Data Processing Agreement

This English version is a translation provided for convenience. If it differs from the Turkish version, the Turkish version prevails.

This Data Processing Agreement (the “Agreement”) sets out the terms on which a planner using the Eventora Service has Eventora process personal data about their guests. It is an integral part of the Terms of Use. Terms not defined in this Agreement have the meaning given in the Terms of Use and in Personal Data Protection Law No. 6698 (“KVKK”).

1. The parties

Data controller: the customer who opens an account with Eventora and gives guest data to the Service, that is, the natural or legal person who is the Account Owner (the “Controller”). On electronic acceptance, the Controller’s details are those registered on the Account at the time of acceptance.

Data processor: IRON LABS TEKNOLOJİ ANONİM ŞİRKETİ (“Eventora” or the “Processor”)

2. Definitions

• Guest Data: personal data about guests and the people coming with them that the Controller uploads to or enters in the Service, or that arises while the Service is used. Its scope is set out in Annex 1.
• Data Subject: the natural person to whom Guest Data relates.
• Sub-processor: a third party the Processor engages to process Guest Data.
• Data Breach: a security incident leading to Guest Data being unlawfully obtained, disclosed, altered, lost or made unavailable.
• Authority and Board: the Personal Data Protection Authority and the Personal Data Protection Board.
• Instructions: the actions the Controller takes through the Service’s interface (adding guests, starting campaigns, starting calls, deleting and so on), this Agreement, and other instructions the Controller gives in writing.

3. Subject and duration

3.1. The subject of this Agreement is the rights and obligations relating to the Processor processing Guest Data on behalf of and on the instructions of the Controller while providing the Service.

3.2. The Agreement takes effect when the Terms of Use are accepted and remains in force for as long as the Processor processes Guest Data, until deletion or return under Section 15 is complete.

4. Nature and purpose of the processing

4.1. The Processor processes Guest Data only to provide the Service. This covers:

• storing, displaying and editing guest lists;
• importing guest lists from Excel files, with AI proposing the column mapping;
• sending guests invitations, reminders and event details by WhatsApp and SMS;
• calling guests with an AI voice assistant, recording their replies, notes and callback requests, and producing a transcript and a summary of the conversation;
• recording replies (Attending, Awaiting reply, Maybe, Declined), party sizes and companions;
• preparing seating plans and seating guests at tables;
• tracking the delivery status of messages and calls and settling credits.

4.2. A detailed description of the processing (data categories, groups of data subjects, retention and location) is in Annex 1.

4.3. The Processor does not use Guest Data for its own purposes, advertising or marketing, does not sell it, and does not pass it to third parties other than as set out in this Agreement. The Processor may use records that contain no personal data (for example, how many messages in a campaign were delivered) and aggregated statistics to keep the Service secure and to bill for it.

5. Instructions

5.1. The Processor processes Guest Data only on the Controller’s documented instructions. Actions taken through the Service’s interface and this Agreement are the Controller’s documented instructions.

5.2. Where required by law (for example, a court order or a request from a competent authority), the Processor may process Guest Data outside the instructions. In that case it informs the Controller in advance, unless the law forbids it.

5.3. If the Processor believes an instruction breaches the KVKK or other legislation, it informs the Controller at once and may suspend carrying out the instruction.

6. The Controller’s obligations and warranties

6.1. The Controller represents and undertakes that:

• it has a valid legal basis under KVKK art. 5 (and, where relevant, art. 6) to give Guest Data to the Service and to contact guests by WhatsApp, SMS and voice call;
• it has informed Data Subjects under KVKK art. 10 and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, stating that their data will be processed through Eventora and its sub-processors, including transfers abroad;
• it instructs the transfers abroad in Section 11 and has given the information those transfers require;
• it does not send commercial electronic messages through the Service, and where a message counts as one, obtaining the recipients’ prior consent under Law No. 6563 and the related Regulation, and registering with and querying the Message Management System (İYS), are its own responsibility;
• it keeps Guest Data accurate and up to date and does not enter data not needed for the event, in particular special categories of personal data (health, religion, ethnic origin and so on);
• it enters data about guests under 18 only where needed and where it has a legal basis.

