BOSS-IQ Data Processing Agreement (DPA)

This Data Processing Agreement (“DPA”) forms part of, and is incorporated into, the Terms of Service (the “Agreement”) between:

• Blueprint IQ Yazılım ve Danışmanlık Anonim Şirketi (“Blueprint IQ AŞ”, “Processor”, “we”) — operator of the BOSS-IQ service; and
• the customer identified in the Agreement (“Customer”, “Controller”, “you”).

It governs the processing of personal data that we carry out on your behalf when you use BOSS-IQ. Where you act as a processor for your own end-customers, we act as your sub-processor and the same obligations apply on a back-to-back basis.

Last updated: [DATE] · Effective: the date of the Agreement, or [DATE on adoption]. DPA contact: privacy@boss-iq.io

1. Definitions

Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject”, and “personal data breach” have the meanings given in the EU General Data Protection Regulation (GDPR) and, where applicable, the Turkish Personal Data Protection Law No. 6698 (KVKK). “Sub-processor” means a third party engaged by us to process Customer Personal Data. “Customer Personal Data” means personal data within the Customer Content that we process on your behalf under the Agreement.

2. Roles and scope

2.1 Roles. This DPA covers Customer Personal Data that we process on your behalf to provide the Service — for this data, you are the Controller and we are the Processor (or, where you are a processor, we are your sub-processor).

2.2 Where we act as a controller. For a limited set of data we process for our own purposes — namely account/identity data we collect to operate our business relationship with you, and the evaluation-and-improvement of our AI systems described in the Privacy Policy — Blueprint IQ AŞ acts as an independent controller, and that processing is governed by our Privacy Policy rather than this DPA. This split is recognized under both GDPR and KVKK (veri sorumlusu / veri işleyen).

2.3 Your instructions. We will process Customer Personal Data only on your documented instructions, including as set out in this DPA and the Agreement, except where required by law (in which case we will inform you unless legally prohibited). Your use of the Service, and your configuration choices, constitute documented instructions.

2.4 Your obligations. You are responsible for ensuring you have a lawful basis to provide Customer Personal Data to us and for the accuracy and legality of that data, including any third-party or special-category data you upload. Because content is processed in full by our AI sub-processors without redaction (see the Privacy Policy, Section 3.2), you should only upload data you are authorized to share for these purposes, and you are responsible for the legality of the content you submit.

3. Subject-matter and details of processing (GDPR Art. 28(3))

The required processing details are set out in Annex I.

4. Confidentiality

We ensure that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and process the data only as necessary to provide the Service.

5. Security measures (GDPR Art. 32)

We implement appropriate technical and organizational measures to protect Customer Personal Data, described in Annex II. You acknowledge that the measures in Annex II are appropriate for the nature of the Service, and that some are roadmap items clearly marked as such. We describe only the controls we can stand behind today as current.

6. Sub-processors

6.1 Authorization. You provide general written authorization for us to engage sub-processors to process Customer Personal Data. Our current sub-processors are listed in our public sub-processor list, which identifies each provider’s purpose, data category, and processing region.

6.2 Sub-processor terms. We impose data-protection obligations on each sub-processor that are no less protective than those in this DPA, to the extent applicable to the sub-processor’s role.

6.3 Changes and objection. We will give you at least 30 days’ advance notice before adding or replacing a sub-processor that processes Customer Personal Data (via the mechanism stated in the sub-processor list). You may object on reasonable data-protection grounds within that window; if we cannot reasonably accommodate the objection, you may terminate the affected part of the Service as your exclusive remedy.

6.4 Liability. We remain responsible for our sub-processors’ performance of their data-protection obligations to the same extent we would be.

7. Assistance to the Controller

7.1 Data-subject requests. Taking into account the nature of the processing, we will provide reasonable assistance (including appropriate technical and organizational measures) to help you respond to data-subject requests to exercise their rights (access, rectification, erasure, restriction, portability, objection). If a data subject contacts us directly, we will refer them to you. Our assistance may involve a reasonable lead time, and we will act within the timeframes applicable law allows.

7.2 DPIAs and consultation. We will provide reasonable assistance with data-protection impact assessments and prior consultations with supervisory authorities, taking into account the information available to us.

8. Personal data breach notification

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide the information reasonably available to us to help you meet your own notification obligations (including, under GDPR, the 72-hour authority-notification timeline). We are strengthening our security-monitoring and detection capabilities (see Annex II); this contractual notification commitment applies to breaches of which we become aware.

9. International transfers

9.1 The processing regions for each sub-processor are stated in the public sub-processor list. Our database and your uploaded files are hosted in the European Union (Amsterdam); certain derived and AI-related processing takes place in the United States (see Annex I and the sub-processor list).

9.2 Where we transfer Customer Personal Data outside Türkiye or the EEA (including to sub-processors in the United States), we put in place an appropriate transfer mechanism — EU Standard Contractual Clauses (SCCs) for the GDPR side and a KVKK-compliant cross-border transfer mechanism (the KVKK standard contract or undertaking, with notification to the Turkish Data Protection Authority) for the KVKK side — and apply supplementary measures where required. The two mechanisms are treated as separate requirements.

10. Return and deletion

On termination or expiry of the Agreement, and at your choice, we will delete or return Customer Personal Data, and delete existing copies, within 90 days, except to the extent retention is required by applicable law (for example, tax and accounting records). Deletion is carried out through our erasure process, which we are progressively automating with a termination-triggered purge. Some operational logs and AI-quality traces are deleted on shorter, provider-set windows.

11. Audit

We will make available to you information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable notice, confidentiality, frequency limits, and our security policies. We may satisfy audit requests by providing documentation, completed security questionnaires, or third-party certifications/reports where and when available (we do not currently hold a SOC 2 report — see Annex II).

12. Liability and order of precedence

The liability provisions of the Agreement apply to this DPA. In the event of a conflict between this DPA and the Agreement regarding the processing of personal data, this DPA prevails.

13. Governing law

This DPA is governed by the law specified in the Agreement (Republic of Türkiye), without prejudice to mandatory data-protection law (GDPR / KVKK) applicable to the Customer.

Annex I — Details of processing (GDPR Art. 28(3))

Annex II — Technical and organizational security measures (GDPR Art. 32)

The following describes our security measures. Measures marked (roadmap) are planned and not yet fully in place; they are disclosed honestly and will be updated as they ship.

Annex III — List of sub-processors

Incorporated by reference: see the BOSS-IQ Public Sub-Processor List.

BOSS-IQ is a product of Blueprint IQ AŞ.