Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of every agreement under which Reaktör Teknoloji Ticaret Limited Şirketi (trading as Reactll, "Reactll", "we") provides services to a business client ("Client", "you"): a signed proposal, an order, a maintenance or subscription agreement, or the use of Reactll Connect and the Reactll app (together the "Main Agreement"). It applies whenever we process personal data on your behalf.

You accept this DPA by accepting a proposal that refers to it, by confirming it through the acceptance link we send you, by accepting it in the Reactll app, or in writing (including email). We keep a record of who accepted which version, when and how.

1. Definitions

"Data Protection Law" means every law on personal data that applies to the processing: in particular Regulation (EU) 2016/679 ("GDPR"), the GDPR as retained in the United Kingdom with the Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection, and Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"). "Personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the GDPR; under the KVKK, "controller" means veri sorumlusu and "processor" means veri işleyen. "Client Personal Data" means the personal data we process for you under the Main Agreement, described in Annex I. "Sub-processor" means a third party we engage that processes Client Personal Data.

2. Roles

You are the controller of Client Personal Data and we are your processor. Where you are yourself a processor for someone else, we are your sub-processor and you confirm that your controller has authorised our engagement. For our own business data about you (your contacts at our company, invoices, our correspondence with you) we are an independent controller; our Privacy Policy covers that, not this DPA.

3. Your instructions

We process Client Personal Data only on your documented instructions. The Main Agreement, this DPA, the settings you choose in Reactll Connect and the Reactll app (for example which modules — visitors, events, forms, sales and orders — are switched on), and your written requests are your instructions. We will tell you without undue delay if we believe an instruction breaks Data Protection Law; we may then suspend that part of the processing until you confirm or change it. If a law requires us to process data differently, we will tell you before we do, unless that law forbids it.

You are responsible for the lawfulness of the data you have us process: that your websites, forms and apps give the notices and obtain the consents Data Protection Law requires (see section 16 for a ready paragraph), and that you only collect what you need.

4. Confidentiality

Only people who need Client Personal Data for the services can access it. Each of them is bound by a written confidentiality obligation that continues after they leave. Access is personal (no shared accounts or keys) and is removed when someone no longer needs it.

5. Security

We keep in place the technical and organisational measures in Annex II, appropriate to the risk of the processing. We may improve them over time, but we will not lower the overall level of protection during the term.

6. Sub-processors

You give us general authorisation to use the Sub-processors listed in Annex III. We tell you at least 30 days before a new Sub-processor starts processing Client Personal Data, by email to your main contact and on this page. You may object on reasonable data protection grounds within that period; we will then try in good faith to find an alternative, and if we cannot, either party may end the affected part of the services without penalty, with a pro-rata refund of prepaid fees for it. Each Sub-processor is bound by written terms giving at least the protection of this DPA, and we remain responsible to you for its work.

7. Where the data is and international transfers

Client Personal Data is stored in the European Union, on our server in Frankfurt, Germany. It is accessed from the EU (our managing director works from the Netherlands) and from Türkiye (our team and our registered office are in Istanbul). Some Sub-processors in Annex III are outside the EU.

• From the EU/EEA: transfers to us and to Sub-processors in countries without an adequacy decision are covered by the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("EU SCCs"), which are incorporated into this DPA by reference: Module Two where you are a controller, Module Three where you are a processor. For the EU SCCs: the optional docking clause 7 applies; under clause 9 option 2 (general authorisation) applies with the notice period in section 6; the optional wording in clause 11 does not apply; clauses 17 and 18 choose the law and the courts of the Netherlands; Annexes I to III of this DPA complete the Appendix of the EU SCCs. Where a Sub-processor in the United States is certified under the EU-U.S. Data Privacy Framework, we rely on that certification.
• From the United Kingdom: the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022) is incorporated by reference. Its Table 1 is completed by the parties' details, Table 2 by the choices above, Table 3 by Annexes I to III, and in Table 4 either party may end it as allowed by its section 19. Transfers from the UK to the EU rely on the UK's adequacy regulations.
• From Switzerland: the EU SCCs apply with the changes the Swiss Federal Data Protection and Information Commissioner requires: references to the GDPR are to the Swiss FADP, the competent authority is that Commissioner, and data subjects in Switzerland may bring claims in Switzerland.
• From Türkiye (KVKK): storing data in Frankfurt and using the Sub-processors abroad is a transfer under article 9 of the KVKK. Where you are a controller in Türkiye we sign the standard contract published by the Personal Data Protection Authority for controller-to-processor transfers on request, at no cost; the party that is the data exporter notifies the Authority within the period the KVKK sets (currently five business days from signature).

