Under applicable data protection laws (EU GDPR and Turkish Law No. 6698), the Client is the Data Controller and Omurga Systems acts as a Data Processor on Client's behalf, providing centralized branch reputation monitoring, Google API connectivity, and automated response suggestions.
The Processor handles only data necessary to fulfill the SaaS services under documented Client instructions:
Processor covenants that Client operational data, review analytics, and proprietary response templates shall never be used to train, fine-tune, or calibrate public or proprietary foundational AI models (including OpenAI, Anthropic, or Google models). All inferences are performed in isolated, zero-retention ephemeral session contexts.
Processor implements state-of-the-art security safeguards:
Controller grants general authorization to utilize verified enterprise infrastructure sub-processors (Hetzner Online GmbH, OpenAI, Netgsm A.Ş., Cloudflare Inc. or equivalent providers certified under ISO-27001 and SOC 2 Type II). Changes are posted transparently on the Privacy portal.
In the event of a confirmed security incident or unauthorized access impacting Controller data, Processor shall notify Controller in writing without undue delay and at the latest within 72 (seventy-two) hours (targeting 48 hours for critical incidents), taking immediate remedial actions to mitigate consequences.
Any inquiry, erasure, or rectification request under GDPR Chapter III or Turkish KVKK Art. 11 received directly by Processor regarding public store reviews or interactions shall be routed to Controller within three (3) business days. Controller maintains sole responsibility for substantive review and response within statutory timelines (30 days); Processor shall provide necessary technical assistance.
Controller exclusively owns all branch records, operating data, Google review history, and response templates imported or generated on the platform. Processor holds only a limited, non-exclusive license to process such data strictly for the performance of the SaaS services. Upon termination, data can be securely exported in industry-standard JSON/CSV formats.
De-Identified & Aggregated Benchmarking Rights: Without prejudice to Controller's exclusive ownership of its operational data, Processor may process and publish irreversibly de-identified, anonymized, and aggregated statistical metrics (e.g. cross-industry response times, resolution velocities, and regional sentiment indices) to benchmark algorithmic performance and issue market intelligence reports, ensuring no customer or branch identity is ascertainable.
Upon subscription expiration or termination, Processor shall securely purge or return all operational customer data within 30 days, save for records mandated by statutory telecommunications logging laws.
This DPA is governed by Turkish Law. The Exclusive Evidence Agreement (HMK Art. 193), Istanbul Anatolia Courts jurisdiction, and ISTAC Arbitration options under the Master Agreement shall apply in full force.