version: 4 effective_date: 2026-07-30 replaces: v3 amendment_clause: continued-use-v1

B2B Data Processing Agreement (B2B-DPA) — v4

Scope Note: This B2B-DPA relates to the processing of personal data belonging to the Customer's own end users within the scope of the Service provided by DoWaba to its corporate customer (SME panel owner). In this agreement, the Customer is positioned as Data Controller and DoWaba as Data Processor. The current list of sub-processors that may actually be used is published at /legal/alt-isleyenler; DoWaba's relationship with each provider is subject to any separate terms and agreements actually executed with that provider. This B2B-DPA is not a representation that such a provider agreement has been executed.

Article 1 — Parties and Definitions

This B2B Data Processing Agreement ("Agreement") is entered into between the following parties:

• Data Controller (Customer): The corporate subscriber who is a member of the DoWaba panel and carries out communication activities towards their end users through the DoWaba infrastructure.
• Data Processor (DoWaba): Acr Yapay Zeka Eğitim Ve Bilişim Teknolojileri Limited Şirketi, https://dowaba.com, Burdur / Turkey, info@dowaba.com.

Definitions are used within the meaning of Article 3 of the Personal Data Protection Law No. 6698 ("KVKK"). KVKK Board Decision No. 2017/61 sheds light on the practical consequences of the Data Controller — Data Processor distinction. To the extent applicable, the provisions of Article 28 of the EU GDPR (2016/679) are also taken into account.

Article 2 — Subject of the Agreement

The subject of the Agreement is to regulate DoWaba's authority and obligations to process personal data in accordance with the written instructions of the Customer, during the provision of omnichannel communication (WhatsApp, Instagram, Telegram, Email, Messenger, Web Widget, Phone AI Voice) and automation services towards the Customer's end users.

Within the scope of the Service, DoWaba provides the Customer only with technical infrastructure. The disclosure obligation towards the Customer's end users, obtaining explicit consent, and content management are the Customer's responsibility.

Article 3 — Categories of Data Processed

Categories of personal data that may be processed by DoWaba on behalf of the Customer under the Agreement:

1. Identity data (first name, last name, title)
2. Contact data (phone, email, username, social media identity)
3. Message content (WhatsApp / IG / Telegram / email / web widget texts and media)
4. Call data (voice recording, transcript, call metadata)
5. Automation workflow data (appointment, order, cart, product interest)
6. Technical data (IP, browser, device, session)
7. Preference and behavior data (channel preference, explicit consent status)

The Customer is obliged to notify DoWaba in writing before carrying out any processing that falls outside this list and involves special categories of personal data (health, biometric, etc.), and to take the necessary additional measures as the Customer.

Article 4 — Categories of Data Subjects

Categories of data subjects whose personal data is processed under the Agreement:

• The Customer's end users (existing customers, prospective customers, subscribers, visitors),
• The Customer's employees (operators, sales representatives, call center personnel — those using the panel),
• The Customer's resellers and business partners (if the relevant activity requires this scope).

Article 5 — Processing Period

DoWaba processes personal data for the duration of the Agreement and for a reasonable retention period. When the service agreement ends, a return or deletion process is carried out in accordance with the Customer's valid written instruction; access to data subject to a statutory retention obligation or legal hold (tax, consumer law, communication dispute records) is restricted, and that data is retained only for the required period under technical and administrative measures appropriate to the risk.

Applicable retention periods and settings that the Customer can change are shown in the relevant feature panel or current service documentation. Customer control is limited to the fields actually made available in the panel and their permitted ranges. In voice conversations the call audio is, for technical infrastructure reasons, recorded temporarily for the duration of the call; where the selected privacy mode does not permit persistence, that temporary technical recording is automatically destroyed at the end of the call without its content being read. This temporary recording does not extend the scope of the retention modes defined in the Privacy Policy for Telephone and AI Conversations.

