Data Processing Addendum

1. Parties and Subject Matter

1.1. This Data Processing Addendum ("Addendum") is an integral part of the Terms of Service concluded between Yaşar Alkan Anatolia Art Web Hizmetleri ("zuwinasa cloud") and the member using zuwinasa cloud services ("Member").

1.2. This Addendum governs the rights and obligations of the parties under Turkish Personal Data Protection Law No. 6698 ("KVKK") and related legislation with regard to personal data that zuwinasa cloud processes on behalf of the Member while providing the services.

1.3. In the event of a conflict between this Addendum and the Terms of Service concerning the processing of personal data, this Addendum prevails.

2. Definitions

• Board / Authority: the Turkish Personal Data Protection Board / Personal Data Protection Authority.
• Data controller: the person who determines the purposes and means of processing personal data. Under this Addendum, the Member.
• Data processor: the person who processes personal data on behalf of the data controller based on the authority granted by it. Under this Addendum, zuwinasa cloud.
• Sub-processor: a third-party service provider that zuwinasa cloud uses to provide the services and that processes Member data.
• Hosted data: personal data contained in the websites, databases, mailboxes, files and virtual servers that the Member hosts on the services.
• Data breach: hosted data being obtained by others by unlawful means.

3. Scope of Processing

3.1. Subject and purpose: provision of hosting, email, domain and related technical services. In this context, data is stored and backed up, emails are relayed and filtered, and the security of the services is ensured.

3.2. Duration: the term of the service under the Terms of Service plus the deletion periods set out in section 12.

3.3. Categories of data subjects: visitors, customers, members and employees of the Member's websites, parties to email correspondence and other persons included in the data hosted by the Member.

3.4. Categories of data: any data the Member chooses to host, for example identity, contact, customer transaction, order, email content and transaction security data.

3.5. zuwinasa cloud does not check the content of hosted data and has no knowledge of it. If the Member processes special categories of personal data, the Member is responsible for taking the necessary additional measures.

4. Instructions

4.1. zuwinasa cloud processes hosted data only on the documented instructions of the Member. The following count as the Member's instructions:

• the Terms of Service and this Addendum,
• actions the Member takes in the member panel and the control panel (Plesk etc.),
• written instructions the Member gives through the support channels.

4.2. If zuwinasa cloud considers an instruction to be unlawful, it informs the Member and may refuse to carry it out.

4.3. Actions taken at the request of competent authorities where required by law are an exception to this section. Unless prohibited by law, zuwinasa cloud informs the Member of such actions.

5. Confidentiality

zuwinasa cloud ensures that its employees and assistants who can access hosted data are bound by confidentiality. Their access is limited to what is necessary to provide the service.

6. Security Measures

In accordance with Article 12 of the KVKK, zuwinasa cloud takes the technical and organisational measures listed in Annex 2 to ensure an appropriate level of security. The Member is responsible for security in the areas under its own control, for example keeping passwords, website software, plugins and themes up to date and secure and making its own backups.

7. Sub-processors

7.1. The Member gives zuwinasa cloud general authorisation to use the sub-processors listed in Annex 1.

7.2. At least 30 days before adding or replacing a sub-processor, zuwinasa cloud updates this page and notifies the Member at its registered email address.

7.3. A Member who objects to the change on reasonable grounds may terminate the service before the change takes effect. Refunds for the unused period are subject to the Delivery and Refund Policy.

7.4. zuwinasa cloud concludes contracts with its sub-processors that provide essentially the same level of protection as the obligations in this Addendum.

8. Transfers Abroad

8.1. Hosted data is stored and processed in the countries specified in the Terms of Service and in Annex 1.

8.2. Transfers to sub-processors abroad are made with the appropriate safeguards provided for in Article 9 of the KVKK.

8.3. The Member is responsible for informing its own data subjects, in its own privacy notice, that their data is hosted abroad.

9. Data Subject Requests

9.1. If a data subject request reaches zuwinasa cloud directly, zuwinasa cloud forwards it to the Member within five business days at the latest; except where required by law, it does not answer the request itself.

9.2. When answering requests, the Member can access, correct and delete data through the control panel. For actions that cannot be carried out in the panel, zuwinasa cloud provides reasonable assistance.

10. Data Breaches

10.1. If zuwinasa cloud detects a data breach affecting hosted data, it informs the Member without delay and within 24 hours at the latest at the Member's registered email address.

10.2. The notification contains the following information, as far as it is known at the time:

• the nature of the breach,
• the systems and data categories affected,
• the likely consequences,
• the measures taken and recommended,
• a contact person.

10.3. The obligation to notify the Board and the data subjects lies with the Member as data controller. Under Board decision No. 2019/10, this notification must be made within 72 hours at the latest. zuwinasa cloud cooperates reasonably with the Member in this process.

11. Information and Audits

11.1. On the Member's reasonable request, zuwinasa cloud provides in writing the information necessary to demonstrate compliance with this Addendum. This includes referring the Member to the public certificates and reports of the sub-processors.

11.2. Because the infrastructure is shared, no on-site audits are carried out on behalf of individual Members. The audit rights of competent authorities remain unaffected.

12. End of Service and Deletion of Data

12.1. When the service ends for any reason, hosted data is deleted at the end of the periods in sections 7 and 8 of the Terms of Service: 15 days after suspension for an unpaid web hosting service, 3 days after stopping for a virtual server.

12.2. For web hosting services, copies in the infrastructure backups are deleted within the backup cycle, within 3 months at the latest. zuwinasa cloud does not back up virtual servers.

12.3. The Member is responsible for downloading its data before these periods expire.

12.4. Traffic data under Law No. 5651 and records that must be kept under tax and commercial law are retained for the periods required by law.

13. Liability

13.1. Each party is liable for breaches of its obligations under this Addendum in proportion to its fault. The limitations of liability in the Terms of Service also apply to this Addendum to the extent permitted by law.

13.2. The joint liability provision in Article 12(2) of the KVKK remains unaffected. In the internal relationship between the parties, liability is determined according to the degree of fault. The recourse provision in the Terms of Service remains unaffected.

14. Term and Changes

14.1. This Addendum takes effect upon acceptance of the Terms of Service and remains in force after the end of the service until the deletions under section 12 are completed.

14.2. zuwinasa cloud may update this Addendum because of changes in legislation or in the services. Material changes are notified to the Member at its registered email address.

Annex 1: Sub-processors

Annex 2: Technical and Organisational Measures

Technical measures

• TLS (SSL) encryption for the panels and server administration; TLS support for email connections
• Automatic security updates for Plesk and operating system packages; kernel updates applied during regular maintenance
• Server firewall with a default "deny" rule and Fail2Ban against brute-force attacks
• Web application firewall (ModSecurity)
• Daily malware scanning and real-time antivirus
• Each hosting subscription runs under its own system user
• Password-based SSH login as root disabled on the servers
• Mandatory two-factor authentication for the administration panel
• Daily incremental and weekly full backups for web hosting services, plus a daily full-server backup encrypted with AES-256
• DDoS and bot protection for domains whose name servers are managed in our Cloudflare account

Organisational measures

• Access to hosted data limited to authorised persons and to situations required by the service

Physical security: The physical security of the data centers is ensured by the sub-processor concerned in its own certified infrastructure.