Data Processing Agreement

This Data Processing Agreement (the "Agreement") sets out the rights and obligations of an organization using the EnaFeedback service and ENA Innovation regarding personal data processed on that organization's behalf. It is based on Turkish Personal Data Protection Law No. 6698 ("KVKK") and its secondary legislation.

This English text is a translation. In case of conflict, the Turkish version prevails.

1. Parties and scopeCopy Anchor Link

1.1. The parties are:

1.2. This Agreement applies together with the proposal or order form accepted by the Customer, the Terms of Service, the End User License Agreement and any other terms the parties agree in writing (together, the "Main Agreement"). It also applies during the free trial.

1.3. On matters of personal data protection, this Agreement prevails over the Main Agreement in case of conflict.

2. DefinitionsCopy Anchor Link

The terms "personal data", "special categories of personal data", "data subject", "data controller", "data processor", "processing" and "Board" have the meanings given in KVKK. In addition:

• Service: the provision of the EnaFeedback software through its web application, its mobile application and the related ENA Cloud services (QR, NFC and display redirects, short links, notification and AI gateways).
• Customer Data: personal data entered into the Service by the Customer, its users, staff or visitors, or generated by the Service on the Customer's behalf.
• Sub-processor: a third party engaged by ENA Innovation to process Customer Data.
• Data Breach: the unlawful acquisition of Customer Data by others, or a security incident leading to it.
• Customer Environment: the dedicated application stack, database, cache and file storage allocated to the Customer.

3. RolesCopy Anchor Link

3.1. For Customer Data, the Customer is the data controller and ENA Innovation is the data processor. The Customer determines the purposes and means of processing.

3.2. ENA Innovation acts as a data controller only for processing for its own purposes, such as contract management, invoicing, communication with Customer representatives and the security of its own central services. That processing is governed by the EnaFeedback Privacy Policy.

3.3. Third-party providers that the Customer connects to the Service with its own account (for example, its own email, SMS, push notification or AI provider account) are not ENA Innovation's Sub-processors. The relationship with those providers is between the Customer and the provider.

4. Subject matter, nature and durationCopy Anchor Link

4.1. The subject matter and purpose of processing, the categories of data subjects and the categories of data are set out in Annex 1.

4.2. ENA Innovation processes Customer Data for the term of the Main Agreement and until the deletion or return period in Section 14 ends.

5. Customer instructionsCopy Anchor Link

5.1. ENA Innovation processes Customer Data only on the Customer's documented instructions. Instructions include the Main Agreement, this Agreement, settings the Customer makes in the Service (including module, form field, notification, AI and integration settings) and written requests from an authorized Customer representative.

5.2. If ENA Innovation believes an instruction violates KVKK or other legislation, it informs the Customer without delay and may suspend the processing concerned until the instruction is clarified.

5.3. If the law requires ENA Innovation to process Customer Data for another purpose, ENA Innovation informs the Customer before processing, unless the law prohibits it.

5.4. ENA Innovation does not use Customer Data for its own purposes, does not sell it and does not use it to train AI models.

6. Customer obligationsCopy Anchor Link

As data controller, the Customer is responsible in particular for:

• Determining the legal basis under Articles 5 and 6 of KVKK for each processing activity.
• Informing data subjects under Article 10 of KVKK. The Service does not ship with a privacy notice or consent text by default. The Customer writes and publishes these texts in visitor and staff forms.
• Being able to prove consent where it relies on explicit consent. The Service does not keep a separate record that a consent checkbox was ticked.
• Configuring forms and guidance so that special categories of personal data (for example, patients' health information) are not collected unnecessarily through free-text fields or attachments, and informing ENA Innovation in writing if it expects to process special categories of data.
• Meeting its controller obligations, such as VERBİS registration, a retention and destruction policy and responding to data subject requests.
• Assigning user roles and permissions on a need-to-know basis and removing access for users who leave.

7. ConfidentialityCopy Anchor Link

7.1. ENA Innovation ensures that its employees and other persons working on its behalf who access Customer Data are bound by written confidentiality obligations. Under Article 12(4) of KVKK, these obligations continue after they leave their role.

7.2. Access to Customer Data is limited to the persons and the extent needed to provide, support, maintain and secure the Service.

