalf (Annex A).
• Sub-processor: a third party engaged by Ajansify to process Customer Personal Data.
• Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• SCCs: the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.
• Other terms, such as controller, processor, data subject and processing, have the meaning given in the Applicable Data Protection Law. Under KVKK, controller means "veri sorumlusu" and processor means "veri işleyen".

2. Roles and scope

• The Customer is the controller of Customer Personal Data, or a processor acting for another controller. Ajansify is the Customer's processor, or sub-processor.
• If the Customer is a processor, it confirms that its controller has authorised the Customer's instructions, including the use of Ajansify and its Sub-processors.
• Ajansify is a controller, not a processor, for account, billing, security, marketing, cookie and service operation data. That processing is governed by our Privacy Policy, not by this DPA.

3. Details of processing

The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects, are set out in Annex A.

4. Processing on documented instructions

• Ajansify processes Customer Personal Data only on the Customer's documented instructions. These are the Terms, this DPA and the Customer's use and settings of the service, for example generating content, connecting services, publishing, saving to cloud storage, sharing through public links and inviting team members.
• Additional instructions must be in writing and consistent with the Terms.
• We inform the Customer without delay if, in our opinion, an instruction infringes Applicable Data Protection Law, and we may suspend that processing until the instruction is confirmed or changed.
• If the law requires us to process Customer Personal Data otherwise, we inform the Customer first, unless the law prohibits it.
• We do not use Customer Personal Data for our own purposes, except to keep the service secure and prevent fraud and abuse, and to create aggregate or anonymised statistics that do not identify the Customer or any person. We do not sell Customer Personal Data, use it for advertising, use it to train our own AI models, or allow AI providers to use it to train their general models.

5. Customer obligations

The Customer confirms and is responsible for the following:

• it has a lawful basis for the processing, including for sending Customer Personal Data to Ajansify, its Sub-processors and the AI providers that perform the jobs;
• it has given the required notices to data subjects, including notices for data not obtained from them (article 14 GDPR, article 10 KVKK), for example to reviewers, people in photos and its own customers;
• it has obtained the consent or permission of people shown in images and videos and of people whose voices are used, where the law requires it, including for AI lip sync, voice and likeness features;
• it does not upload special categories of personal data or children's data unless this is lawful and necessary and it applies the required safeguards, in line with our AI & Acceptable Use Policy;
• its instructions comply with the law;
• it is responsible for its choice and use of connected third-party services (publishing tools, cloud storage, Google Business Profile). These services are chosen by the Customer and are not Ajansify's Sub-processors;
• it is responsible for checking and labelling AI-generated content and for the content it publishes.

6. Confidentiality

Ajansify ensures that persons authorised to process Customer Personal Data are bound by confidentiality and have access only to the extent they need it for their work.

7. Security

• Ajansify implements appropriate technical and organisational measures under article 32 GDPR and article 12 KVKK, as described in Annex B.
• We may update these measures, provided the overall level of protection is not reduced.
• The Customer is responsible for the security of its own account, including passwords, team permissions and the public links it creates.

8. Sub-processors

• The Customer gives Ajansify general authorisation to engage the Sub-processors listed on Service Providers & Sub-processors.
• Before adding or replacing a Sub-processor, we update that list and notify the Customer by e-mail or in the app at least 30 days in advance where possible. In urgent cases, such as security or service continuity, we notify as soon as possible.
• The Customer may object in writing to [email protected] within the notice period on reasonable data protection grounds. We will discuss the objection in good faith. If we cannot resolve it, the Customer may stop using the affected service by cancelling its subscription before the change takes effect, under the Terms and without prejudice to its mandatory statutory rights.
• We impose on each Sub-processor, by written contract, data protection obligations that are no less protective than this DPA. Ajansify remains responsible to the Customer for its Sub-processors' performance.

9. Assistance with data subject requests

• The service lets the Customer view, correct, delete and export content and disconnect services, which helps it answer data subject requests.
• If we receive a request about Customer Personal Data directly, we forward it to the Customer without undue delay and do not respond ourselves, except to redirect the person, unless the law requires otherwise.
• We give further reasonable assistance, taking into account the nature of the processing.

10. Impact assessments and prior consultation

We provide reasonable information and assistance for the Customer's data protection impact assessments and prior consultations with supervisory authorities, as far as they concern our processing. We do this mainly through this DPA, Annex B and the Sub-processor list.

11. Personal Data Breach

• We notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. We aim to do so within 48 hours.
• The notice describes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information may be provided in stages.
• We take reasonable steps to contain the breach and reduce its effects.
• The Customer decides on and makes any notifications to supervisory authorities and data subjects; we assist. A notice is not an admission of fault.
• We send notices to the account owner's e-mail address and may also show them in the app.

12. Return and deletion

• While the subscription is active, the Customer can export its content with the service functions.
• After the Terms end or the account is closed, the Customer has 30 days to export its content. We then delete Customer Personal Data from our active systems. Copies in backups are deleted in the normal backup cycle, within 90 days of closure at the latest, and are not actively processed in the meantime.
• If the law requires us to keep some data, we keep it only for as long as required and protect it.
• On request, we confirm deletion in writing.
• Content the Customer has saved to its own cloud storage or published through connected services is outside our systems and is not deleted by us.

