Data Processing Agreement (DPA)

Under Turkish Law No. 6698 on the Protection of Personal Data and its secondary legislation · Version 1.0 · Last updated: 12 June 2026

Article 1 — Parties

This Data Processing Agreement (the "Agreement" or "DPA") is concluded between the following parties:

The Data Controller and the Data Processor are jointly referred to as the "Parties" and individually as a "Party".

Article 2 — Definitions

Capitalised terms are used, unless stated otherwise, with the meanings given in Law No. 6698 (Art. 3) and its secondary legislation. The main ones: Law/KVKK (Law No. 6698); Authority/Board (the Turkish Personal Data Protection Authority/Board); Personal Data, Special Categories of Personal Data, Processing, Data Controller, Data Processor, Sub-Processor (Annex 2); Data Subject (the natural-person representatives of the businesses contacted through the platform, and natural-person merchants/tradespeople who own such businesses); Standard Contract (the template texts adopted by the Board's resolution of 04.06.2024); Commercial Electronic Message/İYS (Law No. 6563); Processing Instruction (the campaign, targeting, listing and sending actions the Customer creates on the platform are deemed documented instructions).

Article 3 — Subject Matter and Scope

The subject of this Agreement is to regulate the rights and obligations regarding the lawful conduct, under the KVKK, of the personal-data processing activities carried out on the Customer's behalf through the LeaderMix platform within the scope of the Terms of Service / Subscription relationship between the Parties (the "Main Agreement"). This Agreement is an integral annex to the Main Agreement; in case of conflict concerning the protection of personal data, this Agreement prevails. The Agreement covers the processing activities, data categories and data-subject groups set out in Annex 1.

Article 4 — Roles of the Parties and Rationale

4.1. By the essential nature of the processing activity, the Customer is the "Data Controller" and LeaderMix is the "Data Processor". The Customer determines the purpose and essential means of the processing (targeting, listing, with which text/when to communicate, starting/stopping campaigns) (KVKK Art. 3/1-ı); LeaderMix executes these decisions on the Customer's behalf in line with the Customer's platform instructions (Art. 3/1-ğ) and does not use the data for any independent purpose of its own. As the messages sent promote the Customer's goods/services, the "service provider" capacity under Law No. 6563 also belongs to the Customer.

4.2. LeaderMix is an independent data controller only for the following activities (outside the scope of this Agreement): establishing/operating/securing the platform; account management, billing, statutory retention; product development and statistics using only anonymised/aggregated data.

4.3. Data isolation and pooling prohibition (architecturally verified). Each Customer's lead records are kept isolated and tied to the user identity; duplicate-record checks are performed only within the relevant Customer's own data set; when the same business is scanned by different Customers, separate records are created; one Customer's lead is not made visible to or reused by others; access is filtered by user identity. LeaderMix undertakes that it does not pool the personal data it collects in a common database for multiple Customers and does not reuse it. If this architecture changes and data is used for common purposes across Customers, LeaderMix becomes a joint/independent controller for that activity and will notify the Customer of such a change in advance.

Article 5 — Nature, Purpose and Duration of Processing; Data Categories

In summary, the processing activity consists of collecting business/representative contact data from publicly available sources (Google Maps/Places, business websites, online directories, LinkedIn), verifying it, performing AI-based company analysis and message-text generation, sending promotional e-mails and tracking replies; details are in Annex 1. LeaderMix undertakes not to process beyond Annex 1; not to collect/process special categories of data under KVKK Art. 6; and, if such data is detected incidentally, to destroy it without delay and inform the Customer.

Article 6 — Legal Grounds for Processing (KVKK Arts. 5–6 and Law 6563/İYS)

6.1. The Customer ensures that at least one of the conditions in KVKK Art. 5 exists for the data processed. The principal legal ground is the Customer's legitimate interest (Art. 5/2-f), provided the data subjects' fundamental rights and freedoms are not harmed; the Customer documents the balancing test. The mere fact that data is publicly available is not sufficient on its own (the limit of Art. 5/2-d). Explicit consent is not used as the basis for collection.

6.2. The processing does not involve special categories of data (Art. 6); the Parties are jointly responsible for maintaining this state.

6.3. The duty to inform (Art. 10) belongs to the Customer. To support this, every outgoing e-mail contains (i) on whose behalf the message is sent, (ii) the source/purpose/legal ground of the data, (iii) the KVKK Art. 11 application channel and (iv) an opt-out link; LeaderMix places these elements technically, while the Customer is responsible for the lawfulness of the content.

