Skip to content

Data Processing Addendum

Effective Date: October 24, 2026  ·  Version: 1.7

(KVKK / GDPR: Controller or Processor ↔ Processor)

This DPA governs the processing of Customer Data by Processor on behalf of Customer. It is incorporated into and forms part of the Agreement between Customer (you) and SEZ YAZILIM DANIŞMANLIK TİCARET LİMİTED ŞİRKETİ ("sevk", "Processor"). If there is any conflict between this DPA and the Agreement regarding the processing of Customer Data, this DPA prevails. Read this together with our Privacy Policy, Security, and Subprocessors pages.

1. Definitions

1.1 Applicable Data Protection Laws

Means, as applicable: (i) the Turkish Law on the Protection of Personal Data No. 6698 ("KVKK") and secondary legislation and Board decisions; and (ii) the EU General Data Protection Regulation (EU) 2016/679 ("GDPR"), together with any other data protection laws applicable to the Parties.

1.2 Customer Data

Means any personal data (including email addresses and related metadata) that Customer uploads, transfers, stores, or otherwise makes available to the Services, or that is processed on Customer's behalf through use of the Services, including end-recipient/contact list data and broadcast-related data.

1.3 End-Recipients

Means individuals whose personal data is included in Customer Data (e.g., Customer's contacts/subscribers).

1.4 Services

Means the email sending, inbound email receiving and processing, deliverability, reporting, analytics, and related services provided by Processor under the Agreement.

1.5 Sub-processor

Means any third party engaged by Processor to process Customer Data in connection with the Services.

1.6 Personal Data Breach

Has the meaning given under GDPR (where applicable) and includes any breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data. Terms "controller", "processor", "personal data", and "processing" shall have the meanings given in GDPR and/or KVKK, as applicable.

2. Roles and Scope

2.1 Roles

For Customer Data processed on Customer's behalf, sevk acts as Data Processor. Customer may act as controller or as a processor authorized by the relevant controller; in the latter case, sevk acts as Customer's sub-processor. Customer shall obtain the authorizations required to engage sevk and pass on the controller's lawful instructions. Separate processing for account administration, billing, and any independently determined security or legal purpose is described in the Privacy Policy and requires its own lawful basis.

Customer may be a natural person or a legal entity. An individual accepting on behalf of another person or organization must have authority to bind that Customer. A project name does not by itself identify the contracting party or the controller of Customer Data.

2.2 Scope and Purpose Limitation

Processor shall process Customer Data only: (a) to provide the Services and perform its obligations under the Agreement and this DPA; and (b) in accordance with Customer's documented instructions, including as set out in the Agreement, this DPA, and Customer's lawful configuration and use of the Services.

2.3 No Sale / No Independent Use

Processor will not sell, rent, or otherwise use Customer Data for its own marketing or independent commercial purposes.

3. Customer Obligations

3.1 Lawfulness and Instructions

Customer represents and warrants that:

  • (a) it has a valid legal basis under Applicable Data Protection Laws for collecting and processing Customer Data and for instructing Processor to process Customer Data;
  • (b) it will provide all required notices to End-Recipients and obtain any required consents/permissions; and
  • (c) its instructions and use of the Services comply with Applicable Data Protection Laws and applicable electronic communications / anti-spam rules (including unsubscribe/opt-out requirements where applicable).

3.2 Data Quality and Minimization

Customer is responsible for the accuracy, quality, and lawfulness of Customer Data and for ensuring it does not upload data beyond what is necessary for its purposes.

3.3 Sensitive Data Prohibition

Customer shall not upload or otherwise process through the Services any special categories of personal data / sensitive data (e.g., health data, political opinions, biometric data), unless the Parties expressly agree in writing and Customer has established a lawful basis and implemented required safeguards.

3.4 Indemnity (Sensitive Data / Unlawful Use)

To the extent permitted by applicable law and subject to any liability limitations in the Agreement, Customer shall indemnify and hold harmless Processor from and against reasonable losses, damages, and regulatory fines/penalties arising from Customer's unlawful instructions or Customer's breach of Sections 3.1–3.3 (including uploading sensitive data contrary to this DPA), except to the extent caused by Processor's breach of this DPA.

4. Processor Obligations

4.1 Processing on Documented Instructions

Processor shall process Customer Data only on documented instructions from Customer, including regarding transfers of Customer Data to a third country or international organization, unless required to do so by applicable law.

