Data Processing Agreement · Bilgi Ticareti Help

1. Parties and roles

This agreement is an annex to the Service Agreement. With respect to the student, customer, subscriber and visitor data that the Entrepreneur uploads to the Platform or collects through the Platform (“Customer Data”), the Entrepreneur is the data controller and Vista AI Technology LLC is the data processor.

2. Subject matter of processing

Customer Data is processed solely for the purpose of providing the Platform services: hosting, course access, email and message delivery, appointment and webinar management, routing to the payment flow, analytics, and AI operations initiated by the Entrepreneur. Data categories: identity, contact, order, learning progress, communication preferences and other information collected in the Entrepreneur's forms.

3. Obligations of the data processor

To process Customer Data only on the Entrepreneur's instructions and within the operation of the Platform; not to use it for its own purposes.
To logically separate the data from other Entrepreneurs' data and to take technical and organizational measures in accordance with KVKK Art. 12.
To subject its personnel to a confidentiality obligation.
To notify the Entrepreneur without delay upon becoming aware of a data breach and to cooperate in remedying the breach.
To provide the Entrepreneur with reasonable assistance in responding to data subject requests (including the data download and account deletion tools in the portal).

4. Sub-processors

The Entrepreneur gives general authorization for the use of sub-processors in the areas of hosting, database, storage/CDN, email, video, AI and accounting for the provision of the Platform. The list of sub-processors is shared on request; the addition of a new sub-processor is notified a reasonable time in advance.

5. Transfers abroad

Some of the sub-processors provide services outside Türkiye. Transfers are made within the framework of standard contracts and appropriate safeguards under KVKK Art. 9. The Entrepreneur is obliged to state the transfer abroad in its own privacy notice; the legal pages automatically generated by the Platform include this information.

6. Termination of the agreement

When the service ends, the Entrepreneur can export its data within 30 days. At the end of this period, Customer Data is deleted or anonymized, except for data that must be retained by law.