Data Processing Agreement (DPA)

This page contains the standard agreement governing the processing of personal data between businesses that use the Bildir365 service and the service provider. It has been prepared in line with Art. 28 of the EU General Data Protection Regulation (“GDPR”) and Art. 12 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”).

Parties and effectiveness

This Data Processing Agreement (the “Agreement”) is entered into between:

• Customer (controller): the business identified by the details it provided when creating its account on Bildir365 (business name, name of the authorized person, email and, optionally, phone number).
• Provider (processor):
  Bekir UĞUR (trade name: Konsol Dev)
  Hürriyet Mahallesi, Numan Durak Aksoy Bulvarı No: 158/B, Kat: 2, No: 11, 27900 Oğuzeli / Gaziantep, Turkey
  Email: info@bildir365.com

Formation and effectiveness. The Agreement is formed electronically and takes effect when the Customer creates an account on Bildir365 or starts using the Service; no signature is required. The person creating the account declares that they are authorized to accept this Agreement on behalf of the Customer.

The Agreement forms an integral part of the Terms of Use. The Customer may write to info@bildir365.com to request a copy signed by both parties.

KVKK. For Customers subject to the KVKK, this Agreement also serves as the arrangement between controller and processor regarding the data security obligations under Art. 12 KVKK.

Annexes. The following annexes form an integral part of the Agreement: Annex 1 (Details of the processing), Annex 2 (Technical and organizational measures) and Annex 3 (Sub-processors).

§ 1 Subject matter and duration

1.1 Subject matter. The Provider processes personal data on behalf of the Customer and in accordance with the Customer’s instructions in connection with the Customer’s use of the Bildir365 service (the “Service”). The Service is a service for collecting and managing feedback via QR codes (website, web dashboard and iOS app).

1.2 Scope. This Agreement covers only data that the Provider processes on behalf of the Customer:

• data collected through the Customer’s feedback forms;
• account data of the Customer’s staff (for the purpose of team management and the delivery of notifications).

Processing for which the Provider itself is responsible — website visitors, the contact form, account registration, authentication and subscription management, support requests, and security and abuse prevention (see § 2.4) — is outside the scope of this Agreement and is described in the Privacy Policy.

1.3 Duration. The Agreement applies, as set out in § 9, for as long as the Provider processes personal data on behalf of the Customer.

1.4 Terms. Terms used in this Agreement such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given in Art. 4 GDPR and Art. 3 KVKK.

§ 2 Nature and purpose of the processing, types of data, data subjects

2.1 Nature and purpose. The Provider collects, records, organizes and stores personal data through the forms defined by the Customer; transmits and displays it to the Customer’s authorized users via the dashboard, the app, email and push notifications; automatically masks inappropriate words entered in forms; and deletes data where required. The purposes are the delivery and management of feedback for the Customer, management of the Customer’s team, sending of notifications, and ensuring the security of the Service.

2.2 Types of data and data subjects. The categories of personal data and of data subjects are set out in detail in Annex 1. In summary: the information that feedback senders provide in the Customer’s form, form responses, attachments and technical data (IP address, browser information), and the account data of the Customer’s staff.

2.3 Special categories of data. The Service is not designed for the processing of special categories of personal data within the meaning of Art. 9 GDPR and Art. 6 KVKK; the Provider does not knowingly collect such data. The Customer’s obligations in this respect are set out in § 6.3.

2.4 Prevention of abuse. To prevent abuse of the Service (rate limiting, blocking based on IP address and browser information, review of content reports), the Provider additionally acts, to the extent necessary and in its own legitimate interest, as a controller; this processing is described in the Privacy Policy. Beyond that, the Provider does not use the personal data it processes on behalf of the Customer for its own purposes, does not sell it, does not share it for marketing purposes and does not use it to create profiles.

§ 3 Instructions

3.1 Instructions. The Provider processes personal data only on documented instructions from the Customer, including with regard to transfers to third countries (see § 7). The instructions are:

• this Agreement and the Terms of Use;
• the Customer’s configuration and use of the Service (e.g. defining forms and fields, managing users and permissions, notification settings, deleting feedback, deleting the account);
• additional written instructions that the Customer sends by email to info@bildir365.com.