4.2 Unlawful Instructions / Legal Conflict

If Processor reasonably believes that an instruction infringes Applicable Data Protection Laws, Processor shall promptly inform Customer and may suspend the relevant processing until the Parties agree on a lawful instruction.

4.3 Confidentiality

Processor shall ensure that persons authorized to process Customer Data are under appropriate confidentiality obligations (contractual or statutory).

4.4 Security

Processor shall implement and maintain appropriate technical and organizational measures ("TOMs") to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. The TOMs are described in our Security page and summarised in Annex 2.

4.5 Accountability Documentation

Processor shall maintain internal documentation of processing activities as required by applicable law and shall make available relevant compliance information as set out in Section 10.

5. Sub-Processors

5.1 General Authorization

Customer grants Processor a general written authorization to engage Sub-processors for the purposes of providing the Services.

5.2 Flow-Down Obligations

Processor shall enter into a written agreement with each Sub-processor imposing data protection obligations no less protective than those in this DPA, including appropriate security measures.

5.3 Sub-processor List

Processor maintains an up-to-date sub-processor list at /subprocessors("Sub-processor List").

5.4 Notice of Changes & Objection

  • (a) Processor will provide at least 30 days' prior notice of any intended addition or replacement of a Sub-processor by updating the Sub-processor List and notifying Customer via email to the account owner email on file.
  • (b) Customer may object within 30 days on reasonable and objective data protection grounds.
  • (c) If the Parties cannot resolve the objection, Processor may (i) offer an alternative; or (ii) allow Customer to terminate the affected Service(s) in accordance with the Agreement (or, if not addressed, the Parties will agree a commercially reasonable exit).

5.5 Liability for Sub-processors

Processor remains responsible for the performance of its Sub-processors to the extent required under Applicable Data Protection Laws and the Agreement.

6. Data Subject Requests

6.1 Controller Responsibility

Customer is responsible for responding to requests from End-Recipients.

6.2 Redirection

If an End-Recipient contacts Processor directly regarding Customer Data, Processor shall, where appropriate, promptly redirect the request to Customer and, upon Customer's request, provide reasonable assistance as set out below.

6.3 Assistance

Taking into account the nature of processing and Processor's technical capabilities, Processor shall provide reasonable assistance to enable Customer to fulfil data subject requests within statutory timeframes, including (where available) data export, suppression/blacklisting, and deletion functionality.

7. Personal Data Breach Notification

7.1 Notification to Customer

Processor shall notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Data and shall provide information reasonably required for Customer's risk assessment and any mandatory notifications.

7.2 Target Notification Time

Without limiting the "without undue delay" standard, Processor's target is to notify Customer within 48 hours of awareness, where feasible.

7.3 Controller Notifications

Customer is responsible for any legally required notifications to authorities and/or data subjects. Processor will provide reasonable cooperation and supporting information as needed.

8. International Data Transfers

8.1 General

Processor is established in Türkiye. Customer Data may be processed in the locations listed in Annex 3, subject to the safeguards below.

8.2 Appropriate Safeguards

Before a restricted international transfer, the Parties shall establish a lawful transfer mechanism appropriate to their roles and the processing involved, including, as applicable:

  • (a) an adequacy decision or safeguards under GDPR Article 46. For eligible transfers from Customer to Processor, the EU Standard Contractual Clauses are incorporated as specified in Annex 4, subject to their scope, completion of the required annexes and assessment, and binding execution by both Parties.
  • (b) a mechanism permitted by KVKK Article 9 for transfers from Türkiye, including completed and executed Turkish standard contracts where applicable. EU safeguards do not replace KVKK requirements.

8.3 KVKK Standard Contract Notification (5 Business Days)

Where Processor executes a KVKK standard contract for a relevant transfer (including via Sub-processors), Processor shall ensure notification to the Turkish authority within five (5) business days following completion of signatures, using the legally prescribed method/module.

8.4 Customer's Additional Steps

The Parties shall provide the information needed to complete any required transfer instrument and assessment. This DPA and provider agreements do not replace separately required transfer safeguards. If those safeguards cannot be established or maintained, the affected transfer shall not begin or shall be suspended.

The incorporation in Annex 4 does not establish a safeguard for processing outside the scope of Commission Implementing Decision (EU) 2021/914, including where Processor's relevant processing is directly subject to GDPR Article 3. In that case, the Parties must establish another applicable Chapter V mechanism before the affected restricted transfer. Provider agreements between sevk and AWS do not by themselves establish the safeguard for a separate transfer from Customer to sevk.

