Data Processing Agreement (DPA)
Our data processing obligations under GDPR and KVKK
This Data Processing Agreement (“DPA”) constitutes an integral and inseparable part of the Terms of Service (“Main Agreement”) accepted through the Kynic Agent platform and is entered into between the following parties.
Parties
- Data Controller (Customer): The natural or legal person who registers on the Kynic Agent platform, begins using the Services, and exclusively determines the purposes and means of processing the personal data of its own End Users (“Data Controller”, “Customer”).
- Data Processor (Kynic Agent): Muhammed Eren Akbaş – Kynic Agent, operating under the laws of the Republic of Türkiye (Tax Office: Küçükköy / Tax Identification Number: 0151249191, Address: Istanbul / Türkiye) (“Data Processor”, “Kynic Agent”).
1. Definitions
- 1.1. Law / Legislation: The Personal Data Protection Law No. 6698 (“KVKK”), the European Union General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act (“CCPA”), and all applicable data protection legislation,
- 1.2. Data Controller: The Customer who determines the purposes and means of processing the personal data of End Users,
- 1.3. Data Processor: Kynic Agent, which processes personal data on behalf of and in accordance with the instructions of the Data Controller,
- 1.4. Subprocessor: Authorized third-party service providers that provide real-time artificial intelligence (LLM API), communication channels, or web hosting support for the provision of platform services,
- 1.5. Data Subject (End User): All natural persons with whom the Customer communicates and whose data is processed through the Customer's Kynic Agent platform and artificial intelligence assistants,
- 1.6. Special Categories of Personal Data: Data defined under Article 6 of the KVKK and Article 9 of the GDPR, including health, biometric, and genetic data, as well as data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, religious denomination, clothing, membership in associations, foundations, or trade unions, criminal convictions, and security measures.
2. Subject Matter and Scope of the Agreement
2.1. The subject matter of this DPA is to determine the rights, authorities, and obligations of the parties regarding the processing of personal data belonging to the Customer's End Users by Kynic Agent, acting as the Data Processor, in accordance with the KVKK, GDPR, and applicable legislation within the scope of the Customer's use of the Kynic Agent platform.
2.2. By registering for the Kynic Agent Services or accepting the Terms of Service, the Customer shall be deemed to have accepted this DPA as a binding and integral addendum.
3. Roles and Representations of the Parties
3.1. Data Controller Status and Responsibility: The Customer acknowledges and undertakes that it is the primary Data Controller of the End User data processed through the platform and that it is solely responsible for the lawful collection of such data, providing the necessary privacy notices to End Users in accordance with Article 10 of the KVKK and the GDPR, obtaining explicit consent where required, and establishing the applicable legal bases.
3.2. Data Processor Status: Kynic Agent processes personal data solely on behalf of the Customer, for the provision of the Services, the technical operation of the platform, and in accordance with the Customer's instructions, and acts in the capacity of Data Processor.
4. Special Provisions Regarding Artificial Intelligence and Data Privacy
4.1. Model Training Prohibition: Kynic Agent does not use Customer Data or messages and personal data belonging to the Customer's End Users for the purpose of training its own general-purpose artificial intelligence models and strictly does not use or transfer such data for this purpose.
4.2. Automated PII Masking Layer: Before sending requests to external artificial intelligence services (including OpenAI, Anthropic, Google Gemini, etc.), Kynic Agent shall scan and mask Personally Identifiable Information (PII - First Name, Last Name, Phone Number, Email, Turkish National ID Number (TCKN), etc.) contained in messages through an automated data masking layer and shall share only masked text with external services in a stateless manner.
4.3. Server and Hosting Infrastructure: The Data Processor undertakes to store the primary relational and vector databases, Customer account data, and chat histories on virtual private server (VPS) infrastructure leased from a hosting provider located in Türkiye and managed by the Data Processor (Türkiye).