Article 6 — Purpose of Processing

DoWaba processes the personal data within the scope of the Agreement only for the following purposes and in accordance with the Customer's written / panel-level instructions:

• Provision of the Service (message transmission, call routing, automation),
• Monitoring of service quality and error diagnosis,
• Information security, fraud detection, prevention of service abuse,
• Fulfillment of legal obligations.

DoWaba may not use Customer data for its own marketing, profiling, or cross-selling purposes. Statistics generated to improve service quality are kept in aggregate and anonymous form.

Article 7 — Obligations of the Data Controller (Customer)

The Customer, in its capacity as Data Controller, accepts and undertakes the following obligations:

1. KVKK Art. 10 disclosure obligation. To clearly inform its end users of the data processing carried out within the scope of the Service, through which channel and for what purpose it is processed; and where necessary, to use the sample disclosure templates provided by DoWaba by adapting them.
2. Explicit consent management. To obtain explicit consent from the end user for marketing, commercial electronic communications, or other activities requiring consent, in a manner compliant with KVKK Art. 5/1 and the Law on the Regulation of Electronic Commerce No. 6563 and IYS.
3. Lawful processing basis. To verify that it has a basis under KVKK Art. 5 / Art. 6 for each processing activity.
4. VERBİS registration. To keep its data inventory and VERBİS registration up to date if it exceeds the obligation thresholds.
5. Authorized user management. To distribute the permissions granted on the panel to the extent needed and according to the need-to-know principle; and to revoke the permissions of departing personnel.
6. Content control. The Customer is itself responsible for the lawfulness of the content (broadcast messages, automatic responses, announcements) it uploads to the panel.
7. Notice profile. Managing in the panel the notice profile that determines the scope of the first-layer notice in voice calls, and the written first-layer notice in messaging channels. The platform default is the short first layer; use of the short notice is the Customer's choice and responsibility, and the Customer may switch to the detailed (full-text) notice form in the panel at any time. The Customer assesses whether the first layer satisfies the KVKK Article 10 information obligation for its own specific activity, call type and audience; full and proper performance of that obligation — including making the full notice text accessible on its own website and application channels — rests exclusively with the Customer. The Customer is responsible for the accuracy of the business name, privacy mode, legal basis and retention period it declares on the platform. DoWaba implements that selection as the Customer's documented instruction, makes no representation as to the sufficiency of the profile on the Customer's behalf and, in the capacity of data processor within the meaning of Law No. 6698, provides the technical infrastructure only; the detailed layer delivered on request is open on every line and channel and cannot be disabled. The scope, minimum elements and limits of the profile distinction and of the layered notice in messaging channels are governed by the Privacy Policy for Telephone and AI Conversations.

Article 8 — Obligations of the Data Processor (DoWaba)

DoWaba, in its capacity as Data Processor, accepts and undertakes the following obligations:

1. Adherence to instructions. To carry out processing only in accordance with the Customer's written instructions (agreement, panel configuration, API calls); if processing becomes mandatory by law, to inform the Customer to the extent not legally prohibited.
2. Confidentiality. To limit persons authorized to access the data according to access need and subject them to appropriate confidentiality obligations arising from contract, internal policy, or law; and, where applicable, ensure that those obligations continue after access or the business relationship ends.
3. Technical and administrative measures (TOM). To apply documented measures under KVKK Art. 12 that are proportionate to the nature and risk of the processing, the state of the art, and implementation cost. Based on its risk assessment, DoWaba selects controls such as encryption in transit, least privilege / RBAC, access and audit logging, backup and recovery, monitoring, and vulnerability management to the extent they are actually deployed and applicable to the relevant component. This clause is not a general representation that every data store is encrypted at rest or that an independent penetration test has been completed at a specified interval.
4. Use of sub-processors. To publish the current list of sub-processors that may actually be used and, where practicable, give reasonable advance notice of planned material changes by panel or email. Notice may be shorter or contemporaneous for urgent security, legal, or provider-driven changes. The Customer may submit a written objection based on concrete data-protection grounds; the parties will consider an alternative configuration or provider in good faith. Termination and fee consequences are governed by the main Service agreement and mandatory law; this clause does not grant an unconditional right to terminate free of charge.
5. Support for data subject applications. To provide reasonable and appropriate technical support to enable the Customer to respond to KVKK Art. 11 applications from the Customer's end users.
6. Data breach notification. Upon becoming aware of a personal data breach affecting Customer data, to inform the Customer in writing without undue delay and to the extent information is then available, and to provide further information as the investigation progresses.