3.2 Verification and feasibility. The Provider may verify by reasonable means that an instruction sent by email originates from the Customer. It will make reasonable efforts to carry out instructions that go beyond the functions of the Service; if it cannot, it will inform the Customer without undue delay.

3.3 Unlawful instructions. If the Provider considers that an instruction infringes the GDPR, the KVKK or other data protection provisions, it will inform the Customer without undue delay and may suspend implementation of the instruction until the Customer has confirmed or changed it. The Provider has no obligation to review the lawfulness of instructions or to provide legal advice.

3.4 Legal requirements. If the Provider is required by law to which it is subject to process data otherwise than as instructed, it will inform the Customer before the processing, unless that law prohibits such notification.

§ 4 Obligations of the Provider

4.1 Confidentiality. The Provider restricts access to personal data to persons necessary for operating the Service; at present, that person is solely the Provider itself. Everyone with access to personal data is bound by confidentiality, which continues after the processing has ended (Art. 28(3)(b) GDPR; Art. 12(4) KVKK). The Provider will place any persons it authorizes in the future under the same obligation.

4.2 Technical and organizational measures. In accordance with Art. 32 GDPR and Art. 12(1) KVKK, the Provider implements the technical and organizational measures described in Annex 2 to ensure a level of security appropriate to the risk. The Provider may update these measures in line with technical progress, but will not materially reduce the level of protection.

4.3 Data subject requests. Responding to requests concerning data subjects’ rights (Arts. 12–22 GDPR; Art. 11 KVKK) is the Customer’s responsibility. Taking into account the nature of the processing, the Provider will assist the Customer with this to a reasonable extent. If a data subject contacts the Provider directly and it is apparent that the request concerns the Customer’s data, the Provider will forward the request to the Customer without undue delay and will not respond on the substance without the Customer’s instruction; it may refer the requester to the Customer. The Customer can access its data and delete feedback through the dashboard and app functions of the Service; where this is not sufficient, the Provider will assist within a reasonable time upon the Customer’s request by email.

4.4 Assistance under Arts. 32–36 GDPR. Taking into account the nature of the processing and the information available to it, the Provider will assist the Customer to a reasonable extent in meeting its obligations under Arts. 32–36 GDPR (security of processing, breach notifications, data protection impact assessment and prior consultation) and will provide the necessary information for that purpose.

4.5 Personal data breach. If the Provider becomes aware of a personal data breach concerning personal data it processes on behalf of the Customer, it will notify the Customer by email without undue delay and, where possible, within 48 hours after becoming aware of it. To the extent available, the notification will describe: the nature of the breach (where possible, the categories and approximate numbers of data subjects and records concerned), its likely consequences, the measures taken or proposed, and a contact point. Where not all information can be provided at the same time, it may be provided in phases. The Provider will take reasonable measures to remedy the breach and mitigate its adverse effects and will cooperate with the Customer. Deciding whether to notify the competent authority (Art. 33 GDPR; Art. 12(5) KVKK and the relevant decisions of the Personal Data Protection Board) and the data subjects is the Customer’s responsibility. A breach notification is not an admission of fault or liability by the Provider.

4.6 Deletion and return. When the service relationship ends, personal data is deleted or returned, at the Customer’s choice:

• Deleting the account: When the Customer’s authorized person follows Settings › Subscription › Delete My Account in the app and confirms with the code sent by email, the business and all data and attachments linked to it are permanently deleted immediately. This cannot be undone.
• Other cases of termination: If the service relationship ends in another way (e.g. expiry of the license or termination), personal data is deleted within 30 days at the latest after the Customer’s request.
• Return: Upon the Customer’s request, the Provider will give the Customer a machine-readable export of the data before deletion. Because account deletion cannot be undone, a Customer who wants an export must request it before deleting its account.
• Retention periods: The retention periods applicable to deleted feedback and other categories of data are set out in Annex 1.
• Exceptions: Copies remaining in the hosting provider’s backups (see Annex 3) may be retained until the backup cycle, which is not under the Provider’s control, has run its course; these copies are not used for any other purpose and are deleted when the backup cycle is complete. Records that must be retained by law are kept only for the period and purpose required by that obligation.
• Confirmation: Upon the Customer’s request, the Provider will confirm by email that the deletion has been carried out.

