Data Processing Agreement
Last updated: [To be specified before publication: effective date]
1. Parties and Roles
This Data Processing Agreement (the "Agreement" or "DPA") is entered into between SMARTLABS MEDYA TEKNOLOJİLERİ ANONİM ŞİRKETİ, registered under MERSIS No. [To be completed: MERSIS number], having its address at REŞİTPAŞA MAH. DENİZBANK SİTESİ SOK. NO:20 SARIYER İSTANBUL, tax office SARIYER VD, tax number 7720710368 (the "Provider" or "Processor"), and the legal entity or merchant identified in the account or order records for the Medyapin® OS service (the "Customer" or "Controller"). Provider's VERBIS registration: [To be completed: VERBIS registration number]. Contact: info@smartlabs.com.tr, registered e-mail (KEP): [To be completed: Registered e-mail (KEP) address], telephone: 08502593666.
Medyapin® and Medyapin.com are registered trademarks of SMARTLABS MEDYA TEKNOLOJİLERİ ANONİM ŞİRKETİ.
With respect to personal data processed within its own tenant, the Customer is the data controller within the meaning of Article 3(1)(ı) of the Turkish Personal Data Protection Law No. 6698 ("KVKK"); with respect to such data, the Provider is the data processor within the meaning of Articles 3(1)(ğ) and 12(2) KVKK, acting on behalf of and on the instructions of the Customer.
The Provider is itself the data controller for data processed in its own customer relationship (billing and payment data, account owner contact details, consent records, etc.); such processing is governed not by this Agreement but by the KVKK Privacy Notice and the Privacy Policy.
2. Definitions
Terms used but not defined in this Agreement have the meanings given in Article 3 KVKK.
- Personal Data: any information relating to an identified or identifiable natural person.
- Special Categories of Personal Data: the data listed in Article 6 KVKK (including biometric data).
- Data Subject: the natural person whose personal data is processed.
- Processing: any operation performed on personal data, such as obtaining, recording, storing, retaining, altering, transferring, classifying or preventing the use of personal data.
- Service: the Medyapin® OS cloud-based digital signage and in-store experience platform provided by the Provider, including the content management system (CMS), screen players on Android, Windows, webOS, Tizen and other platforms, music broadcasting, Vision Edge camera triggers, Model Studio and, where applicable, optional on-premise licence components.
- Sub-processor: a third-party processor engaged by the Provider to process Customer Personal Data.
- Personal Data Breach: unlawful acquisition of Customer Personal Data by others, or unauthorised access to, loss, alteration or disclosure of such data as a result of a security breach.
- Board: the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
- Instructions: the configurations and actions taken by the Customer through the Service interface, this Agreement, the Terms of Service and other documented instructions given in writing.
3. Subject Matter, Nature, Purpose and Duration of Processing
3.1. The Provider processes Customer Personal Data solely to provide, maintain and secure the Service, to provide technical support and to carry out the Customer's documented Instructions.
3.2. Processing consists of hosting, storage, transmission, content delivery, scheduling of playback on screens, collection of events and telemetry, reporting and backup. Details are set out in Annex 1.
3.3. Processing continues for the term of the Customer's subscription to the Service and ends upon completion of the return and deletion processes set out in Section 12.
4. Obligations of the Provider
4.1. Compliance with Instructions
The Provider processes Customer Personal Data only on the Customer's documented Instructions. If applicable law requires other processing, the Provider will inform the Customer before processing unless legally prohibited. If the Provider considers that an Instruction infringes KVKK or other legislation, it will inform the Customer without delay and may suspend execution of that Instruction.
4.2. Confidentiality
The Provider ensures that its employees and contractors authorised to access Customer Personal Data are bound by written confidentiality obligations, have only the minimum access necessary for their duties and receive training on personal data protection. This obligation survives the end of the engagement.
4.3. Data Security
Pursuant to Article 12 KVKK, and taking into account the Board's "Personal Data Security Guide (Technical and Organisational Measures)", the Provider implements the technical and organisational measures set out in Annex 2 to ensure an appropriate level of security, to prevent unlawful processing of and unlawful access to personal data and to safeguard such data. The Provider may update these measures in line with technological developments, provided that updates do not reduce the overall level of security.
4.4. Assistance with Data Subject Requests
Taking into account the nature of the processing, the Provider provides reasonable technical and organisational assistance so that the Customer can respond to data subject requests under Article 11 KVKK (requests for information, rectification, erasure, notification of third-party recipients, etc.) within the thirty-day period set out in Article 13 KVKK. Export and deletion tools are available for this purpose in the Service interface (Settings → Privacy and KVKK). Any request received directly by the Provider will, unless legally prohibited, be forwarded to the Customer without delay and without being answered.
