Data processing agreement

1. Parties, subject matter and definitions

1.1. This Data Processing Agreement (the "DPA") is an integral part of the Terms of Service and is entered into pursuant to Article 12(2) of Law No. 6698 on the Protection of Personal Data (KVKK). With respect to the personal data in the documents uploaded by the Customer, the Customer is the data controller and SERHAN YILDIRIM "SEALINGO" ("Sealingo") is the data processor. This applies to the Individual Customer that chooses professional use as it does to the Business Customer: the fact that the Individual Customer is a natural person does not change its status as data controller with respect to the personal data in the documents it uploads.

Scope: This DPA applies only to Commercial Customers (Business Customers and Individual Customers that choose professional use). It does not apply to Consumer Customers (Terms of Service, clause 18): Sealingo is the data controller for a Consumer Customer's account information and the documents and content they upload, and this data is processed in accordance with the Privacy Notice (KVKK) (Terms of Service, clause 11.4). In this DPA, "Customer" means a Commercial Customer.

1.2. Definitions:

• Document Data: personal data in the Source Documents the Customer uploads to the platform and in everything produced from them. This includes Draft Translations, page images, working files and flagged items, as well as job information (purpose of use, the customer reference the Customer enters for its own client, special requests). Seal conversations (messages written by the Customer's users on the Work with Seal screen, Seal's answers and the records Seal reads for those answers) are also Document Data.
• Glossary Data: the terms, their equivalents and the explanations the Customer enters in the account glossary (Clause 8.7).
• Folder Data: the name, reference and note of the folders the Customer creates, the list of jobs in the folder (job number, date, languages) and the terms, equivalents and explanations entered in the folder glossary (Clause 8.8).
• Data subject: the natural person to whom Document Data relates.
• Sub-processor: a service provider that Sealingo uses to process Document Data.
• Board: the Personal Data Protection Board. Authority: the Personal Data Protection Authority.
• Physical Document: in Sworn & Notarized Delivery, the printouts made by the Partner Agency, the signed and certified translation, and the Original Document the Customer hands to the courier. Personal data in a Physical Document is also Document Data.
• Other terms defined in the Terms of Service (Customer, Business Customer, Individual Customer, Commercial Customer, Consumer Customer, Source Document, Draft Translation, Job, Approval, Sworn & Notarized Delivery, Partner Agency, Original Document, Recipient, Pickup Contact, etc.) have the same meaning in this DPA.

1.3. In matters relating to personal data, this DPA takes precedence over the Terms of Service.

2. Subject matter, nature and duration of processing

2.1. Purpose: preparation of the translation jobs requested by the Customer. This covers reading, translation, layout, quality control, making the work available to the Customer, revision rounds and deletion at the end of the retention period. If the Customer chooses Sworn & Notarized Delivery, the purpose also covers: review, correction and signature of the translation by the Partner Agency's Sworn Translator; submission to a notary in the case of notarized delivery; and carriage of the Physical Document by courier.

2.2. Categories of data subjects: the Customer's own clients; family members, company officers and employees, students, patients, parties to legal proceedings, witnesses, public officials and other third parties named in the documents.

2.3. Categories of data: identity, contact, family and civil registry information, education, professional, financial, legal transaction and visual records (photograph, signature, seal). If present in a document, special categories of personal data are also processed: health, criminal convictions and security measures, religion, biometric data, etc. Sealingo does not select document content; whatever is in the document the Customer uploads is processed.

2.4. Processing activities: hosting, conversion to page images and cropping, text reading, translation and review with artificial intelligence models, layout, making the work accessible to the Customer, and deletion; in a Seal conversation, sending the Customer's records to an artificial intelligence model to answer the user's question. In Sworn & Notarized Delivery, additionally: downloading and printing, signature and stamp, submission to a notary, carriage in a sealed envelope, short-term physical storage and destruction of printed drafts.

2.5. Duration: the DPA remains in force for the term of the Terms of Service. Document Data is deleted within the periods set out in Clause 8.