6.4. Commercial electronic messages (Law 6563/İYS): if the recipient is a merchant/tradesperson, prior consent is not mandatory, but the opt-out right is provided and refusal notifications are enforced; registering recipients with İYS, refusal checks and proving merchant/tradesperson status rest with the Customer in its service-provider capacity. If the recipient is not a merchant/tradesperson, prior consent (opt-in) is the rule. İYS registration, consent/refusal management and recording refusals in İYS within three business days rest with the Customer; LeaderMix provides the opt-out infrastructure.

Article 7 — Obligations of the Data Processor

• Processing only on instructions; it notifies the Customer without delay of any instruction it considers unlawful.
• Confidentiality; it binds everyone with access by written confidentiality undertakings (indefinitely, even after termination).
• Data security (Art. 12) — it implements and keeps current the technical and organisational measures in Annex 3.
• For sub-processors it complies with Article 10; it imposes at least equivalent obligations on them.
• Support for data-subject requests (Article 12); it forwards any request reaching it directly to the Customer without delay.
• Data-breach notification — it informs the Customer within 24 hours at the latest of becoming aware (Article 13).
• Destruction/return at the end of the relationship — under the regime in Article 14; no general destruction promise conflicting with Article 14 is made.
• It keeps records for accountability; it notifies the Customer in advance of material changes to servers/locations (Annex 2/Annex 3).

Article 8 — Obligations of the Data Controller

• Ensures that one of the conditions in KVKK Art. 5/Art. 6 exists for every data item (Article 6).
• Fulfils the Art. 10 duty to inform towards data subjects; is responsible for the content of the notice.
• Fulfils the obligations under Law 6563/İYS (service-provider registration, consent/refusal, merchant-tradesperson proof, İYS transfer).
• Warrants the lawfulness of the instructions it gives LeaderMix.
• Fulfils its VERBİS obligation if subject to it; concludes Art. 11 requests reaching it within 30 days as a rule.

Article 9 — Technical and Organisational Security Measures

LeaderMix takes measures proportionate to the nature and risk of the data, in line with KVKK Art. 12 and the Authority's guidance (minimum list in Annex 3). Measures are reviewed periodically in light of technological developments and risk assessment. The Customer is responsible for the security of its own access accounts and the lists it creates.

Article 10 — Sub-Processors

The Customer gives general consent to the use of the sub-processors in Annex 2. LeaderMix gives at least 15 days' prior notice of any new/changed sub-processor; the Customer may object on reasonable, data-protection-related grounds and, if unresolved, may terminate with respect to the affected service. LeaderMix imposes at least equivalent obligations on every sub-processor and remains liable to the Customer for their acts. Article 11 applies to sub-processors located abroad.

Article 11 — International Transfers (KVKK Art. 9)

11.1. Transfers are subject to KVKK Art. 9 as amended by Law No. 7499 (in force since 01.06.2024) and the Regulation of 10.07.2024 (Official Gazette 32598).

11.2. Tiered regime: (a) adequacy decision; (b) appropriate safeguards (standard contract, BCR, undertaking + Board permission); (c) incidental cases — only for non-recurring transfers; not applicable to LeaderMix's systematic transfers.

11.3. As all of the sub-processors in Annex 2 are located abroad and the transfers are continuous, the principal mechanism is the Standard Contract. LeaderMix establishes the applicable Art. 9 mechanism with every foreign sub-processor, notifies the Authority of the Standard Contract within 5 business days of signature, and provides the notification record upon request.

11.4. As of the date of this Agreement, the Board has not issued an adequacy decision for any country; transfers rely on appropriate safeguards. LeaderMix maintains a transfer inventory; the Customer uses it for its own documentation obligations. Any transfer for which a valid safeguard cannot be established is stopped.

Article 12 — Data-Subject Rights (KVKK Art. 11) and Support

Data subjects have the rights under Art. 11 (to learn, information, purpose, third parties, rectification, Art. 7 erasure/destruction, notification, objection to automated analysis, compensation). Concluding the requests is the Customer's obligation; LeaderMix supports by performing the necessary technical operations (access/rectification/erasure/suspension) within a reasonable time and within 7 days at the latest; it does not answer on the merits any request reaching it directly, but forwards it to the Customer without delay. Ensuring that AI analysis does not produce decisions based exclusively on automated processing against the data subject is the Customer's responsibility.

Article 13 — Data-Breach Notification (KVKK Art. 12)

LeaderMix informs the Customer within 24 hours at the latest of becoming aware of a breach, covering the nature of the breach, the affected data-subject/data categories, the likely consequences and the measures taken. This period is intended to allow the Customer to make its own notification to the Board (within the reasonable 72 hours under Resolution No. 2019/10). LeaderMix limits the effects and gives full support to the investigation; it makes notifications to the public/third parties only upon the Customer's written instruction.

