Data processing agreement (DPA)

Draft. This text has not yet been reviewed by a lawyer and is not legal advice.

1. Roles

The Customer is the controller; GlobalisTMS OÜ is the processor. This agreement forms part of the Terms of Use and is accepted at registration (version and acceptance time are stored).

2. Subject matter and duration

Subject: conducting, recording, transcribing and summarising the Customer's calls with its callers by means of AI. Duration: term of the contract plus the retention period (default 90 days).

3. Processor obligations

• Processes data only on the Customer's documented instructions.
• Binds its staff to confidentiality.
• Implements appropriate technical and organisational measures (encryption, access control, audit log).
• Engages sub-processors only under this agreement, publishes the list and gives prior notice of changes.
• Notifies the Customer of a personal data breach without undue delay (at the latest within 72 hours).
• At the end of the contract deletes or returns the data at the Customer's choice.

4. International transfers

Transfers rely on GDPR standard contractual clauses and/or the standard contracts under Turkish KVKK art. 9. For Customers established in Türkiye the parties assess the notification duty towards the Authority.

5. Audits

With reasonable prior notice the Customer may request an audit or an independent audit report once a year.

6. Liability

Liability is subject to the limits in the Terms of Use, except for intent and gross negligence.