4.5. Impact Assessments and Consultation
The Provider provides reasonable assistance, to the extent of information available to it, with the Customer's data protection impact assessments for processing activities that may carry high risk, in particular in-store sensing and camera triggers, and with notifications to and correspondence with the Board.
4.6. Personal Data Breach Notification
The Provider will notify the Customer without undue delay and at the latest within [To be specified before publication: 24 or 48] hours of becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will include, to the extent then known, the nature of the breach, the categories and approximate numbers of data and data subjects concerned, likely consequences, measures taken or proposed and a contact person. This period is intended to enable the Customer to notify the Board within 72 hours of becoming aware of the breach, as expected under Board Decision No. 2019/10 of 24 January 2019. The Provider will promptly take the measures necessary to mitigate the effects of the breach and cooperate with the Customer. The obligation to notify the Board and data subjects rests with the Customer.
4.7. Records
The Provider keeps records of the processing activities it carries out on behalf of the Customer and audit logs of actions within the Service (actor, action, IP address, correlation ID), and shares them on request to the extent necessary for the Customer's compliance obligations.
5. Sub-processors
5.1. By this Agreement the Customer grants the Provider a prior general authorisation to engage the Sub-processors listed in Annex 3.
5.2. The Provider will inform the Customer by e-mail and/or through the Service interface at least 30 days before adding or replacing a Sub-processor.
5.3. The Customer may object in writing on reasonable data-protection grounds within 30 days of the notice. The parties will negotiate a reasonable solution in good faith; failing that, the Customer may terminate the affected part of the Service without penalty and any prepaid fees for the unused period will be refunded.
5.4. The Provider enters into a written agreement with each Sub-processor containing data protection obligations no less protective than those in this Agreement and remains liable to the Customer for the acts of its Sub-processors as for its own.
6. International Transfers
6.1. Customer Personal Data is hosted by default in the European Union ("eu") data region. Transfers abroad are carried out in accordance with Article 9 KVKK as amended by Law No. 7499, in force since 1 June 2024.
6.2. Accordingly, a transfer relies primarily on an adequacy decision of the Board and, in the absence of such a decision, on one of the appropriate safeguards under Article 9(4) KVKK: the standard contract published by the Board (notified to the Board within five business days of signature), binding corporate rules approved by the Board, or a written undertaking authorised by the Board. Only where none of these is available may the occasional transfer cases listed in Article 9(6) apply.
6.3. Which party fulfils the obligation to notify the standard contract to the Board depends on the transfer scenario: [To be specified before publication: responsible party and process for notification].
6.4. For Customers established in the European Union, the Provider assumes obligations equivalent to Article 28 of Regulation (EU) 2016/679 ("GDPR"); where required, the European Commission Standard Contractual Clauses (SCCs) are concluded in addition to this Agreement.
7. Audits
7.1. The Provider makes available, upon the Customer's reasonable request, the information necessary to demonstrate compliance with this Agreement. The Customer exercises its audit right primarily through security documentation provided by the Provider, independent audit reports (where available) and answers to written security questionnaires.
7.2. Where these means are reasonably insufficient, or in the event of a Personal Data Breach or a request from the Board, the Customer may carry out, or have carried out, an on-site audit no more than once a year, with at least 30 days' prior written notice, during business hours, without unreasonably disrupting the Provider's operations and without breaching the confidentiality of other customers' data. The auditor must be bound by confidentiality and must not be a competitor of the Provider.
7.3. The costs of an on-site audit are borne by the Customer. If the audit reveals a material non-compliance, the Provider will remedy it at its own cost within a reasonable period.
8. Obligations of the Customer
As data controller, the Customer represents and undertakes that it:
- has a valid legal basis under Articles 5 and 6 KVKK for personal data processed through the Service and obtains explicit consent where required;
- will fulfil its duty to inform its own data subjects (employees, store visitors, customers) under Article 10 KVKK, including visible signage and layered privacy notices at locations where cameras or sensors are used;
- will not give the Provider any instruction to process data unlawfully;
- will not use the Service for facial recognition, identity verification or the individual identification of data subjects by biometric means, and will not enable features outside the default scope of the Service, such as demographic estimation or presence tracking, without a separate written agreement, explicit consent and legal review;
- has obtained the necessary permissions and rights for personal data contained in content it uploads to the Service;
- will maintain the security of its own user accounts (strong passwords, multi-factor authentication, role-based authorisation) and will inform the Provider immediately upon becoming aware of unauthorised access to the Service.
