Data Processing Agreement (DPA)

This agreement supplements the Terms of Service for Users acting in a commercial capacity.

Roles

The User acts as data controller and Adropic as data processor. Adropic remains controller for data relating to your own user account.

Subject matter

• Subject: ad creative production, campaign management and optimisation
• Duration: for the term of the service and 90 days thereafter
• Data types: customer avatars, campaign performance data, brand assets, user account information
• Data subjects: the User's staff and end users targeted by advertising

Adropic's obligations

1. Process personal data only on the User's documented instructions
2. Ensure authorised personnel are bound by confidentiality
3. Implement appropriate technical and organisational measures (encryption, access control, logging)
4. Publish subprocessor usage transparently on the subprocessors page and announce changes 30 days in advance
5. Provide reasonable assistance with data subject requests
6. Notify the User without undue delay after becoming aware of a breach
7. Delete or return data on termination of the service

Subprocessors

The User gives general authorisation for the providers listed on the subprocessors page. You may object to a new subprocessor on reasonable grounds; if you do, you may stop using the affected feature or terminate the agreement.

International transfers

Some subprocessors are located outside Türkiye. Transfers rely on standard contractual clauses under KVKK art. 9 and, where applicable, GDPR art. 46.

Audit

Once per year and with reasonable notice, the User may request information on the measures in place and any independent audit reports.