9. Deletion or Return of Customer Data

9.1 Termination Request

Upon termination or expiration of the Agreement, Processor shall, at Customer's written choice, return or delete Customer Data.

9.2 Backups

Processor shall delete Customer Data from restricted backup copies within 30 days after deletion from live stores, unless storage is required by applicable law. Until deletion, backup copies shall be restricted to recovery and any required legal preservation. Erasure instructions shall be reapplied before restored data is returned to normal use.

9.3 Legal Retention Exception

After completing the instructed deletion or return, Processor shall delete remaining copies unless storage is required by applicable law; where GDPR Article 28(3)(g) applies, the exception is limited to storage required by Union or Member State law. Any separate retention by sevk as a controller requires an identified lawful basis, necessary data scope, restricted access, and a defined retention or review date. A general possibility of future abuse does not justify retaining all Customer Data indefinitely.

9.4 Operational Retention

Outgoing message bodies and per-send attachment copies are deleted within 30 days after handoff to the delivery provider, final failure, or cancellation. Delivery summaries are deleted within 90 days of that outcome. Opens and clicks do not extend either period. Completed queue payloads are removed within 24 hours; terminal failed queue payloads within 7 days. Pending, scheduled and retrying deliveries remain available while processing is necessary. Unresolved billing retains only the technical and financial evidence needed for reconciliation, without message bodies, subject lines or sender/recipient addresses after the summary period. These are service retention periods, not statutory minimum retention requirements.

Reusable templates, broadcast source content, uploaded files and inbound messages remain subject to Customer instructions and project deletion. Tracked destination URLs and routing identifiers remain until project deletion to preserve delivered links. Activity records follow the separate periods in the Privacy Policy. Any exceptional legal preservation must satisfy Section 9.3.

Project deletion removes the live project and opens a review of remaining storage and history copies, due within 30 days. It does not immediately erase every retained copy. Authorized staff verify any necessary legal preservation before erasure; a hold must record its reason, case reference and next review date under Section 9.3. Copies without a continuing lawful basis are erased through that review. Opening a review does not extend the retention periods above or applicable deadlines for data subject requests.

10. Audit, Information, and Compliance Evidence

10.1 Information

Processor shall make available to Customer information reasonably necessary to demonstrate compliance with this DPA.

10.2 Audit Rights (Reasonable Limitations)

Customer may audit Processor's compliance with this DPA: (a) upon reasonable prior written notice (e.g., 30 days); (b) no more than once per year (unless a material breach or breach incident occurs); (c) during normal business hours; and (d) subject to confidentiality and security restrictions to protect other customers and Processor's systems.

10.3 Alternative Evidence

Processor may satisfy audit requirements by providing independent third-party security reports/certifications and security documentation, where available, unless Customer reasonably requires further verification.

11. Assistance with DPIA and Regulator Consultations

Processor shall provide reasonable assistance to Customer in fulfilling obligations relating to security of processing, DPIAs, and consultations with supervisory authorities, to the extent applicable and taking into account the nature of processing and information available to Processor.

12. Technical and Organizational Measures

Processor may update TOMs provided that such updates do not materially degrade the overall security of the Services.

13. Limitation of Liability

This DPA does not expand either Party's liability beyond the limitations set out in the Agreement, except where such limitation is prohibited by Applicable Data Protection Laws or conflicts with the applicable Standard Contractual Clauses. The Standard Contractual Clauses prevail over conflicting liability limits, audit restrictions, and governing-law or jurisdiction provisions in the Agreement.

14. Term

This DPA remains in effect for the duration of Processor's processing of Customer Data under the Agreement.

Annex 1: Processing Details

  • A. Subject-matter: Email delivery platform services (broadcast sending, inbound email receiving and processing, deliverability, reporting, suppression handling, customer support related to Customer Data), and AI-assisted drafting when requested by Customer.
  • B. Duration: Processing lasts as required for the Services, subject to the deletion periods in Section 9, Customer instructions and any specifically applicable legal retention.
  • C. Nature: Collection (from Customer and, for inbound email, from third-party senders), storage, transmission, retrieval, analysis of delivery events, suppression handling, deletion/return upon termination.
  • D. Purpose: Provide the Services under Customer's instructions.
  • E. Categories of data: email address, subscription state, audience and segment membership, bounce and complaint history, message content and metadata (subject, status, timestamps, message ID, user-agent), optional contact custom fields, and inbound sender addresses, headers, bodies and attachments. When Customer uses AI drafting, processing may also include prompts, conversation history, the current email draft, generated content, supplied image URLs and image content.
  • F. Data subjects: End-Recipients, senders of inbound email addressed to the Customer's domains, and Customer's authorized users/admins (to the extent included in Customer Data).
  • G. Special categories: Not intended; prohibited under Section 3.3 unless expressly agreed in writing with safeguards.

