Data Processing Agreement

1. Parties and order of precedence

This Data Processing Agreement (“DPA”) is between the university, company or other organisation using ITSPracticing (the “Controller” or “Institution”) and ITSPracticing, Yıldız, Çırağan Cd., 34349 Beşiktaş/İstanbul, Türkiye (the “Processor”). It forms part of the agreement under which the Institution uses the Service (the “Main Agreement”). If this DPA conflicts with the Main Agreement on data protection, this DPA prevails; where the EU Standard Contractual Clauses apply, they prevail over both.

2. Definitions

“Data Protection Law” means the GDPR (Regulation (EU) 2016/679), the UK GDPR, Türkiye's Law No. 6698 (KVKK) and its secondary legislation, and any other law applicable to the processing. “Personal Data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given in Data Protection Law (under KVKK, “data controller” is veri sorumlusu and “processor” is veri işleyen).

3. Processing on instructions

• The Processor processes Personal Data only on the Controller's documented instructions, which are this DPA, the Main Agreement, and the Controller's configuration of the Service (for example: who is invited, which practice modes and AI features are enabled, whether sessions are recorded). The Processor will tell the Controller if it believes an instruction breaks Data Protection Law.
• The Processor may process Personal Data otherwise only where required by law, and will inform the Controller first unless the law forbids it.
• The Controller is responsible for having a lawful basis for the processing, for the instructions it gives, and for informing its learners and staff, including about session recording and AI features.

4. Confidentiality and personnel

Everyone authorised by the Processor to process Personal Data is bound by confidentiality. Access by the Processor's personnel is limited to what is necessary to operate, support and secure the Service.

5. Security

The Processor implements the technical and organisational measures in Annex II, taking into account the state of the art, cost, and the nature and risks of the processing. It may update them provided the overall level of protection is not reduced.

6. Subprocessors

• The Controller gives general authorisation for the subprocessors listed at Subprocessors.
• The Processor will give at least 30 days' notice before adding or replacing a subprocessor. The Controller may object on reasonable data-protection grounds within that period; the parties will then work in good faith on a solution, and if none is found the Controller may terminate the affected part of the Service without penalty.
• The Processor imposes on each subprocessor data-protection obligations no less protective than this DPA, and remains liable for its subprocessors' performance.
• AI features that use the AI subprocessor are disabled by default and are used only if the Controller enables them.

7. International transfers

The Processor stores Service data in the European Union. Where Personal Data is transferred to a country without an adequacy decision, the transfer is made under the EU Standard Contractual Clauses (and the UK Addendum where relevant), the EU–US Data Privacy Framework where the recipient is certified, or — for transfers from Türkiye — the standard contracts and other safeguards required by Article 9 of KVKK, including any notification to the Personal Data Protection Authority that the law requires. On request, the Processor will provide copies of these safeguards.

8. Assistance

• Data subject requests: the Processor will promptly forward any request it receives about the Controller's data and, taking into account the nature of the processing, help the Controller respond — including by providing exports and carrying out deletions.
• The Processor will provide reasonable assistance with data-protection impact assessments and prior consultations, and with the Controller's security obligations.

9. Personal data breaches

The Processor will notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Controller's data. The notice will include what is known about the nature of the breach, the categories and approximate number of people and records concerned, likely consequences, and measures taken or proposed, and will be updated as more becomes known. This allows the Controller to meet the 72-hour notification duties under GDPR and KVKK.

10. Return and deletion

When the Main Agreement ends, the Processor will, at the Controller's choice, return the Controller's Personal Data in a commonly used machine-readable format and/or delete it, within 90 days, unless law requires storage. Deleted data leaves the database's point-in-time restore history automatically (currently within 6 hours). During the agreement, retention follows the Controller's configuration and the Privacy Notice.

11. Information and audits

The Processor will make available the information necessary to demonstrate compliance with this DPA and allow for audits, including inspections, by the Controller or an auditor it mandates, on at least 30 days' notice, no more than once a year unless a breach or a regulator requires otherwise, at the Controller's cost, and subject to confidentiality. The Processor may first answer by providing documentation and written responses.

12. Liability and term

Liability under this DPA is governed by the Main Agreement, except where Data Protection Law does not allow it to be limited. This DPA lasts as long as the Processor processes Personal Data for the Controller.

Annex I — Description of the processing

Annex II — Technical and organisational measures

Access and isolation

• Every Institution's data is isolated in the database by row-level security policies; queries run under a restricted database role, so application bugs cannot read across Institutions.
• Role-based capabilities limit what each user can do; reviewers are read-only by construction; recording access needs a separate permission.
• Platform accounts do not grant access to learner attempts; database administration access is limited to named personnel.
• Administrative actions (invitations, role changes, removals) are recorded in an audit log.

Encryption and infrastructure

• TLS for all traffic between browsers, the application and its providers.
• Encryption at rest by the database and storage providers.
• Database and recording storage located in the EU; short point-in-time restore history.

Authentication

• Managed authentication with hashed passwords (minimum 15 characters), checks against known breached passwords, email verification and new-device verification.
• Bot protection on account creation.

Privacy by design

• Session recordings mask all typed inputs and passwords in the browser before upload; headers, bodies, cookies and canvas content are never captured; URLs and error text are scrubbed of credential-like values.
• Staff are never recorded; access to recordings requires a dedicated permission, and deletion removes stored files as well as their index.
• AI features are off by default, honour regional restrictions, and receive only the minimum text needed.
• Simulated business data is fictional by design.

Operations

• Automated tests for authorisation and tenant isolation, run against a real database; accessibility checks on new screens.
• Incident response, including revoking sessions and notifying the Controller as set out in section 9.

Annex III — Subprocessors

The authorised subprocessors are listed at Subprocessors.

Contact

Privacy and DPA requests: privacy@itspracticing.com. Institutions can request a countersigned copy of this DPA, including the Standard Contractual Clauses where relevant.