Skip to content
Türkçe Talk to us

Data Processing Annex

Annex 1 to the Terms of Service (called the data processor annex on the company creation screen)

Company
Alone AI Teknoloji Ltd. Şti.
Version
taslak-2026-10
Effective
Last updated

This English text is a translation provided for information. The Turkish version is the binding text.Türkçe (esas metin)

Draft: this text is under legal review and becomes final once approved.

Contents14 sections
  1. E.1.Subject, duration and purpose
  2. E.2.Data subjects and data categories
  3. E.3.Processing on instructions
  4. E.4.Deletion requests made directly by people
  5. E.5.Confidentiality and personnel
  6. E.6.Technical and organizational measures
  7. E.7.Sub-processors
  8. E.8.Meta channels and transfers abroad
  9. E.9.Assistance with data subject requests
  10. E.10.Data breach notification
  11. E.11.Information and audits
  12. E.12.Retention, return and deletion
  13. E.13.Obligations arising from Meta
  14. E.14.Liability and term

This annex is Annex 1 of the Terms of Service and is accepted together with the agreement, under the same version, when a company is created. The same text appears at the end of the Terms of Service; this page publishes the annex separately so that it can be read and printed on its own.

This annex sets out, under Article 12 of the Turkish Personal Data Protection Law No. 6698 ("KVKK"), the terms for processing in which the Customer is the data controller and UPPU the data processor. It is the document called the "data processor annex" in the box on the company creation screen. Terms not defined in this annex have the meaning given in the Agreement and in the KVKK.

E.1. Subject, duration and purpose

UPPU processes Customer Data for the term of the Agreement and until the deletion periods in clause E.12 of this annex expire, solely to provide the service to the Customer: receiving, storing and showing messages to Users; delivering the Customer's replies and templates; tracking delivery; applying Meta's messaging rules; and passing data to the integrations defined by the Customer.

E.2. Data subjects and data categories

  • Data subjects: people who write to the Customer through the channels or to whom the Customer sends messages; web chat visitors; third parties whose details appear in shared content (for example people in contact cards).
  • Data categories: channel identifiers (WhatsApp BSUID and phone number, Messenger PSID, Instagram IGSID, web visitor ID); name and display name; message contents; media files; shared locations and contact cards; delivery, read and error details; conversation, tag and assignment details; consent and withdrawal records; raw copies of messages.
  • Special categories: the Platform is not designed to process special categories of personal data. Message contents, media files and backups are not separately encrypted at rest, and backups are not kept off the server. If people send such data, the Customer is responsible for the existence of a legal basis. If the Customer is going to process special categories of data, it assesses in advance whether these measures are adequate under Article 6(4) of the KVKK and the Board's decision on adequate measures.
  • Server access logs: the IP address and browser details of visitors to pages where the chat widget is loaded are written to the access logs of UPPU's servers, even if the widget is never opened. UPPU keeps these logs as data controller for its own security (KVKK Privacy Notice); the Customer mentions this in its own privacy notice.

E.3. Processing on instructions

UPPU processes Customer Data only on the Customer's instructions. The Agreement, the Customer's settings in the panel (channels, retention period, webhook and API settings) and its written requests are the Customer's instructions. If UPPU considers an instruction to be unlawful, it informs the Customer and may decline to carry it out. If other processing is required by a legal obligation, the Customer is informed in advance unless the law prohibits this.

E.4. Deletion requests made directly by people

Meta's terms require data obtained through Meta channels to be deleted at the request of the person concerned. When a deletion request reaches UPPU directly, UPPU reasonably verifies the requester's identity and then forwards the request to the Customer within 3 business days at the latest. Within 10 business days the Customer either fulfills the request with the erasure tool in the panel or notifies UPPU, with reasons, of a statutory retention obligation or another legal obstacle. UPPU tells the person the outcome and any reasons; the parties observe these periods so that the person can be answered within 30 days at the latest. If the Customer's API access is enabled, the erasure is reported to the Customer's systems with the contact.erased event. Individual erasure is not possible in a closed company; its data is deleted all at once when the period in clause E.12 expires.

E.5. Confidentiality and personnel

UPPU binds its employees and assistants who may access Customer Data to confidentiality and limits access to those who need it for their work. Platform administrator accounts have no implicit access to company data. This obligation continues after the end of their duties and of the Agreement (KVKK Art. 12/4).