7.3. ENA Innovation does not disclose Customer Data to third parties except as permitted by this Agreement. If a competent authority requests Customer Data, ENA Innovation informs the Customer, unless the law prohibits it, and limits the disclosure to what the law requires.

8. Data securityCopy Anchor Link

8.1. Under Article 12 of KVKK, ENA Innovation takes technical and organizational measures that ensure an appropriate level of security to prevent unlawful processing of and access to personal data and to safeguard it. These measures are set out in Annex 2.

8.2. The measures may be updated as technology develops. Updates may not lower the overall level of protection described in Annex 2.

8.3. Under Article 12(2) of KVKK, the parties acknowledge that they are jointly responsible for taking data security measures. Settings within the Service, user accounts, roles, providers the Customer connects itself and files the Customer takes out of the Service (Excel and PDF exports, SQL dumps) are the Customer's responsibility.

9. Sub-processorsCopy Anchor Link

9.1. The Customer gives general written authorization for the engagement of the Sub-processors listed in Annex 3.

9.2. ENA Innovation notifies the Customer by email or within the Service at least 30 days before adding or replacing a Sub-processor. The notice states the Sub-processor's name, the processing activity and the place of processing.

9.3. The Customer may object in writing on reasonable grounds within 15 days of the notice. The parties will discuss a reasonable solution in good faith. If no solution is found, the Customer may terminate the Main Agreement for the affected part of the Service, without penalty, before the change takes effect.

9.4. If an urgent change is needed for security or service continuity, ENA Innovation makes the change and informs the Customer without delay. Section 9.3 still applies.

9.5. ENA Innovation imposes on each Sub-processor written data protection obligations no less protective than those in this Agreement. ENA Innovation remains liable to the Customer for a Sub-processor's failure to meet its obligations.

10. Cross-border transfersCopy Anchor Link

10.1. Using services marked as "cross-border transfer" in Annex 3 may require Customer Data to be transferred outside Türkiye. The Customer's choices in the Service (for example, turning on AI features or connecting its own provider) determine the scope of the transfer.

10.2. For every cross-border transfer to which it is a party, ENA Innovation complies with Article 9 of KVKK as amended by Law No. 7499 and with the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad. Each transfer is based on an adequacy decision or, if there is none, on one of the appropriate safeguards, primarily the standard contract published by the Board.

10.3. Where ENA Innovation signs a standard contract as the data exporter, ENA Innovation notifies the Board within 5 business days of signing. Where the Customer is the data exporter, the notification is the Customer's responsibility, and ENA Innovation provides the information needed for it.

10.4. If a Sub-processor's standard terms do not allow the KVKK standard contract to be signed, ENA Innovation informs the Customer. The parties then jointly consider options such as switching off the feature concerned, an alternative provider or another legal basis.

10.5. The region where the Customer Environment is hosted is stated in the order form or notified in writing at the Customer's request.

11. Assistance with data subject requestsCopy Anchor Link

11.1. If a data subject request reaches ENA Innovation directly, ENA Innovation does not answer it. It forwards the request to the Customer within 5 business days and tells the requester that the request has been passed to the Customer.

11.2. The Customer handles data subject requests primarily with the Service's own tools (viewing records, Excel and PDF export, deleting records). Where these are not enough, ENA Innovation provides reasonable technical assistance on the Customer's written request. To help the Customer meet the 30-day response period in Article 13 of KVKK, ENA Innovation normally completes such assistance within 10 business days.

11.3. In the Service, deletion generally removes a record from the interface and marks it as deleted in the database. If data of a specific data subject must be permanently erased from the database or anonymized, ENA Innovation does so, or shows the Customer how to do so, at the Customer's request. Exceptions needed to preserve the integrity of audit records are agreed with the Customer.

12. Data breach notificationCopy Anchor Link

12.1. When ENA Innovation becomes aware of a Data Breach affecting Customer Data, it notifies the Customer without undue delay and in any case within 48 hours of becoming aware of it. This period is intended to let the Customer notify the Board in time under Article 12(5) of KVKK and the Board's decision on the 72-hour notification period.

12.2. To the extent known at the time, the notice includes:

• the nature of the breach and the dates it started and was detected
• the categories of data affected and the approximate number of data subjects
• likely consequences
• measures taken and proposed
• a contact person at ENA Innovation

If information is not yet available, ENA Innovation does not delay the first notice; it adds information as it becomes known.