6.2. The Controller is responsible for the lawfulness of the instructions it gives through the Service’s interface (whom to contact, when and by which channel).

6.3. Through the roles it gives its team, the Controller decides who has access to Guest Data, and it ensures that Team Members comply with this Agreement.

6.4. Where the Account Owner processes Guest Data on behalf of another controller (for example, an agency acting for a couple), it represents that it has that controller’s authority to use Eventora as a sub-processor and that it provides the obligations in this Agreement to that controller as well.

7. The Processor’s obligations

The Processor:

• processes Guest Data only in line with this Agreement and the instructions;
• takes and maintains the technical and organisational measures in Annex 2, under KVKK art. 12;
• ensures that only personnel who need access for their work have access to Guest Data (Section 8);
• engages sub-processors under Section 10;
• assists the Controller with Data Subject requests (Section 12) and data breaches (Section 13);
• provides the information the Controller needs to show compliance with this Agreement, under Section 14;
• deletes or returns Guest Data when the Agreement ends, under Section 15;
• does not keep guest names, phone numbers, message contents or call transcripts in its logs.

8. Confidentiality of personnel

8.1. The Processor ensures that its employees and assistants who can access Guest Data are under a written duty of confidentiality, which continues after their role ends.

8.2. Personnel access to Guest Data is limited to what is needed to run the Service, answer a support request, investigate a security incident or meet a legal obligation. Personnel are trained on the KVKK.

9. Security measures

9.1. The Processor takes the measures required by KVKK art. 12 and recommended in the Board’s Personal Data Security Guide, appropriate to the nature of the processing and the risks, to prevent unlawful processing of and access to Guest Data and to safeguard it. The measures taken are in Annex 2.

9.2. The Processor may update the measures in line with technological developments and risks. Updates may not lower the level of protection.

9.3. The parties acknowledge that, under KVKK art. 12/2, the Controller and the Processor are jointly responsible for taking security measures. The Controller also takes the measures set out in the Terms of Use for the security of its Account (passwords, roles, devices).

10. Sub-processors

10.1. The Controller gives the Processor general authorisation to engage the sub-processors listed in Annex 3.

10.2. The Processor enters into a written contract with each sub-processor containing data protection obligations no less protective than those in this Agreement, and sends each sub-processor only the least data the task needs. The Processor is liable to the Controller for a sub-processor’s failure to meet its obligations as for its own acts.

10.3. The Processor informs the Controller by email or in the Service at least 15 days before adding or replacing a sub-processor, and updates Annex 3.

10.4. Within 15 days of the notice, the Controller may object to the change on reasonable data protection grounds by writing to kvkk@eventora.com.tr. If the parties cannot find a reasonable solution, the Controller may end the agreement by deleting its account as described in the Terms of Use. If no objection is made in time, the change is accepted.

10.5. In urgent cases (for example, a sub-processor’s service ending suddenly, or a security risk), the Processor may make the change at the same time as the notice; the Controller’s right to object is reserved.

11. Transfers abroad

11.1. Guest Data is stored in Google Cloud’s data centres in Belgium (europe-west1). Some sub-processors process data in the European Union, the United States or other countries. The transfers and countries are in Annex 3.

11.2. Transfers abroad are made under KVKK art. 9 and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad: on the basis of an adequacy decision of the Board for the destination country where one exists, and otherwise by signing the standard contracts published by the Board. The Processor notifies the Authority of the standard contracts it signs within 5 business days of signing.

11.3. The exceptions for occasional transfers (such as the data subject’s explicit consent) are used only for non-recurring transfers where the safeguards above are not available, and only after assessing them together with the Controller.

11.4. The Controller instructs the Processor to make the transfers set out in this section and in Annex 3.

12. Assistance with Data Subject requests

12.1. Requests from guests concerning their rights under KVKK art. 11 are made to and answered by the Controller. The Controller can view, correct and delete guest details through the Service’s interface.