3. Obligations of the Customer (data controller)

3.1. The Customer acknowledges that it processes Document Data on the basis of one of the processing conditions in Articles 5 and 6 of KVKK and that it is legally authorized to upload it to the platform.

3.2. The Customer is responsible for informing data subjects in accordance with Article 10 of KVKK. This information also covers: that the documents will be translated using a software service that includes artificial intelligence technologies; and that they will be processed on servers abroad (European Union and United States). If the Customer chooses Sworn & Notarized Delivery, this information also covers: that the documents will be reviewed by a sworn translator of a translation agency, submitted to a notary where necessary, and that the original document will be carried by courier.

3.3. The Customer is also responsible for: obtaining the explicit consent of data subjects where required; ensuring that the conditions in Article 6 of KVKK and the adequate measures determined by the Board are in place for special categories of personal data; registering with the Data Controllers' Registry (VERBİS) if required; and responding to data subject requests.

3.4. The Customer does not upload to the platform documents that are not necessary for the translation job.

3.5. Instructions: by using the service and opening jobs, the Customer instructs Sealingo to process Document Data as described in this DPA and in the operation of the platform. Additional instructions are given in writing and must be consistent with the scope of the service.

3.6. By choosing Sworn & Notarized Delivery, the Customer instructs Sealingo to: transfer Document Data to a Partner Agency, and have it printed, signed and carried by courier. In notarized delivery, this instruction also covers submission of the document and the translation to a notary.

4. Obligations of Sealingo (data processor)

4.1. Sealingo processes Document Data only on the Customer's instructions and to provide the service. It does not use it for its own purposes, sell it or disclose it to third parties. The information containing no personal data described in Clause 9 is excluded from this.

4.2. Sealingo does not use Document Data to train artificial intelligence models. It ensures by contract that its sub-processors do not use it for this purpose either.

4.3. If Sealingo believes that an instruction violates KVKK, it informs the Customer and may decline to carry out that instruction.

4.4. Sealingo employees and persons it authorizes who can access Document Data are under a written confidentiality obligation, and their access is limited to what their duties require. Platform administrators cannot see document content through the application interface. Partner Agency users see only the source documents and the approved translation of jobs assigned to them. This access opens after the Additional Fees are deducted and closes when the job's documents are deleted. The Partner Agency does not see the Customer's account and billing information.

4.5. Sealingo takes and keeps up to date the technical and administrative measures in Annex 1 in accordance with Article 12(1) of KVKK.

4.6. Sealingo forwards requests it receives directly from data subjects to the Customer without delay and within 5 business days at the latest. It provides the reasonable support necessary for the Customer to respond to these requests.

4.7. Sealingo provides reasonable support to the Customer in requests and investigations by the Board or competent authorities concerning Document Data. Unless legally prohibited, it notifies the Customer of such requests.

4.8. Audit: the Customer may request in writing information and documents showing that Sealingo complies with this DPA. An on-site audit may be carried out under the following conditions: at least 30 days' prior notice; no more than once a year; during business hours; through an independent auditor bound by a confidentiality undertaking; and at the Customer's expense. An audit does not give access to other customers' data or to Sealingo's trade secrets. These limits do not apply to a request by the Board.

5. Sub-processors

5.1. The Customer grants Sealingo a general authorization to use the sub-processors listed in Annex 2.

5.2. Sealingo informs the Customer by email or on the platform at least 15 days before adding or replacing a sub-processor. The Customer may object on reasonable grounds within this period. If the objection cannot be resolved, the Customer may terminate the Terms of Service and receive a refund for its unused credits (Terms of Service Clause 6.6).

5.3. Sealingo enters into contracts with sub-processors that provide a level of protection no lower than that in this DPA.

5.4. Sealingo uses the Partner Agencies shown in Annex 2 as sub-processors for Sworn & Notarized Delivery. A Partner Agency processes Document Data only for jobs for which Sworn & Notarized Delivery has been chosen. Sealingo enters into a written partner agreement with the Partner Agency that provides protection no lower than that in this DPA (Clause 5.3). This agreement includes at least the following:

• processing only for the assigned job and on Sealingo's instructions;
• written confidentiality for employees and the courier;
• no use for artificial intelligence training or any other purpose;
• the physical measures in Annex 1;
• notification of a breach to Sealingo within 24 hours at the latest;
• deletion and destruction after delivery (Clause 8.6);
• Sealingo's right to request information and to audit;
• not passing the job to another agency without Sealingo's written consent.

