Data Processing Agreement

Provider / seller details

Legal name: [eklenecek]
MERSIS no.: [eklenecek]
Tax office: [eklenecek]
Tax no.: [eklenecek]
Address: [eklenecek]
Phone: [eklenecek]
Email: [eklenecek]
KEP (registered email): [eklenecek]

Parties and roles

This agreement is an annex to the Terms of Service. The business using Dokun is the data controller under Turkish Law No. 6698 (KVKK) for the personal data of its card-holding customers; Dokun processes this data only on the business's behalf as data processor. Business accounts, billing and security logs are outside the scope of this agreement (Dokun is the controller for those).

Subject, scope and duration

Subject: running the loyalty program. Data categories: name (optional), email, phone (if given), birthday (if given), card serial number, stamp/reward/coupon history, visit rating and comment, marketing consent records, Apple Wallet device registration data. Data subjects: the business's card-holding customers and staff. Duration: the subscription term plus the return/deletion period in section 11.

Instructions

Dokun processes personal data only on the business's documented instructions; dashboard settings, campaign sends and API calls count as instructions. Dokun informs the business if it believes an instruction infringes the law. Data is not used for advertising, profile sales or Dokun's own purposes, except anonymous aggregate usage statistics.

Confidentiality and staff

Dokun staff with access to data are bound by confidentiality, and access is granted only to the minimum extent needed for support, maintenance and security.

Security measures

Technical and organizational measures: TLS encryption in transit; row-level security (RLS) isolating businesses in the database; masked details in counter customer search; transaction verification via QR or one-time code; role-based staff permissions; API keys stored only as hashes; rate limiting and bot protection; encrypted backups; access and activity logs; regular security updates.

Sub-processors

The business grants general authorization for the following sub-processors: • Supabase — database, authentication, file storage (EU, Ireland) • Vercel — application hosting and server functions (EU region; global edge network, US-based company) • Apple — Apple Wallet passes and push notifications (APNs) (US/global) • Cloudflare — Turnstile bot protection (global) • Google — Google Analytics, only on the public marketing site and with cookie consent; no card holder data is sent (EU/US) • Resend — transactional and campaign emails (US/EU) • Netgsm or İleti Merkezi — SMS verification codes (Turkey) • iyzico — subscription payments; business billing/payment data only (Turkey) This page is updated and businesses are notified by email at least 30 days before a new sub-processor is added; the business may object on reasonable grounds. Dokun imposes obligations on sub-processors equivalent to this agreement.

International transfers

Some sub-processors process data outside Turkey. Transfers follow KVKK Art. 9 (as amended in 2024 by Law No. 7499); absent an adequacy decision, via the standard contracts published by the Board. Standard contracts must be notified to the Personal Data Protection Authority within 5 business days of signature; which party fulfils this notification and the transfer tool per sub-processor will be confirmed by legal review.

Data subject requests

Dokun provides the business with dashboard tools (view, export and delete a customer record) so it can answer card holders' requests under KVKK Art. 11. Requests sent directly to Dokun are forwarded to the business without delay.

Breach notification

Dokun notifies the business without undue delay and at the latest within 72 hours after becoming aware of a personal data breach affecting its data, describing the nature of the breach, affected data and data subject categories, likely consequences and measures taken. Notifying the Board and data subjects is the business's duty as controller; Dokun provides reasonable assistance.

Audits

The business may request information and documents to verify compliance. On-site audits require reasonable prior written notice, take place at most once a year during business hours and must protect other customers' confidentiality; costs are borne by the business. Independent audit reports of sub-processors are shared where possible.

Return and deletion at the end of the agreement

When the subscription ends, the business can export its data as CSV from the dashboard for 30 days. After that, personal data is deleted or anonymized, including backups, within 90 days at the latest, except records subject to statutory retention. On request, deletion is confirmed in writing.

Precedence

In case of conflict between this agreement and the Terms of Service regarding personal data processing, this agreement prevails.