Data Processing Agreement
Terms for processing customer personal data through Yanıtly services.
v1 — pending legal review · 21 October 2026
Service provider: MobiCraft Dijital Teknolojiler Ltd. Şti. · Tax no. 6211267004 (İkitelli Tax Office) · MERSİS 0621126700400001 · İstanbul Trade Registry Directorate · Trade registry no. 1124985 · Ziya Gökalp Mah. Muhsin Ertuğrul Cad. No:3 34480 Başakşehir/İstanbul, Türkiye.
support at mobicraft.tr · +90 850 302 85 84
1. Parties and roles
This text is the data processing addendum to the service agreement between the customer using Yanıtly and MobiCraft. The customer is the controller of personal data concerning its customers, guests, staff and other data subjects; MobiCraft acts as processor on documented customer instructions. Where the customer processes for another controller, MobiCraft acts as subprocessor under the same instruction chain. Processing by MobiCraft as controller for its own account administration, billing and legal obligations is described separately in the privacy notice.
2. Subject matter, duration and nature
Processing supports customer relations, reservations, support, communications and business functions enabled by the customer. Operations include collection, recording, organisation, storage, access, transmission and deletion. Processing lasts for the service agreement and the return/deletion process below. The customer determines the modules and channels, purposes, data subject groups and retention instructions.
3. Data categories and data subjects
Data subjects include customer users and staff, prospects, customers, hotel guests including children (through the controller), parents/guardians, reservation holders and people contacting the customer. Patients and care recipients are included only for health-sector customers. Data may include names and contact details, channel identifiers, reservation and transaction records, messages and attachments, product images, consent/preferences, access and activity logs and, when enabled, audio and transcripts. Special category data is processed only where the controller has met the legal requirements, enabled the relevant module and provided explicit, documented instructions; unnecessary data must not be submitted. Payment card details are processed on the payment provider’s own checkout; any virtual card data supplied by controller-enabled OTA or channel-manager integrations is subject to separately agreed processing scope and security conditions.
4. Documented instructions
MobiCraft processes data only to provide the service and follow customer settings and documented instructions, not for its own independent advertising purposes. If processing or disclosure is legally required, it informs the customer beforehand unless prohibited by law. If it considers an instruction unlawful under data protection law, it informs the customer without delay and suspends the affected processing pending clarification. The customer is responsible for a lawful basis, notices and consent where required. Transfers through OTA, channel-manager and e-commerce integrations enabled by the customer are under the controller’s documented instructions. Providers selected and contracted directly by the customer do not become MobiCraft subprocessors merely through that connection.
5. Confidentiality
Authorised people with access to data are bound by confidentiality duties. Access is limited to roles and permissions required for their work. Confidentiality continues after the service ends. Personal data unnecessary for support should not be shared.
6. Technical and organisational measures
Measures follow the approach described on the Security page: HTTPS/TLS in transit, tenant scoping and role-based access, secure sessions, support for multi-factor administrative access, network/edge protection, rate limiting and audit records. Backups, access controls and incident investigation support continuity. Measures are reviewed as risks and technology change; this text is not a certification or a guarantee of uninterrupted service.
7. Subprocessors
The customer gives general written authorisation to use the providers in the Subprocessor list for the services it selects. MobiCraft contractually passes on applicable data protection and confidentiality duties and remains responsible for its obligations. Where possible, new or replacement subprocessors are notified to the customer’s registered contact at least 30 days in advance. During that period the customer may object on reasoned data protection grounds; the parties will work on an alternative or termination of the affected service.
8. International transfers
Primary application and database hosting uses Hetzner infrastructure in Germany. AI text, audio and image calls use OpenAI’s general API endpoints; processing may take place in the United States and EU-specific data residency is not used. Other provider locations are listed separately. The controller determines the legal basis and instructions for transfers under KVKK Article 9; MobiCraft, as processor, provides the list of providers, processing countries and applicable transfer mechanisms, and assists with the necessary agreements. Before transfer, each party fulfils the agreement and notification duties applicable to its role; when a standard contract is used, the transfer agreement identifies the party responsible for notifying the Authority within five business days of signature. GDPR Chapter V safeguards also apply where required. This DPA alone is not a KVKK standard transfer contract, an adequacy decision or executed EU Standard Contractual Clauses.
9. Assistance with data subject rights
MobiCraft promptly forwards data subject requests it receives directly to the customer and does not answer on the customer’s behalf unless legally required or instructed. Within available information and technical capabilities, it assists with access, correction, export, deletion and restriction requests. It provides reasonable assistance with impact assessments, consultation with authorities and security obligations when needed.
10. Personal data breach notification
MobiCraft notifies the customer without undue delay and at the latest within 72 hours after becoming aware of a personal data breach affecting the customer’s data; shorter notification windows can be agreed in the partner contract. The initial notice includes available information; the nature of the breach, affected data and data subject groups, likely consequences, measures taken and contact point may be supplemented in stages. This period does not postpone an earlier or different notification duty of the customer to an authority. The customer makes its own notification decisions; MobiCraft assists investigation and remediation.
11. Information and audits
MobiCraft provides information necessary to demonstrate compliance and assists audits by the customer or its independent auditor on reasonable prior notice. Audits are planned to protect other customers’ data, confidential information and security. Urgent review may be arranged following a breach, an authority request or justified suspicion; these arrangements do not remove statutory audit rights.
12. Return and deletion
At service end, the tenant account and data are marked for deletion. Service-end data cleanup is performed manually by MobiCraft on the customer’s written request. The customer may request return or deletion through the panel or support contact above; contact deletion requests enter a review queue. Within 30 days of receiving a valid request, data categories covered by the existing return and deletion scope are returned or deleted according to the customer’s choice. This scope is limited to supported operations for contact identity and communication data, linked conversation and message content, and call recordings and transcripts. Automatic deletion of all associated data, including attachments and storage objects, is not promised; manual processing of records outside this scope is agreed separately with the customer. Backups remain access-restricted and expire through the backup rotation within 120 days. After a backup restore, previous deletions are reapplied on the customer’s request. Records that must be retained by law are restricted to that purpose for the required period; the customer is informed of the exception’s scope.
13. Liability
Each party is responsible for its own legal and contractual duties. The service agreement’s liability provisions apply without limiting mandatory law, data subjects’ compensation rights or authorities’ powers. Using subprocessors does not remove MobiCraft’s obligations under this addendum.
14. Effect and contact
This v1 text is a draft pending legal review; publication alone does not constitute signature or acceptance. It takes effect when the customer and MobiCraft accept it as part of the service agreement. For data processing matters this addendum takes precedence in case of conflict, subject to mandatory law and applicable transfer agreements. Use the contact details above for an executed version, instructions or questions.