Data Processing Agreement

This agreement is part of the Terms of Use and applies to personal data processed on behalf of the customer within the scope of the OnlyContact service. A customer who accepts the terms is deemed to have accepted this agreement as well. It is made under Article 12 of KVKK and, to the extent applicable, Article 28 of the GDPR.

Roles

The customer is the data controller (or a data processor on behalf of its own customers), and Only Contact is the data processor (or sub-processor). For data we process on our own behalf for account management, billing and security, the Privacy Policy applies.

Data processed

• Purpose: providing the CRM, messaging, form, social media, email and AI assistant features used by the customer.
• Data subjects: the customer’s leads, customers, site visitors, people it exchanges messages with and people who write comments, email senders, team members.
• Types of data: identity and contact details, channel IDs, message, comment and email content, files, form responses, campaign and UTM information, IP address, browser information, notes and other fields added by the customer.
• Duration: the term of the service and the deletion process below.

Customer’s obligations

The customer is responsible for the legal basis of the processing, informing data subjects, the necessary consents, commercial message rules, cookie and live chat notices on its site, the measures required for special categories of data, data subject requests and its own obligations regarding transfers abroad. The settings and use of the service are deemed to be the customer’s instructions.

Our obligations

• We process data only on the customer’s instructions and to provide the service; if there is a legal requirement, we notify the customer where permitted. If we believe an instruction violates legislation, we inform the customer.
• We ensure that staff who access the data are under an obligation of confidentiality.
• We apply the security measures below.
• We provide reasonable support with data subject requests and assessments required by legislation. We forward to the customer any requests that come directly to us.
• When we become aware of a personal data breach affecting customer data, we inform the customer without delay and share the information we have.
• On request, we provide reasonable information demonstrating compliance with this agreement. On-site audits are agreed in writing, with reasonable prior notice and under confidentiality terms.

Security measures

• Hashing of passwords; encryption of channel access tokens and email passwords.
• Separation between companies at application level, user permissions, recording of support logins.
• Login and request limits, webhook signature verification, form security, file type checks, removal of metadata from images.
• The security measures of the hosting and network providers.

Messages and lead content are not separately encrypted in the database, and two-step verification for users is not currently offered. The customer assesses whether these measures are adequate given the nature of its data.

Sub-processors

The customer gives general authorisation for us to use the sub-processors below. Before adding a new sub-processor, we give at least 14 days’ prior notice on this page or by email; the customer may object on reasonable grounds and, if no solution is found, may terminate the relevant service. We impose on sub-processors obligations substantially similar to those in this agreement and we are legally responsible for their processing.

Meta, Telegram and the customer’s email provider are independent services that the customer connects by its own choice and are subject to their own terms.

Transfers abroad

The customer is aware that sub-processors may be located outside Turkey and the European Economic Area and permits these transfers. Transfers are made under the mechanisms in Article 9 of KVKK and Chapter V of the GDPR.

Deletion and return

When the account owner confirms the account deletion request with the email code, the account closes. When our team approves, customer data is deleted from our systems at once; if approval is not given, it is deleted after 30 days at the latest, and an email is sent to the person who made the request. Raw webhook logs are removed within 30 days at the latest, application logs within 90 days at the latest, and copies in backups at the end of the backup cycle; statutory retention requirements are reserved. A copy of the data may be requested at [email protected] before deletion.

Liability and precedence

Liability is subject to the Terms of Use; cases where the law does not permit limitation are reserved. On matters relating to personal data, if this agreement and the terms conflict, this agreement applies.