5.5. Separately from Clause 5.2, a new Partner Agency is notified by email at least 3 days before it begins receiving jobs; the Customer may object within this period and afterwards. Jobs of a Customer that objects to a Partner Agency are not assigned to that agency; the Customer is not required to terminate the Terms of Service for this reason. If no other suitable Partner Agency is available, Sworn & Notarized Delivery may not be offered to that Customer.

5.6. The Physical Document is carried by an employee of the Partner Agency or by a courier company engaged by Sealingo or the Partner Agency; Sealingo pays the courier fee. The Customer grants general authorization for this. The Physical Document is carried in a sealed envelope. Only the name, telephone number and address of the Recipient and the Pickup Contact are given to the courier. The party that engages the courier company binds it with a written confidentiality obligation. The name of the courier company is shown on the job page.

5.7. In notarized delivery, the document and the translation are submitted to the notary by the Partner Agency. The notary processes this data as an independent data controller within the scope of its statutory duties and retains it in accordance with its own legislation. The notary is not a sub-processor of Sealingo (Annex 3). The deletion rule in Clause 8 does not cover the records held by the notary.

6. Cross-border transfer

6.1. The service requires Document Data to be processed in the countries shown in Annex 2. The Customer uses the service knowing that this transfer is a necessary part of the service and gives instructions for the transfer.

6.2. Sealingo carries out transfers in accordance with Article 9 of KVKK: it signs with sub-processors the standard contracts published by the Board and notifies the Authority within 5 business days of signature.

6.3. Informing data subjects about cross-border transfer is the Customer's obligation (Clause 3.2).

6.4. The Partner Agency, the courier and the notary are in Türkiye. Sworn & Notarized Delivery does not require any additional cross-border transfer.

7. Data breach notification

7.1. When Sealingo becomes aware of a data breach affecting Document Data, it informs the Customer without delay and within 48 hours at the latest.

7.2. The notification includes the following, to the extent known at the time: the nature and time of the breach; the categories of data affected; the approximate number of persons and records; the likely consequences; the measures taken and proposed; and a contact person. The notification is supplemented as new information becomes available.

7.3. Under Article 12(5) of KVKK, notifying the Board and data subjects is the Customer's obligation; under the Board's decision, notification to the Board is made within 72 hours. Sealingo provides the information necessary for the Customer to make this notification. Except where required by law, it does not notify data subjects or the public without the Customer's written consent.

7.4. When the Partner Agency becomes aware of a breach affecting Document Data or a Physical Document, it notifies Sealingo within 24 hours at the latest. This includes loss, theft and delivery to the wrong person. Sealingo informs the Customer in accordance with Clause 7.1.

8. Retention, deletion and return

8.1. Document Data is permanently deleted from the platform within the following periods:

• Approved, rejected or stopped jobs: within the period the Customer chooses in the settings, counted from the closing of the job (7, 30, 60 or 90 days; 30 days by default).
• If the Customer chooses "immediately upon approval" in the settings: the source documents, page images and working files of an approved job are deleted immediately after approval (within 1 hour at the latest); the translation, quality report and delivery note are deleted 24 hours after approval so that they can be downloaded. With this option, 7 days applies to rejected and stopped jobs, jobs delivered but not approved, and Seal conversations.
• Jobs delivered but not approved: within the same period, counted from the last delivery. At the end of this period the job closes without approval.
• Jobs awaiting credits: if no credits are added within 30 days, the job closes and its documents are deleted.
• Drafts not started: after 7 days.
• Seal conversations: within the period the Customer chooses in the settings (7, 30, 60 or 90 days), counted from the last message of the conversation. The Customer's user may delete their own conversation at any time.
• Folders with extended retention: if the Customer's account admin chooses 90 days or 1 year for a folder, the documents of the jobs in that folder and the Seal conversations opened in the folder are deleted within that period instead of the periods above (or within the period in the settings, if longer). If the period is shortened, the folder is deleted, or the job or conversation is removed from the folder, the period in the settings applies; if that period has already expired, the documents are deleted immediately.
• Jobs for which Sworn & Notarized Delivery has been chosen: while Sworn & Notarized Delivery is in progress (while awaiting credits and while with the Partner Agency), the job's documents are not deleted; this waiting period is at most 90 days from completion of the job. When the order is delivered or cancelled, the retention period is calculated from completion of the job as above; if the period has already expired, the documents are deleted immediately.
• The Customer may, at any time from the settings, delete the data of all jobs other than jobs in processing and in review; the user who opened a job or the account admin may also delete the data of a single job from the job page. Deletion of a job with Sworn & Notarized Delivery in progress is carried out when Sworn & Notarized Delivery is concluded, or at the latest 90 days after completion of the job.

