Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of every agreement under which Reaktör Teknoloji Ticaret Limited Şirketi (trading as Reactll, "Reactll", "we") provides services to a business client ("Client", "you"): a signed proposal, an order, a maintenance, hosting or subscription agreement, or the use of Reactll Connect and the Reactll app (together the "Main Agreement"). It applies whenever we process personal data on your behalf.

You accept this DPA by accepting a proposal that refers to it, by confirming it through the acceptance link we send you, by accepting it in the Reactll app, or in writing (including email). We keep a record of who accepted which version, for which company, when and how, and we send you a copy on request. That record is the parties' electronic signature and date for this DPA and for the EU SCCs and the UK Addendum in section 7.

1. Definitions

"Data Protection Law" means every law on personal data that applies to the processing: in particular Regulation (EU) 2016/679 ("GDPR"), the GDPR as retained in the United Kingdom with the Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") with its secondary legislation, and, for Clients in the United States, the state privacy laws named in section 17. "Personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the GDPR; under the KVKK, "controller" means veri sorumlusu, "processor" means veri işleyen and "supervisory authority" means the Personal Data Protection Board and Authority (Kişisel Verileri Koruma Kurulu / Kurumu).

"Client Personal Data" means the personal data we process for you under the Main Agreement, described in Annex I. "Hosted Systems" means the Client's websites, stores and apps that we host, maintain or have access to under the Main Agreement, including their databases. "Sub-processor" means a third party we engage that processes Client Personal Data.

2. Roles

You are the controller of Client Personal Data and we are your processor. Where you are yourself a processor for someone else, we are your sub-processor and you confirm that your controller has authorised our engagement on these terms. For our own business data about you (your contacts at our company, invoices, our correspondence with you) we are an independent controller; our Privacy Policy covers that, not this DPA.

3. Your instructions

We process Client Personal Data only on your documented instructions, including with regard to transfers to a third country. The Main Agreement, this DPA (including the Sub-processors and locations in Annex III), the settings you choose in Reactll Connect and the Reactll app (for example which modules — visitors, events, forms, sales and orders, subscriptions, public profiles — are switched on), and your written requests are your instructions.

We will tell you without undue delay if we believe an instruction infringes Data Protection Law; we may then suspend that part of the processing until you confirm or change it. If Union or Member State law to which we are subject requires us to process data otherwise, we will tell you before we do, unless that law forbids it on important grounds of public interest. For any other law, including Turkish law and the law of a Sub-processor's country, clauses 14 and 15 of the EU SCCs apply to data from the EU, the UK and Switzerland.

You are responsible for the lawfulness of the data you have us process: that your websites, forms and apps give the notices and obtain the consents Data Protection Law requires (section 16 has a ready paragraph), and that you only collect what you need. The Connect script reads technical information from the visitor's browser (screen width, language, browser) before any consent; only the return-visit identifier in Annex I waits for consent. Where the law of your country requires consent for this kind of analytics (for example Germany under section 25 TDDDG), load the Connect script on your site only after the visitor's consent — your consent tool decides when the script loads.

4. Confidentiality and access

Only people who need Client Personal Data for the services can access it. Each of them is bound by a written confidentiality obligation that continues after they leave. Hosted Systems run on their own separate servers, one set per Client, and are accessed only by the people working on that Client's project. Reactll's own server — which holds the Reactll Connect data, the HQ, our own projects and our development and test environments — is accessed only by our core team. Access is removed when someone no longer needs it.

5. Security

We keep in place the technical and organisational measures in Annex II, appropriate to the risk of the processing, as required by article 32 GDPR and article 12 KVKK. We may add measures, or replace a measure with one of at least the same effect; we do not remove a measure listed in Annex II without your consent.

6. Sub-processors

You give us general authorisation to use the Sub-processors listed in Annex III. We tell you at least 30 days before a new Sub-processor starts processing Client Personal Data, by email to your main contact and on this page. You may object on reasonable data protection grounds within that period; until your objection is resolved, the new Sub-processor does not process your Client Personal Data. We will try in good faith to find an alternative, and if we cannot, either party may end the affected part of the services without penalty, with a pro-rata refund of prepaid fees for it.

