Data Processing Agreement
Effective October 25, 2026
If the English and Turkish versions of this document differ, the Turkish version prevails.
This Data Processing Agreement ("DPA") is part of the Terms of Service between the Customer and Muhammed Yeğenoğlu (Targity). It applies when Targity processes personal data on the Customer's behalf, and is intended to meet Article 12 of the KVKK and, where applicable, Article 28 of the GDPR.
1. Roles
The Customer is the data controller of the personal data of its own customers and contacts ("Customer Data"). Targity is the data processor and processes Customer Data only to provide the Service.
2. What is processed
| Data subjects | The Customer's shoppers, newsletter subscribers and other contacts |
|---|---|
| Data | Name, email address, phone number, city and country, gender and date of birth where the store holds them; orders, products bought and carts; consent and opt-out records; message history and engagement (delivery, opens, clicks) |
| Purpose | Importing data from the Customer's platform, segmenting, sending messages the Customer configures, measuring their results |
| Duration | The term of the Terms, plus the deletion period below |
Targity does not import passwords, national identity or tax numbers, or full street addresses from the Customer's platform. The Customer should not upload special categories of personal data (such as health data) unless strictly necessary.
3. Targity's obligations
- Process Customer Data only on the Customer's documented instructions, which are given through the Service's settings and these Terms, unless the law requires otherwise; tell the Customer if an instruction appears unlawful.
- Ensure that people authorised to process Customer Data are bound by confidentiality.
- Take appropriate technical and organisational security measures (section 5).
- Help the Customer, as far as reasonably possible, to answer data subjects' requests and to meet its obligations on security, breach notification and impact assessments.
- Notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data, so the Customer can meet its own 72-hour notification duty.
- Not sell Customer Data or use it for its own purposes; aggregated statistics that do not identify anyone are not Customer Data.
4. Sub-processors
The Customer authorises Targity to use the sub-processors below. Targity imposes data protection obligations on them that are no less protective than this DPA and remains responsible for them. Targity will announce new sub-processors at least 15 days in advance by email or in the dashboard; the Customer may object on reasonable grounds and, if no solution is found, terminate the affected service.
| Sub-processor | Service | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of servers and databases | Finland (EU) |
| Email delivery provider (currently Uzman Posta) | Delivering emails until the Customer's own sending is set up | Türkiye |
Providers the Customer connects itself (its e-commerce platform, SMS provider, WhatsApp Business account) work under the Customer's own contracts with them and are not Targity's sub-processors.
5. Security measures
- Encrypted connections (TLS) for data in transit; credentials of connected services encrypted at rest.
- Each Customer's data held in a separate database.
- Access limited to authorised staff, with individual accounts; passwords stored as salted hashes.
- Regular backups and updates of servers and software.
- Consent and opt-out checks before sending, and a test mode that keeps messages away from real recipients.
6. International transfers
Customer Data is hosted in the European Union (Finland). The Customer instructs and authorises this transfer. Targity carries out transfers outside Türkiye in line with Article 9 of the KVKK, using appropriate safeguards such as standard contracts, and supports the Customer in any notification these require.
7. Deletion and return
When the Customer deletes its store or the Terms end, Targity deletes Customer Data within 30 days, unless the law requires it to be kept. During that period the Customer may request an export. Backups are overwritten in their normal cycle.
8. Audits
Targity will make available the information needed to demonstrate compliance with this DPA and answer reasonable written questions. On-site audits can be agreed in advance, at the Customer's cost, no more than once a year unless a breach occurred.
9. Precedence
If this DPA conflicts with the Terms regarding personal data, this DPA prevails. If the English and Turkish versions differ, the Turkish version prevails.