Data processing agreement. An annex to the terms of service.

1. Parties and roles

Data controller: the Customer that uses the Service having accepted the terms of service.

Data processor: YGMR Danışmanlık Limited Şirketi, Yeşilova Mah. 1. Değer Sk. No:28 İç Kapı No:3 Küçükçekmece/İstanbul, MERSİS 0953096784700001; for KVKK correspondence kvkk@ygmr.com.tr.

The Customer decides for what purpose and by what means personal data is processed, through the settings of the Service and the instructions in this agreement; Postlip Metrics processes this data only on the Customer’s behalf. Terms not defined here have the meaning they have in the terms of service.

2. Subject, nature, purpose and duration

• Subject: providing the Service.
• Nature: receiving, validating, screening for personal data and storing the messages that come from the Customer’s products; computing sessions, people, conversions and attribution; producing metrics, reports and alerts; storing Mailing & SMS contacts and sending messages; reading data from the platforms the Customer connects and sending data to them on the Customer’s instructions; storing content and files. Processing is automated, by the Service’s software.
• Purpose: the Customer measuring, analysing and marketing its products. Postlip Metrics does not use Customer data for its own purposes, does not sell it, does not use it for its own marketing and does not combine it with another Customer’s data.
• Duration: for the term of the agreement under the terms of service; after the agreement ends, only for the period in the section “End, return and erasure” below.

3. Categories of personal data

No special categories of personal data are processed; in the terms of service the Customer undertakes not to send such data to the Service.

4. Categories of data subjects

• Visitors and users of the Customer’s websites and apps.
• The Customer’s Mailing & SMS contacts: its customers, subscribers and prospects.
• The Customer’s report and alert recipients and content authors.

5. The Customer’s instructions

• The Customer’s instructions are this agreement, the terms of service and the settings the Customer makes in the Service: consent mode, event schema and personal data classes, retention periods, contact fields and permissions, connections, conversion destinations, audience syncs, campaigns, webhooks and deletion requests. Instructions that cannot be given through settings are given in writing.
• If we believe an instruction breaches KVKK or other legislation, we inform the Customer without delay and may hold off carrying it out until it is clarified.
• If a transfer or processing is required by law, we tell the Customer in advance unless the law forbids it.

6. Obligations of Postlip Metrics

• To process Customer data only on the Customer’s instructions and to provide the Service.
• To let only our employees who are bound by confidentiality access Customer data, as far as their work requires.
• To take and keep up to date the technical and organisational measures below.
• To use sub-processors under the rules of this agreement.
• To help the Customer with data subject requests, data breaches and showing its compliance with KVKK.
• To return and erase Customer data when the agreement ends.

7. Technical and organisational measures

• Hosting: the Service’s servers are in data centres in Turkey; database backups are taken on these servers too.
• Tenant isolation: every record belongs to an organization. The database’s row-level security (RLS) rules run every query only in that organization’s context, and no application code bypasses them. The API, ingestion and background jobs connect with separate database roles, with the least rights.
• Encryption: traffic is encrypted with TLS. Connection tokens, provider passwords, signing keys, two-step verification secrets, the identity and contact details of Mailing & SMS contacts, and the IP address and browser details waiting for conversion forwarding are sealed with AES-256-GCM; the key ring can be rotated.
• Hashing: fields defined as personal in the event schema are hashed with HMAC-SHA256 and a key per app; the client address in session and audit records is kept only as a keyed hash; write and API keys are stored only as hashes; contacts are searched through a keyed blind index; passwords are stored with scrypt.
• Data minimisation: IP address and browser details are not stored with events; a message with personal data in an undefined field is refused; the web SDK writes no cookies and does not read form field values; in the consent-required mode no persistent id is created for a visitor without consent.
• Access control: permissions by role and app scope; two-step verification (e-mail code or authenticator app, recovery codes), which can be made mandatory in an organization; rate limits, account lockout and CAPTCHA on risky sign-ins; the authenticator app is mandatory for platform administrators.
• Support access: the platform team can look at an organization only through a support access that needs a reason and lasts at most 24 hours. The access is read-only and shows no events, contacts or e-mail addresses. Its opening and every read are written to the organization’s audit log and e-mailed to the owners; the organization can close it at any time.
• Audit log: every change is written to the audit log with who, when, what, and the values before and after; the Customer searches and exports it in the panel.
• Logs: application logs never contain request bodies, personal data, IP addresses or credentials; the servers keep no access log.
• Outbound connections: webhook and provider calls go only over HTTPS and only to public addresses; internal network addresses are blocked.
• Backups: the database is backed up every day and each backup’s integrity is checked; backups rotate and are deleted after 35 days at the latest.
• Retention and erasure: the Customer chooses retention periods per app; data past them is deleted every day. A deletion request erases all of a person’s data in an app.

