Data Processing Agreement (draft)
Draft — prepared from the product's technical behaviour. Legal review required before enterprise contracting. Bracketed items are placeholders to be completed.
This is a short draft describing how Melano processes personal data contained in Customer Content on a customer's behalf. It is not yet an executable agreement: it has not been reviewed by a lawyer, and the final DPA will be agreed with each customer. Türkçe özet: Bu belge, müşteri içeriğindeki kişisel verilerin müşteri adına işlenmesine ilişkin bir veri işleme sözleşmesi taslağıdır; hukuki inceleme olmadan imzaya esas alınamaz.
1. Parties and roles
The customer organization ("Customer") is the controller of the personal data contained in the content it uploads to or creates in Melano ("Customer Content"). [COMPANY LEGAL NAME] ("Processor") processes that data on the Customer's behalf.
[LEGAL REVIEW REQUIRED] Confirm the role allocation, the order of precedence with the main agreement, and whether the EU Standard Contractual Clauses (processor modules) or KVKK standard contracts must be attached.
2. Subject matter and nature of processing
| Item | Description |
|---|---|
| Nature and purpose | Storing Customer Content, indexing it for search, generating draft answers with citations through the configured AI provider, supporting human review, producing exports |
| Duration | The term of the main agreement, until the Customer deletes the content or closes its organization |
| Categories of data subjects | Determined by the Customer; typically the Customer's employees and contacts named in its documents |
| Categories of personal data | Determined by the Customer; any personal data contained in uploaded documents, questionnaires and answers |
| Special categories | Not intended; the Customer should not upload them unless agreed |
3. Processor obligations
- Process Customer Content only on the Customer's documented instructions, which are given through the use of the service and the main agreement.
- Ensure personnel with access are bound by confidentiality.
- Keep each Customer's content isolated from other customers and never use it to serve another customer.
- Assist the Customer, taking into account the nature of processing, with data subject requests, security, breach notification and impact assessments.
- Notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Content. [LEGAL REVIEW REQUIRED]
- Make available information necessary to demonstrate compliance, as agreed in the main agreement.
4. Technical and organizational measures
- Server-side authorization of every request against organization membership and role (five roles).
- Private file storage with short-lived signed download links issued after authorization.
- AES-256-GCM encryption of stored integration credentials; one-way password hashing; HttpOnly session cookies; HTTPS in production.
- Audit logging of security- and business-relevant actions, without content or secrets.
- Redaction of secrets and content from application logs.
- Only question text and selected passages are sent to the AI provider; no user identities or credentials.
No certification (such as SOC 2 or ISO 27001) is claimed.
5. Sub-processors
The Customer authorizes the sub-processors listed in section 6 of the Privacy Policy (hosting, network, database and storage, AI provider). The Processor will inform the Customer of intended changes, giving the Customer the opportunity to object, and will impose data protection obligations on each sub-processor.
[LEGAL REVIEW REQUIRED] Define the notice period and objection procedure, and confirm each sub-processor's own DPA and transfer mechanism.
6. Deletion and return
The Customer can delete content at any time and export questionnaire results before closing its organization. Closing the organization permanently deletes all Customer Content, files, audit log and usage records through an asynchronous purge. Export files are deleted automatically 30 days after creation under the current technical default. Data may remain in the database provider's backups until they expire ([DATABASE BACKUP RETENTION PERIOD]).
7. International transfers
[LEGAL REVIEW REQUIRED] Transfers to sub-processors outside Türkiye or the EEA require a mechanism under KVKK Article 9 and GDPR Chapter V. None is claimed in this draft.
8. Execution
[COMPANY INFORMATION REQUIRED] Party details, signatures, governing law ([GOVERNING LAW AND JURISDICTION — LEGAL REVIEW REQUIRED]) and liability terms are to be completed in the final agreement.