version: 3 effective_date: 2026-07-17 replaces: v2

Data Processing Agreement (DPA) — v3

Scope Note: This text describes the contractual principles applicable to sub-processors that DoWaba may use in providing the Service. For the Customer's end-user data, the Customer is the Controller and DoWaba is the Processor; that relationship is governed by the current B2B-DPA v2. This text is not a representation that any provider DPA or KVKK standard contract has been executed or notified to the Authority, or that an adequacy decision exists. Provider-specific signed documents and the Article 9 mechanism must be verified separately.

1. Parties and Definitions

This Data Processing Agreement ("DPA") is entered into between the following parties:

• Data Controller: Acr Yapay Zeka Eğitim Ve Bilişim Teknolojileri Limited Şirketi ("DoWaba"), https://dowaba.com, Burdur / Turkey, info@dowaba.com.
• Sub-processor: The third-party service provider with which this DPA is entered into (Hetzner / Google / OpenAI / Anthropic / Meta / PayTR / SIP trunk operator, etc.).

This agreement has been drawn up taking into account the Personal Data Protection Law No. 6698 ("KVKK"), KVKK Art. 12 (data security), KVKK Board Decision No. 2017/61 (Data Controller — Data Processor distinction), KVKK Board Decision No. 2024/959 (standard contract for international transfers), KVKK Board Decision No. 2018/10 (adequate measures for special categories of data), and, to the extent applicable, the provisions of the EU GDPR (2016/679).

Definitions. The concepts of "Personal Data", "Processing", "Data Controller", "Data Processor", "Explicit Consent" and "Data Subject" are used within the meaning of Article 3 of KVKK Law No. 6698. "Service" is DoWaba's omnichannel (WhatsApp, Instagram, Telegram, Email, Messenger, Web Widget, Phone AI Voice) communication and automation platform.

2. Subject, Nature and Purpose of Processing

The Sub-processor processes personal data on behalf of DoWaba in accordance with DoWaba's written instructions. The subject of processing is to provide server infrastructure, AI inference (transcription/summary), messaging channels, payment collection, or telecommunications infrastructure.

Purpose: The provision of the DoWaba Service, the processing, storage and AI enrichment of end-user data, and the fulfillment of legal obligations.

3. Data Categories and Categories of Data Subjects

Categories of data that may be processed under the Agreement:

1. Identity data (first name, last name, title)
2. Contact data (phone number, email, username, IP)
3. Visual/auditory data (phone voice recordings, transcripts)
4. Message content (WhatsApp, IG, Telegram, email, etc.)
5. Transaction data (appointment, order, cart information — if integrated by the Customer)
6. Payment references (card information in the sub-processor's domain, not in DoWaba's domain)

Categories of data subjects: DoWaba customers (SME panel owners), the Customer's end users (prospective customer, customer, subscriber, visitor).

4. Processing Period

The Sub-processor processes personal data for the duration of the Service agreement. When the agreement ends, it destroys or returns the data in accordance with DoWaba's written instructions; data subject to legal retention obligations is held until the period expires.

5. Data Controller Instructions

The Sub-processor may not process data outside DoWaba's documented instructions (agreement, panel configuration, API calls, written directives). If processing becomes mandatory by law, it immediately informs DoWaba to the extent not legally prohibited.

If DoWaba's instruction is contrary to KVKK or the relevant legislation, the Sub-processor notifies DoWaba of this in writing; if the non-compliance continues, it reserves the right to stop processing.

6. Confidentiality

The Sub-processor ensures that all its personnel accessing the data are subject to a written confidentiality obligation. This obligation continues even after the business relationship ends. Access is granted according to the need-to-know principle.

7. Scope of Technical and Organisational Measures

The parties determine, implement, and review measures proportionate to processing and risk under KVKK Article 12. Possible controls include access control, transfer security, logging, key management, backup, incident response, and supplier assessment.

This list is not an absolute guarantee that the same control exists for every item, provider, or storage layer, that all data is encrypted at rest, or that a particular certification or penetration test exists. Controls are represented only from current verified technical and operational records.

8. Use of Sub-processors

Sub-processing is governed by controller instructions, agreements actually in force, and applicable law. The scope and timing of change notice, objection, audit, and downstream obligations are documented under the customer/provider agreement actually executed. This text alone does not promise a fixed 30-day period or the existence of a particular provider agreement.

