Data processing agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer ("Controller") and Venüs Yazılım Bilişim ve İnternet Hizmetleri ("Zefily", "Processor"). It applies when Zefily processes personal data on the Controller's behalf while providing the service, and it prevails over the Terms where they conflict on data protection.

1. Subject and duration#

Zefily processes personal data only to provide the service described in the Terms, for as long as the Controller uses it, and for the deletion periods in section 10.

2. Nature and purpose of the processing#

Zefily operates software on servers the Controller connects: it installs and configures software, runs deployments, backups, database transfers, file operations and terminal sessions on the Controller's instructions, and reports system information and logs. Personal data is processed only as a side effect of these operations — for example when a backup copies a database or when the Controller opens a log or file in the panel.

3. Types of data and data subjects#

The personal data is whatever the Controller's sites and applications contain: typically names, contact details, account data, order and transaction data, content and technical data (IP addresses, logs) of the Controller's own customers, visitors, users and employees. The Controller decides whether special categories of data are processed and must tell Zefily if they are.

4. Instructions#

Zefily processes personal data only on the Controller's documented instructions: the Terms, this DPA, and the actions the Controller and its members take or schedule in the panel, API and command-line tool. Zefily informs the Controller if it believes an instruction breaks data protection law. Zefily may process personal data otherwise only where the law requires it, and then tells the Controller first unless the law forbids that.

5. Confidentiality#

Zefily ensures that staff who can access personal data are bound to confidentiality and access it only as far as needed to provide the service or support the Controller asked for. Staff access to customer servers through support tools is logged and visible to the Controller in the audit log.

6. Security measures#

Zefily maintains appropriate technical and organizational measures, including:

• every job on a customer server signed by the control plane and by a separate signing service, with replay protection and expiry; high-risk jobs also need the Controller's passkey approval;
• mutual TLS between the Agent and Zefily; the Agent accepts no inbound connections;
• secrets encrypted with per-organization keys held in a separate key management system;
• tenant isolation enforced in the database (row-level security) and tested automatically;
• passkey-only staff sign-in, four-eyes approval for sensitive admin actions, and an append-only, hash-chained audit log;
• encrypted backups of Zefily's own systems and tested restore procedures;
• regular updates, vulnerability scanning and security testing.

Zefily may update these measures as long as the overall level of protection does not decrease.

7. Sub-processors#

The Controller authorizes Zefily to use the sub-processors listed in the Privacy policy for the purposes stated there. Zefily binds each sub-processor to obligations no less protective than this DPA and remains responsible for them. Zefily announces new sub-processors at least 30 days in advance; the Controller may object on reasonable data protection grounds and, if no solution is found, terminate the affected service.

Data that stays on the Controller's own servers and backup destinations is not processed by Zefily's sub-processors.

8. International transfers#

Where personal data is transferred outside the European Economic Area, the United Kingdom or Türkiye, the parties rely on an adequacy decision or the applicable standard contractual clauses, which are incorporated by reference, and for Türkiye on the safeguards of KVKK article 9.

9. Assistance#

Taking into account the nature of the processing, Zefily helps the Controller to answer data subject requests, to carry out data protection impact assessments and prior consultations, and to meet its security obligations. Most data subject requests concern data on the Controller's servers, which the Controller can access directly.

10. Return and deletion#

When the service ends, the Controller keeps its data on its own servers and backup destinations. Zefily deletes the personal data it holds for the Controller (for example managed backups and terminal recordings) within 30 days, and from its own backups within a further 35 days, unless the law requires it to keep them. Managed backups can be downloaded before the end of the service.

11. Personal data breaches#

Zefily notifies the Controller without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting the Controller's data, with the information the Controller needs to meet its own obligations (in Türkiye, the 72-hour notification to the Authority).

12. Audits#

Zefily makes available the information needed to show compliance with this DPA. The Controller may audit compliance, at most once a year and with 30 days' notice, by reviewing Zefily's documentation, certifications or third-party reports; on-site audits are possible where these are not sufficient, during business hours and at the Controller's cost.

13. Liability#

The limitations of liability in the Terms apply to this DPA, except where the law does not allow them.

Signed / accepted electronically by the Controller when accepting the Terms.

Processor: Venüs Yazılım Bilişim ve İnternet Hizmetleri, Küçükbakkalköy Mah. Dereboyu Cad. Brandium Residence No:3a, R5 Blok, K:7 D:48, 34750 Ataşehir/İstanbul, Türkiye, hello [at] zefily [dot] com.