Veri İşleme Sözleşmesi · Data Processing Agreement

1. Definitions

• Controller: Customer (Tenant) — the party determining purposes and means of processing.
• Processor: ArchitectAPI AI Systems — processes personal data on Controller's behalf.
• Personal Data: as defined in KVKK Art. 3, GDPR Art. 4(1), UK GDPR Art. 4(1).
• Sub-processor: third-party service providers we use (list at /processors).
• SCCs: EU Commission Implementing Decision (EU) 2021/914 Standard Contractual Clauses.
• UK IDTA: UK International Data Transfer Agreement / Addendum (DPA 2018 § 119A).

2. Subject Matter, Duration, Categories

ArchitectAPI processes personal data only for the duration of the agreement and on Controller's documented instructions, in scope of the modules Controller activates. On termination, data is returned or deleted within 30 days (subject to legal retention obligations).

2.1 Processing Categories

3. Controller's Obligations

• Establishes lawful basis for processing (Art. 6 GDPR / KVKK Art. 5).
• Provides Art. 13/14 GDPR (or KVKK Art. 10) information notices to its data subjects.
• Issues only documented, written instructions to ArchitectAPI (via API + configuration).
• For Special Category data, follows §15 below.

4. Processor's Obligations (ArchitectAPI)

• Processes only on Controller's documented instructions; does not use for own purposes or sell.
• Ensures personnel are bound by written confidentiality and trained in GDPR / KVKK.
• Implements TOMs in §6.
• Provides 30-day prior notice of sub-processor changes.
• Assists Controller with DSR requests (access, erasure, portability, rectification, objection) within 30 days.
• Notifies Controller of personal data breach within 48 hours of awareness (§7).

5. Sub-processors

Current list at /processors. Changes notified by email 30 days in advance. Controller may object on reasonable grounds; affected service may be suspended, alternative sub-processor sought, or Controller may terminate the affected service with pro-rata refund.

6. Technical and Organisational Measures (TOM)

• Encryption: TLS 1.2+ in transit; column-level encryption with pgcrypto for PII at rest.
• Access control: Role-based (owner/admin/operator/viewer); internal service tokens rotated every 90 days; admin access requires MFA.
• Tenant isolation: Two-layer (Row-Level Security + middleware filter).
• Audit log: Append-only, tamper-evident (hash chain planned).
• Backup: Point-in-Time Recovery, RPO ≤ 5min, RTO ≤ 30min target.
• SDLC security: SAST/DAST in CI pipeline; dependency scanning every build.
• Physical: Data centres (AWS, Hetzner) ISO 27001 + SOC 2 certified.
• Incident response: 24/7 on-call + documented runbooks; summary shared on request.
• Pseudonymisation: Where feasible; analytics IPs are anonymised.

7. Personal Data Breach Notification

ArchitectAPI shall:

• Notify Controller within 48 hours of becoming aware of a breach;
• Report nature, affected record count, categories;
• Describe TOMs taken and to be taken;
• Assist Controller in its 72-hour notification to the supervisory authority under GDPR Art. 33 / UK GDPR Art. 33 / KVKK Art. 12.

8. International Transfers

Mechanisms:

• EU/EEA → third country: EU SCCs Module 2 (Controller-to-Processor) — see "EU SCC Module 2" tab for Annexes I/II/III.
• UK → third country: UK IDTA or UK Addendum to EU SCCs — see "UK IDTA Addendum" tab.
• EU/UK → US (DPF-certified): EU-U.S. Data Privacy Framework / UK Extension where applicable.
• Türkiye → third country: Per KVKK Art. 9 — Board permit, undertaking, or explicit consent.
• Schrems II: Transfer Impact Assessment available on request.

9. Audit Right

Once per year, with 30 days' notice, at Controller's expense, Controller may audit ArchitectAPI's TOMs. Audit must not unreasonably interfere with operations; trade secrets may be redacted. SOC 2 Type II or ISO 27001 reports accepted in lieu of on-site audit.

10. Return / Deletion

On termination or written request, ArchitectAPI returns personal data in structured format (JSON/CSV) and/or deletes within 30 days. Where Turkish tax law (10 years) applies, data is held in isolation for that period, not used for any other purpose.

11. Liability

Liability for fines / data subject claims (GDPR Art. 82, UK GDPR Art. 82, KVKK Art. 12) is allocated to the breaching party in proportion to fault. ArchitectAPI's aggregate liability is capped at fees paid in the 12 months preceding the claim (consistent with Terms §10).

12. Order of Precedence

This DPA is read together with the Terms of Service. In conflict, this DPA prevails.

13. Contact

Data Protection Officer: support@architectapi.com · Legal: support@architectapi.com · Imprint: /imprint

EU SCC Module 2 — Annexes (Decision 2021/914)

Where Controller is established in the EEA (or its data subjects are in the EEA) and ArchitectAPI processes data outside the EEA, the parties incorporate the EU Standard Contractual Clauses (Module 2 — Controller-to-Processor) by reference. The full text is available at eur-lex.europa.eu. The following Annexes complete the SCCs.

UK IDTA / UK Addendum to EU SCCs

For transfers from the United Kingdom, the parties incorporate by reference either:

1. The UK International Data Transfer Agreement (IDTA) issued by the ICO under § 119A Data Protection Act 2018 (in force 21 March 2022), or
2. The International Data Transfer Addendum to the EU Commission SCCs ("UK Addendum"), issued by the ICO and laid before Parliament under § 119A DPA 2018 (in force 21 March 2022).

Supervisory authority: Information Commissioner's Office (ICO), United Kingdom — ico.org.uk.

§15. Special Category Data (GDPR Art. 9 / KVKK Özel Nitelikli)

15.1 Default Position

The Platform is not designed to process special-category personal data — health, biometric, genetic, ethnic, racial, political, religious, philosophical, trade-union membership, sexual orientation, sex life — under GDPR Art. 9(1), nor "özel nitelikli kişisel veri" under KVKK Art. 6.

Customers must not upload such data to the Platform unless they have first contacted support@architectapi.com and executed a Special Category Data Addendum with ArchitectAPI.

15.2 Customer's Lawful Basis Obligation

Where Customer obtains a Special Category Data Addendum, Customer warrants that it has a lawful basis under GDPR Art. 9(2) (typically explicit consent, employment law, vital interests, or substantial public interest) and, for KVKK, the conditions in Art. 6(2) or explicit consent.

15.3 Enhanced Technical Measures

Under the Special Category Data Addendum, ArchitectAPI provides:

• Application-layer envelope encryption (KMS-backed customer keys);
• Restricted sub-processor list (no AI sub-processors unless Customer explicitly opts in);
• Enhanced audit logging with end-customer identifiable export;
• Dedicated data residency option (EU-only or TR-only) with no replication outside the chosen region;
• Quarterly TOM attestation in writing.

15.4 Sub-processor Restrictions

By default, Special Category Data is excluded from AI sub-processor inference (Google Gemini, Anthropic). If Customer wishes to enable AI processing of Special Category Data, an additional consent flow at the data subject level is required, and the Customer must record evidence per GDPR Art. 9(2)(a).

15.5 Children's Data (Art. 8 GDPR)

The Platform is not directed at children. Customers must not upload data of children under 16 (EU) / 13 (US — COPPA) / 18 (TR — KVKK practice for minors) without explicit guardian consent and a separate addendum with ArchitectAPI's DPO.

15.6 Termination Right

If Customer breaches §15.1 by uploading Special Category Data without an addendum, ArchitectAPI may suspend the Customer's account on 7 days' written notice and, on continued breach, terminate the Agreement under Terms §12 with no refund liability for the breach period.