12.3. ENA Innovation takes the measures needed to limit the effects of the breach and reasonably assists the Customer in notifying the Board and data subjects. The obligation to notify the Board and data subjects rests with the Customer as data controller. ENA Innovation does not announce the breach to third parties on the Customer's behalf without the Customer's prior written approval, unless required by law.

12.4. Data Breach notices are sent to the email address and phone number of the authorized person the Customer names under the Main Agreement. The Customer keeps this information up to date.

13. Audits and informationCopy Anchor Link

13.1. At the Customer's request, ENA Innovation provides the information and documents needed to demonstrate compliance with this Agreement. This includes answering security questionnaires and keeping the annexes to this Agreement up to date.

13.2. Under Article 12(3) of KVKK, the Customer may carry out an audit itself or through an independent auditor. An audit:

• takes place at most once a year, with additional audits allowed after a Data Breach, at the Board's request or on serious suspicion of non-compliance
• requires at least 30 days' written notice and a scope agreed in advance
• takes place during business hours without unreasonably disrupting ENA Innovation's operations
• gives no access to other customers' data or to ENA Innovation's trade secrets
• is carried out under a confidentiality undertaking, at the Customer's cost unless agreed otherwise

13.3. The ISO 27001 certification process for the information security management system is in progress. This Agreement does not mean that ENA Innovation holds any certification.

14. Term, termination, return and deletionCopy Anchor Link

14.1. This Agreement takes effect together with the Main Agreement and remains in force until ENA Innovation stops processing Customer Data.

14.2. Before the Main Agreement ends, the Customer can retrieve its data with the Service's export tools (Excel and PDF exports; SQL export available to the Owner role). If the Customer requests it in writing within 30 days after termination, ENA Innovation delivers a copy of the Customer Data in a common machine-readable format.

14.3. Within 30 days after the Main Agreement ends, ENA Innovation shuts down the Customer Environment and deletes Customer Data, including the database, file storage, cache and backup dumps on the server. Automatic backups of the managed database service are deleted automatically when their configured retention period expires. ENA Cloud redirect logs are deleted or anonymized under ENA Innovation's log retention practice within [●] months at the latest.

14.4. If the law requires a longer retention period, ENA Innovation keeps the data concerned only for that purpose and period, keeps it confidential and deletes it at the end of the period.

14.5. At the Customer's request, ENA Innovation confirms in writing that deletion is complete.

14.6. If the Customer does not move to paid use at the end of the trial, trial environment data is also deleted under Section 14.3.

15. LiabilityCopy Anchor Link

15.1. Each party is liable for breaching its own obligations under this Agreement and KVKK.

15.2. The limitations of liability in the Main Agreement apply to this Agreement to the extent permitted by law. Liability is not limited for intent, gross negligence or where the law does not permit a limitation.

16. Governing law and other termsCopy Anchor Link

16.1. This Agreement is governed by the laws of the Republic of Türkiye. The jurisdiction clause of the Main Agreement applies to disputes.

16.2. If any provision of this Agreement is held invalid, the other provisions are not affected.

16.3. ENA Innovation may update this Agreement to reflect changes in legislation or in the Service. Material changes to the Customer's detriment are notified to the Customer at least 30 days before they take effect.

16.4. This Agreement is published in Turkish and English. In case of conflict, the Turkish version prevails.

17. ContactCopy Anchor Link

Annex 1: Details of processingCopy Anchor Link

Subject matter and purpose. Providing visitor feedback, hygiene ratings, surveys and content pages in the Customer's physical premises through QR codes, NFC tags and live displays; managing tickets and routing them to resolution teams; keeping cleaning logs, control (inspection) logs and check-in/check-out records; sending notifications; reporting; running the AI features the Customer turns on (sentiment analysis, voice and video transcription, translation); support, maintenance and security.

Nature of processing. Collection, recording, storage, organization, viewing, transfer (to notification and AI providers), transformation (re-encoding of image, audio and video files), reporting, export and deletion.

Data subjects and data categories:

Special categories of personal data. The Service is not designed to collect special categories of personal data. However, free-text fields and attachments may contain such data, such as health information or images entered by the data subject. The Customer manages this risk under Section 6.