5. Obligations and Security of the Data Processor
5.1. Compliance with Instructions: The Data Processor shall not process, sell, rent, or transfer personal data to unauthorized third parties for any purpose other than the Customer's written instructions or configuration-based instructions provided through the platform.
5.2. Technical and Administrative Measures: In accordance with Article 12 of the KVKK and Article 32 of the GDPR, the Data Processor undertakes to implement the necessary technical and administrative security measures, including TLS 1.3 transmission encryption, AES-256 storage encryption, logical tenant isolation (Tenant Isolation), and WAF, in accordance with the Security Policy, in order to prevent unauthorized access to, loss of, or unlawful processing of data.
5.3. Confidentiality Obligation: The Data Processor shall ensure that personnel authorized to access personal data are subject to legal and contractual confidentiality obligations. This obligation shall continue indefinitely even after termination of the Agreement.
5.4. Data Breach Notification: If the Data Processor detects a personal data security breach affecting Customer Data within systems under its control, it shall notify the Data Controller by email without delay and within no later than 24–48 hours from the time it becomes aware of the breach.
5.5. Data Subject Requests: Rights requests and applications received directly by the Data Processor from End Users shall be forwarded to the Customer within a reasonable period for the necessary action to be taken.
6. Prohibition of Special Categories of Personal Data and Indemnification
6.1. Limitation of Use: The Kynic Agent platform is not designed, by its nature, for the processing of special categories of personal data (including health data, biometric data, religious or political beliefs, etc.).
6.2. Customer Undertaking: The Customer undertakes that it shall not collect or transfer special categories of personal data from End Users through the platform without obtaining explicit consent where required and in violation of applicable legislation. The Customer is responsible for warning its End Users not to enter special categories of personal data into the chat interface.
6.3. Right of Recourse: Any administrative fines, compensation, administrative sanctions, and legal costs imposed on or incurred by Kynic Agent by official authorities (including the Turkish Data Protection Authority, DPA, etc.) or third parties as a result of the Customer's breach of this section shall be directly recourseable to the Customer.
7. Subprocessors and International Transfers
7.1. General Authorization: The Customer provides general authorization for Kynic Agent to use the authorized third-party service providers listed on the Subprocessors page for the purpose of carrying out real-time artificial intelligence, communication channel, and web hosting processes required for the operation of the platform.
7.2. Changes to Subprocessors: Kynic Agent shall notify the Customer of changes to the Subprocessor list at least 30 days before the effective date of such changes. The Customer retains the right to object to a new Subprocessor for legitimate reasons.
7.3. International Transfer Safeguards: Where personal data is transferred outside Türkiye or the EU/EEA, Kynic Agent undertakes to act in accordance with Article 9 of the KVKK (Standard Contractual Clauses), the GDPR Standard Contractual Clauses (SCCs), or approved data transfer mechanisms.
8. Term, Data Destruction, and Exceptions
8.1. Term: This DPA shall remain in effect for as long as the Customer's platform subscription and the Main Agreement remain in effect.
8.2. Deletion and Destruction of Data: Upon termination of the service relationship or closure of the account, Kynic Agent shall securely delete, destroy, or anonymize the Customer's End User data in accordance with the Data Retention and Destruction Policy.
8.3. Legal Retention Exception: Technical logs and financial records subject to statutory retention obligations arising from applicable legislation (including the Turkish Commercial Code (“TTK”), Tax Procedure Law (“VUK”), Law No. 5651, etc.) shall continue to be retained for the periods prescribed by law.
9. Notifications and Contact
The following contact information may be used to contact the Data Processor regarding this Data Processing Agreement (DPA), personal data protection processes, or KVKK/GDPR requests:
- Data Processor Legal Name: Muhammed Eren Akbaş – Kynic Agent
- Tax Office / Tax Identification Number: Küçükköy / 0151249191
- Address: Istanbul, Türkiye
- Contact Email: contact@kynicagent.com