4.7 Information and audits. The Provider will make available to the Customer, upon written request and within a reasonable time, the information necessary to demonstrate compliance with the obligations in this Agreement, and will allow for and contribute to audits (including inspections) conducted by the Customer or an auditor mandated by it. The following conditions apply to audits:

• at most once per year;
• on at least 30 days’ prior written notice and during the Provider’s normal working hours in Turkey;
• conducted primarily by means of written information and documentation and remote review, and without unreasonably disrupting the Provider’s operations;
• limited to processing within the scope of this Agreement (other customers’ data and the Provider’s trade secrets are excluded);
• if the Customer mandates a third party, that person must be bound by confidentiality and must not be a competitor of the Provider; the Customer and the auditor keep confidential the information learned during the audit.

In the event of a personal data breach, concrete indications of non-compliance with this Agreement or a request by a competent supervisory authority, the once-a-year limit and the 30-day notice period do not apply; notice is then given a reasonably short time in advance. The Provider will also cooperate with the competent supervisory authorities (including the Personal Data Protection Board) in the performance of their tasks.

4.8 Records and contact. To the extent required by law, the Provider keeps a record of the processing activities it carries out on behalf of the Customer (Art. 30(2) GDPR). Contact for data protection matters: info@bildir365.com.

§ 5 Sub-processors

5.1 General authorization. The Customer gives the Provider general written authorization to engage the sub-processors listed in Annex 3 for the services and processing locations stated there (Art. 28(2) GDPR).

5.2 Notice of changes. If the Provider intends to add or replace a sub-processor, it will notify the Customer by email at least 14 days in advance, at the email address registered in the Customer’s account, and will update Annex 3. The notice states the sub-processor’s name, headquarters, service and processing location.

5.3 Objection. Within this period, the Customer may object to the change by email on reasonable data protection grounds. The parties will try in good faith to resolve the objection. If no objection is raised within the period, the change is deemed approved.

5.4 Right to terminate. If the parties cannot resolve the objection within a reasonable time, the Customer may end the Agreement by deleting its account or terminating the Service (§ 4.6 applies). This right may also be exercised for a reasonable period after the change has been implemented.

5.5 Flow-down of obligations. The Provider selects sub-processors from among those providing sufficient guarantees to implement appropriate technical and organizational measures, and imposes on each sub-processor, by contract (including the sub-processor’s standard data processing terms appropriate to the nature of its service), data protection obligations at the same level as those in this Agreement (Art. 28(4) GDPR).

5.6 Liability. The Provider remains liable to the Customer for the performance of the sub-processor’s obligations (Art. 28(4) GDPR), subject to § 8.

§ 6 Obligations of the Customer

6.1 Lawfulness. As controller, the Customer is responsible for the lawfulness of the processing of personal data (Arts. 5 and 6 GDPR; Arts. 4 and 5 KVKK), in particular for having a valid legal basis for collecting feedback.

6.2 Information and data subject rights. The Customer is responsible for informing data subjects (in particular feedback senders) in accordance with Arts. 13 and 14 GDPR and Art. 10 KVKK, through its form or another suitable means, and for responding to data subjects’ requests.

6.3 Special categories of data and children’s data. The Customer does not collect special categories of personal data in its forms (Art. 9 GDPR; Art. 6 KVKK — e.g. health, religion, ethnic origin, political opinions, biometric data); it does not knowingly collect personal data from persons under 18 and does not design its forms for them. The Customer designs its forms and free-text fields so that they do not request such information and, if it notices that such data has reached it, deletes it immediately.

6.4 Staff accounts. The Customer manages its users (staff) in the Service itself: it adds and removes users, determines roles and form permissions, keeps login credentials confidential and removes access for people who leave. The Customer is responsible for informing its staff that their data is processed as part of the Service.