Retention. Feedback, hygiene ratings, tickets, scan records and audit records are kept until the Customer deletes them or the Main Agreement ends. Periods applied automatically by the Service: file uploads never attached to a submission are deleted after 24 hours; incomplete survey sessions are deleted after 90 days; location sessions end after at most 30 minutes and staff sessions after 12 hours.

Annex 2: Technical and organizational measuresCopy Anchor Link

The measures below are those implemented in the current version of the Service. Measures not listed here are not committed to under this Agreement.

Environment separation

• A separate application stack (API, web application, cache, file storage and reverse proxy) runs for each Customer.
• Each Customer has its own PostgreSQL database and its own database user.

Network and transport security

• All hostnames are served through Cloudflare with end-to-end validated TLS.
• Application servers accept TLS 1.2 and 1.3. The web application uses HSTS.
• Remote administrative access to servers (SSH) is restricted to an authorized administrator IP address.
• The web application sends Content Security Policy (CSP), frame protection, MIME-type protection and restrictive referrer policy headers. Cookie-authenticated write requests must carry a custom header as CSRF protection. The API applies a CORS allowlist.

Authentication and authorization

• Admin panel sign-in runs through an invite-only identity service (Logto); public sign-up is disabled.
• Role-based access control applies, with 7 organization roles and 35 permission scopes. Owner-only operations are further restricted. The last owner cannot be removed.
• Field staff sign in with a personal code or a device-bound quick sign-in key (passkey). Personnel codes are stored only as Argon2id hashes. Sign-in locks after 10 failed attempts in 15 minutes.
• Staff web sessions end after 12 hours. In the mobile app, access tokens are valid for 15 minutes; refresh tokens rotate and reuse is detected.

Encryption and hashing

• Provider and AI API keys are stored encrypted with AES-256-GCM. Encryption keys are derived per purpose from a master secret with HKDF-SHA256.
• Display credentials and NFC trust tokens are stored only as SHA-256 hashes and compared with a timing-safe method.
• Requests to the central ENA Cloud services are signed with HMAC-SHA256 and bound to a timestamp.

Logging and traceability

• Admin actions are written to the audit log with the user, IP address, browser information and before/after values.
• Audit records are linked by an HMAC-SHA256 hash chain; chain integrity is verified in the record detail view.
• Every export is written to the audit log.
• Notification deliveries and AI calls are logged separately. AI call logs do not store prompts or content.

Data minimization and access limitation

• Visitor submissions are anonymous by default; the Customer can switch contact fields on or off.
• In the admin panel, staff contact details, the user list, team members and notification recipients are shown masked.
• Survey sessions do not store the respondent's identity.
• Uploaded photos are re-encoded on the server; files are checked by their content bytes against the declared type.

Abuse protection

• Global and per-endpoint rate limits, a per-IP request limit at server level and request size limits apply.
• Visitor forms include a bot-trap field and duplicate-submission blocking.

Backup and continuity

• The database is protected by the managed database service's automatic backup and point-in-time recovery.
• A separate database backup is taken before every update.

Secure development

• Before every release, type checks, static analysis (ESLint, Semgrep), unit tests, a dependency security audit and secret scanning (gitleaks) run.
• When the error monitoring service is enabled, authentication headers, cookies and password/token fields are scrubbed before sending.

Organizational measures

• Access to Customer Data is limited to staff who need it for their work, and staff are bound by confidentiality obligations.
• Security vulnerabilities are received and assessed through the published responsible disclosure policy.
• Sub-processors are bound by written obligations under Section 9.
• The ISO 27001 certification process is in progress.

Annex 3: Sub-processorsCopy Anchor Link

Notes

• ENA Cloud (QR, NFC and display redirects, short links, notification and AI gateways) is operated by ENA Innovation itself and is not a Sub-processor.
• Providers the Customer connects with its own account (for example SendGrid, an SMTP server, Twilio, Bird, Firebase Cloud Messaging, OpenAI, Anthropic or its own Google Gemini key) and YouTube or Vimeo embeds added by page authors are not on this list (Section 3.3).
• The current list is also published on the Sub-processors page. The full legal names and processing locations of Sub-processors are provided in writing on request.