Where the EU SCCs, the UK Addendum or the KVKK standard contract conflict with this DPA, they prevail. On request we give you a copy of the clauses as they apply between us and a short transfer impact assessment describing what can be seen from outside the EU, by whom and how it is protected.

8. Helping with data subjects' rights

If a data subject contacts us about Client Personal Data, we forward the request to you without undue delay and at the latest within 5 business days, and we do not answer it ourselves unless you ask us to. Taking into account what the services allow, we help you answer requests for access, correction, erasure, restriction, portability and objection: in the HQ and the Reactll app a submission's personal details can be deleted with one action, and we export or delete data on request within 10 business days.

9. Personal data breaches

We tell you without undue delay, and at the latest within 48 hours after we become aware of it, of a personal data breach affecting Client Personal Data, so that you can meet your own deadline (72 hours under the GDPR and the UK GDPR; the KVKK expects notice "as soon as possible", which the Authority reads as 72 hours). Our notice describes, as far as we know at the time: what happened, the categories and approximate number of data subjects and records concerned, the likely consequences, what we have done and propose to do, and a contact. We add information as we learn it, we take reasonable steps to contain the breach, and we do not notify authorities or data subjects on your behalf unless you ask us to or the law requires it. Telling you about a breach is not an admission of fault.

10. Impact assessments and authorities

We give you the information you reasonably need for a data protection impact assessment or a prior consultation with a supervisory authority about the services, and we cooperate with a supervisory authority's requests about the processing.

11. Retention and deletion

We keep Client Personal Data only as long as the services need it, and we enforce these periods with scheduled jobs, not by hand:

• Form submissions from your websites (name, email, phone, message and other fields): kept with the personal details for 24 months, then anonymised. The record of the request stays (date, form, page, traffic source) so your counts, charts and reports remain correct, but it no longer identifies anyone.
• Visitor analytics from Reactll Connect: no IP address is stored; visits are counted with a value that changes every day. Kept for 24 months, then deleted.
• Sales and order data (only if you switch that module on): no address, email or phone; the customer appears as a first name and an initial. Kept while the services run.
• Backups of the database: deleted after 30 days. Data deleted from the live system disappears from backups within that period.
• When the services end (the Main Agreement ends, or you disconnect a site): you may ask for an export of your data within 30 days; after 60 days we delete or irreversibly anonymise the Client Personal Data, then the backups follow within the backup period. We confirm the deletion in writing on request. We only keep what a law requires us to keep, and only for that purpose.

12. Audits

We make available the information needed to show that we meet this DPA, starting with this page, Annex II and our answers to your written questions. If that is not enough, you (or an independent auditor bound by confidentiality who is not our competitor) may audit us once a year, with at least 30 days' written notice, during business hours, in a way that does not disrupt our work or reveal other clients' data; we may first offer a remote audit. Each party bears its own costs, unless the audit finds a material breach of this DPA by us. An audit required by a supervisory authority, or following a personal data breach, is not limited to once a year.

13. Liability

Each party's liability under this DPA is governed by the limits of liability in the Main Agreement, except where Data Protection Law or the EU SCCs do not allow those limits. Nothing in this DPA limits a data subject's rights against either party.

14. Term, order of precedence and changes

This DPA applies for as long as we process Client Personal Data for you, and its obligations on deletion and confidentiality continue after that. If this DPA conflicts with the Main Agreement on the processing of personal data, this DPA prevails; the transfer clauses in section 7 prevail over both.

Each version of this DPA has a number and a date. We tell you at least 30 days before a new version takes effect. Changes that only add protection for the data, update Annex II or III (subject to section 6) or follow a change in the law apply from that date. Any other change applies to you only once you accept the new version; until then the version you accepted continues to apply.