12.2. If a guest makes a request directly to the Processor, the Processor passes it on to the Controller without delay and tells the guest that the request should be made to the planner, who is the data controller. The Processor does not answer the request itself unless required by law.

12.3. Where the interface is not enough (for example, deleting data in an archived event or in message and call records), the Controller may ask for help by writing to kvkk@eventora.com.tr. The Processor helps within a reasonable time, so that the Controller can meet its 30-day statutory deadline for answering.

13. Data breach notification

13.1. When the Processor becomes aware of a Data Breach affecting Guest Data, it notifies the Controller without undue delay and in any case within 24 hours of becoming aware, at the email address registered on the Account and, where needed, in the Service. This allows the Controller to meet its obligation under KVKK art. 12/5 and the Board’s decision to notify the Board within 72 hours.

13.2. The notice contains, as far as known at the time: the nature and time of the breach, the categories of data and approximate number of people affected, its likely consequences, the measures taken and proposed, and a contact person. Where the information cannot be given at once, it is given without delay as it becomes known.

13.3. The Processor takes the measures needed to limit the effects of the breach at once, cooperates with the Controller in the investigation, and keeps records of the breach.

13.4. Notifying the Board and the Data Subjects is the Controller’s obligation. The Processor does not make these notifications on the Controller’s behalf unless required by law or instructed by the Controller. The Processor’s notice of a breach is not an admission of fault.

14. Audits

14.1. On the Controller’s written request, the Processor provides the information and documents needed to show compliance with this Agreement (a description of the security measures, the current list of sub-processors and, where available, sub-processors’ independent audit reports and certifications).

14.2. Where the documents are not sufficient, after a Data Breach, or when the Board requires it, the Controller may carry out an audit itself or through an independent auditor under a duty of confidentiality. An audit:

• is notified in writing at least 30 days in advance (this period may be shortened after a Data Breach or at the Board’s request);
• takes place at most once a year, during business hours and without disrupting the Service;
• is limited to the processing of Guest Data and does not include access to other customers’ data, trade secrets or sub-processors’ premises;
• is at the Controller’s expense, except that if the audit shows the Processor has materially breached this Agreement, the Processor bears its reasonable costs.

14.3. Instead of an on-site audit, the Processor may offer to provide the same information through documents or a remote meeting.

15. Deletion or return

15.1. During the Agreement, the Controller may delete Guest Data through the Service’s interface.

15.2. When the last member of an Account deletes themselves, the Account is closed: its events are archived and running campaigns are cancelled. The Processor deletes the Guest Data (guests, imported files, message texts and numbers, and the calls’ numbers, outcomes, summaries, transcripts and any recordings) at the end of the retention period after closure (30 days).

15.3. Before closing its account, the Controller may ask for the Guest Data to be returned in a commonly used electronic format by writing to kvkk@eventora.com.tr. The Processor meets the request within a reasonable time.

15.4. Deleted data is removed from backups automatically within the backup cycle; during that time backups are used only for disaster recovery and are not processed for any other purpose.

15.5. Invoices, payment records and credit transactions are not Guest Data; they are kept for as long as tax and commercial law require. If there is any other Guest Data that the Processor is legally required to keep, the Processor keeps it only for that purpose and for as long as required, and keeps it confidential.

15.6. Excel files uploaded for an import are deleted when the import is complete; any that cannot be deleted then are removed automatically by a storage rule within 30 days at the latest. Floor plan files are deleted when the plan is replaced or removed.

16. Liability

16.1. Each party is liable for damage resulting from its own breach of its obligations under this Agreement and the KVKK. To the extent permitted by law, the Processor’s liability under this Agreement is subject to the liability provisions of the Terms of Use; liability for intent and gross negligence, and liability that cannot be limited by law, are reserved.

16.2. The Controller compensates the Processor for claims brought against it, administrative fines imposed on it and reasonable defence costs where these arise because the Controller gave Guest Data without a legal basis, did not inform Data Subjects, gave unlawful instructions, or sent unlawful messages through the Service.

