Data Processing Agreement

[AVUKAT METNİ BEKLENİYOR — lawyer text pending] Definition of the parties, subject matter of the agreement and its relationship to the Terms of Service.

[AVUKAT METNİ BEKLENİYOR — lawyer text pending] Nature and purpose of the processing activities, categories of data subjects, categories of personal data and duration of processing.

[AVUKAT METNİ BEKLENİYOR — lawyer text pending] Acting on instructions, confidentiality, technical and organisational measures, assistance with data subject requests, personal data breach notification and its timing.

The sub-processors Klyrix/document works with to deliver the service (the same list as in the Privacy Policy and the KVKK / GDPR Privacy Notice):

• Vercel: application hosting and server functions (upload, verification and administration panel requests).
• Supabase: database and authentication of administration panel accounts.
• Cloudflare: object storage (R2; files are kept redundantly in two separate stores, this being one of them) and bot protection (Turnstile).
• Contabo: processing server (security processing of files and the identity verification engine) and object storage (the other of the two redundant stores).
• Resend: e-mail delivery (verification codes and account e-mails).
• Gupshup: WhatsApp verification code (OTP) messages.
• Slack: the Brand’s delivery channel: processed files (including the file itself), form responses and verification result summaries are delivered to the Brand’s own Slack workspace.
• Stripe: Brand payments (card top-ups); no payment is ever collected from End Users.

[AVUKAT METNİ BEKLENİYOR — lawyer text pending] Notification of sub-processor changes to the Brand and the objection procedure; obligations imposed on sub-processors.

[AVUKAT METNİ BEKLENİYOR — lawyer text pending] International transfers: for each sub-processor, the transfer mechanism relied on under applicable data protection law and the parties’ obligations in this respect.

Retention periods applied on the platform (the same for all Brands):

• Raw images and videos captured during identity verification (document images, selfie, liveness video) and the face-comparison and profile-photo crops derived from them: automatically deleted 7 days after submission.
• Data in the biometric security pool (biometric face template, one facial photograph, ID number and, if provided, username): automatically deleted 90 days after the record is created. Deletion of its own record by the Brand does not affect this period; if explicit consent is withdrawn, the data is deleted before the period expires.
• Files uploaded through the document collection flow are automatically deleted from both of the platform’s stores 7 days after delivery to the Brand (8 days after processing completes if no delivery takes place).
• The verification decision (approved/rejected) and the explicit consent record are retained for audit purposes. Personal data such as the fields read from the document, form answers, contact details (e-mail, telephone) and IP address is deleted at the same time as the files (7 days after the decision for standalone identity verification); for records still under review, this period starts at the decision. Only transaction information that contains no personal data (time, status, fee) is kept.
• Files that could not be safely processed (rejected) or could not be processed are kept for at most 7 days for manual review; files held unprocessed because the Brand’s balance was insufficient or its account was suspended are held for at most 7 days. In both cases they are deleted at the end of the period.
• Brand account and billing data: kept for the duration of the contractual relationship and for the statutory retention periods required by commercial and tax legislation.

[AVUKAT METNİ BEKLENİYOR — lawyer text pending] Deletion or return of data upon termination of the agreement.

[AVUKAT METNİ BEKLENİYOR — lawyer text pending] Audit rights, liability, entry into force and termination.