Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between the customer (“Controller”, “you”) and İnisiyatif Yazılım Bilgisayar Danışmanlik Hiz. Ltd. Şti. (“Zervanor”, “Processor”) and applies where Zervanor processes personal data on your behalf in providing the Service. It is designed to meet Article 28 of the GDPR and the corresponding KVKK requirements.

If you require a signed copy of this DPA for your records, email privacy@zervanor.com.

1. Roles

You are the controller of the personal data contained in the data you send through the Service (“Customer Content”). Zervanor acts as a processor and processes that data only on your documented instructions, including those expressed through your configuration and use of the Service. For Zervanor’s own account, billing, and usage data, Zervanor is a controller — see the Privacy Policy.

2. Subject matter and details

• Subject matter: provision of the Zervanor automation platform.
• Duration: for the term of your subscription, plus the deletion period below.
• Nature and purpose: hosting, executing, and orchestrating the workflows and agents you configure.
• Types of data: as determined by you — typically the contact and business data your automations handle.
• Categories of data subjects: as determined by you — typically your end users, customers, and contacts.

3. Processor obligations

Zervanor will:

• process Customer Content only on your documented instructions, including for international transfers, unless required by law (in which case we will inform you where permitted);
• ensure persons authorized to process the data are bound by confidentiality;
• implement appropriate technical and organizational security measures (Section 5);
• assist you, taking into account the nature of processing, with data-subject requests and with your obligations on security, breach notification, and impact assessments;
• make available information needed to demonstrate compliance and allow for audits on reasonable notice; and
• at the end of services, delete or return Customer Content as described in Section 7.

4. Sub-processors

You authorize Zervanor to engage sub-processors to provide the Service. Current sub-processors include:

Sub-processor	Function	Location
Akamai (Linode)	Cloud hosting and storage	EU / US
Cloudflare	CDN, network security, tunneling	Global
PayTR	Payment processing (Türkiye)	Türkiye
Stripe	Payment processing	US / EU
Novu	Email and notification delivery	EU / US
Google	Optional single sign-on and Gemini AI features	US / EU
OpenAI	Optional AI-assisted features	US

Zervanor imposes data-protection obligations on each sub-processor no less protective than this DPA and remains responsible for their performance. We will give you reasonable notice of any new or replacement sub-processor and a chance to object on reasonable data-protection grounds.

5. Security

Zervanor maintains measures appropriate to the risk, including encryption in transit, hashed credentials, multi-tenant isolation, access controls on a least-privilege basis, audit logging, monitoring, and regular review.

6. Personal data breaches

Zervanor will notify you without undue delay after becoming aware of a personal data breach affecting Customer Content, and will provide information reasonably available to help you meet your notification obligations.

7. Return and deletion

On termination, and at your choice, Zervanor will delete or return Customer Content and delete existing copies within a reasonable period, except where retention is required by law.

8. International transfers

Where processing involves transferring personal data outside the EEA, the UK, or Türkiye, the parties rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and equivalent KVKK mechanisms, which are incorporated by reference where applicable.

9. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms of Service.

Contact

İnisiyatif Yazılım Bilgisayar Danışmanlik Hiz. Ltd. Şti. — privacy@zervanor.com.