Draft — requires lawyer review. This agreement is an annex to the Terms of Service and is accepted at sign-up; no separate signature is needed. Prepared with KVKK Article 12 and, for visitors in the EU, GDPR Article 28 in mind. Placeholders are shared with the Turkish version.
Version: 0.1 (draft) · Effective: [YÜRÜRLÜK TARİHİ]
1. Parties and roles
- Controller: the user who creates a bio page ("User").
- Processor: WebWorks 101 OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia, Estonian Commercial Register code 14816432 ("tappon").
The User is the controller of data collected from visitors on the User's bio page and decides what is collected, why and how it is used. tappon processes that data only on the User's behalf and instructions.
2. Subject matter
| Data subjects | Bio page visitors; people who fill in the User's forms; the User's newsletter subscribers; people who buy from the User |
| Data categories | Name, email, phone, message and any other fields the User defines in forms; submission time. Visit statistics: country, city, device, OS, browser and language, referring site, UTM parameters, time (no IP address stored) |
| Purpose | Publishing the User's bio page; storing the data for the User, showing and exporting it, and passing it to notifications/integrations the User enables |
| Nature | Collection, recording, storage, display, export, transfer to integrations enabled by the User (e.g. webhook, email notification), deletion |
| Duration | For the term of the Service; the User can delete data from the dashboard at any time |
3. tappon's obligations
3.1. Instructions: tappon processes data only on the User's documented instructions; the User's settings and actions in the dashboard are instructions. tappon will tell the User if it believes an instruction is unlawful.
3.2. No own use: tappon does not use the data for its own purposes, sell it, use it for advertising or pass it to third parties. Sole exception: to filter fake traffic, a keyed hash of the visitor IP address is kept in cache for at most 10 minutes, based on tappon's own legitimate interest in service security; it is not shown to the User.
3.3. Confidentiality: staff and contractors with access are bound by confidentiality; access is limited to those who need it, to the extent needed.
3.4. Security: tappon applies the measures in Annex 1. Under KVKK Article 12(2) tappon is jointly responsible with the User for taking these measures.
3.5. Data subject requests: the User can handle access, correction, deletion and export requests in the dashboard. tappon gives reasonable help where the dashboard is not enough. If a data subject contacts tappon directly, tappon forwards the request to the User and tells the data subject to contact the page owner.
3.6. Breach notification: tappon notifies the User without undue delay and within [SÜRE: 24/48] hours of becoming aware of a breach affecting the User's data, including the nature of the breach, the data and number of people affected (if known), likely consequences and measures taken, and helps the User notify the Turkish Authority (72 hours) and data subjects.
3.7. Deletion and return: when the Service ends or the account is deleted, tappon deletes the User's data from live systems within [SÜRE: 30] days and from encrypted backups within [YEDEK SAKLAMA SÜRESİ]. The User can export the data as CSV/JSON at any time before that. An account being put on hold when the trial or a paid period ends does not count as the Service ending: the data stays stored on the User's behalf, a page on hold collects no new visitor data (forms, emails etc.), and the User can still export or delete the data.
3.8. Audit: on reasonable request tappon provides information and documents showing compliance. If documents are not enough, tappon allows an audit with at least 30 days' notice, no more than once a year, under confidentiality and without access to other customers' data. Audits by competent authorities are not subject to these limits.
4. Sub-processors
4.1. The User gives general authorisation for the sub-processors in Annex 2.
4.2. tappon informs the User by email and on this page at least 30 days before adding or replacing a sub-processor. If the User objects on reasonable grounds and no solution is found, the User may terminate without penalty and receive a refund for the remaining days.
4.3. tappon imposes obligations on sub-processors at least as protective as this agreement and remains liable to the User for their acts.
5. International transfers
Servers are in Germany. The transfer to the hosting provider relies on the standard contract (processor-to-processor module) under KVKK Article 9, notified to the Authority within 5 business days. [AVUKAT TEYİT: which module applies given tappon's place of establishment and Users in Türkiye] For data subjects in the EU, data is processed inside the EU (Germany).
6. The User's obligations
6.1. The User confirms it collects data on a lawful basis, gives its visitors its own privacy notice and obtains explicit consent where required. tappon lets the User add a link to its own privacy notice and an optional consent checkbox to bio page forms.
6.2. The User does not use bio page forms to collect special-category data (health, religion, ethnic origin, etc.), national ID numbers, card data or data of under-18s.
6.3. If the User sends commercial electronic messages to the contacts collected, obtaining consent, registering with İYS and handling opt-outs under Law No. 6563 and the related Regulation is the User's responsibility.
6.4. If the User adds third-party tracking codes (pixels) or embeds, the User is the controller for data sent to those parties and must obtain any required consent. These parties are not tappon sub-processors.
6.5. The User fulfils any VERBIS registration duty it may have.
7. Liability and term
This agreement runs as long as the Terms of Service and survives until the data is deleted. Liability follows section 14 of the Terms of Service, without prejudice to mandatory provisions of KVKK and GDPR. In case of conflict on data protection matters, this agreement prevails.
Annex 1 — Technical and organisational measures
- TLS (HTTPS) encryption on all connections.
- Passwords stored with one-way salted hashing. [TEKNİK TEYİT]
- Database reachable only from inside the server; closed to the outside.
- Admin access on least privilege, strong authentication and [TEKNİK TEYİT: IP restriction / two-factor].
- Server access by SSH key only; password login disabled. [TEKNİK TEYİT]
- Backups encrypted client-side; the backup provider cannot read the content. [TEKNİK TEYİT]
- Regular security updates; daily security scan and file-change check. [TEKNİK TEYİT]
- No IP stored in visitor statistics; country/city derived on the fly from a local database.
- Bot protection and rate limiting on forms.
- Confidentiality undertakings for staff and contractors; access logging.
- Deletion requests fulfilled within the set periods; periodic destruction.
Annex 2 — Sub-processors
| Sub-processor | Service | Location | Data |
|---|---|---|---|
| Contabo GmbH | Server hosting | Germany | All service data |
| [YEDEK KONUMU] | Encrypted backup storage | [DOLDURULACAK] | Encrypted backups (unreadable to provider) |
| Our own mail server (on Contabo GmbH) | Delivery of form notifications and service emails | Germany | Form data in notification emails |
| [KULLANILIYORSA: CDN/DNS provider] | Content delivery, attack protection | [DOLDURULACAK] | Visitor IP and request data (transient) |
| [KULLANILIYORSA: bot protection provider, e.g. Cloudflare Turnstile] | Bot check on forms | [DOLDURULACAK] | Visitor IP and browser signals |
Not sub-processors (for information): fonts and weather data are fetched server-side/served from our own server; no visitor data is sent. The geolocation database is local; no data leaves the server. [KULLANILIYORSA: link safety checks (e.g. Google Safe Browsing) only check link addresses added by the User and send no visitor data.]