9. Privacy-First Sensing
9.1. The Vision Edge component performs image processing on the device. The Service does not perform facial identity recognition. Raw video and audio are not uploaded to the cloud or retained by default; the retention period for this class is enforced at zero (0).
9.2. Only trigger events and aggregated data are transmitted to the cloud. When Model Studio is used, product images uploaded by the Customer are processed for training.
10. Liability
The parties' liability under this Agreement is subject to the limitations of liability set out in the Terms of Service and, where applicable, the Distance Service Agreement, without prejudice to mandatory law and cases of intent and gross negligence. Pursuant to Article 12(2) KVKK, the parties are jointly liable towards data subjects and the Board for taking data security measures; internally, liability is shared in proportion to each party's fault.
11. Term, Precedence and Amendments
11.1. This Agreement takes effect on the date the Customer accepts the Terms of Service or the relevant order/subscription begins and remains in force until processing of Customer Personal Data ends.
11.2. On matters of personal data protection, this Agreement prevails over the Terms of Service and other contractual documents.
11.3. The Provider may update this Agreement as required by legislative changes or Board decisions; material changes will be notified to the Customer at least 30 days before taking effect.
12. Return and Deletion of Data at the End of the Contract
12.1. Before the subscription ends, the Customer may obtain its data as a compressed (zip) file in JSON/CSV format using the data export tool under Settings → Privacy and KVKK.
12.2. Within [To be specified before publication: X] days of termination, the Provider will erase, destroy or anonymise Customer Personal Data, including backups, and will confirm this in writing upon request. Data that must be retained by law (e.g. audit and evidentiary records) is kept only for the applicable retention period and with restricted access.
13. Governing Law and Jurisdiction
This Agreement is governed by Turkish law. The courts and enforcement offices of [To be specified before publication: competent courts, e.g. Istanbul (Çağlayan)] have jurisdiction over disputes. In the event of any discrepancy between the Turkish text and any translation, the Turkish text prevails.
Annex 1 — Processing Details
Categories of Data Subjects
- The Customer's employees and authorised users of the Service
- Visitors to the Customer's stores and venues (only at event and aggregate level)
- Persons appearing or named in content uploaded by the Customer
- The Customer's own customers (to the extent POS events are sent by the Customer)
Categories of Personal Data
- Identity and contact: name and surname, business e-mail, telephone
- Account and security: user ID, roles and permissions, password hash (scrypt), MFA information, session records
- Transaction security: IP address, audit logs, correlation IDs
- Visual and audio content: images, videos and audio uploaded by the Customer
- Device and location: screen/device IDs, store location, device telemetry, screenshots
- Sensor and trigger events: events without personal identifiers and aggregated counts
- POS events: sales/transaction events sent by the Customer
Special Categories of Personal Data
The Service is not designed to process special categories of personal data (including biometric data). The Customer agrees not to transfer such data to the Service without a separate written agreement.
Default Retention Periods
Configurable per organisation through retention classes:
- Raw telemetry: 30 days
- Screenshots: 90 days
- Raw camera and audio recordings: 0 days (not retained)
- Audit and evidentiary records: approximately 7 years
Annex 2 — Technical and Organisational Measures
- TLS encryption for all data in transit
- Passwords stored as scrypt hashes
- Multi-factor authentication (MFA)
- Role-based access control (RBAC) based on the principle of least privilege
- Strict tenant isolation enforced server-side
- Audit logs recording actor, action, IP address and correlation ID
- Encryption of secrets and credentials at rest
- Signed device manifests and software updates; per-device key pairs
- Rate limiting and brute-force protection
- Regular backups and periodic restore drills
- Vulnerability management and tracking of security updates
- Short-lived, signed content access URLs
- Default "eu" data region
- Personnel confidentiality undertakings and awareness training
- Policies and procedures aligned with the Board's "Personal Data Security Guide (Technical and Organisational Measures)"
Annex 3 — List of Sub-processors
- Google Cloud (Google Ireland Ltd. / Google LLC) — Vertex AI and Cloud Storage; region europe-west4 (Netherlands); only when the Customer uses Model Studio training; data processed: product images
- iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.) — payment processing; acts mainly as an independent controller / payment institution for payment data
- Hosting / cloud infrastructure provider — [To be specified before publication: legal name, service and region]
- Transactional e-mail provider — [To be specified before publication: legal name, service and region]
Changes to this list are notified in accordance with Section 5.