E.6. Technical and organizational measures

To ensure an appropriate level of security under Article 12 of the KVKK, UPPU applies at least the following measures:

  • keeping data in UPPU's data center in Istanbul, on servers managed by UPPU;
  • isolating each company's data with a mandatory company filter; tying permissions to roles and explicit rights; showing phone numbers masked to agents;
  • TLS on all connections; encrypting Meta access tokens, WhatsApp PINs, webhook addresses and secrets with AES-256-GCM using a rotatable key ring separate from the application's general encryption key (APP_KEY), with each encrypted value bound to its company and record;
  • storing only the SHA-256 digest of API keys; scope, channel, IP range and expiry limits;
  • signed webhooks and checks that prevent target addresses from pointing into internal networks;
  • two-factor authentication and passkeys; mandatory two-factor authentication for platform administrators; limits on login attempts; password confirmation for sensitive actions;
  • logging of data changes and security events in an audit log; passwords, codes and tokens are never logged;
  • a firewall, mandatory access control (SELinux), administrative access by key only and from restricted addresses, and automatic security updates on the servers;
  • nightly database backups kept for 7 days, with restores tested every month;
  • automatic nightly deletion of data whose retention period has expired, documented by destruction records.

UPPU may update these measures in line with technological developments; an update may not lower the level of protection.

E.7. Sub-processors

UPPU processes Customer Data in its own data center and does not use a cloud or hosting provider to host this data. Service emails (verification, invitation and alert emails) are sent through mail.uppu.net; these emails do not contain people's names or message contents. UPPU informs the Customer at least 30 days before using a new sub-processor that will access Customer Data; if the Customer objects on reasonable grounds, it may terminate the Agreement.

E.8. Meta channels and transfers abroad

UPPU stores Customer Data in Türkiye. On the WhatsApp, Messenger and Instagram channels connected by the Customer, messages pass through Meta's systems abroad because that is how these channels work. The Customer connects these channels with its own Meta account and by accepting Meta's terms directly; Meta processes this data under the terms between the Customer and Meta and is not a sub-processor of UPPU. Informing people about the use of these channels and the obligations under Article 9 of the KVKK are the Customer's responsibility; UPPU provides the necessary information on the Customer's request.

E.9. Assistance with data subject requests

The panel lets the Customer export a person's data in JSON format and erase it permanently; if the Customer's API access is enabled, the erasure is reported to the Customer's systems with the contact.erased webhook event. UPPU forwards requests it receives directly to the Customer within 3 business days at the latest and reasonably assists the Customer in answering them. Clause E.4 applies to deletion requests.

E.10. Data breach notification

When UPPU becomes aware of a data breach affecting Customer Data, it informs the Customer without undue delay and within 48 hours at the latest. The notification includes, as far as then known, the nature of the breach, the categories of data and data subjects affected, the likely consequences and the measures taken or proposed. UPPU assists the Customer in meeting its obligation to notify the Personal Data Protection Board and the people concerned.

E.11. Information and audits

UPPU answers the Customer's reasonable requests for information and documents showing compliance with this annex. With reasonable prior notice, subject to confidentiality and at its own cost, the Customer may carry out an audit, or have one carried out by an independent auditor, at most once a year. Audits are conducted so as not to endanger the confidentiality of other customers' data or the security of the Platform.

E.12. Retention, return and deletion

  • Conversations and messages are deleted automatically at the end of the period chosen by the Customer, counted from the conversation's last activity (30 to 730 days; 365 days if not chosen); incoming media files 90 days after receipt; raw copies of messages after 90 days (or the Customer's retention period, if shorter). The periods for other records (such as webhook events, the API log, uploaded media and records of messages that could not be processed) are in the retention table of the Privacy Policy.
  • Before the Agreement ends, the Customer can export people's data from the panel, one person at a time, as JSON; if API access is enabled, it can retrieve messages and media through API v1. For a bulk export the Customer writes to UPPU, and UPPU provides it in JSON format within 30 days.
  • The Customer Data of a closed company is permanently deleted, all at once, 365 days after closure; individual or earlier deletion is not possible during this period. The Customer can erase people's data in the panel before closing the company.
  • The company record (name), billing name, tax number, accepted contract version and setup steps are kept for 10 years (Tax Procedure Law No. 213 and Turkish Commercial Code No. 6102), and audit logs for at least 3 years and at most 10 years; these records are not deleted when a closed company is purged and are destroyed when their period has passed.
  • Deleted data remains in backups for at most 7 days and in database change logs for at most 14 days.
  • Each automatic deletion is documented by a destruction record containing only counts. On request, the deletion is confirmed to the Customer in writing.

E.13. Obligations arising from Meta

For data obtained through Meta channels, UPPU also: processes the data only on the Customer's behalf and on its instructions; keeps each customer's data separate; contractually prohibits the Customer from processing this data in breach of Meta's terms (clause 7.2); cuts off access at Meta's request; deletes the access tokens when the Customer removes UPPU's partner access from its WhatsApp Business account, and for Facebook Page and Instagram channels deletes the stored token when the channel is disconnected or when the company's data is purged; and does not use the data for profiling, enrichment or training AI models.

E.14. Liability and term

The parties' liability under this annex is subject to clause 14 of the Agreement; joint responsibility for data security measures under Article 12(2) of the KVKK is reserved. This annex remains in force after the Agreement ends until the Customer Data has been deleted.