13. Audits

• We make available the information needed to show compliance with this DPA: this DPA, Annex B, the Sub-processor list and written answers to a reasonable security questionnaire once every 12 months.
• If this information is not sufficient, or a supervisory authority requires it, or after a Personal Data Breach, the Customer may carry out an audit, including an on-site audit. The Customer must give 30 days' notice, and the audit takes place during business hours, at most once every 12 months (except when required by an authority or after a breach). It is carried out by the Customer or an independent auditor bound by confidentiality who is not our competitor. The Customer bears its own costs. The audit must not disrupt our operations or give access to other customers' data.
• Audits of Sub-processor facilities, such as data centres, are covered by the Sub-processors' own audit reports or certifications where available.

14. International transfers

• Customer Personal Data is hosted in Germany (EU). Ajansify is established in Türkiye, and some Sub-processors are in the United States or operate globally.
• EU/EEA. Where the processing involves a transfer of Customer Personal Data from the EU/EEA to a country without an adequacy decision, the SCCs are incorporated by reference: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor. The Customer is the data exporter and Ajansify the data importer. For the SCCs: Clause 7 (docking clause) applies; under Clause 9(a), Option 2 (general authorisation) applies with the notice period in section 8; the optional wording in Clause 11 does not apply; under Clause 13, the competent supervisory authority is that of the Member State where the Customer is established or, if it is not established in the EU, where its representative is or where the data subjects are; under Clause 17, Option 2 applies, and the SCCs are governed by the law of the Member State where the Customer is established or, if that law does not allow third-party beneficiary rights or the Customer is not established in the EU, by the law of Ireland; under Clause 18, disputes are resolved by the courts of that Member State. Annex I of the SCCs is completed by Annex A, Annex II by Annex B and Annex III by the Sub-processor list.
• If the European Commission adopts standard contractual clauses for importers that are themselves subject to the GDPR, those clauses will apply in place of the SCCs above. Until then, the SCCs apply to the extent applicable, together with the measures in Annex B.
• Onward transfers to Sub-processors in third countries rely on the EU-US Data Privacy Framework where the Sub-processor is certified, and otherwise on the SCCs.
• United Kingdom. For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner is incorporated and completed with the information in this DPA.
• Türkiye. Transfers of Customer Personal Data abroad are made under the standard contracts set out in the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad. Ajansify signs the appropriate standard contracts with its Sub-processors and notifies the Personal Data Protection Authority within the statutory period where it is responsible for notification. Where the law requires the Customer to be a party, the Customer agrees to sign the relevant standard contract.
• Other countries. Where other laws require transfer safeguards, the parties apply the safeguards those laws require.
• If the SCCs and this DPA conflict, the SCCs prevail.

15. Requests from authorities

If we receive a legally binding request from an authority for Customer Personal Data, we inform the Customer unless the law prohibits it, disclose only the minimum required, and challenge requests that appear unlawful or excessive where reasonable.

16. Liability

Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms, except where Applicable Data Protection Law, including the SCCs, does not allow such limitation.

17. Term, precedence and changes

• This DPA applies for as long as Ajansify processes Customer Personal Data, including after the Terms end until deletion under section 12.
• In case of conflict regarding data protection, the SCCs prevail over this DPA, and this DPA prevails over the Terms.
• We may update this DPA to reflect changes in law, Sub-processors or the service. We notify material changes in advance by e-mail or in the app. Changes that reduce the overall protection of Customer Personal Data require the Customer's agreement.
• Except for the SCCs, this DPA is governed by the law and jurisdiction set out in the Terms.

Annex A – Details of processing

Annex B – Technical and organisational measures

• Encryption in transit: HTTPS/TLS for connections to the service and for calls to Sub-processors.
• Credentials and keys: passwords stored only as hashes; access keys for connected services stored encrypted.
• Access control: role- and brand-based permissions inside customer accounts; internal access on a need-to-know and least-privilege basis; administrative access limited to authorised staff.
• Separation: customer data is logically separated by account.
• Availability: regular backups; hosting in data centres in Germany operated by Contabo.
• Logging and monitoring: security and access logs kept for 2 years; AI job logs kept for up to 1 year with restricted access.
• Network security: Cloudflare proxy and attack protection, rate limits and bot checks.
• Data minimisation: temporary server copies deleted after each job; card data handled by the payment institution, not by Ajansify; only the cloud files the Customer selects are accessed, with narrow permission scopes.
• Sub-processor management: written contracts; AI providers used through business (API) services without training on Customer Personal Data.
• Incident management: breach handling and notification as described in section 11.
• Personnel: confidentiality obligations; access removed when no longer needed.
• Deletion: deletion procedures as described in section 12.

Annex C – Sub-processors

The current list of Sub-processors, their purposes, locations and transfer safeguards is published on Service Providers & Sub-processors.