6.5 Instructions. The Customer is responsible for the lawfulness of the instructions it gives.

6.6 Other obligations. Obligations that fall to the Customer as controller (e.g. registration with the Data Controllers Registry (VERBİS) where required, a record of processing activities under Art. 30 GDPR, a data protection impact assessment where required, notification of breaches to competent authorities) are the Customer’s responsibility. The Customer also assesses, on its own responsibility, whether the measures in Annex 2 are appropriate to the risk of its own processing activities.

6.7 Contact details. The Customer keeps the contact details in its account (in particular its email address) up to date; notices under this Agreement (§ 4.5 and § 5.2) are sent to that address.

§ 7 Transfers abroad

7.1 Processing location. The Provider’s servers and email delivery are in Turkey (Annex 3). iOS push notifications are transmitted via Google (Firebase Cloud Messaging; EU/US) and Apple (APNs; US); a push notification is sent only if the user has granted notification permission on their iOS device, and the permission can be turned off at any time. The Customer instructs that the Service be provided with this setup.

7.2 Standard Contractual Clauses. The European Commission has not adopted an adequacy decision for Turkey. Therefore, for Customers established in the European Economic Area (EEA), Switzerland or the United Kingdom, Module Two (transfer controller to processor) of the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the “SCC”) is incorporated into this Agreement by reference. Under the SCC, the Customer is the data exporter and the Provider is the data importer. The SCC take effect between the parties upon acceptance of this Agreement; no separate signature is required.

7.3 SCC selections. For the purposes of the SCC, the parties have agreed:

• SCC Clause 7 (docking clause): included (a third entity may accede to the SCC with the agreement of the parties).
• SCC Clause 9(a) (sub-processors): Option 2 — general written authorization; the notice period is at least 14 days (§ 5.2).
• SCC Clause 11(a) (redress): the optional independent dispute resolution body is not provided for.
• SCC Clause 13(a) (supervision): the competent supervisory authority is the authority of the country in which the Customer, as data exporter, is established.
• SCC Clause 17 (governing law): Option 1 — the law of Germany.
• SCC Clause 18(b) (choice of forum and jurisdiction): the courts of Germany.
• SCC Annexes: SCC Annex I.A (parties) = Annex 1 Part A; SCC Annex I.B (description of the transfer) = Annex 1 Part B; SCC Annex I.C (competent supervisory authority) = Annex 1 Part C; SCC Annex II (technical and organizational measures) = Annex 2; SCC Annex III (sub-processors) = Annex 3.

7.4 Switzerland and the United Kingdom. For Customers established in Switzerland, the SCC apply with the adaptations published by the Swiss Federal Data Protection and Information Commissioner (FDPIC): references to the GDPR are deemed to refer to the Swiss Federal Act on Data Protection (FADP), the competent supervisory authority is the FDPIC, and data subjects keep the possibility to seek redress in Switzerland as their place of habitual residence. For Customers established in the United Kingdom, the SCC apply together with the International Data Transfer Addendum published by the Information Commissioner’s Office (ICO); the competent supervisory authority is the ICO.

7.5 Priority. In the event of a conflict between this Agreement and the SCC, the SCC prevail.

7.6 KVKK. For Customers subject to the KVKK, the Provider’s processing in Turkey does not constitute a transfer abroad. For transmissions to the sub-processors abroad used for push notifications (Annex 3), the framework of Art. 9 KVKK applies: the transmission takes place only if the user has granted notification permission on their device, the permission can be turned off at any time, and the content transmitted is limited to what is stated in Annex 1 (the message text and the sender’s identity are not transmitted). If the Customer so requests, the parties will separately agree any additional safeguards considered necessary under Art. 9 KVKK.

§ 8 Liability

8.1 Between the parties. Liability between the parties is subject to the limitations of liability in the Terms of Use, to the extent permitted by applicable law.

8.2 Towards data subjects. These limitations do not affect liability towards data subjects or rights arising under Art. 82 GDPR and SCC Clause 12; the right of recourse between the parties under Art. 82(5) GDPR remains unaffected.

