Data Processing Agreement

1. Parties and order of precedence

This Data Processing Agreement (“DPA”) is between the university, company or other organisation using ITSPracticing (the “Controller” or “Institution”) and ITSPracticing, Yıldız, Çırağan Cd., 34349 Beşiktaş/İstanbul, Türkiye (the “Processor”). It forms part of the agreement under which the Institution uses the Service (the “Main Agreement”). If this DPA conflicts with the Main Agreement on data protection, this DPA prevails; where the EU Standard Contractual Clauses apply, they prevail over both.

2. Definitions

“Data Protection Law” means the GDPR (Regulation (EU) 2016/679), the UK GDPR, Türkiye's Law No. 6698 (KVKK) and its secondary legislation, and any other law applicable to the processing. “Personal Data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given in Data Protection Law (under KVKK, “data controller” is veri sorumlusu and “processor” is veri işleyen).

3. Processing on instructions

• The Processor processes Personal Data only on the Controller's documented instructions, which are this DPA, the Main Agreement, and the Controller's configuration of the Service (for example: who is invited, which practice modes and AI features are enabled, whether sessions are recorded). The Processor will tell the Controller if it believes an instruction breaks Data Protection Law.
• The Processor may process Personal Data otherwise only where required by law, and will inform the Controller first unless the law forbids it.
• The Controller is responsible for having a lawful basis for the processing, for the instructions it gives, and for informing its learners and staff, including about session recording and AI features.

4. Confidentiality and personnel

Everyone authorised by the Processor to process Personal Data is bound by confidentiality. Access by the Processor's personnel is limited to what is necessary to operate, support and secure the Service.

5. Security

The Processor implements the technical and organisational measures in Annex II, taking into account the state of the art, cost, and the nature and risks of the processing. It may update them provided the overall level of protection is not reduced.

6. Subprocessors

• The Controller gives general authorisation for the subprocessors listed at Subprocessors.
• The Processor will give at least 30 days' notice before adding or replacing a subprocessor of its own choosing, and will tell the Controller as soon as it is told of a change a subprocessor makes itself. The Controller may object on reasonable data-protection grounds within that period; the parties will then work in good faith on a solution, and if none is found the Controller may terminate the affected part of the Service without penalty.
• The Processor requires appropriate data-protection obligations of each subprocessor (the status of each agreement is being confirmed), and remains liable for its subprocessors' performance.
• AI features that use the AI subprocessor are disabled by default and are used only if the Controller enables them.

7. International transfers

The Processor's main database is in the European Union (Frankfurt). Practice workspaces run in Germany (Hetzner), the location of the session-recording storage is being confirmed, and some providers are US companies. The transfer mechanism for each provider (EU Standard Contractual Clauses and the UK Addendum where relevant, the EU–US Data Privacy Framework, or for transfers from Türkiye the standard contracts required by Article 9 of KVKK, including any notification to the Personal Data Protection Authority) is being put in place provider by provider. On request, the Processor will tell the Controller the status for each provider.

8. Assistance

• Data subject requests: the Processor will promptly forward any request it receives about the Controller's data and, taking into account the nature of the processing, help the Controller respond — including by providing exports and carrying out deletions.
• The Processor will provide reasonable assistance with data-protection impact assessments and prior consultations, and with the Controller's security obligations.

9. Personal data breaches

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data. The notice will include what is known about the nature of the breach, the categories and approximate number of people and records concerned, likely consequences, and measures taken or proposed, and will be updated as more becomes known. A fixed notice period is being agreed.

10. Return and deletion

When the Main Agreement ends, the Processor will, at the Controller's choice, return the Controller's Personal Data in a commonly used machine-readable format and/or delete it, within 90 days, unless law requires storage. The database keeps a point-in-time restore history (currently 6 hours); other backups exist and their retention is being documented. During the agreement, retention follows the Controller's configuration and the Privacy Notice.

11. Information and audits

The Processor will make available the information necessary to demonstrate compliance with this DPA and allow for audits, including inspections, by the Controller or an auditor it mandates, on at least 30 days' notice, no more than once a year unless a breach or a regulator requires otherwise, at the Controller's cost, and subject to confidentiality. The Processor may first answer by providing documentation and written responses.

12. Liability and term

Liability under this DPA is governed by the Main Agreement, except where Data Protection Law does not allow it to be limited. This DPA lasts as long as the Processor processes Personal Data for the Controller.

Annex I — Description of the processing

Annex II — Technical and organisational measures

Access and isolation

• Each request is scoped to your Institution in the application and in the database. We are moving all queries to a database role that cannot bypass these checks.
• Role-based capabilities limit what each user can do; reviewers are read-only by construction; recording access needs a separate permission.
• Our operators can enter an Institution's workspace to give support, and each entry is logged.
• Administrative actions (invitations, role changes, removals) are recorded in an audit log.

Encryption and infrastructure

• TLS for all traffic between browsers, the application and its providers.
• Encryption at rest by the database and hosting providers; for practice workspaces it is being confirmed.
• Main database in the EU (Frankfurt); practice workspaces in Germany; recording storage location being confirmed; short database restore history.

Authentication

• Managed authentication with hashed passwords (minimum 15 characters), checks against known breached passwords, email verification and new-device verification.
• Bot protection on account creation.

Privacy by design

• Session recordings mask all typed inputs and passwords in the browser before upload; headers, bodies, cookies and canvas content are never captured; URLs and error text are scrubbed of credential-like values.
• Staff are never recorded; access to recordings requires a dedicated permission, and deletion removes stored files as well as their index.
• AI features are off by default, honour regional restrictions, and receive only the minimum text needed.
• Simulated business data is fictional by design.

Operations

• Automated tests for authorisation and tenant isolation, run on a test database; production configuration checks are being added.
• Incident response, including revoking sessions and notifying the Controller as set out in section 9.

Annex III — Subprocessors

The authorised subprocessors are listed at Subprocessors.

Contact

Privacy and DPA requests: privacy@itspracticing.com. Institutions can request a countersigned copy of this DPA, including the Standard Contractual Clauses where relevant.