This text is a draft and not yet final. Highlighted fields in square brackets (e.g. company name and address) must be filled in and the text must be reviewed by a lawyer before publication.
Data Processing Addendum
Addendum for business customers setting out RintUp's obligations as a data processor.
1. Scope and parties
This Data Processing Addendum ("Addendum") forms an integral part of the Terms of Service ("Agreement"). For personal data the Customer enters into the service, the Customer is the data controller and [COMPANY NAME] ("RintUp") is the data processor within the meaning of Article 3 of KVKK (Law No. 6698). The Addendum takes effect when the Agreement is accepted; customers who need a signed copy can write to kvkk@rintup.com. The Turkish version prevails in case of conflict.
2. Details of processing
| Item | Description |
|---|---|
| Subject and purpose | Providing availability monitoring, alert delivery and status page services under the Agreement |
| Duration | The term of the Agreement plus the 30-day deletion period after termination |
| Nature of processing | Recording, storage, organisation, transmission (alerts), display (status pages), deletion |
| Data subjects | The Customer's workspace members, alert recipients, status page subscribers, people who may be named in the Customer's monitored systems |
| Data categories | Name, e-mail, phone number, role; monitor targets and check results; credential secrets entered by the Customer (encrypted); status page announcement content |
| Special categories | Not intended to be processed; the Customer agrees not to enter special categories of personal data into the service |
3. Processing on instructions
RintUp processes personal data only on the Customer's documented instructions. The Agreement, panel settings and API calls constitute the Customer's instructions. If RintUp believes an instruction infringes the law, it informs the Customer immediately. RintUp does not use personal data for its own purposes, sell it or build profiles.
4. Confidentiality
RintUp employees and contractors with access to personal data are bound by written confidentiality obligations. Access is limited to the least privilege required for the task and is logged.
5. Technical and organisational measures
In line with KVKK Article 12 and the Board's Personal Data Security Guide, RintUp implements at least the following measures:
- TLS encryption in transit; encrypted backups; database and application servers located in Türkiye
- Customer secrets stored with envelope encryption (key management service + data key, AES-256-GCM) and key rotation; secrets never written to logs, errors or events
- Workspaces isolated with row-level security (RLS) in the database and scope checks in the application layer
- Argon2id password hashing, two-factor authentication, role-based authorisation, session revocation
- Append-only audit records; secret access recorded in the audit log
- Blocking of internal network and metadata addresses for requests to external targets (SSRF protection)
- Dependency vulnerability scanning, regular updates, backup restore drills
6. Subprocessors
The Customer gives general written authorisation for the providers listed on the Subprocessors page. RintUp imposes on subprocessors obligations no less protective than those in this Addendum and remains liable to the Customer for their acts. New subprocessors are announced at least 30 days in advance; if the Customer objects on reasonable grounds and the parties cannot find a reasonable solution, the Customer may terminate the affected service without penalty.
7. Data subject requests and assistance
RintUp forwards to the Customer without delay any data subject request about customer data that reaches RintUp directly. It provides reasonable technical assistance for the Customer's responses to KVKK Article 11 requests, data security assessments and correspondence with the Board; the panel and the API offer the tools needed to view, correct and delete data.
8. Breach notification
When RintUp becomes aware of a breach affecting customer data, it notifies the Customer without undue delay and within 24 hours at the latest. The notice describes the nature of the breach, the affected data and data subject groups, likely consequences and the measures taken or proposed. This period is set so that the Customer can notify the Board within 72 hours. Notifying the Board and data subjects is the Customer's obligation as data controller.
9. Transfers abroad
Customer data is stored on servers in Türkiye. Because of how the service works, alert e-mails are delivered through an e-mail provider in the USA. For transfers abroad RintUp puts in place the appropriate safeguards of KVKK Article 9 (standard contract and notification to the Authority). The Customer is responsible for the location of integrations it chooses for channels other than SMS and e-mail.
10. Termination, return and deletion
When the Agreement ends the Customer can export its data via the API for 30 days; after that period customer data is deleted from live systems and purged from encrypted backups within 14 days. Records subject to statutory retention are kept for that period. Deletion is confirmed in writing on the Customer's request.
11. Audits
On request RintUp provides the Customer with information and documents demonstrating compliance with this Addendum. The Customer may carry out an audit at most once a year, with at least 30 days' notice, during business hours and through an independent auditor bound by confidentiality, at its own cost. Audits required by the Board or a competent authority are not subject to this limitation.
12. Liability and precedence
The parties' liability under this Addendum is subject to the limitations in the Agreement; under KVKK Article 12(2) the parties are jointly liable towards data subjects for data security and have recourse against each other in proportion to their fault. In matters of personal data protection, this Addendum prevails over the Agreement in case of conflict.
Draft note: the joint liability and recourse clause and the 24-hour notification period should be reviewed by counsel.