Data Processing Agreement
This English text is a translation provided for convenience. Where the Turkish version differs, the Turkish version prevails for users in Türkiye.
1. Roles and scope
For data the business enters about its own staff and customers, the business is the controller and Pingel is a processor acting only on its behalf and instructions. For business owners' account, payment and contact data, Pingel is the controller.
This agreement sets out Pingel's (processor) obligations under KVKK Art. 12 and GDPR Art. 28 for personal data the Customer (controller) uploads to or processes through the service, and forms an annex to the Service and Subscription Agreement.
2. Subject of processing
Subject: providing the POS service. Duration: the subscription term. Data subjects: the business's staff and customers. Data types: names, phone numbers, addresses, order and payment history, loyalty points, staff shift and sales records. No special category data is expected.
3. Pingel's obligations
- Process data only on the Customer's documented instructions (including the service itself and its settings), never for its own purposes.
- Ensure that people with access are bound by confidentiality.
- Implement appropriate technical and organisational measures: encrypted connections, logical separation of customers' data, role-based access rules, backups, minimal administrative access.
- List sub-processors below, notify the Customer before adding one and allow objection, and impose the same protections on them.
- Reasonably assist the Customer with data subject requests and security obligations.
- Notify the Customer of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it.
- On termination, keep data for 30 days for the Customer to export, then delete it (from backups within 35 days).
- Provide the Customer, on request, with information demonstrating compliance.
4. Customer's obligations
- As controller, inform the data subjects (staff, customers, students/parents etc.) and have the required legal basis or consent.
- Enter only the data needed for the purpose; enter special category data only where lawful and necessary.
- Manage user accounts and permissions securely.
5. Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Google Firebase / Google Cloud (Google Ireland Ltd., Google LLC) | Hosting, authentication, database, server functions | EU and/or US data centres |
| Google Gemini API (Google LLC) | AI features: the text or transcript you submit is processed | United States |
| Firebase Cloud Messaging (Google) | Push notifications (if you allow them) | EU and/or US |
| Google reCAPTCHA / Firebase App Check | Bot and abuse protection | United States |
| E-posta hizmet sağlayıcısı (SMTP) | Transactional e-mail | EU and/or US |
| Banks | Receiving and verifying bank-transfer payments | Türkiye |
| Google Analytics 4 (Google Ireland Ltd., Google LLC) | Visit statistics — only with your consent | EU and/or US |
6. International transfers
Some sub-processors are outside Türkiye. Transfers rely on appropriate safeguards such as standard contracts and the providers' data processing terms under KVKK Art. 9 and GDPR Chapter V.
7. Entry into force
This agreement takes effect when the Customer electronically accepts the service agreement and remains in force for its term. Institutions needing a signed copy can request one at [email protected].