Article 9 — International Processing and Transfer Safeguard

Depending on the enabled feature and selected provider, personal data may be processed on the infrastructure of Hetzner Online GmbH in Germany and by technical providers abroad such as Google LLC (including Gemini services), OpenAI, L.L.C., Anthropic PBC, or Meta Platforms Inc. This list describes possible actual providers; it is not a representation that a KVKK standard contract has been executed or notified to the Authority, or that an adequacy decision exists.

• A regular and continuous international transfer may begin only where an actually applicable route under KVKK Article 9 exists for that transfer, such as an adequacy decision or an established appropriate safeguard.
• Explicit consent may be considered only where the statutory conditions for an incidental transfer exception are met; it cannot by itself serve as the general safeguard for regular Voice / AI transfers.
• This B2B-DPA does not itself create authority for an international transfer. For Voice/AI features the Customer enables with its own AI provider account or API key, the Customer is the party to the service and data-processing relationship with that provider; determining, establishing and maintaining the appropriate KVKK Article 9 mechanism and making any required notifications are the obligations of the Customer (the controller). DoWaba uses that key only on the Customer's instructions, acting technically as processor, and records this allocation of responsibility through a panel declaration at activation.
• The Customer must accurately and currently inform its own end users of the providers actually enabled and the applicable transfer conditions, and must fulfil its own controller obligations.
• Under the short notice profile, which is the platform default for voice calls, and under the short first layer in messaging channels, on legal bases other than explicit consent the information about processing abroad (transient processing in voice calls) is removed from the first layer and moved to the detailed layer, which is delivered on request within the same call or message exchange; that layer is open on every line and channel and cannot be disabled. That choice does not change the transfer itself, its scope, or the Customer's KVKK Article 9 obligations under this Article. On lines and channels relying on explicit consent, the international-transfer information is given in the first layer before consent is obtained, in the short form as well.

DoWaba keeps the record of this responsibility arrangement and the basis on which the platform gate was opened in an auditable operational record. This text is not a representation that a standard contract has been executed or a notification made by either DoWaba or the Customer.

Article 10 — Data Breach Notification

Upon becoming aware of a personal data breach affecting Customer data, DoWaba informs the Customer in writing (email or panel notification) without undue delay. The initial notification may be made with the information reasonably available at that time and is supplemented as the investigation progresses. To the extent available, the notification includes:

• The nature of the breach,
• The affected data categories and the approximate number of data subjects,
• The likely consequences,
• The measures taken / to be taken,
• The contact information of DoWaba's data contact person.

The Customer is itself responsible, in its capacity as Data Controller, for the notification to be made to the KVKK Board and to the affected data subjects. DoWaba provides reasonable technical support in this process.

The 72-hour period in KVKK Board practice concerns the Data Controller's notification to the Board; this clause is not a separate guarantee that DoWaba will complete a full notification to the Customer within exactly 72 hours in every incident.

