Data processing agreement
Last updated: 2026-10-21
This Data Processing Agreement (“DPA”) forms part of the Kroveo terms of service between your organisation (“Customer”, controller) and Deka Teknoloji Bilişim Hizmetleri ve Ticaret A.Ş. (“Deka”, processor). It applies when Deka processes personal data in Customer’s workspace, and is designed to meet GDPR Art. 28 and KVKK Art. 12.
Where Customer is established in the EEA, the United Kingdom or Switzerland, the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914, Module Two: controller to processor), together with the UK International Data Transfer Addendum and the Swiss amendments where applicable, are incorporated into this DPA for the transfer of personal data to Deka in Türkiye. Sections 1–5 of this DPA complete Annex I and the security page completes Annex II of the Clauses; Customer is the data exporter and Deka the data importer; the competent supervisory authority is the one in Customer’s country; Clause 17 option 1 applies with the law of Ireland and Clause 18 the courts of Ireland.
1. Subject and duration
Deka processes personal data only to provide Kroveo to Customer, for the duration of the agreement and the deletion period that follows it.
2. Nature of the processing
Hosting, storing, analysing and transforming content Customer uploads (images, descriptions, Power BI files and the data inside them), generating reports, and publishing them where Customer asks.
3. Data and data subjects
Personal data Customer chooses to upload, which may include data about Customer’s employees, customers or other individuals contained in reports and datasets, and Customer’s users’ account data. Customer should not upload special categories of personal data unless necessary and lawful.
4. Deka’s obligations
Deka will:
- process personal data, including any transfer, only on Customer’s documented instructions, which are these terms and Customer’s use of Kroveo, unless Union, member state or Turkish law requires otherwise, in which case Deka informs Customer before processing unless that law prohibits it;
- inform Customer if, in Deka’s opinion, an instruction infringes GDPR or KVKK;
- ensure people with access are bound by confidentiality;
- apply the technical and organisational measures described on the security page, maintained under Deka’s ISO/IEC 27001-certified management system;
- help Customer respond to data subject requests and with security, impact assessments and authority consultations, as far as reasonable;
- notify Customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Customer data;
- delete or return Customer data at the end of the service as described in the terms, unless law requires storage;
- make available information needed to show compliance, primarily through its certifications and reports; audits, including on-site inspections by Customer or an auditor mandated by Customer and bound by confidentiality, are possible with 30 days’ notice, at Customer’s cost, once a year unless a supervisory authority or a data breach requires otherwise.
5. Sub-processors
Customer authorises the sub-processors listed on the security page: Cloudflare, Inc. (hosting, storage, database); Microsoft (sign-in, Fabric publishing on Customer’s instruction); Google (sign-in). Customer’s AI provider is engaged by Customer under Customer’s own agreement and is not a Deka sub-processor. Deka imposes on each sub-processor data protection obligations equivalent to this DPA and remains responsible for their performance. Deka will give 30 days’ notice of new sub-processors on that page and by email to admins; Customer may object on reasonable grounds and, if no solution is found, end the affected service.
6. International transfers
Where personal data is transferred outside Türkiye or the EEA, Deka relies on adequacy decisions (including the EU–US Data Privacy Framework), Standard Contractual Clauses and, for transfers from Türkiye, the safeguards required by KVKK Art. 9. Customer authorises these transfers.
7. Liability and precedence
Liability under this DPA follows the terms of service. If this DPA conflicts with the terms on data protection, this DPA prevails.
Contact: privacy@kroveo.com. A signed copy is available on request.