Aller au contenu principal
Ce document est actuellement disponible en anglais et en turc. Vous consultez la version anglaise.

Data Processing Agreement (GDPR DPA)

Last updated: 12 October 2026

This agreement sets out the terms, under Article 28 of the EU General Data Protection Regulation (GDPR) and Turkish Law No. 6698 (KVKK), for personal data processed on behalf of the customer using Kitisel ("Controller") by Artisel Tech ("Processor"). It forms part of the Terms of Service and takes effect when you start using the service.

Subject, duration, nature and purpose

The Processor processes personal data to provide the service (site analysis, content creation, publishing, reporting) and only on the Controller's documented instructions (service settings and use). The duration is the term of the service agreement.

Categories of data and data subjects

  • Names and email addresses of team members, activity logs.
  • Personal data that may appear on connected sites and in Search Console data (for example author names, information in page addresses).
  • Information the Controller adds to the brand profile and article content.

Processing of special categories of personal data is not intended; the Controller agrees not to upload such data to the service.

Processor obligations

  • Processes data only on documented instructions and informs the Controller if it believes an instruction is unlawful.
  • Ensures that personnel with access to the data are bound by confidentiality.
  • Implements appropriate technical and organizational measures: TLS in transit, AES-256-GCM encryption of credentials, argon2id password hashing, data separation between organizations, role-based access, audit logs of administrative actions.
  • Reasonably assists the Controller in responding to data subject requests.
  • Notifies the Controller without undue delay after becoming aware of a personal data breach.
  • Deletes the data at the end of the agreement, subject to legal retention obligations, and provides an export before deletion on request.
  • Makes available the information necessary to demonstrate compliance with this agreement.

Sub-processors

The Controller gives general authorization for the sub-processors below. The Processor imposes equivalent data protection obligations on them and announces any new sub-processor in advance by updating this page; the Controller may object on reasonable grounds.

  • Google LLC (USA): AI (Gemini API), Sign in with Google, Search Console API.
  • [Hébergeur]: servers, database and backups.
  • Email delivery provider: transactional emails.
  • İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.: payments (once payments are available).
  • Cloudflare, Inc. (USA): bot checks (if enabled).

International transfers

Transfers outside the EEA or Türkiye rely on the European Commission's standard contractual clauses, adequacy decisions or the safeguards in Article 9 of KVKK. During the beta, content sent to the free tier of the Gemini API may be used by Google to improve its products; the Controller agrees not to add personal data to content during this period.

Contact

Artisel Tech, Akhisar/Manisa. Email: info@artiseltech.com.