This text is a draft and is being reviewed by our lawyers. It may change before it takes effect.
This agreement forms part of the Terms of Service between EPIC ALGORITHMS YAZILIM DANIŞMANLIK VE DIŞ TİCARET LİMİTED ŞİRKETİ ("processor") and the customer that owns a portal ("controller"). It meets Article 28 of the GDPR and the corresponding duties under Turkish Law No. 6698. Customers who need a signed copy can ask at [email protected].
Scope and roles
The processor processes the personal data the controller and its users put into the controller's portal, only to provide Epic Portal. The controller decides why and how that data is processed and is responsible for having a lawful basis for it.
What is processed
- Data subjects: the controller's staff, its clients and their contacts, and other people whose data the controller enters.
- Categories: identity and contact data, work data (projects, tasks, tickets, meeting notes), financial data (quotes, invoices, payments), HR data (leave), sign-in and security logs, and files.
- Special categories: none are required; the controller should not enter them unless it has a basis to.
- Duration: for as long as the portal exists, and the deletion period below.
Instructions
The processor processes the data only on the controller's documented instructions, which are these terms and the controller's use of the portal, unless the law requires otherwise, in which case it tells the controller first where the law allows. It tells the controller if it believes an instruction breaks data protection law.
Confidentiality
Everyone at the processor who can reach the data is bound to confidentiality and reaches it only when needed to run or support the service.
Security measures
- A separate install and database for every portal, on servers in the country the controller chose.
- Encryption in transit (TLS) and of secrets at rest; sign-in tokens for Google and Microsoft kept in the controller's own install.
- Two-factor authentication for staff and customers, role-based access, and a log of administrative actions.
- Daily database backups in the same country, tested restores, and monitoring of every install each minute.
- Prompt security updates through a staged rollout, first to our own install.
Subprocessors
The controller authorises the subprocessors on the subprocessors page. The processor binds each to obligations at least as protective as these, remains responsible for them, and tells the controller of a new one at least 30 days ahead; the controller may object on reasonable grounds and, if the parties cannot resolve the objection, end the affected service.
Assistance
The processor helps the controller, as far as it reasonably can, to answer data subjects' requests, to keep data secure, to assess the impact of processing and to consult authorities.
Personal data breaches
The processor tells the controller without undue delay, and within 48 hours of becoming aware, of a breach affecting the controller's data, with what it knows and what it is doing about it, so the controller can meet its own duties to notify.
Deletion and return
When the service ends the controller can export its data for 30 days. The processor then deletes it, and backups within a further 30 days, unless the law requires it to keep some of it.
Information and audits
The processor makes available the information needed to show it meets these duties, and allows audits by the controller or an auditor it appoints, on reasonable notice, at most once a year unless a breach or an authority calls for more, and at the controller's cost.
International transfers
Where a subprocessor processes data outside the European Economic Area or Turkey, the transfer rests on an adequacy decision or on the standard contractual clauses, and on the safeguards Article 9 of Law No. 6698 requires.
General
Liability under this agreement follows the Terms of Service. If this agreement and the Terms conflict on data protection, this agreement wins.