Data processing agreement

1.1. This agreement is between the Customer that accepts the Terms of use (the controller) and Wennes Biyoteknoloji Limited Şirketi (Unique Alphabet®, the processor), and forms part of the Terms.

1.2. It covers personal data that the Customer puts into the platform and that we process on its behalf (Customer Personal Data). For account, user, Audit Log, support and billing records Unique Alphabet® is the controller; those are covered by the Privacy notice, not this agreement.

1.3. If this agreement and the Terms conflict on the protection of personal data, this agreement applies.

1.4. Applicable law: Turkish Personal Data Protection Law No. 6698 (KVKK) and its secondary legislation; where the Customer or data subjects are in the EU or the UK, also the GDPR and the UK GDPR.

3.1. We process Customer Personal Data only on the Customer's documented instructions. The Terms, this agreement, the Customer's settings and actions in the platform (e.g. creating a share, keeping AI on, granting permission on an Assistant permission card) and written support requests are instructions.

3.2. If the law requires processing, we tell the Customer before processing, unless the law prohibits it.

3.3. If we believe an instruction breaks data protection law, we tell the Customer at once and may suspend that instruction until it is resolved.

4.1. Only people who need to and who are bound by confidentiality access Customer Personal Data; the duty continues after they leave.

4.2. Our team accesses content only in three cases: the Customer's written request, a security incident, a legal obligation. Each access is recorded with person, reason, scope and duration (Staff Access Policy).

We apply and maintain at least: TLS 1.2/1.3 encrypted connections; passwords stored only as hashes; company data separated row by row on the server; sensitive fields encrypted with an application key; a tamper-evident Audit Log on a SHA-256 chain with an external anchor; two-step sign-in available to every user; mandatory two-step sign-in for the admin panel, which by design shows no content; error records stripped of personal data; an access matrix and same-day removal of access on leaving. Measures are updated as they improve and never lowered. Details: Security and data page.

6.1. If a data subject contacts us directly about Customer Personal Data, we pass the request to the Customer without delay and do not answer it without the Customer's instruction.

6.2. We help the Customer meet these requests through the platform's tools (view, correct, delete, export) and, where needed, with reasonable assistance.

7.1. When we become aware of a breach affecting Customer Personal Data, we notify the Customer without undue delay and in any case within 24 hours.

7.2. The notice contains what is known at the time and is completed later: the nature of the incident, categories and approximate number of people and records concerned, likely consequences, measures taken and proposed, a contact person.

7.3. We give reasonable help with the Customer's notifications to the authority (72 hours) and to data subjects. We do not notify the authority on the Customer's behalf.

8.1. The Customer gives general authorisation to use the sub-processors in Annex A.

8.2. We notify account owners by email and in Annex A at least 30 days before adding or replacing a sub-processor.

8.3. Within that period the Customer may object in writing on reasonable grounds. We look for a solution together (for example switching the function off for that Customer). If there is none, the Customer may switch off the service concerned or terminate without penalty before the change takes effect and receive a pro rata refund of the unused period.

8.4. We impose on each sub-processor in writing obligations as protective as these, and remain responsible to the Customer for its acts.

9.1. Customer Personal Data is stored in Türkiye (İstanbul). The only flows abroad are two AI functions, and their only recipient is Anthropic, PBC (USA). The provider does not train models on this data and deletes it within 30 days. (a) Label Check: pasted label text (with emails and phone numbers removed) or the uploaded label file (PDF/image), without file names. (b) Assistant: the user's question and the last six turns of the conversation (up to 400 characters each), under three rules: (i) public data (regulations, shared toxicology sources) is used as it is; (ii) the Customer's account data reaches the model only as placeholders (such as "PRODUCT_1"), and values such as formula percentages and results are not sent; (iii) if a better answer needs values, the Assistant asks for permission — the permission covers only the named product and fields, lasts at most for that conversation, is written to the audit log and listed in Settings; only the values permitted are sent. The Customer's Owner or an Administrator chooses the permission policy: off, ask, or ask an admin.

9.2. By keeping AI on, and for (b) by also granting permission, the Customer instructs these transfers. The Owner or an Administrator can switch off every AI operation at any time with one setting. While it is off, no data goes abroad.

9.3. Under KVKK Art. 9, signing the Board's processor-to-processor standard contract with the recipient and notifying the Board is our obligation. As of 27 October 2026 this is not yet complete; we have asked the provider in writing. We tell the Customer when it is complete and give the notification receipt on request. A Customer that keeps AI on knowing this gives its instruction on that basis.

9.4. Where a label shows a Responsible Person who is an individual, informing that person is the Customer's duty.

9.5. For Customers in the EU, the transfer from the Customer to us (in Türkiye) is made under the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated into this agreement by reference. Annex I is replaced by §§1–2 of this agreement, Annex II by §5, Annex III by Annex A. Choices: Clause 7 (docking) applies; Clause 9 option 2 (general authorisation, 30 days); the option in Clause 11 does not apply; under Clause 13 the competent supervisory authority is that of the Member State where the Customer is established; under Clauses 17 and 18, the law and courts of Ireland. For Customers in the UK, the same clauses apply together with the ICO's International Data Transfer Addendum (UK Addendum, version B1.0); under its Table 4, either party may end it. If the standard contractual clauses and this agreement conflict, the clauses prevail. The onward transfer to Anthropic is covered by the EU SCCs and UK Addendum in Anthropic's Data Processing Addendum.

10.1. When the account closes, the Customer can export all data for 90 days; where an account is above the Free limits after a payment problem or the end of a paid period, a read-only period of at most 60 days comes first (Terms §05, §09A).

10.2. At the end of that period we delete Customer Personal Data; records we must keep by law (Audit Log archive, invoices) fall outside this agreement and are kept for the periods in the Privacy notice.

10.3. On request we confirm the deletion in writing.

11.1. We make available the information needed to show compliance by answering the Customer's written questions within 30 days and sharing existing documents (policies, the Security and data page, measurement records).

11.2. If written information is not enough, the Customer may audit no more than once a year, with 30 days' notice, during business hours, through an auditor bound by confidentiality, at its own cost. Audits do not include access to other customers' data or the host's premises. Audits by the authority are not affected.

Under KVKK Art. 12(2) the parties are jointly responsible for taking data security measures. For everything else, §14 of the Terms applies.

This agreement takes effect with the Terms and lasts as long as Customer Personal Data is processed. It is changed under the procedure in §15 of the Terms; changes required by law apply at once.

Services that do not touch Customer Personal Data (for information): GitHub (code and workflows, USA), Google Analytics (website statistics, USA), Euromsg Express (marketing email, Türkiye). Error records are kept on our own server. Planned: payment institution (iyzico, Türkiye), e-invoicing provider (Türkiye), backup storage (Türkiye) — notified 30 days before they are added.