Draft – subject to legal review

Sendonis Data Processing Agreement

Effective date: [EFFECTIVE DATE]

This Data Processing Agreement ("DPA") forms part of the Sendonis Terms of Service (the "Agreement") between Sinapp Sağlık Eğitim Yazılım Danışmanlık Ltd. Şti., Nurol Plaza, Maslak/İstanbul, Türkiye ("Sendonis" or "Processor") and the customer identified in the Agreement ("Customer"). It applies whenever Sendonis processes Customer Personal Data on behalf of Customer in providing the Service.

1. Definitions

• "Data Protection Laws" – all laws applicable to the processing of Customer Personal Data under the Agreement, including Regulation (EU) 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss FADP, Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and its secondary legislation, the California Consumer Privacy Act as amended by the CPRA ("CCPA"), and other applicable national laws.
• "Customer Personal Data" – personal data contained in Customer Data that Sendonis processes on behalf of Customer, primarily Recipient Data.
• "Controller", "Processor", "Data Subject", "Personal Data Breach", "Processing", "Supervisory Authority" – as defined in the GDPR; for KVKK, "Controller" corresponds to veri sorumlusu and "Processor" to veri işleyen. Under the CCPA, "Service Provider" and "Business" have their statutory meanings.
• "Subprocessor" – any third party engaged by Sendonis to process Customer Personal Data.
• "SCCs" – the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.
• "UK Addendum" – the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0 or successor).
• "KVKK Standard Contracts" – the standard contracts for cross-border transfers published by the Turkish Personal Data Protection Board under Article 9 KVKK.

Capitalised terms not defined here have the meaning in the Agreement.

2. Roles and scope

2.1 Customer is the Controller (or a Processor acting on behalf of its own controller) of Customer Personal Data, and Sendonis is the Processor (or sub-processor). Under the CCPA, Sendonis is Customer's Service Provider.

2.2 Sendonis is an independent controller for its own customer account, billing, support, security, and abuse-prevention data, as described in its Privacy Policy. This DPA does not apply to that data.

2.3 Details of the processing are set out in Annex I.

3. Customer obligations

3.1 Customer is responsible for the lawfulness of the processing and of its instructions, including having a lawful basis and all required consents for sending Messages (including İYS registration and consent checks under Turkish Law No. 6563, ePrivacy/PECR consent, CAN-SPAM, CASL, TCPA/10DLC and other local rules), providing notices to Data Subjects (including about international transfers and Subprocessors), and the accuracy and quality of Customer Personal Data.

3.2 Customer will not submit special categories of personal data, criminal-offence data, or data of children unless expressly agreed in writing.

3.3 Where Customer is itself a Processor, Customer warrants that its instructions, including the appointment of Sendonis as sub-processor, have been authorised by the relevant controller.

4. Processor obligations (Art. 28(3) GDPR; Art. 12 KVKK)

Sendonis will:

(a) Instructions. Process Customer Personal Data only on Customer's documented instructions, including with regard to international transfers, unless required to do so by applicable law (in which case Sendonis will inform Customer before processing, unless the law prohibits this). The Agreement, this DPA, Customer's configuration of the Service and API/Web App requests constitute Customer's documented instructions. Sendonis will inform Customer if, in its opinion, an instruction infringes Data Protection Laws.

(b) Confidentiality. Ensure that persons authorised to process Customer Personal Data are bound by confidentiality obligations.

(c) Security. Implement the technical and organisational measures in Annex II (Art. 32 GDPR; Art. 12 KVKK). Sendonis may update these measures provided the overall level of security is not reduced.

(d) Subprocessors. Comply with Section 5.

(e) Data subject requests. Taking into account the nature of the processing, assist Customer by appropriate technical and organisational measures (including suppression-list, export and deletion features) in responding to Data Subject requests. Sendonis will promptly forward to Customer any request it receives directly that relates to Customer Personal Data and will not respond except to direct the Data Subject to Customer, unless required by law. Sendonis may process unsubscribe and opt-out requests received through the Service's unsubscribe mechanisms directly by adding the Data Subject to Customer's suppression list, as instructed by Customer.

(f) Assistance. Provide reasonable assistance with Customer's obligations under Arts. 32–36 GDPR (security, breach notification, data protection impact assessments and prior consultation) and corresponding KVKK obligations, taking into account the information available to Sendonis.

(g) Deletion or return. Comply with Section 9.

(h) Information and audit. Comply with Section 8.

(i) CCPA. Not sell or share Customer Personal Data; not retain, use or disclose it for any purpose (including commercial purposes) other than the business purposes specified in the Agreement or as permitted by the CCPA; not retain, use or disclose it outside the direct business relationship with Customer; not combine it with personal information received from other sources except as permitted by the CCPA; and notify Customer if it can no longer meet its CCPA obligations.

(j) Permitted service-related processing. Customer authorises Sendonis to process limited Customer Personal Data (e.g. delivery, bounce and complaint events and hashed identifiers) to operate per-tenant suppression lists, enforce sending limits and the AUP, prevent fraud and abuse, maintain deliverability and security, and comply with law and the requirements of Third-Party Delivery Providers, and to create aggregated or de-identified statistics that do not identify Customer or any Data Subject.