Article 14 — Retention and Destruction

14.1. Data is subject to the principles of KVKK Art. 4 (purpose-limited/proportionate retention) and Art. 7 (erasure/destruction/anonymisation when the purpose ceases).

14.3. Opt-out records: upon an opt-out request, the relevant data is removed from active processing; the minimum data strictly required to evidence the refusal may be retained only for that purpose and limited to the statutory period.

14.4. Rule at the end of the relationship / account closure — destruction: upon termination of the Main Agreement or closure/deletion of the account, (a) LeaderMix anonymises the account and user record and closes access; (b) the lead records belonging to the Customer and the linked third-party data are destroyed or irreversibly anonymised as the processing purpose has ceased (returned if the Customer expressly requests); no indefinite retention on the grounds that it "might possibly be needed"; (c) even if the same person is later processed by a different Customer, previous leads of the closed account are not linked/restored to the new account; orphaned records fall within destruction/anonymisation; (d) a processing record is provided upon request.

14.5. Sole retention exception — Law 6563 message records: the only exception to the destruction rule is the consent/refusal and sending records relating to commercial electronic messages under Law No. 6563 and the relevant Regulation. Only the records whose retention is mandated by legislation are kept (the entire raw lead database is not included — it is destroyed); the retention period is limited to the statutory period (3 years from the record date) and the records are automatically destroyed at its end; access is restricted and the records cannot be used for active processing/marketing; the obligation belongs to the Customer in its service-provider capacity, LeaderMix merely stores on its behalf.

14.6. Reuse prohibition: no data retained under 14.5 may be offered to another Customer, used in a new campaign, processed for product development/independent purposes, or restored as previous leads upon re-subscription. Otherwise LeaderMix becomes an independent controller for that activity and must establish a valid Art. 5 ground + provide notice.

14.7. Where anonymisation is chosen, it is ensured to be irreversible and to prevent identification even when matched with other data.

Article 15 — Liability and Indemnity

Each Party is liable for damages arising from breaches of its obligations in proportion to its own fault. If it is proven that an administrative fine/compensation arose exclusively from the other Party's breach, the paying Party has a right of recourse against the other. LeaderMix is liable only for breaches of the obligations imposed on data processors or for acting outside lawful instructions; the Customer is liable for unlawful instructions and for deficiencies in legal grounds/notice/İYS. The maximum liability cap is subject to the limits in the Main Agreement; intent, gross negligence and the mandatory provisions of the KVKK are excluded from this cap.

Article 16 — Audit Rights

The Customer has the right to audit, or have audited, compliance at most once per year and with at least 15 days' prior written notice (reasonable additional audits after a data breach excepted). LeaderMix may satisfy this obligation with current measure reports and, where available, independent certificates/audit reports. Audits are conducted at reasonable hours, without disrupting LeaderMix's operations or violating other customers' confidentiality; information obtained is confidential.

Article 17 — Term, Termination, Governing Law and Competent Court

This Agreement remains in force for the duration of the Main Agreement and ends with it; provisions which by their nature must survive termination (confidentiality, destruction/return, liability) remain in force. If a material breach is not remedied within 30 days despite written notice, the other Party may terminate for cause. The Agreement is governed by Turkish law; the Istanbul (Anatolian) Courts and Enforcement Offices have jurisdiction over disputes. The addresses in Article 1/the account records are the notification addresses; unless a change is notified within 7 days, notice to the old address is valid. The Agreement, together with its annexes, constitutes the entire understanding; the invalidity of one provision does not affect the others.

Annex 1 — Processing Details Table

Annex 2 — Sub-Processor List and International Transfer Regime

For all international transfers, the appropriate Standard Contract type is established according to the direction of the transfer and notified to the Authority within 5 business days of signature.

Annex 3 — Technical and Organisational Security Measures

Organisational: personal-data inventory/processing records; employee confidentiality agreements and training; access-authorisation matrix (least privilege); data-protection agreements with sub-processors; data-breach response plan; retention and destruction policy, periodic destruction; risk analysis.

Technical: encryption in transit and at rest (TLS/HTTPS; sensitive-field encryption); multi-factor authentication and strong password policy; WAF (Cloudflare), rate limiting, bot/vulnerability protection; access/session logs, monitoring/alerting; regular, encrypted and access-restricted backups; patch management, security testing; access blocks on sensitive files/directories; secure storage and rotation of API keys; PII masking in error/monitoring tools (Sentry) (before_send + send_default_pii=False).

Electronic Acceptance

By ticking the relevant acceptance box during registration with LeaderMix, the Customer declares that it has read, understood and accepted this Data Processing Agreement in its entirety. The acceptance date, agreement version and IP address are recorded by LeaderMix for evidentiary purposes. For corporate Customers requesting a separately signed (wet-ink/electronic) copy, a signable copy can be provided.