8. Sub-processors

The Customer authorises Postlip Metrics to use the sub-processors below to provide the Service. Sub-processors are bound by data protection obligations at the same level as in this agreement; we are liable to the Customer for their performance of those obligations.

Domain name resolution (DNS) comes from a provider established abroad. The Service’s traffic does not pass through this provider and it does not process Customer data, so it is not a sub-processor. If the Customer turns on AI-written report summaries (an organization setting, off by default), only the report’s aggregate numbers and metric definitions are sent to the AI model provider (US); no personal data, ids or free text are sent.

We e-mail the organization’s owners at least 30 days before adding or replacing a sub-processor. If the Customer objects on reasonable grounds and no agreement is reached, it can end the agreement before the change takes effect. We tell a Customer that asks the company names of the sub-processors, under confidentiality.

The platforms and providers the Customer itself chooses and connects (ad, analytics and social media platforms, Mailing & SMS’s e-mail and SMS providers, İYS, webhooks and alert channels) are not sub-processors of Postlip Metrics: the Customer makes its own agreement with them, and transfers to them happen on the Customer’s instructions.

9. Transfers and transfers abroad

• We transfer Customer data only as far as the Service needs, to sub-processors, and on the Customer’s instructions to the recipients the Customer chooses.
• The transfer abroad to the e-mail delivery provider is made under KVKK Art. 9, within the standard contractual clauses announced by the Board and the related safeguards.
• Conversion forwarding and audience sync. The Customer setting up a conversion destination or an audience sync is the instruction to transfer to that platform. Transfers happen only for events with marketing consent given explicitly (or from a Customer source in the “no consent needed” mode) and for people with marketing consent; bot and internal traffic is never sent. As far as the platform uses them, it receives: the conversion event’s name, time, value, currency, products, order id and page address; click and browser ids; SHA-256 hashes of the user id and of the e-mail, phone, first name, last name, city, postal code and country in the Mailing & SMS record; and, on platforms that ask for them, the visitor’s IP address and browser details. In an audience sync only these hashes of the segment’s people with marketing consent are sent.
• IP address and browser details. These two values are kept sealed with AES-256-GCM from ingestion to delivery, for conversion forwarding only; they are written to no event, session, person, log, audit log or delivery detail. They are deleted when delivery succeeds or finally fails, in any case within 7 days. Private, shared and internal network addresses are never sent.
• Most of these platforms are established abroad. The Customer as data controller provides the legal basis for these transfers under KVKK Art. 9 (the data subject’s explicit consent or the Customer’s standard contract with the platform) and informs the visitors.

10. Data subject requests

• We pass data subject requests that reach us directly to the Customer without delay and do not answer them without the Customer’s instructions.
• The Customer can carry out requests with the Service’s tools: person and account profiles, the Mailing & SMS contact card and export, permissions and the suppression list, deletion requests (Settings → Data rights or the Management API). A deletion request erases all of a person’s data in an app within minutes; the request stays on record with the number of rows removed.
• For a request these tools cannot meet, we help the Customer to a reasonable extent.

11. Data breaches

• When we learn of a personal data breach that affects Customer data, we notify the Customer without delay and in any case within 72 hours, at the e-mail addresses of the organization’s owners.
• As far as known, the notice describes the nature and time of the breach, the categories and approximate numbers of data and data subjects affected, its likely consequences, the measures taken and proposed, and a contact person; what is not yet known is added as it becomes known.
• Notifying the breach to the Personal Data Protection Board and to the data subjects is the Customer’s obligation as data controller; we provide the information and documents it needs for this.

12. End, return and erasure

• When the agreement ends, the Customer can take its data with the Service’s export tools within the 30-day period of the terms of service (return).
• At the end of that period Customer data is erased, except what the law requires us to keep; copies in backups are erased by the scheduled rotation within 35 days at the latest. We confirm the erasure in writing if the Customer asks.

13. Information and audits

• At the Customer’s request we provide the information and documents that show compliance with this agreement (a description of the measures, the list of sub-processors, the relevant audit records).
• The Customer can audit, itself or through an independent auditor, no more than once a year, with written notice at least 30 days in advance, during business hours, without disturbing the operation of the Service or the confidentiality of other Customers’ data, and under a confidentiality undertaking. The Customer bears the costs of the audit. An audit after a breach and a request of the Personal Data Protection Board or another competent authority are not subject to the yearly limit.

14. Liability and precedence

• Liability under this agreement is subject to the limitations in the terms of service; liabilities that cannot be limited by law remain.
• On matters of personal data protection this agreement takes precedence over the terms of service. Where this agreement is silent, the terms of service and KVKK apply.