Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the merchant that opened an organisation on Rommerce OS (the Controller) and Piemsoft Yazılım ve Eğitim San.Tic.Paz.Ltd.Şti, 7281195865, Vatan Mahallesi 230.Cad No:101 Merkez/Isparta (the Processor). It applies whenever the Processor handles personal data on the Controller's behalf, and it prevails over the Terms where the two conflict on data protection.

Where the Controller is subject to Turkish Law no. 6698 (KVKK), the Controller is the "veri sorumlusu" and the Processor the "veri işleyen", and this DPA also serves as the written arrangement between them.

2. What is processed

• Subject matter and purpose: providing the Service - importing orders and returns from the Controller's sales channels, reserving stock, booking shipments, requesting invoices and credit notes, handling support requests, reconciling payments, and producing reports.
• Duration: for as long as the Controller has an organisation on the Service.
• Data subjects: the Controller's customers and recipients of its deliveries; people who write to the Controller through the support form.
• Categories of data: name, e-mail address, phone number, billing and delivery address, company name and tax number where the buyer is a business, order contents and value, payment method and status (never card numbers), invoice and credit-note data, shipment and tracking data, return reasons, support messages, and payer names appearing on bank statement lines the Controller imports.
• Special categories: none are required by the Service, and the Controller agrees not to enter any.

3. The Processor's obligations

• Instructions. The Processor processes the data only on the Controller's documented instructions. Configuring the Service - connecting a provider, switching on a synchronisation, pressing a button - is an instruction. The Processor tells the Controller if it believes an instruction breaks data-protection law.
• Confidentiality. People authorised to access the data are bound by confidentiality, and access is limited to what operating and supporting the Service requires.
• No other use. The Processor does not sell the data, does not use it for its own marketing and does not use it to train AI models.
• Assistance. The Processor helps the Controller answer data-subject requests (the Service lets the Controller find, correct and erase an individual customer's details), and assists with impact assessments and consultations with authorities where the Controller needs it.
• Requests received directly. If a data subject writes to the Processor about data held for the Controller, the Processor forwards the request to the Controller and does not answer it on its own.

4. Security measures

The Processor maintains, as a minimum:

• strict tenant isolation - every record belongs to one organisation and every query is scoped to it, verified by automated tests;
• encryption at rest of integration credentials, webhook secrets and two-factor secrets; hashed passwords; HTTPS for all traffic;
• role-based access control inside each organisation, two-factor authentication, optional IP allow-lists, session and API-token revocation;
• an audit log of critical changes, available to the Controller's own administrators;
• signature verification of incoming webhooks; rate limiting of public endpoints;
• removal of location and device metadata from uploaded product photos;
• reminders to rotate old integration credentials; dependency and secret scanning in the build pipeline;
• regular backups with tested restore procedures.

5. Sub-processors

The Controller gives a general authorisation for the Processor to use sub-processors, under a contract that imposes the same data-protection obligations as this DPA. The Processor remains responsible for them. Current sub-processors that may handle the Controller's customer data:

• Hosting and database provider - storing and serving the application and its backups.
• E-mail delivery provider - sending support-ticket replies and notifications.

The following providers are used by the Service but do not receive the Controller's customer data: the payment providers Stripe and iyzico (the Controller's own subscription only), the language-model provider behind the AI listing features (product text only) and remove.bg (product photos only).

The Processor announces a new sub-processor for customer data on this page and to account owners at least fourteen days in advance. The Controller may object on reasonable data-protection grounds; if no solution is found, the Controller may terminate the Service.

Not sub-processors: the marketplaces, webshops, couriers, invoicing services and banks the Controller connects. The Controller chose them and has its own contract with each; the Service sends them data on the Controller's instruction.

6. International transfers

Customer data is stored in the European Union. If a sub-processor processes it outside the EEA, the Processor ensures an adequacy decision or the European Commission's Standard Contractual Clauses apply; for data subject to KVKK, the conditions of KVKK Art. 9.

7. Personal data breaches

The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, with the information the Controller needs for its own notifications (GDPR Art. 33-34; KVKK Art. 12): what happened, which data and roughly how many people are affected, the likely consequences and the measures taken.

8. Deletion and return

During the contract the Controller can export its data and erase individual customers' details from within the Service. When the organisation is closed, the Processor deletes or irreversibly anonymises the Controller's personal data, including from backups as they expire, unless the law requires it to be kept.

9. Audits

The Processor makes available the information needed to demonstrate compliance with this DPA and answers reasonable written questionnaires. Where that is not enough, the Controller may carry out an audit once a year, with thirty days' notice, during business hours, under confidentiality and without access to other customers' data.

10. Liability and term

Liability under this DPA follows the limits in the Terms of Service, without restricting the rights of data subjects or the powers of supervisory authorities. The DPA ends when the Processor has deleted the Controller's personal data.

11. Contact

Data-protection contact of the Processor: info@piemsoft.com.