17. Term, termination and precedence

17.1. This Agreement remains in force as long as the Terms of Use do, and cannot be terminated separately. When the Terms of Use end, this Agreement continues until the deletion in Section 15 is complete.

17.2. If this Agreement and the Terms of Use differ on the processing of Guest Data, this Agreement applies.

17.3. The Processor may change this Agreement using the procedure for changing the Terms of Use. Changes required by a change in the law or a Board decision may apply without waiting for the notice period.

17.4. This Agreement is governed by the laws of the Republic of Turkey. The jurisdiction and evidence provisions of the Terms of Use apply to disputes.

18. Acceptance and signature

18.1. This Agreement is accepted electronically together with the Terms of Use when signing up for the Service. Electronic acceptance has the same effect as signing the Agreement in writing.

18.2. Corporate customers may also wish to sign this Agreement separately, by hand or with a secure electronic signature. They can write to hukuk@eventora.com.tr for this. If the signed copy and this text differ, the signed copy applies.

Annex 1: Description of the processing

Annex 2: Technical and organisational measures

Hosting and infrastructure

• The database (Cloud SQL, PostgreSQL), file storage (Cloud Storage) and application servers (Cloud Run) are in Google Cloud’s europe-west1 (Belgium) region.
• Google Cloud encrypts data at rest by default.
• File storage is not public; files are uploaded and downloaded only through short-lived signed links.
• The services that run background work are closed to the internet and accept only authenticated internal calls.
• Each service runs under its own service account with only the permissions it needs. Passwords and API keys are kept in Google Secret Manager, not in the source code.
• Regular database backups are taken within Google Cloud.

Security in transit

• All traffic between the apps and the servers goes over HTTPS (at least TLS 1.2, HSTS) through Cloudflare.
• Connections to service providers (Meta, SMS operators, the payment institution, the AI provider) use encrypted channels. The signatures of notifications (webhooks) from providers are verified.
• Phone calls are connected to the telephone network through the operator’s infrastructure.

Access control

• Users authenticate with Firebase Authentication; accounts opened with email and password cannot be used until the email address is verified.
• The web session is held in a cookie only the server can read (httpOnly). Sensitive actions such as deleting an account require a recent sign-in.
• Codes sent for phone sign-in are stored only as keyed hashes (HMAC); sending codes and attempts are limited per number and per IP address.
• Client integrity is checked with Firebase App Check.
• Access to Guest Data is limited by role (Organisation, Organisation Employee, Host); permissions are enforced on the server, not in the interface. Users see only the data of the accounts and events they belong to.
• Eventora personnel’s access to production data is limited to those who need it for their work.

Data minimisation

• Logs do not contain guest names, phone numbers, message contents or call transcripts; where a number has to appear, it is masked. Background jobs receive only record identifiers.
• For Excel imports, the AI provider sees only the column headers and at most 5 sample rows with phone numbers masked and email addresses hidden; it never sees the whole list.
• The voice assistant is given only the event details and the guest’s name, party size and tag.
• Phone numbers are stored in a single format (E.164).

Retention and deletion

• Uploaded Excel files are deleted when the import is complete; a storage rule also deletes them after 30 days at the latest.
• Floor plan files that are replaced or removed are deleted.
• The Guest Data of closed accounts is deleted automatically at the end of the retention period.

Integrity and traceability

• Credit transactions are kept in an append-only ledger; entries are never changed or deleted, and corrections are made with a new entry.
• The status history of messages and calls is recorded.

Organisational measures

• Personnel are under a duty of confidentiality and are trained on the KVKK.
• A new sub-processor is not used before a legal review.
• In a data breach, the notification process in Section 13 applies.

Annex 3: Sub-processors

Sub-processors that process Guest Data

Other service providers that do not process Guest Data

The following providers process only the data of account holders and team members. Eventora is the data controller for that data, and its processing is governed by the Privacy Policy. They are listed for information.