Data processing agreement

Last updated: 25 October 2026

This data processing agreement (“DPA”) applies between the business that uses Agenta (the “Customer”, controller) and Ömer Ögeday İnan (Agenta), İskele Mah. 2018/8 Sk. No: 8, Urla / İzmir, Türkiye, tax number Urla VD / 4750517527 (“Agenta”, processor). It is part of the terms of service and is accepted with them; it applies for as long as Agenta processes personal data for the Customer. Where the DPA and the terms differ on data protection, the DPA applies.

1. Subject and duration

Agenta processes personal data only to provide the Agenta service to the Customer, for the duration of the agreement and the deletion period in section 9.

2. Nature and purpose of processing

Receiving, storing and answering messages that the Customer's customers send through the channels the Customer connects; passing requests and contact details to the Customer; summaries, classification and reports in the Customer's panel; notifications to the Customer's staff.

3. Types of data and data subjects

• Data subjects: the Customer's customers and prospects who send messages; the Customer's staff who use the panel.
• Data: message content and attachments, platform IDs, profile names, contact details given in the conversation (such as name, phone, e-mail), time and channel, conversation summaries, appointment and order requests; for staff: name, e-mail, login and notification data.
• The service is not meant for special categories of data (Art. 9 GDPR). If the Customer's customers send such data on their own, Agenta processes it only as part of the conversation.

4. Instructions

Agenta processes personal data only on the Customer's documented instructions. The terms, this DPA and the settings the Customer chooses in the panel are those instructions. Agenta tells the Customer if it believes an instruction breaks the GDPR, and it may process data otherwise only if EU or member state law requires it, after informing the Customer where allowed.

5. Confidentiality and security

Everyone at Agenta who has access to personal data is bound to confidentiality. Agenta takes the technical and organisational measures in Annex 2 and keeps them up to date.

6. Sub-processors

The Customer gives general authorisation for the sub-processors in Annex 3. Agenta tells the Customer by e-mail at least 30 days before adding or replacing a sub-processor. The Customer can object within that period on reasonable data protection grounds; if we cannot find a solution, the Customer can terminate the agreement before the change takes effect. Agenta places the same data protection obligations on each sub-processor in writing and remains responsible for them.

7. Assistance

Agenta helps the Customer, as far as it reasonably can, to answer requests from data subjects (access, erasure and other rights), with security, with data protection impact assessments and with prior consultation (Art. 32–36 GDPR). Requests that reach Agenta directly are passed to the Customer.

8. Personal data breaches

Agenta informs the Customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach, with the information the Customer needs to meet its own notification duties.

9. End of processing

When the agreement ends, the Customer can export its data for 90 days. After that Agenta deletes it, except where law requires storage. Copies in backups disappear when the backup periods in the privacy policy end (at most 30 days).

10. Information and audits

Agenta gives the Customer the information needed to show compliance with Art. 28 GDPR and allows audits by the Customer or an auditor it appoints, after reasonable notice, during business hours and bound by confidentiality. Each party bears its own costs.

11. International transfers

Agenta is established in Türkiye, which has no EU adequacy decision. For transfers of personal data from a Customer in the EU/EEA to Agenta, the standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914, Module 2, controller to processor) apply and are incorporated into this DPA by reference; the optional clause 7 does not apply, under clause 9 option 2 (general authorisation) with the notice period in section 6, under clause 11 the optional wording does not apply, and the annexes of the clauses are filled in with sections 2–3 and Annexes 2–3 of this DPA. For onward transfers to sub-processors outside the EU/EEA, Agenta uses the standard contractual clauses (Module 3) or the EU–US Data Privacy Framework.

12. Transfer, liability and law

If Agenta transfers the agreement under section 10 of the terms, this DPA moves with it to the new processor, and the Customer has the termination right described there. Liability follows the terms. This DPA is governed by the same law as the terms, except where the standard contractual clauses require otherwise.

Annex 1. Contact

Processor: Ömer Ögeday İnan (Agenta), İskele Mah. 2018/8 Sk. No: 8, Urla / İzmir, Türkiye. Data protection contact: info@agenta.digital. Controller: the Customer, as registered in its account.

Annex 2. Technical and organisational measures

• Hosting in Germany (Contabo GmbH); data in transit over TLS 1.3.
• Separation of each Customer's data in the database with PostgreSQL row-level security.
• Access tokens of channels encrypted at rest (XSalsa20-Poly1305); session keys stored only as hashes.
• Backups encrypted before leaving the server (age / libsodium); the storage provider does not hold the keys.
• Access to production systems only for authorised persons.
• Phone numbers, e-mail addresses, card and bank numbers and access tokens are masked in error reports before they are sent.
• Default retention of conversations at most 24 months; deletion 90 days after the end of the agreement.

Annex 3. Sub-processors

Meta, Telegram, Google Calendar and Google Ads take part only if the Customer connects that channel or integration. Expo, Apple and Google deliver notifications only to staff who use the mobile app.