Effective date: [EFFECTIVE DATE]
This agreement applies whenever we process personal data on your behalf. It forms part of the Terms of Service and applies automatically when you subscribe — there is nothing separate to sign. If a term here conflicts with the Terms of Service, this agreement prevails for matters of data protection.
It is made between DİGİENSEO DİJİTAL PAZARLAMA DANIŞMANLIK LİMİTED ŞİRKETİ, a limited liability company established in Türkiye (MERSİS 0295122228600001), registered office Bahçelievler Mah. Prof. Dr. Necmettin Erbakan Cad. Elit İş Merkezi No: 3 İç Kapı No: 210, 54050 Serdivan / Sakarya, Türkiye (the “processor”), and the customer identified in the order (the “controller”).
You are the controller of the personal data of visitors to your website. You decide why it is processed. We are the processor and act only on your instructions.
Two categories fall outside this agreement, because we are the controller of them and they are covered by ourPrivacy Policy instead: the personal data of your own staff who hold an account with us or appear on an invoice, and the aggregated and anonymised data described in clause 12.
The record we keep on your behalf is kepton your own server as well where you install our server-side logging component. That copy is under your control, on infrastructure you choose, and we are not the processor of it.
Your documented instructions are: the Terms of Service, this agreement including Annex I, the settings you choose in the service, and any further written instruction you give. We will not process the personal data for any other purpose.
If we believe an instruction breaches applicable data protection law, we will tell you and may pause the processing concerned until it is resolved.
Processing continues for as long as the Terms of Service are in force, and afterwards only for as long as any record remains within the retention period in Annex I.
Everyone we authorise to process the personal data is bound by a duty of confidentiality and is given access only to what their role requires.
We implement the technical and organisational measures set out in Annex II, appropriate to the risk. We may update them, provided the level of protection is not reduced.
You give us general authorisation to engage the sub-processors listed in Annex III. We impose data protection obligations on each of them no less protective than those in this agreement, and we remain responsible to you for their performance.
We will tell you at least 30 days before adding or replacing a sub-processor. If you have a reasonable objection on data protection grounds, tell us within those 30 days and we will work with you to find an alternative; if none can be found, you may terminate the affected part of the service without penalty for the remainder of the period you have paid for.
Requests from your visitors go to you as controller. We will provide reasonable assistance to help you respond within the statutory time, and we will pass on to you without undue delay any request that reaches us directly, rather than answering it ourselves.
A practical limitation, stated so it is not discovered later. What we hold on your behalf contains no name, account or contact detail. To locate a record we need an IP address and an approximate time. Where a request cannot be matched to a record on that basis, we cannot identify the individual, and neither of us is obliged to acquire additional data solely in order to do so.
Taking into account what we know and the nature of the processing, we will give you reasonable help with your obligations on security, breach notification, data protection impact assessments and prior consultation.
We will notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf, with the information we have at the time, and will supply further detail as it becomes available. Notifying a supervisory authority or affected individuals is your decision as controller.
Deletion happens automatically. Every record is written with an expiry attached to it and is removed by the storage layer when that expiry passes; the retention periods are in Annex I. Nothing is retained beyond them, and there is no separate archive.
On termination we stop processing. Records already written expire on their normal schedule — at the latest 90 days afterwards. If you want a copy of the record before it expires, ask us while it exists; we cannot produce it afterwards.
We will make available the information reasonably needed to demonstrate our compliance with this agreement, and will contribute to an audit conducted by you or an auditor you appoint. Audits are at your cost, on reasonable notice, no more than once a year unless required by a supervisory authority or following a breach, and conducted so as not to disrupt the service or the confidentiality of other customers’ data.
We may create aggregated and anonymised data from the processing — for example the network characteristics and behavioural patterns that distinguish automated traffic from genuine visitors — and use it for any purpose connected with operating, evaluating, securing and improving the service, including across customers. Such data does not identify any individual, any visitor or you, and cannot be reversed to do so. We are the controller of it, and this right survives termination.
Nothing in this clause permits us to use identifiable personal data processed on your behalf for our own purposes. In particular, we do not use it for our own marketing — no remarketing audiences, no lookalike audiences and no list uploads.
We are established in Türkiye and access the personal data from Türkiye. There is no European Commission adequacy decision covering Türkiye.
Where you transfer personal data subject to the GDPR to us, the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914), Module Two (controller to processor), are incorporated into this agreement and completed as follows: Clause 7 (docking) applies; under Clause 9, option 2 (general written authorisation) applies with the 30-day notice period in clause 6 above; under Clause 11, the optional independent dispute resolution body does not apply; under Clause 17, the governing law is that of Ireland; under Clause 18(b), the courts of Ireland have jurisdiction. Annexes I, II and III of this agreement serve as Annexes I, II and III to the Clauses. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum applies to those Clauses.
[TO BE CONFIRMED WITH COUNSEL: that Module Two is the correct module for this arrangement; the governing-law and jurisdiction options selected above; whether a transfer impact assessment is to be annexed; and what the KVKK requires in addition on the Türkiye side, including whether a separate undertaking or standard contract must be filed with the Authority.]
The liability provisions of the Terms of Service apply to this agreement. Nothing here limits the rights of a data subject under applicable law.
A. Parties. As stated at the top of this agreement.
B. Categories of data subject. Visitors to your website who arrive from a Google Ads advertisement.
C. Categories of personal data.
No special category data is processed, and none should be sent to us. The service is not designed to receive it.
D. Nature and purpose. Automated evaluation of advertising traffic to identify invalid clicks; challenging or blocking the sources identified; adding offending IPv4 addresses to your Google Ads exclusion list; and keeping a dated record so you can answer an invalid traffic investigation.
E. Scope limitation. Only a request carrying a Google Ads click identifier (gclid or gad_source) is processed. A request without one is passed through without inspection, scoring or recording.
F. Frequency. Continuous, for the traffic in scope.
G. Retention.
H. Competent supervisory authority. [TO BE CONFIRMED WITH COUNSEL — determined by the controller’s establishment or, for the Standard Contractual Clauses, by Clause 13.]
HttpOnly, Secure andSameSite=Lax.The following sub-processors are authorised as at the effective date:
Where you install our server-side logging component, the record is also written to your own hosting environment. That copy is not held by us and your hosting provider is not our sub-processor.
DİGİENSEO DİJİTAL PAZARLAMA DANIŞMANLIK LİMİTED ŞİRKETİ
Bahçelievler Mah. Prof. Dr. Necmettin Erbakan Cad. Elit İş Merkezi No: 3 İç Kapı No: 210, 54050 Serdivan / Sakarya, Türkiye
Gümrükönü Tax Office, tax no. 2951222286
privacy@spendevidence.com