§ 9 Term and termination

9.1 Term. The Agreement takes effect in accordance with § 1.3 and applies for as long as the service relationship continues. It ends when the service relationship ends (deletion of the account, expiry of the license or termination); however, the provisions of the Agreement continue to apply for as long as the Provider continues to process personal data on behalf of the Customer (e.g. the deletion period under § 4.6 and backups).

9.2 Material breach. The Customer may terminate the Service if the Provider materially breaches this Agreement or the SCC and fails to remedy the breach within a reasonable period set for that purpose; termination may be immediate where the breach cannot be remedied or where waiting cannot reasonably be expected of the Customer. The Provider may likewise stop the relevant processing or terminate the Service if the Customer does not change or withdraw an instruction that has been reported as unlawful (§ 3.3).

9.3 Provisions surviving termination. Confidentiality, deletion and return (§ 4.1 and § 4.6), liability (§ 8) and those provisions of the SCC that must continue to apply after termination remain in force after the Agreement ends.

§ 10 Final provisions

10.1 Language versions. This Agreement is published in Turkish, English and German. For Customers established in the EEA, Switzerland and the United Kingdom, the German version is authoritative; for all other Customers, the Turkish version is authoritative; the English version is provided for convenience only.

10.2 Order of precedence. On matters of personal data protection, in the event of a conflict between this Agreement and the Terms of Use, this Agreement prevails; in the event of a conflict between this Agreement and the SCC, the SCC prevail.

10.3 Form and amendments. The Agreement may be concluded, and notices under this Agreement may be given, electronically (including by email); under Art. 28(9) GDPR, electronic form is sufficient. The Provider may update this Agreement because of legal developments, decisions of authorities or changes to the Service; the current version is published on this page. Material changes to the Customer’s detriment will be notified to the email address registered in the account and take effect at least 30 days after the notice; a Customer that does not accept the change may end the Agreement within that period by deleting its account. § 5 applies to changes of sub-processors. The text of the SCC cannot be changed in this way.

10.4 Severability. If any provision of this Agreement is invalid or unenforceable, this does not affect the validity of the remaining provisions. In that case, the parties agree that the valid provision closest to the economic and legal purpose of the invalid provision applies in its place.

Annex 1 — Details of the processing

This Annex contains the details of the processing under Art. 28(3) GDPR and corresponds to SCC Annex I.

A. Parties (SCC Annex I.A)

• Data exporter (Customer): role: controller. Identity and contact details: the business name, name of the authorized person, email and (if provided) phone number the Customer provided when creating its account. Contact person: the authorized person named in the account.
• Data importer (Provider): role: processor. Bekir UĞUR (trade name: Konsol Dev), Hürriyet Mahallesi, Numan Durak Aksoy Bulvarı No: 158/B, Kat: 2, No: 11, 27900 Oğuzeli / Gaziantep, Turkey; email: info@bildir365.com. Contact person: the Provider itself.
• Date of acceptance: the date on which the Customer creates its account or starts using the Service (see “Parties and effectiveness”).

