Cloud

Draft: the company details have not been filled in yet. These texts take effect after legal review.

Data Processing Agreement

Version: 2026-10-12

This is a translation. The Turkish version is the binding text.

This Data Processing Agreement ("DPA") is an annex to the EJO Cloud Terms of Service (the "Agreement") and is accepted together with the Agreement. The parties are: the organization that signs up for EJO Cloud (the data controller, the "Customer") and [Company name], [Company address] (the data processor, "EJO"). Terms not defined in this DPA have the meanings given in the Agreement and in Law No. 6698 on the Protection of Personal Data ("KVKK").

1. Subject matter and roles

1.1. While providing the EJO Cloud service to the Customer, EJO processes the personal data within Customer Data on the Customer's behalf. For this data, the Customer is the data controller and EJO is the data processor.

1.2. Data that EJO processes for its own purposes (signup, communication with the account owner, billing, service security) is outside the scope of this DPA; for this data EJO is the data controller and the Personal Data Protection Notice applies.

2. Details of processing

3. EJO's obligations

3.1. Instructions. EJO processes personal data only on the Customer's documented instructions. The Agreement, this DPA and the settings and operations the Customer makes in the Installation are the Customer's instructions. If EJO considers that an instruction violates KVKK, it informs the Customer. If processing is required by law, EJO informs the Customer before processing, unless the law prohibits this.

3.2. Confidentiality. EJO allows access to personal data only to persons who need access to provide the service and places these persons under a confidentiality obligation. This obligation continues after their duties end (KVKK Art. 12/4).

3.3. Security. Pursuant to KVKK Art. 12 and the Board's Personal Data Security Guide, EJO takes at least the technical and administrative measures in Annex-2. EJO may improve these measures but may not lower the general level of protection.

3.4. Data breach. When EJO becomes aware of a data breach affecting Customer Data, it notifies the Customer's Account Owner without delay and within 48 hours at the latest. The notification includes, to the extent known at that time, the nature of the breach, the categories of data and persons affected, its likely consequences and the measures taken or proposed; it is supplemented as new information is learned. This period is so that the Customer can notify the Board within 72 hours. Notifying the data subjects and the Board is the Customer's obligation as data controller; EJO provides the information needed for this.

3.5. Data subject requests. If a data subject request reaches EJO directly, EJO does not respond to the request, forwards it to the Customer within a reasonable time and informs the applicant that the Customer is the data controller. EJO assists the Customer, to the extent of the nature of the service, in the operations the Customer will perform under KVKK Articles 11 and 13. The Installation itself provides the Customer with tools for operations such as deleting user accounts and viewing audit records.

3.6. Assistance and information. EJO provides, on request, the information needed for the Customer to demonstrate its compliance with KVKK: this DPA, the current sub-processor list, a description of the security measures and answers to reasonable security questions.

4. Sub-processors

4.1. The Customer gives general authorization for the use of the sub-processors in Annex-1. EJO concludes with each sub-processor a written contract containing obligations no less protective than those in this DPA and is liable to the Customer for the sub-processor's work.

4.2. At least 30 days before adding a new sub-processor or replacing one, EJO notifies the Account Owner by email and updates the list on this page. Within this period the Customer may object on reasonable grounds based on data protection. If the parties cannot find a solution, the Customer may terminate the Agreement before the change takes effect and receives a refund of the fee for the unused period that it paid in advance. Changes made for urgent security reasons are notified immediately.

5. Transfers abroad

5.1. The databases, Installations and backups hosting Customer Data are kept on servers in Türkiye.

5.2. Transfers to sub-processors stated in Annex-1 as being abroad are made under KVKK Art. 9, with the standard contracts announced by the Board and by notifying the Personal Data Protection Authority within five business days from the signing of the contract. Cloudflare carries the TLS traffic between the browser and the Installation and does not permanently store Customer Data. Only the service emails that EJO Cloud sends to the account owner reach the email delivery provider; notifications inside the Installation go through the channels the Customer itself configures (SMTP, Slack, etc.).

5.3. If the Customer connects the Installation to services abroad of its own choosing (e.g. GitHub, a cloud provider's secret manager, a registry abroad), this connection is established on the Customer's instruction and under the Customer's responsibility; the KVKK Art. 9 steps required for transfers to those services belong to the Customer. These services are not EJO's sub-processors.

6. Deletion and return

6.1. When the Agreement ends, EJO deletes the Installation and its database. The final backup taken before deletion is kept for 30 days; during this period, if the Account Owner requests, EJO returns the data as a PostgreSQL dump. When the period expires, the backup is deleted; copies in the daily backups drop out within 14 days at the latest. Thus Customer Data is completely deleted at the latest 44 days after termination.

6.2. While the Agreement continues, the Customer may delete data in the Installation with the Installation's own tools. Deleted data drops out of the daily backups within 14 days at the latest.

6.3. Except for data that must be retained by law, EJO does not keep a copy of Customer Data. On request, it confirms the deletion in writing.

7. Audit

7.1. To demonstrate compliance with this DPA, EJO provides the information in 3.6. If this information is not sufficient, the Customer may conduct an audit, by written notice at least 30 days in advance, at most once a year, during business hours and in a way that does not endanger the confidentiality of the data of EJO's other customers or the security of the service, itself or through an independent auditor under a confidentiality obligation. The cost of the audit belongs to the Customer. In case of a data breach or a request from a competent authority, these limits do not apply.

7.2. If the Board or another competent authority makes a request concerning Customer Data, EJO informs the Customer of it, unless the law prohibits this.

8. Customer's obligations

8.1. The Customer is responsible for the lawful processing of the personal data it uploads to the Installation, for informing the data subjects and, where necessary, for obtaining their explicit consent.

8.2. EJO's developer, pull request and delivery metrics may show per-person results. If the Customer will use these metrics for a purpose such as evaluating its employees' performance, determining the legal basis for this and informing its employees about it is the Customer's responsibility.

8.3. If required, the Customer makes its own registration with the Data Controllers' Registry (VERBİS) and shows its processing activities in this registration.

9. Liability and precedence

Liability under this DPA is subject to Section 10 of the Agreement; however, under KVKK Art. 12/2 the parties are jointly liable to data subjects for taking the measures required to protect personal data. If the Agreement and this DPA conflict, this DPA applies with respect to the processing of personal data.

Annex-1: Sub-processors

Sub-processor Service Data processed Location
[Hosting provider] Servers, databases and backup infrastructure All Customer Data Türkiye
Cloudflare, Inc. DNS, TLS, attack protection, bot checks Encrypted traffic between browsers and the Instance, IP addresses USA (global network)
Brevo SAS Sending EJO Cloud service e-mails Account Owner's e-mail address, organization name, subdomain, e-mail content France (EU)

Annex-2: Technical and administrative measures

Separation

Encryption

Access

Continuity

Against abuse

Administrative