Annex 2: Technical & Organizational Measures

The complete TOMs description is on the Security page.

  • Access control: project roles, API key permissions with optional domain restrictions, and optional two-factor authentication for users.
  • Encryption: public web connections and primary data storage are encrypted.
  • Tenant isolation: customer data is separated by project, with permissions controlling access.
  • Logging and monitoring: service activity, errors and email delivery are monitored to maintain reliability and investigate incidents.
  • Vulnerability management: software updates and security patches.
  • Backups and disaster recovery: a 30-day managed-service backup retention policy, with restoration subject to prior erasure instructions.
  • Sub-processor due diligence: Processor shall identify the applicable provider terms, processing roles and required transfer safeguards for each service.

Annex 3: Sub-Processor List

Processor maintains the provider list at /subprocessors, including service scope, processing locations and relevant provider terms. Information about safeguards applicable to a specific transfer is available through the privacy contact; this list does not replace the instruments required by Section 8.

Annex 4: EU Standard Contractual Clauses

A. Scope and Incorporation

Where Customer makes Customer Data available to Processor in a transfer subject to GDPR Chapter V, no applicable adequacy decision covers that transfer, and the relevant processing falls within the scope of Commission Implementing Decision (EU) 2021/914, the unmodified Standard Contractual Clauses in the Annex to that Decision form part of this DPA. Module Two applies where Customer is a controller; Module Three applies where Customer is an authorized processor. Only the applicable module and the common clauses apply. The Clauses prevail over conflicting provisions of the Agreement.

B. Selected Options

  • Clause 7: the optional docking clause does not apply.
  • Clause 9(a): Option 2, general written authorization, applies with 30 days' prior notice under DPA Section 5.4.
  • Clause 11(a): the optional independent dispute resolution provision does not apply.
  • Clause 17: Option 1 applies; the Clauses are governed by the law of Ireland.
  • Clause 18(b): disputes are resolved before the courts of Ireland, without limiting the rights of data subjects under the Clauses.

C. Annex I: Parties and Transfer

Data importer: SEZ YAZILIM DANIŞMANLIK TİCARET LİMİTED ŞİRKETİ, EVLİYA ÇELEBİ MAH. SADİ KONURALP CAD. IKSV VAKFI NO: 5 İÇ KAPI NO: 2 BEYOĞLU/İSTANBUL, Türkiye. Privacy contact: support@sevk.io. Role: processor under Module Two, or sub-processor under Module Three. Its activities are the Services described in DPA Annex 1.

Data exporter: the individual or legal entity contracting as Customer. Before relying on the Clauses, the Parties must complete and retain a transfer record identifying Customer's legal name, address, contact person and contact details, role, relevant services, and the signatures and dates for both Parties. Existing account or contract records may supply those details only where actually recorded and incorporated into that transfer record. A project name or account email alone does not complete missing party details. An account agreement acceptance is not, by itself, a completed Annex I or execution of the Clauses.

The data subjects, personal data, purpose, nature of processing and duration are described in DPA Annex 1. Transfers occur on a continuing basis as Customer uses the selected Services. Processing and retention follow Customer's instructions, DPA Section 9, and the documented retention periods for those Services. Sensitive data is excluded unless separately agreed under Section 3.3. Processing locations and any onward transfers must be recorded for the selected Services, using the provider disclosures in Annex 3. The competent supervisory authority for Annex I.C is identified for the actual exporter in accordance with Clause 13.

D. Annex II: Security Measures

DPA Annex 2 and the Security document in the accepted agreement version describe the common technical and organizational measures. The Parties record any additional measures required for the particular transfer. The transfer assessment required by Clause 14 must address the actual processing, destinations, relevant laws and practices, and safeguards; incorporation of the Clauses does not constitute that assessment. Processor shall provide the information reasonably needed for it and comply with the public-authority access obligations in Clause 15.

This DPA forms part of the Agreement accepted by Customer. The acceptance record identifies the agreement version and date. Publication of a new version does not change an earlier acceptance record or supply a missing signature, customer detail, or transfer assessment.