15. Governing law

This DPA is governed by the law that governs the Main Agreement, except that the EU SCCs are governed by the law of the Netherlands, the UK Addendum by the law of England and Wales, and the KVKK standard contract by Turkish law. If you are established in Türkiye, this DPA is governed by Turkish law and the courts of Istanbul (Çağlayan) have jurisdiction.

16. A paragraph for your privacy notice

Data subjects should know that a service provider handles their data. You can add this to the privacy notice on your website (replace the brackets):

We use Reactll (Reaktör Teknoloji Ticaret Ltd. Şti., Istanbul) to run our website and to receive the messages you send us through its forms. Reactll processes this data only on our instructions, stores it in the European Union (Frankfurt, Germany), and uses its own service providers as listed at reactll.com/legal/dpa. Our website counts visits without storing your IP address. Form submissions are kept for 24 months, then anonymised. To exercise your rights, contact [your email].

Contact

Reaktör Teknoloji Ticaret Limited Şirketi, Şahkulu Mah. Serdar-ı Ekrem Cad. No: 15/A, Galata, 34430 Beyoğlu, İstanbul, Türkiye · MERSİS 0734209102400001 · [email protected]. Contact for data protection: Sedat Yusuf Ergüneş, managing director. Security reports: [email protected].

Annex I — Description of the processing

• Parties: data exporter: the Client, as identified in the Main Agreement (controller, or processor for its own controller). Data importer: Reaktör Teknoloji Ticaret Limited Şirketi, details above (processor, or sub-processor).
• Subject and purpose: building, hosting, maintaining and monitoring the Client's websites and apps; collecting and showing the Client's website visits, events, form submissions and, if switched on, sales and orders through Reactll Connect; notifications and reports in the HQ, by email and in the Reactll app; following the Client's public business profiles and competitors; support.
• Data subjects: visitors of the Client's websites; people who fill in its forms; its customers (sales and orders module); the Client's staff who use our services or the Reactll app.
• Categories of data: visit data without IP address (pages, referrer, device type, country and city, day-scoped counter); events (clicks on phone, email, WhatsApp, directions, downloads); form submissions (name, email, phone, message and fields the Client's forms collect, page, time); order data (order number, status, totals, items, city, first name and initial); staff accounts (name, email, phone if given, role, device tokens for notifications); correspondence.
• Special categories: not intended. The services are not designed to collect health, religious, biometric or similar data, and the Client should not design forms that ask for it. Because people can write anything into a free-text field, a message may still contain such data; it is protected exactly like every other submission (encrypted at rest, deleted on the same schedule), and the Client tells us in writing if its forms are likely to receive it (for example a healthcare practice), so we can agree any further measure.
• Frequency: continuous, for the term of the Main Agreement.
• Retention: as in section 11.
• Competent supervisory authority: the authority of the EU member state where the Client is established, or where its EU representative is; for the UK the Information Commissioner; for Türkiye the Personal Data Protection Authority (KVKK).

Annex II — Technical and organisational measures

• Hosting: production on a dedicated server in Frankfurt, Germany (DigitalOcean); database, files, queues and backups on the same server, not in third-party storage.
• In transit: TLS only, HSTS, Cloudflare in front of the server; Connect requests from websites signed with a per-site secret (HMAC-SHA256) with replay protection.
• At rest: form submissions' name, email, phone, message and fields encrypted with AES-256 (application-level encryption, keys outside the database); exact lookups (for example "has this person written before") use keyed hashes, never the plain values.
• Data minimisation: visitor analytics stores no IP address and uses no cookies by default; order data without address, email or phone; modules can be switched off per site, and data from a switched-off module is not stored.
• Access: personal accounts with role-based permissions (owner, admin, member; client users see only their own company); server access by personal SSH keys only; access removed when no longer needed; sign-in limits and expiring sessions and tokens.
• Deletion: scheduled jobs enforce the periods in section 11, including anonymising old submissions, deleting old analytics and pruning backups; one-action deletion of a submission's personal details.
• Availability: a verified database backup before every deployment, rolling backups for 30 days, documented rollback; uptime checks every five minutes with public results.
• Development: automated tests must pass before every deployment; changes are reviewed and versioned; production data is not used for testing.
• People: confidentiality obligations for everyone with access; least privilege; security reports to [email protected] answered within two business days.
• Sub-processors: chosen for their security and bound by written data protection terms (Annex III).

Annex III — Sub-processors