Data Processing Agreement
Last updated:
This is a translation; in case of any discrepancy the Turkish version prevails.
Your company enters customer, order, workshop and file data in Üretimo. Your company is the controller of this data; Üretimo is the processor that processes it only on your instructions and to provide the service. This agreement forms part of the Terms of Use and applies for as long as your account is open.
1. Parties and scope
This agreement is between the company using the Üretimo service (the “customer”, controller) and Üretimo (the “processor”). It sets out the processing terms under Art. 12 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and, for customers in the European Union, Art. 28 GDPR. Processing for which Üretimo is itself the controller (its own account, billing and marketing website data) is described in the Privacy Policy.
2. Subject matter, duration, nature and purpose
- Subject matter: data the customer enters in the application or that is collected on its behalf (order form, tracking link).
- Duration: for as long as the account is open; after closure, the periods in section 10.
- Nature: storage, display, editing, export, sending email notifications, backup and deletion.
- Purpose: solely to provide the production tracking service (orders, stages, workshops, customer links, documents, images).
3. Categories of data and data subjects
- Data subjects: the customer’s staff and users, the customer’s customers and their staff, workshop and subcontractor staff, suppliers.
- Categories of data: name, email, phone, address, company details, order and delivery details, price and invoice details, notes, uploaded files and photos, tracking link visit records.
- The service is not designed for special categories of personal data; the customer should not enter such data.
4. Processing on instructions
Üretimo processes the data only on the customer’s documented instructions. Use of the application, its settings and this agreement are the customer’s instructions. Üretimo does not use the data for its own purposes, sell it or use it for advertising. If we believe an instruction breaks the law, we inform the customer. If access to the data is demanded under a legal obligation, we notify the customer in advance unless the law prohibits it.
5. Confidentiality
Üretimo staff and assistants with access to the data are bound by confidentiality and access the data only as far as needed to provide the service, give support or resolve a problem.
6. Security measures
- Row Level Security in the database: each company sees only its own data.
- Access roles: with roles such as admin, office, quality, accounting and workshop, a user sees only what they are permitted to see.
- All connections are encrypted (TLS); passwords are irreversibly hashed; files are accessed through short-lived signed links.
- The database is backed up regularly.
- Measures are updated as technology develops; the level of protection is not reduced.
7. Sub-processors
The customer gives general authorisation for the sub-processors below. Üretimo works with each sub-processor on terms that give protection equivalent to this agreement and remains responsible to the customer for their processing.
| Sub-processor | Role | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | EU (Frankfurt) |
| Vercel | Hosting and server functions | Functions in the EU (Frankfurt); global content network |
| Stripe | Payments and invoices | EU and US |
| Google (Gmail / Workspace) | Sending email | Outside Türkiye, including the US |
| Google (Gemini API) | Image generation (fabric try-on, swatch book, render) | Outside Türkiye, including the US |
| Meta | Consent-based measurement on the marketing website only; no access to customer data in the application | EU (Ireland), US |
Before adding or replacing a sub-processor, we inform the customer by email and by updating the list in the Privacy Policy. If the customer objects on reasonable grounds, we try to agree on a way forward; if we cannot, the customer can end the subscription without penalty. Transfers abroad are made with the safeguards provided for in KVKK Art. 9 and the GDPR.
8. Breach notification
When we become aware of a personal data breach affecting customer data, we inform the customer without undue delay and within 72 hours at the latest. As far as known, the notice describes the nature of the breach, the categories of data and approximate number of records affected, the likely consequences and the measures taken or proposed. We help the customer meet its obligations to notify the supervisory authority and the data subjects.
9. Data subject requests and assistance
If a data subject (for example, a customer’s customer) contacts us directly, we pass the request on to the customer. We reasonably assist the customer in responding to requests for access, rectification, erasure, portability and objection and, where needed, with a data protection impact assessment. Most requests can be handled by the customer in the application (editing, deleting, downloading all data in one click).
10. Deletion and return at the end of the agreement
For 30 days after the account is closed, the customer can download all its data (CSV files that open in Excel, and the files). At the end of that period, or earlier at the customer’s request, the data is deleted; deletion from backups takes no more than 90 days. Records subject to a legal retention obligation (such as Üretimo’s own invoices) are kept for that period.
11. Audits
The customer may request in writing the information needed to demonstrate compliance with this agreement; we reply within a reasonable time. Where this is not sufficient, an audit may be carried out with reasonable prior notice, during business hours, under confidentiality and no more than once a year; it is planned so as not to harm other customers’ data or security.
12. GDPR Art. 28 and precedence
For customers in the European Union this agreement covers the matters listed in GDPR Art. 28(3). If this agreement and the Terms of Use conflict on the protection of personal data, this agreement prevails.
13. Contact
For any questions, requests and notices about this agreement: info@uretimo.com.