Each Sub-processor is bound by a written contract imposing on it data protection obligations no less protective than those in this DPA, in particular sufficient guarantees for the measures of article 32 GDPR. We remain fully liable to you for the performance of each Sub-processor's obligations. On request we give you a copy of the data protection terms we have with a Sub-processor (commercial terms may be removed).

7. Where the data is and international transfers

Location. The data of Reactll Connect, the HQ and the Reactll app is stored in the European Union, on our server in Frankfurt, Germany. Hosted Systems run on their own servers (DigitalOcean, managed through RunCloud); we tell you the region of your servers on request, and Hosted Systems that you host yourself stay where you host them. Client Personal Data is accessed from the EU (our managing director works from the Netherlands) and from Türkiye (our team and our registered office are in Istanbul). It is not accessed from the United States. Some Sub-processors in Annex III are outside the EU.

From the EU/EEA. We are established in Türkiye, which has no adequacy decision of the European Commission. Making Client Personal Data available to us (including remote access from Türkiye to data stored in the EU), and our onward transfers to Sub-processors in countries without an adequacy decision, are covered by the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("EU SCCs"). The EU SCCs are incorporated into this DPA by reference in their official wording, with you as data exporter and us as data importer: Module Two where you are a controller, Module Three where you are a processor. For the EU SCCs: the optional docking clause 7 applies; under clause 9, option 2 (general written authorisation) applies with the notice period in section 6; the optional wording in clause 11 does not apply; under clause 13 the competent supervisory authority is the one named in Annex I; under clauses 17 and 18 the law and the courts of the Netherlands apply; Annexes I to III of this DPA complete the Appendix of the EU SCCs. Our onward transfers are made under clauses 8.7 and 9 of the EU SCCs. If the European Commission adopts standard contractual clauses for a situation that applies to us, we may replace the EU SCCs with them by notice; the replacement takes effect 30 days after our notice, and within that period you may object and end the affected services without penalty.

From the United Kingdom. The International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022) is incorporated by reference. Its Table 1 is completed by the parties' details, Table 2 by the choices above, Table 3 by Annexes I to III, and in Table 4 either party may end it as allowed by its section 19. Transfers from the UK to the EU rely on the UK's adequacy regulations.

From Switzerland. The EU SCCs apply with the changes the Swiss Federal Data Protection and Information Commissioner requires: references to the GDPR are to the FADP for transfers governed by it, the competent authority for those transfers is that Commissioner, the term "member state" includes Switzerland so that data subjects in Switzerland may bring claims in Switzerland, and the EU SCCs also protect legal entities until the FADP no longer does.

From Türkiye (KVKK). Where you are a controller in Türkiye, handing Client Personal Data to us is not a transfer abroad: we are a processor in Türkiye. Storing the data in Frankfurt and the use of the Sub-processors abroad in Annex III are transfers abroad under article 9 of the KVKK, which we make as processor on your instructions. No adequacy decision of the Personal Data Protection Board exists for these countries. We have not concluded the standard contracts provided for in article 9 of the KVKK with these Sub-processors. Annex III lists every recipient abroad, what it receives and where, so that you can inform the data subjects and decide on the use of the services. You remain responsible for telling the data subjects, in your privacy notice, that their data is transferred abroad and to which recipient groups (section 16).

Where the EU SCCs or the UK Addendum conflict with this DPA, they prevail. On request we give you a copy of the clauses as they apply between us and the information we have on what can be accessed from outside the EU, by whom, and how it is protected.

8. Helping with data subjects' rights

If a data subject contacts us about Client Personal Data, we forward the request to you without undue delay and at the latest within 5 business days, and we do not answer it ourselves unless you ask us to. Taking into account the nature of the processing and what the services allow, we help you answer requests for access, rectification, erasure, restriction, portability and objection (and, under the KVKK, the rights in its article 11): in the HQ and the Reactll app a submission's personal details can be deleted with one action, and we export or delete data on request within 10 business days.

9. Personal data breaches

We tell you without undue delay, and at the latest within 48 hours after we become aware of it, of a personal data breach affecting Client Personal Data, so that you can meet your own deadline (72 hours under the GDPR and the UK GDPR; under the KVKK, the Board's decision 2019/10 sets 72 hours for notice to the Board and the shortest reasonable time for the data subjects). Our notice describes, as far as we know at the time: what happened, the categories and approximate number of data subjects and records concerned, the likely consequences, what we have done and propose to do, and a contact. We add information as we learn it, we take reasonable steps to contain the breach, and we do not notify authorities or data subjects on your behalf unless you ask us to or the law requires it. Telling you about a breach is not an admission of fault.