5. Subprocessors

5.1 General authorisation. Customer grants general written authorisation for Sendonis to engage Subprocessors. The current Subprocessors are listed in Annex III and at [SUBPROCESSOR LIST URL].

5.2 Notice and objection. Sendonis will notify Customer of any intended addition or replacement of a Subprocessor at least [SUBPROCESSOR NOTICE DAYS] days in advance (by email, in the Web App, or via a subscription mechanism at [SUBPROCESSOR LIST URL]). Customer may object on reasonable data-protection grounds within that period. The parties will discuss the objection in good faith; if not resolved, Customer may terminate the affected Service without penalty and receive a pro-rata refund of prepaid fees for the unused period, as its sole remedy. In an emergency (e.g. sudden unavailability of a Subprocessor), Sendonis may replace a Subprocessor with shorter notice.

5.3 Flow-down. Sendonis will impose on each Subprocessor data protection obligations that provide at least the same level of protection as this DPA, to the extent applicable to the nature of the services provided, and remains liable to Customer for the performance of its Subprocessors' obligations in accordance with Art. 28(4) GDPR. Customer acknowledges that certain Subprocessors (e.g. Amazon Web Services) contract on standard, non-negotiable terms, and that those terms (including their data processing addenda) apply to their processing.

6. International transfers

6.1 Customer acknowledges that Sendonis is established in Türkiye, which is not subject to an adequacy decision of the European Commission or the UK, and that Customer Personal Data will be transferred to and processed in Türkiye, Germany/EU (Amazon SES and Amazon SNS, AWS region eu-central-1, Frankfurt), [HOSTING PROVIDER / LOCATION], [SMS PROVIDER LOCATION] and the other locations listed in Annex III. Amazon Web Services is headquartered in the United States, so access to or processing of data from the United States (e.g. for support, security or in response to legal requests) cannot be excluded, and is addressed by AWS's data processing terms.

6.2 EU/EEA transfers. To the extent Customer Personal Data subject to the GDPR is transferred to Sendonis (or onward), the SCCs are incorporated by reference and apply as follows:

• Module Two (Controller to Processor) applies where Customer is a Controller;
• Module Three (Processor to Processor) applies where Customer is a Processor;
• Clause 7 (docking clause) applies;
• Clause 9(a): Option 2 (general written authorisation), with the notice period in Section 5.2;
• Clause 11: the optional language does not apply;
• Clause 13: the competent supervisory authority is determined in accordance with Clause 13(a); where Customer is not established in the EU, it is the supervisory authority of the Member State in which Customer's (or Sendonis's) EU representative is established [CONFIRM];
• Clause 17: the SCCs are governed by the law of [SCC GOVERNING LAW / FORUM (EU MEMBER STATE)];
• Clause 18(b): disputes are resolved by the courts of [SCC GOVERNING LAW / FORUM (EU MEMBER STATE)];
• Annexes I.A–I.C, II and III of the SCCs are completed by Annexes I, II and III of this DPA.

Processing by Amazon Web Services in the eu-central-1 region takes place within the EEA. Any onward transfers by Sendonis or its Subprocessors outside the EEA (e.g. to [SMS PROVIDER], [HOSTING PROVIDER / LOCATION] where outside the EEA, or any access by Amazon Web Services from the United States) are made under Module Three SCCs or another valid mechanism (including the EU–U.S. Data Privacy Framework where the Subprocessor is certified), as reflected in the Subprocessor's data processing terms.

6.3 UK transfers. For Customer Personal Data subject to the UK GDPR, the SCCs as amended by the UK Addendum apply. Table 1 is completed with the details in Annex I; Table 2 with the modules and options in Section 6.2; Table 3 with Annexes I–III; and for Table 4, either party may end the Addendum as set out in its Section 19.

6.4 Swiss transfers. For Customer Personal Data subject to the Swiss FADP, the SCCs apply with the adaptations required by the Swiss FDPIC (references to the GDPR read as references to the FADP; the competent authority is the FDPIC). [CONFIRM IF NEEDED]

6.5 Transfers from Türkiye (KVKK Art. 9). Where Customer Personal Data subject to KVKK is transferred abroad (including to Amazon Web Services in the eu-central-1 region in Germany, which remains a transfer abroad under KVKK, and to any Subprocessor outside Türkiye), the parties will rely on a mechanism permitted by Article 9 KVKK, primarily the KVKK Standard Contracts (in the applicable module, e.g. controller-to-processor or processor-to-processor), executed in their prescribed form without modification. The party required by KVKK secondary legislation will notify the Personal Data Protection Authority within five (5) business days of signature. Customer, as controller, remains responsible for informing Data Subjects of such transfers.

Drafting note (lawyer): The KVKK Standard Contracts must be signed in their published form and cannot be incorporated by reference like the EU SCCs. Decide (i) which party signs with AWS/other subprocessors and notifies the Authority, (ii) whether Turkish customers sign a separate KVKK standard contract with Sendonis for its onward transfer, and (iii) whether AWS offers a KVKK standard contract.

