Data Processing Addendum (DPA)
B2B Agreement governing data protection, GDPR Article 28 compliance, Standard Contractual Clauses (SCCs), and security standards.
1. Purpose and Scope of Data Processing
This Data Processing Addendum ('DPA') supplements the ComplyPulse Terms of Service and applies to the processing of personal and infrastructure configuration data by ComplyPulse on behalf of Customer.
Under GDPR (Article 4(7) and 4(8)) and KVKK, Customer acts as the Data Controller (Veri Sorumlusu) and ComplyPulse (operated by Rotbim Bilişim ve Yazılım Teknolojileri A.Ş.) acts as the Data Processor (Veri İşleyen).
2. Zero-Persistent Architecture & Nature of Processing
Nature & Purpose: Continuous automated compliance checks, configuration auditing, and cryptographic hash verification across SOC 2, ISO 27001, HIPAA, and GDPR standards.
Data Categories: Cloud resource identifiers, metadata, encryption flags, IAM account names, and business contact identifiers.
Excluded Data: Customer databases, production data records, application payloads, and proprietary source code files are strictly excluded and never accessed or processed.
3. Technical and Organizational Measures (TOMs)
ComplyPulse implements state-of-the-art security measures in accordance with GDPR Article 32 and ISO 27001:
• Encryption in Transit and at Rest: AES-256-GCM encryption for stored credentials and TLS 1.3 for all API transmissions.
• Multi-Tenant Row-Level Isolation: Cryptographically enforced tenant boundaries preventing cross-tenant access.
• Deterministic Evidence Sealing: SHA-256 digital seals for all generated audit records.
• Least Privilege Role Connectors: Read-only IAM STS AssumeRole architecture.
4. Sub-processors and International Transfers
ComplyPulse engages vetted sub-processors (cloud hosting, database providers, and PCI-DSS Level 1 Merchant of Record) under written agreements imposing data protection standards no less restrictive than this DPA.
International Data Transfers: Cross-border transfers outside the EEA or Turkey are conducted under European Commission Standard Contractual Clauses (SCCs) and appropriate transfer safeguards.
5. Data Deletion and Return
Upon termination of the service agreement, ComplyPulse will, at Customer's choice, permanently delete or return all customer metadata and audit evidence within thirty (30) business days, unless statutory record-keeping obligations require otherwise.