Notification of security incidents that do not affect personal data (for example for your own duties under the NIS2 Directive (EU) 2022/2555) is not part of this DPA; it can be agreed separately.

10. Impact assessments and authorities

We give you the information you reasonably need for a data protection impact assessment or a prior consultation with a supervisory authority about the services, and we cooperate with a supervisory authority's requests about the processing.

11. Retention and deletion

We keep Client Personal Data only as long as the services need it. We enforce the periods below with scheduled jobs where the system allows it, and otherwise by documented manual deletion:

• Form submissions from your websites (name, email, phone, message and other fields): kept with the personal details for 24 months, then the personal details are deleted by a scheduled job. The record of the request stays (date, form, page, traffic source) so your counts, charts and reports remain correct, but it no longer contains the person's details. The HQ's lead alerts and the Reactll app's notification history lose the person's name and message at the same time.
• Visitor analytics from Reactll Connect: no IP address is stored. Kept for 24 months, then deleted by a scheduled job.
• Sales and order data (only if you switch that module on): no address, email or phone; the customer appears as a first name and the initial of the last name. Kept while the services run.
• Subscription data (only if you switch that module on): the subscriber appears as a first name and an initial. Kept while the services run.
• Public profiles and reviews of your business accounts and the competitors you choose: kept while the services run.
• Support requests from your staff in the Reactll app (messages, attachments, voice messages): kept while the services run.
• Hosted Systems: their data stays under your control and is kept as you decide.
• Backups of the database: deleted after 30 days. Data deleted from the live system disappears from backups within that period.
• When the services end (the Main Agreement ends, or a site's service is paused or removed): you may ask for an export of your data, or the hand-over of a Hosted System, within 30 days. 60 days after the services end, a scheduled job deletes the personal details of form submissions and the buyer details of orders and subscriptions, and we delete the copies of Hosted Systems on our servers by documented manual deletion. Visitor analytics of the ended site is not deleted at that point: it is kept and deleted with all other visitor analytics when it reaches 24 months. Backups follow within the backup period. You may also ask us in writing to delete earlier, including the visitor analytics. We confirm the deletion in writing on request.
• Server and access logs: kept for up to 12 months.
• Legal retention: we only keep what a law requires us to keep, and only for that purpose — for example traffic data that Turkish Law No. 5651 requires a hosting provider to keep for the period it sets.

12. Audits

We make available the information needed to demonstrate that we meet article 28 GDPR and this DPA, starting with this page, Annex II and our answers to your written questions. If that is not enough, you (or an independent auditor bound by confidentiality who is not our competitor) may audit us, including by inspection, once a year, with at least 30 days' written notice, during business hours, in a way that does not disrupt our work or reveal other clients' data; we may first offer a remote audit. Each party bears its own costs, unless the audit finds a material breach of this DPA by us. An audit required by a supervisory authority, or following a personal data breach, is not limited to once a year.

13. Liability

Each party's total liability under this DPA is limited to the total fees paid and payable under the Main Agreement for the project or contract concerned. This limit does not apply where Data Protection Law or the EU SCCs do not allow it, or to damage caused intentionally or by gross negligence (article 115 of the Turkish Code of Obligations). Nothing in this DPA limits a data subject's rights against either party, including under article 82 GDPR, or the joint responsibility of the controller and the processor for security measures under article 12(2) KVKK.

14. Term, language, order of precedence and changes

This DPA applies for as long as we process Client Personal Data for you, and its obligations on deletion and confidentiality continue after that. If this DPA conflicts with the Main Agreement on the processing of personal data, this DPA prevails; the transfer clauses in section 7 prevail over both.

This DPA is published in Turkish and English with the same content. For Clients established in Türkiye the Turkish text prevails; for all others the English text. The EU SCCs and the UK Addendum apply in their official wording.