Article 11 — Right of Audit

The Customer may request in writing information and documents reasonably necessary to demonstrate DoWaba's performance of its obligations under this B2B-DPA. DoWaba will reasonably address the request first through current policy and control summaries, relevant record summaries, and, if available, independent third-party reports. Any additional audit is subject to the following rules:

• The request must be reasoned, proportionate, and limited to Customer data and obligations under this Agreement.
• Remote and document-based review takes priority. An on-site or independent third-party audit may occur only where mandatory law requires it, a material incident has occurred, or a documented serious concern has not reasonably been resolved, and the parties agree the scope, timing, method, and cost in writing in advance.
• An audit does not grant access to other customers' data, source code, credentials, or information whose disclosure could weaken security, and is subject to appropriate confidentiality obligations.
• An audit is conducted during normal business hours without unreasonably disrupting the Service. Costs are borne by the Customer unless mandatory law or a verified material breach attributable to DoWaba requires otherwise.

Article 12 — End of the Agreement

When the service agreement ends and the Customer makes a valid written request, DoWaba initiates the return or deletion process without undue delay and carries it out within a reasonable operational period, subject to mandatory retention obligations, legal holds, backup cycles, technical dependencies, and the product's export capabilities then available:

• Data that can technically be provided may be returned to the Customer in one of the standard export formats then available.
• Active production copies are deleted or anonymized under documented retention and deletion jobs; residual backup copies are removed as they expire through ordinary backup cycles.
• Use of data subject to statutory retention or legal hold is limited to the relevant purpose, access is restricted, and it is protected with measures appropriate to the risk.

At the Customer's request, DoWaba may provide written deletion confirmation describing the scope of the operation and known exceptions to the extent supported by system records. This clause is not a guarantee of an independently issued destruction certificate or that every technical copy will be destroyed on a specified date.

Article 13 — Liabilities

Each party is itself responsible for the processing activities it carries out in its own capacity and for the breach of its own obligations. Shared liability situations that may arise under KVKK Art. 12 are reserved.

DoWaba is not responsible for the failure to fulfill disclosure, explicit consent, and other Data Controller obligations towards the Customer's end users.

Article 14 — Insurance and Indemnification

• The Customer indemnifies DoWaba against complaints, KVKK Board sanctions, or compensation claims arising from its own end users, the content it uploads to the panel, or the absence of explicit consent.
• DoWaba is responsible, within the scope of its own liability, for direct damages arising from technical infrastructure defects, its own sub-processor management, or the breach of its own obligations under this Agreement.
• The total liability cap is subject to the liability provisions in the main Service agreement.

Article 15 — Conflict Resolution

In the event of a conflict between this Agreement and other agreements between the Customer and DoWaba, the provisions of this B2B-DPA apply with priority on matters of personal data processing. The main Service agreement applies to other matters.

Article 16 — Entry into Force

This Agreement enters into force upon the Customer's registration on the DoWaba panel and signing of the Service agreement and remains valid for the duration of the Service agreement. DoWaba may update this agreement under the conditions below; the new version is published with an incremented version number at /legal/b2b-dpa and a change notice is displayed on the panel.

DoWaba reserves the right to update this text due to changes in legislation, changes in the scope of service, or reasonable commercial reasons. Changes are announced to the Customer by email and/or panel notification at least 15 days, and material changes at least 30 days, before they take effect. The notice states the changed documents, the new version number and the document digest (SHA-256).

The Customer may object before the notice period expires, through the panel or by writing to kvkk@dowaba.com; upon objection the new version does not automatically take effect for that Customer, the parties consider a resolution in good faith, and if none is found the Customer may terminate the relevant service. If no objection is raised and the Customer continues to use the service after the notice period has expired, such continued use constitutes acceptance of the new version. The acceptance is recorded in the audit log together with the notice date, waiting period, evidence of use, version number and document digest, and is visible to the Customer in the panel.

This provision covers only the contractual relationship between the Customer (the business owning the panel) and DoWaba. It cannot establish the explicit consent under Article 9 or the disclosure under Article 10 of the Turkish Data Protection Law of the person called or calling; acceptance through continued use does not replace the Customer's own obligations towards data subjects.

The Agreement is governed by the law of the Republic of Turkey and the Courts and Enforcement Offices of Burdur have jurisdiction in disputes.

Contact: kvkk@dowaba.com — info@dowaba.com — https://dowaba.com