8.2. Deletion covers source files, page images, working files, translations, flagged items, the job title, the customer reference, special requests and the free-text event logs of the job. The job number, date, language, character count, credit and approval record are kept for billing and evidentiary purposes for the periods set out in the Terms of Service; these records do not contain document content.

8.3. Sealingo deletes the processing logs at the artificial intelligence service provider as soon as the job step is finished. Other copies created on sub-processors' systems during processing are deleted within the periods set out in the relevant sub-processor's contract.

8.4. When the Terms of Service end, Document Data is deleted within 30 days. Downloading the delivery files before they are deleted is the Customer's obligation; Sealingo does not provide a separate return or archive service.

8.5. A deletion record for each deletion (the type and number of records deleted, the time of and reason for deletion) can be downloaded from the job page. On request, Sealingo also confirms in writing that the deletion has been carried out.

8.6. The Partner Agency deletes the files it has downloaded and its working copies within 7 days at the latest from the day the job is delivered or cancelled. It destroys printed drafts and excess printouts. The Original Document is returned to the Customer; the Partner Agency does not keep a copy of it. Records held by the notary and records that the signing Sworn Translator is required by law to keep (if any) are excluded from this. On request, Sealingo confirms in writing that the deletion has been carried out (Clause 8.5).

8.7. Account glossary: Glossary Data is kept so that terms are translated with the same equivalent every time in the Customer's translation jobs. It is not a document and is not subject to the periods in Clause 8.1: it is kept until the Customer deletes it or the Terms of Service end; when the Terms of Service end, it is deleted within 30 days. The Customer may delete the glossary in part or in full at any time. Terms appearing in a job's documents are written to that job's working files and deleted together with the job's other data within the periods in Clause 8.1. Glossary Data is used only in the Customer's own jobs; it is not used in other customers' jobs or in the extraction described in Clause 9. The account glossary is not intended for personal data; the Customer does not enter personal data (personal names, identification numbers, addresses, etc.) in the glossary. If it does, the Customer is also the data controller for that data, and this DPA applies to it as it does to Document Data, except for the retention period.

8.8. Folders: Folder Data is kept so that the Customer can keep its related jobs together and so that names and terms are translated with the same equivalent every time in translations in the same folder. It is not a document and is not subject to the periods in Clause 8.1: it is kept until the Customer deletes it or the Terms of Service end; if no activity takes place in a folder for 2 years and no stored documents remain in it, it is deleted automatically; when the Terms of Service end, it is deleted within 30 days. The Customer may delete a folder and its folder glossary at any time, and deletes it when the folder's purpose has ended. Folder Data may contain personal data (names of persons and companies, file numbers, etc.); the Customer is the data controller for that data, and this DPA applies to it as it does to Document Data, except for the retention period. The folder glossary is used only in that folder's jobs; it is not used in other customers' jobs or in the extraction described in Clause 9. Choosing extended retention for a folder does not oblige Sealingo to provide an archive service (Clause 8.4).