Each version of this DPA has a number and a date. We tell you at least 30 days before a new version takes effect. Changes that only add protection for the data, add to or update Annex II in line with section 5, update Annex III in line with section 6, or follow a change in the law apply from that date. Any other change applies to you only once you accept the new version; until then the version you accepted continues to apply.

15. Governing law and jurisdiction

This DPA is governed by Turkish law, and the courts and enforcement offices of Istanbul (Çağlayan) have jurisdiction. The EU SCCs are governed by the law of the Netherlands and the UK Addendum by the law of England and Wales, with the courts those clauses name. Data subjects' rights to bring claims under the EU SCCs, the UK Addendum or Data Protection Law are not affected.

16. A paragraph for your privacy notice

Data subjects should know that a service provider handles their data. You can add this to the privacy notice on your website:

We use Reactll (Reaktör Teknoloji Ticaret Ltd. Şti., Istanbul, Türkiye) to run our website and to receive the messages you send us through its forms. Reactll processes this data only on our instructions and stores it in the European Union (Frankfurt, Germany). Reactll accesses the data from Türkiye, and some of its service providers, listed at reactll.com/legal/dpa, are outside the European Union (including the United States); these transfers are made under the European Commission's Standard Contractual Clauses. Our website counts visits without storing your IP address. Form submissions are kept for 24 months, then the personal details are deleted. To exercise your rights, contact us at the email address given in this notice.

17. Clients in the United States

State privacy laws. Where you are subject to the California Consumer Privacy Act or another US state privacy law, we act as your "service provider", "contractor" or "processor" under that law. We do not sell or share Client Personal Data; we do not retain, use or disclose it outside the direct business relationship with you or for any purpose other than the services; we do not combine it with personal data from other sources except as those laws allow; we comply with those laws and give the data the same level of protection they require; we tell you if we can no longer meet them; and you may take reasonable steps to stop and remedy unauthorised use. We understand these restrictions and will comply with them.

Health information. A Client covered by HIPAA must not send protected health information through our services, and must not let a Hosted System process it, unless we have first signed a business associate agreement with that Client.

Contact

Reaktör Teknoloji Ticaret Limited Şirketi, Şahkulu Mah. Serdar-ı Ekrem Cad. No: 15/A, Galata, 34430 Beyoğlu, İstanbul, Türkiye · MERSİS 0734209102400001 · [email protected]. Contact for data protection matters: Sedat Yusuf Ergüneş, managing director. Security reports: [email protected].

Annex I — Description of the processing

• Parties: data exporter: the Client, as identified in the Main Agreement and the acceptance record (controller, or processor for its own controller); contact: the Client's main contact. Data importer: Reaktör Teknoloji Ticaret Limited Şirketi, details above (processor, or sub-processor); contact: the data protection contact above. Signature and date: the acceptance record described in the preamble.
• Subject and purpose: building, hosting, maintaining and monitoring the Client's websites, stores and apps (the Hosted Systems); collecting and showing the Client's website visits, events, form submissions and, if switched on, sales, orders and subscriptions through Reactll Connect; notifications and reports in the HQ, by email and in the Reactll app; following the Client's public business profiles and those of the competitors it chooses, including their public reviews; support.
• Nature of the processing: collection, storage, organisation, display, analysis in aggregate, transmission (notifications, email), hosting, backup, deletion of personal details and deletion.
• Data subjects: visitors of the Client's websites and apps; people who fill in its forms; its customers and subscribers; users of the Hosted Systems; authors of public reviews on the profiles followed; the Client's staff who use our services or the Reactll app.
• Categories of data:
  • Visit data: pages, landing and exit page, referrer and traffic source, campaign (UTM) parameters, device type, browser, operating system, language, screen width, country, region and city (derived by Cloudflare from the IP address), time. The IP address and browser user agent are used only in the moment, with a random value that is replaced every day, to count visits; they are not stored. Only after the visitor's consent, signalled by the Client's site, a random visitor ID is kept in the visitor's browser and with the visit to recognise return visits.
  • Events: clicks on phone, email, WhatsApp, directions, downloads and similar, with page and time.
  • Form submissions: name, email, phone, message and the other fields the Client's forms collect, form, page, time, the visit it came from.
  • Order data: order number, status, totals, items, the customer's first name and last-name initial, city and country, a pseudonymous key made from the customer's email with the site's secret, which lets the same customer be recognised within that site, whether the customer is returning.
  • Subscription data: plan, amount, status, dates, the subscriber's first name and initial, country, the same pseudonymous key.
  • Public profiles and reviews: follower and review counts, ratings, and the text, date and public name of the author of a review.
  • Hosted Systems: the personal data the Client's own websites, stores and apps hold, as the Client determines (typically customer accounts, names, contact details, addresses and order history).
  • Staff accounts and support: name, email, phone if given, role, sign-in records, device tokens for notifications, support messages, attachments and voice messages.
  • Correspondence about the services.
• Special categories and criminal-conviction data: not intended in Reactll Connect. Connect is not designed to collect health, religious, biometric, criminal-conviction or similar data, and the Client should not design forms that ask for it. Because people can write anything into a free-text field, a message may still contain such data; it is protected like every other submission (encrypted at rest, deleted on the same schedule). We do not build or host a form or Hosted System designed to process such data unless we have first agreed it with the Client in writing and the measures in Annex II for special categories are in place.
• Frequency: continuous, for the term of the Main Agreement.
• Retention: as in section 11.
• Transfers to Sub-processors: subject matter, nature and location as in Annex III; duration as in section 11.
• Competent supervisory authority: the authority of the EU member state where the Client is established, or where its EU representative is; for the UK the Information Commissioner; for Switzerland the Federal Data Protection and Information Commissioner; for Türkiye the Personal Data Protection Board.

