Data Processing Agreement (DPA)

This agreement supplements the Terms of Service for Users acting in a commercial capacity.

Roles

The User acts as data controller and Adropic as data processor. Adropic remains controller for data relating to your own user account.

Subject matter

• Subject: ad creative production, campaign management and optimisation
• Duration: for the term of the service and 90 days thereafter
• Data types: customer avatars, campaign performance data, brand assets, user account information
• Data subjects: the User's staff and end users targeted by advertising

Adropic's obligations

1. Process personal data only on the User's documented instructions
2. Ensure authorised personnel are bound by confidentiality
3. Implement appropriate technical and organisational measures (encryption, access control, logging)
4. Provide a current list of the subprocessors used on request, and announce changes 30 days in advance
5. Provide reasonable assistance with data subject requests
6. Notify the User without undue delay after becoming aware of a breach
7. Delete or return data on termination of the service

Subprocessors

The User gives general authorisation for Adropic to engage subprocessors in providing the service. A current list of the subprocessors used is available on request. You may object to a new subprocessor on reasonable grounds; if you do, you may stop using the affected feature or terminate the agreement.

International transfers

Adropic Inc. is established in the United States, and some subprocessors are located outside Türkiye and the European Union. Transfers from Türkiye rely on KVKK art. 9 and transfers from the European Union on the standard contractual clauses under GDPR art. 46, where applicable.

Audit

Once per year and with reasonable notice, the User may request information on the measures in place and any independent audit reports.

Lawfulness of instructions

The User warrants that the processing instructions it gives Adropic comply with applicable data protection law and that it holds the necessary legal basis (including consent) for the personal data processed. Where Adropic concludes an instruction is unlawful, it may suspend the relevant processing.

Limits of the assistance obligation

Adropic's obligation to assist with data subject requests, data protection impact assessments and authority investigations is limited to what is reasonable. Adropic may charge a reasonable fee for requests of unusual scope.

Scope of audit

The audit right does not include direct access to production systems and may not cover information relating to Adropic's other customers. Audits are conducted under confidentiality and in a manner that does not disrupt Adropic's operations.

Liability

Liability under this agreement is subject to the limitations in section 16 of the Terms of Service.