6.6 Transfer impact. Sendonis will provide reasonable information to assist Customer with any transfer impact assessment, and implements the supplementary measures described in Annex II.

6.7 Conflict. In the event of conflict between this DPA and the SCCs, the UK Addendum or the KVKK Standard Contracts, the latter prevail.

7. Personal Data Breach

7.1 Sendonis will notify Customer without undue delay, and in any event within [BREACH NOTICE HOURS] hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

7.2 The notice will include, to the extent known: the nature of the breach, categories and approximate number of Data Subjects and records concerned, likely consequences, measures taken or proposed, and a contact point ([PRIVACY EMAIL]). Information may be provided in phases.

7.3 Sendonis will take reasonable steps to contain and remediate the breach and will cooperate with Customer. Customer is responsible for notifications to supervisory authorities (including the Turkish Personal Data Protection Board, which expects notification within 72 hours) and Data Subjects, unless otherwise agreed or required by law.

7.4 Notification is not an acknowledgement of fault or liability. Unsuccessful attempts (e.g. pings, port scans, failed log-in attempts) are not Personal Data Breaches.

8. Audits

8.1 Sendonis will make available to Customer information reasonably necessary to demonstrate compliance with Art. 28 GDPR and this DPA, including [CERTIFICATIONS – if any], summaries of security policies, and responses to reasonable security questionnaires (no more than once per year, unless following a Personal Data Breach or a request from a supervisory authority).

8.2 If such information is insufficient, Customer may conduct (or mandate an independent auditor bound by confidentiality, who is not a competitor of Sendonis) an audit, including inspections, on at least [AUDIT NOTICE DAYS] days' written notice, during business hours, no more than once per twelve months (except following a Personal Data Breach or as required by a supervisory authority), in a manner that does not unreasonably disrupt operations or compromise other customers' data. Customer bears its own costs and Sendonis's reasonable costs, unless the audit reveals a material breach by Sendonis.

8.3 Audits of Subprocessors such as Amazon Web Services are satisfied by the Subprocessor's third-party audit reports and certifications (e.g. SOC 2, ISO 27001), which Sendonis will make available to the extent permitted.

9. Deletion and return

9.1 During the term, Customer may export and delete Customer Personal Data through the Service.

9.2 On termination of the Agreement, Sendonis will, at Customer's choice, return (by enabling export for [DATA EXPORT PERIOD DAYS] days) and then delete all Customer Personal Data within [DELETION PERIOD DAYS] days, and delete existing copies, unless applicable law requires storage. Data in backups will be deleted on the regular backup rotation (up to [RETENTION PERIOD – BACKUPS]) and will remain protected and not actively processed in the meantime.

9.3 Customer instructs Sendonis that, notwithstanding 9.2, Sendonis may retain minimal suppression records (e.g. hashed email addresses or phone numbers of Data Subjects who unsubscribed, hard-bounced or complained) for [RETENTION PERIOD – SUPPRESSION LISTS] to prevent unlawful sending to those Data Subjects and to protect the Service, provided such records are used for no other purpose.

Drafting note (lawyer): Confirm that retaining suppression records post-termination is acceptable as a processor-side instruction, or whether Sendonis is a controller for that limited purpose.

10. Liability

Each party's liability arising out of or in connection with this DPA (including the SCCs, to the extent permitted by them) is subject to the limitations and exclusions of liability in the Agreement. Nothing in this DPA limits either party's liability to Data Subjects under Art. 82 GDPR/UK GDPR, the rights of Data Subjects under the SCCs, or any liability that cannot be limited by law.

11. Term, precedence and miscellaneous

11.1 This DPA remains in effect as long as Sendonis processes Customer Personal Data.

11.2 In case of conflict, the following order applies: (1) SCCs / UK Addendum / KVKK Standard Contracts; (2) this DPA; (3) the Agreement.

11.3 Sendonis may update this DPA to reflect changes in law, guidance or Subprocessors, provided the update does not materially reduce the protection of Customer Personal Data. Notice will be given in accordance with the Agreement.

11.4 This DPA is governed by the law governing the Agreement ([GOVERNING LAW / VENUE]), except where Data Protection Laws or the SCCs require otherwise.

Annex I – Details of processing

A. List of parties

B. Description of processing

C. Competent supervisory authority

As determined under Section 6.2 (Clause 13 SCCs). For KVKK: Kişisel Verileri Koruma Kurumu (Turkish Personal Data Protection Authority). For the UK: the Information Commissioner's Office.

Annex II – Technical and organisational security measures

Drafting note: Replace each placeholder with the measures actually implemented. Do not publish measures that are not in place.

Annex III – Subprocessors

Note: [PAYMENT PROVIDER] and [ANALYTICS PROVIDER] process Sendonis's own customer/visitor data (Sendonis as controller) and are therefore not Subprocessors under this DPA unless they also process Customer Personal Data.