Annex II — Technical and organisational measures

• Hosting: production on a server in Frankfurt, Germany (DigitalOcean); database, files, queues and backups on the same server, not in third-party storage. Hosted Systems run on their own separate servers.
• In transit: TLS only, HSTS, Cloudflare in front of the server. Server-to-server Connect requests from websites (submissions, orders, subscriptions, status) are signed with a per-site secret (HMAC-SHA256) and refused if older than five minutes or replayed. Browser analytics requests are rate-limited.
• At rest: form submissions' name, email, phone, message and fields are encrypted with AES-256 at application level; the key is kept in the application's configuration, not in the database. Exact lookups (for example "has this person written before") use keyed hashes of the email and phone, never the plain values.
• Data minimisation: visitor analytics stores no IP address and sets no cookie or browser storage until the visitor consents; order and subscription data without address, email or phone; a different visitor key per site, so a visitor cannot be followed from one client's site to another's; modules can be switched off per site, and data from a switched-off module is not stored. Each app user can hide names and messages from notifications ("previews"); previews are on by default.
• Access: personal accounts with role-based permissions in the HQ (owner, admin, member; client users see only their own company); sign-in to the Reactll app by one-time email codes, with limits on attempts; web sessions that expire; app tokens per device, revoked on sign-out or by us. Hosted Systems on their own separate servers, accessed only by the people working on that Client's project; Reactll's own server accessed only by the core team (section 4). Access removed when no longer needed.
• Deletion: scheduled jobs run daily and enforce the periods in section 11 that they cover (deleting the personal details of old and ended-service submissions and the buyer details of ended-service orders and subscriptions, deleting analytics older than 24 months, pruning backups older than 30 days); one-action deletion of a submission's personal details; documented manual deletion for the rest.
• Availability: a verified database backup before every deployment, rolling backups for 30 days, documented rollback. We check every five minutes that the monitored websites are reachable; results for publicly listed services are at /status.
• Development: automated tests must pass before every deployment; changes are kept in version control; production data is not used for testing.
• Special categories: a form or Hosted System that processes special categories of personal data (Annex I) is only built or hosted after a written agreement with the Client, and with at least the adequate measures determined by the Turkish Personal Data Protection Board in its decision 2018/10 of 31 January 2018 in place before processing starts — including encryption of the data, logs of access to it, two-factor authentication for remote access, training and confidentiality undertakings for everyone with access, and access only for the people who need it.
• People: confidentiality obligations for everyone with access (section 4); least privilege; security reports to [email protected] answered within two business days.
• Sub-processors: chosen for their security and bound by written data protection terms (Annex III).

Annex III — Sub-processors

For data from the EU, the UK and Switzerland, transfers to Sub-processors outside the EU are made under section 7 and the EU SCCs. For data from Türkiye, see section 7 (KVKK).