9. Information containing no personal data

9.1. To improve the service and reduce its cost, Sealingo may extract information relating to standard forms of official institutions from approved deliveries; examples include certificates of residence, criminal record certificates and student certificates. The information extracted is the form's fixed text, its layout and the approved translation of that fixed text. This information contains no values belonging to any person (name, number, date, address, etc.) and may be used indefinitely.

9.2. Intermediate records kept for comparison during this extraction are kept only as keyed hashes (irreversible cryptographic hashes) and are deleted after 90 days at the latest.

9.3. Sealingo may also use statistics containing no personal data (character count, language pair, document type, duration, cost, error type, etc.) to operate and develop the service.

10. Liability

10.1. The parties' liability toward data subjects and the Board is governed by KVKK; Article 12(2) of KVKK is reserved.

10.2. As between the parties, each party is liable for its own fault. Administrative fines, damages and costs arising from the Customer's breach of its obligations under Clause 3 are borne by the Customer. Legal basis, informing data subjects, explicit consent and unauthorized uploading are examples of these obligations. If Sealingo is required to make a payment for these reasons, it has recourse against the Customer.

10.3. The limitations of liability in Clause 10 of the Terms of Service also apply with respect to this DPA; mandatory provisions of law are reserved.

11. Term and termination

The DPA enters into force and ends together with the Terms of Service. Clauses 7, 8 and 10 remain in effect until Document Data has been deleted and any claims that have arisen have been resolved.

Annex 1. Technical and administrative measures

• Customer data is separated by row-level security rules; each user accesses only the records and files of their own customer account. The only exception is the Partner Agency: users of the Partner Agency in the admin and translator roles access only the source documents and the approved translation of Sworn & Notarized Delivery jobs assigned to them, after the Additional Fees are deducted and until the job's documents are deleted. The Partner Agency has no direct access to the tables; download links are valid for 60 seconds.
• Files are kept in a storage bucket closed to the public. Download links are provided as signed links valid for 60 seconds, and images on the review screen as signed links valid for 1 hour. The unmarked (final) translation is accessible only after approval.
• Data is encrypted in transit (TLS/HTTPS). The database and file storage are stored encrypted at the provider level.
• Role-based authorization applies in business accounts (admin, translator, uploader). Approval and decision authority rests only with translators and admins; billing, team and settings are available only to admins. An individual account has a single user.
• Passwords are at least 8 characters long. Two-step verification (TOTP) is available; when enabled, it is enforced both in the application and in the database. Session refresh tokens are rotated; users can see their open sessions.
• The platform administrator dashboard does not give access to document content or to names and identification numbers in documents. Access to the translation engine and its servers is limited to authorized technical staff.
• The translation engine processes each job's documents in a separate, isolated environment: only that job's files are present in this environment; other jobs' files, the network and access keys cannot be reached.
• Only the content required by the job is sent to the artificial intelligence service provider. Under the provider's commercial terms, this content is not used for model training; processing logs are deleted as soon as the job step is finished.
• The retention rule is applied automatically (Clause 8). The translation engine's job folders are deleted along with it.
• Administrative actions are recorded in an audit log.
• Security headers (preventing framing on other sites and content type sniffing, enforcing HTTPS) and rate limits on forms and actions are applied.
• Employees are under a written confidentiality undertaking and are informed about the protection of personal data.
• In Sworn & Notarized Delivery, the Physical Document is carried in a sealed envelope marked with the job number; the courier does not see the contents of the envelope.
• Changes of custody of the Original Document (courier dispatched for pickup, arrival at the agency, trip to the notary and notarization, dispatch to the courier, delivery) are recorded on the platform with their times.
• The Partner Agency keeps the Physical Document in a locked cabinet and makes it available only to its authorized employees. Printed drafts and excess printouts are destroyed with a paper shredder.
• The Partner Agency undertakes in the partner agreement to require its users to use two-step verification.

Annex 2. Sub-processors

The Physical Document is carried by an employee of the Partner Agency or by a courier company engaged by Sealingo or the Partner Agency (Clause 5.6).

Annex 3. Independent data controllers

Notary: in notarized delivery, the document and the translation are submitted to a notary. The notary is an independent data controller within the scope of its statutory duties; it is not a sub-processor (Clause 5.7).