B. Details of the processing and transfer (SCC Annex I.B)

• Subject matter: provision of the Service; processing of feedback data and staff account data on behalf of the Customer.
• Duration: for as long as the Customer’s account is open (§ 9); retention and deletion periods are set out in the table below.
• Nature: collection, recording, organization, storage, transmission (dashboard, app, email, push), display, automatic masking of inappropriate words and deletion.
• Purpose: delivery and management of feedback for the Customer; team management; sending of notifications; ensuring the security of the Service.
• Categories of data subjects:
  • feedback senders (persons who fill in the Customer’s form);
  • the Customer’s staff (users set up by the authorized person in the Service).
• Categories of personal data:
  • Feedback data: the sender’s name, phone number and email (to the extent included in the form and entered by the sender; the Customer determines which fields are requested and which are mandatory); free text, ratings and choice responses entered in form fields; uploaded files (photo, video, PDF; up to 25 MB); IP address, browser information (User-Agent) and time of submission.
  • Staff account data: name, email, role and the forms the person is authorized to access; password (bcrypt hash only); language preference; email verification and optional two-step verification codes (short-lived); in the iOS app, the session token (only its SHA-256 hash on the server), device name (the generic name provided by iOS) and platform, and the push registration token.
  • Notification data: push title “New feedback · {form name}”; body: notification type/category (e.g. “Complaint”) or “You have received new feedback.”; the message text and the sender’s identity are not included in the push notification. Email: if the user has enabled it, a summary of the new feedback and a link to the dashboard.
  • Moderation records: blocked-sender record (SHA-256 hash of IP address and browser information, last 10 digits of the phone number, email, label); content report (reporting user’s number, reason, text excerpt of the content, date). For these records the Provider additionally acts as a controller under § 2.4.
• Special categories of data: none envisaged; they are not knowingly collected or requested (§ 2.3 and § 6.3).
• Frequency: continuous (as the Service is used).
• Transfer and processing location: processing takes place in Turkey; for push notifications also Google (EU/US) and Apple (US) (Annex 3).
• Transfers to sub-processors: made to the sub-processors in Annex 3, within the services stated there (hosting and email delivery; push delivery) and for the duration of the Service.
• Retention periods: see the table below.

Retention periods for records the Provider keeps under its own responsibility (e.g. contact form messages, rate-limiting records, activity logs) are described in the Privacy Policy.

C. Competent supervisory authority (SCC Annex I.C)

In accordance with SCC Clause 13, the competent data protection supervisory authority of the country in which the Customer, as data exporter, is established. For the current list of the authorities in Germany: BfDI — Anschriften der Aufsichtsbehörden (in German). In Switzerland the FDPIC is competent, in the United Kingdom the ICO (§ 7.4). For Customers subject to the KVKK to whom the SCC do not apply, the competent authority is the Personal Data Protection Board.

Annex 2 — Technical and organizational measures

The Provider implements the following measures in proportion to the nature and scale of the Service (Art. 32 GDPR; Art. 12 KVKK). This Annex corresponds to SCC Annex II. The measures may be updated in line with technical progress; the level of protection will not be materially reduced (§ 4.2).

1. Confidentiality — access and authentication control

• Passwords are stored only as a bcrypt hash.
• App session (API) tokens are stored on the server only as a SHA-256 hash.
• Optional two-step verification by email; mandatory for the Provider’s admin account.
• Rate limiting and brute-force protection for login, registration, password reset and two-step verification.
• Session cookies are set with the HttpOnly, SameSite and (over HTTPS) Secure attributes.
• Role-based access: the Customer’s staff can access only the forms they are authorized for.
• Feedback and support attachments are not publicly accessible; they are served only to authorized users (except logos).
• On the Provider’s side, access is limited to the person needed to operate the Service (currently the Provider alone).
• Physical access: the servers are in the hosting provider’s infrastructure; the physical security of that infrastructure is the hosting provider’s responsibility (Annex 3).

2. Transfer control

• Data is transmitted using HTTPS/TLS.

3. Integrity

• CSRF protection.
• Input validation and output escaping.
• Inappropriate-content filter together with tools for reporting content and blocking senders.

4. Availability

• Backups are made by the hosting provider; the details are not under the Provider’s control.

5. Separation and isolation

• Data isolation between businesses: each business sees only its own data.
• The Customer’s staff see only the data of the forms they are authorized for.

6. Deletion

• Automatic cleanup of deleted and expired data (retention periods in Annex 1).
• When an account is deleted, the business and all data and attachments linked to it are permanently deleted immediately (§ 4.6).

Annex 3 — Sub-processors

The Customer has given general written authorization for the engagement of the following sub-processors under § 5.1. This Annex corresponds to SCC Annex III.

• Apple’s App Store distribution is Apple’s own responsibility; the Provider does not receive App Store purchase or download data.
• Push notifications are sent only if the user has granted notification permission on their iOS device; the permission can be turned off at any time.
• The Customer’s own authorized users are not sub-processors.
• Changes of sub-processors are notified under § 5.2; the current list is on this page.
• Privacy policies of the sub-processors: Google · Apple.