9. International Transfers and Sub-processor Verification

Depending on the enabled feature, providers abroad such as Hetzner Online GmbH, Google LLC, OpenAI, L.L.C., Anthropic PBC, or Meta Platforms Inc. may be used. Listing a provider does not mean that it is used for every customer or call, or that a transfer mechanism has already been established for it.

A regular and continuous transfer begins only after an actually applicable route under KVKK Article 9 has been established for the relevant provider, product, and data flow and recorded by Legal and Operations under an auditable reference. DoWaba Voice remains fail-closed at platform level until that verification is complete, even where Google Gemini Voice or OpenAI Realtime Voice is selected.

Customer acceptance in the panel, call-level explicit consent, or continuing the call cannot open this platform transfer gate. Explicit consent under the incidental-transfer exception cannot serve as the general safeguard for regular Voice/AI transfers. Commercial terms, a provider DPA, or this text do not by themselves create authority under KVKK Article 9. Only verified and archived records may be relied upon for claims about executed contracts, Authority notifications, provider region, or training/improvement use.

10. Personal Data Breach Cooperation

A sub-processor that becomes aware of a personal data breach informs the relevant party without undue delay in the manner required by applicable law and the agreement actually in force, and provides available information on nature, impact, and measures.

A specific 24/72-hour period is committed only after the genuinely applicable legal duty or executed agreement is verified. The party responsible for Authority/data-subject notification and the deadline are determined for the incident and role allocation with legal advice.

11. Audit and Information

Audit and information requests are handled reasonably with regard to applicable law, agreements actually in force, security, and other customers' confidentiality. Certification, independent reports, written questions, or agreed review may be used. This text alone creates no unlimited on-site audit or fixed frequency.

12. End of Agreement — Return, Deletion, or Anonymisation

At termination, data is returned, deleted, or anonymised according to the controller's lawful instruction, applicable law, technical backup cycle, and verified destruction capability. A fixed period or destruction certificate is promised only after the data class and operational process are verified. Records legally required to be retained remain access-restricted for their applicable period.

13. Liabilities

The Sub-processor is liable to DoWaba for damages arising from breach of this DPA, violation of KVKK and applicable legislation, breach of the confidentiality obligation, and vulnerabilities in technical measures. Although the addressee of administrative fines arising from a data breach is legally the Data Controller (DoWaba) under KVKK Art. 12/4, the right of recourse is reserved if it is proven that the breach originated from the Sub-processor.

DoWaba is liable to the Sub-processor for errors in its own instructions, misconfiguration, and breach of the disclosure obligation towards its end users.

14. Determining Applicable Law

Applicable law is determined from the data subject, party roles, activity, establishment, and concrete flow. A provider's EU location or GDPR status does not automatically place the Customer or every data subject under GDPR. KVKK duties remain separately applicable; conflicts and additional duties require independent legal assessment.

15. Resolution Order and Competent Court

Disputes between the parties are first attempted to be resolved through good-faith negotiation. Disputes that cannot be resolved are heard before the Courts and Enforcement Offices of Burdur in accordance with Turkish Law. For overseas sub-processors, the arbitration/jurisdiction provisions separately agreed upon by the parties are reserved.

16. Entry into Force

This DPA enters into force on the date it is accepted by the parties electronically or with a wet signature and continues for the duration of the Service agreement. The provisions of the DPA remain valid until the legal retention and destruction obligations are completed, even if the Service agreement ends.

17. Signature, Acceptance, and Transfer Instrument

Electronic or wet-ink acceptance evidences only the agreement text and party roles actually signed. Customer acceptance does not mean that an overseas provider has signed a DPA or KVKK standard contract.

If an Article 9 instrument is actually executed, applicable filing and record steps are completed within the period confirmed by legal counsel for the concrete module/roles and current law and archived under an auditable reference.

Version and Effective Date

• Version: v3 (replaces v2; hashes of prior versions remain in audit records)
• Effective Date: 17 July 2026
• Contact: info@dowaba.com — KVKK requests: kvkk@dowaba.com — Portal: https://dowaba.com/kvkk-talep
• Jurisdiction: Turkish Law — Courts and Enforcement Offices of Burdur

This text does not replace independent legal advice. In particular, the KVKK Article 9 transfer mechanism, provider/product scope, and any required filings must be verified by independent counsel before the Voice transfer gate is opened.