Turkish Data Processing Agreement (Veri İşleme Sözleşmesi) — English Reference

CIQRA OÜ · Version 1.1 · Last updated: 30 October 2026 · English reference translation of the Turkish Veri İşleme Sözleşmesi. For data controllers established in Türkiye, the Turkish text governs on matters specific to Turkish law; on all other matters it is read together with the Data Processing Agreement.

What this agreement is

The Turkish Data Processing Agreement is the controller–processor agreement between a store owner in Türkiye (or a store owner processing personal data of individuals in Türkiye) and CIQRA OÜ. It restates in Turkish the terms of CIQRA's English Data Processing Agreement version 2.5 and adds the provisions required by Türkiye's Law No. 6698 ("KVKK"). It is accepted at signup by ticking a separate box; the acceptance is recorded with the document version, a hash of the text, the date and time, the accepting user and, where it could be verified, the IP address.

Provisions added for KVKK

  1. Roles (Section 1). For Merchant Personal Data the store owner is the data controller and CIQRA the data processor; CIQRA is a controller only for its own purposes, which are covered by its Privacy Policy and KVKK Information Notice.
  2. Data security — KVKK Art. 12 (Section 4). CIQRA applies the technical and organisational measures in Annex 2. The parties acknowledge that, where CIQRA processes personal data on the store owner's behalf, they are jointly responsible for taking the security measures (Art. 12(2)); the store owner's audit right under Art. 12(3) is exercised as set out in Section 10. Confidentiality survives the end of employment (Art. 12(4)).
  3. Data subject requests — KVKK Art. 11 and 13 (Section 6). CIQRA forwards requests it receives to the store owner and assists it in answering within the 30-day period. The store owner can export a Shopper's data and request its erasure from the Shopper's page in the dashboard ("Personal data"); erasure runs after a waiting period, and financial records keep the transaction with the person removed.
  4. Breaches (Section 8). CIQRA notifies the store owner without undue delay and in any event within 72 hours, in Turkish and under the headings of the Board's breach notification form, so that the store owner can notify the Personal Data Protection Board within 72 hours as required by Board Decision 2019/10.
  5. Transfers abroad — KVKK Art. 9 (Section 11 and Annex 4). Making data available to CIQRA, which hosts it in the European Union, is a transfer abroad. The safeguard is the Board's Standard Contract 2 (controller to processor), signed separately and unchanged; this agreement does not replace it and, in case of conflict, the standard contract prevails.
  6. Retention and destruction (Section 9). The default periods of DPA Section 9 apply, together with the store owner's own retention and destruction policy; destruction records are kept for at least 3 years.

Annex 4 — Transfers abroad (KVKK Art. 9)

  1. Instrument. Standard Contract 2 (from data controller to data processor) announced by Board Decision 2024/959 of 4 June 2024. Official text: https://www.kvkk.gov.tr/Icerik/7931/Kisisel-Verilerin-Yurt-Disina-Aktarilmasinda-Kullanilacak-Standart-Sozlesme-2-Veri-Sorumlusundan-Veri-Isleyene-. It is used unchanged; only the fields the official text leaves to the parties are completed (general authorisation of sub-processors with 30 days' notice; the party that notifies; the annexes, which are the same as Annexes 1–3 of this agreement).
  2. Notification. The standard contract must be notified to the Personal Data Protection Authority within 5 business days of the last signature (Regulation of 10 July 2024, Art. 14(5)). The parties may designate the notifying party; CIQRA's Türkiye Market Terms §4.2 provide that CIQRA notifies, and the data importer is named as the notifying party. Notification is made through the Authority's Standard Contract Notification Module (https://standartsozlesme.kvkk.gov.tr/) or, where that is not available, by registered electronic mail (KEP) or in person. CIQRA sends the store owner the notification date and reference by email.
  3. Updates. A change of parties, content or annexes, or the end of the contract, is notified again (Art. 14(8)).
  4. Signature. The official text is signed by authorised signatories with a wet-ink or secure electronic signature; a click-through acceptance is not used for the standard contract. Documents in a foreign language (such as CIQRA OÜ's Estonian registry extract and signing authority) are attached with a notarised Turkish translation (Art. 14(6)).

Annexes 1–3

Annex 1 (details of the processing), Annex 2 (technical and organisational measures) and Annex 3 (sub-processors) are the same as Annex I, Annex II and Annex III of the Data Processing Agreement; the sub-processors are those in the Subprocessor List.