Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between the individual or legal entity operating a store on the Shopiyz platform ("User" or "Merchant") and the platform provider İNOVABİL TEKNOLOJİ SAN. VE TİC. A.Ş. ("Shopiyz").

This DPA supplements and forms an integral part of the Shopiyz Terms of Use. In the event of any conflict between the Terms of Use and this DPA concerning the processing of Store Customer Personal Data, this DPA prevails.

This DPA takes effect when the User begins using the Shopiyz services and requires no separate signature. By using the services, the User is deemed to have accepted this DPA.

This DPA does not cover Shopiyz's processing of its own users' account, billing and contact data for its own purposes. That processing is governed by the Privacy Policy, where Shopiyz acts as controller.

Company identity note. Shopiyz is in the process of establishing a company in the United Kingdom. Until that entity is registered, the contracting party remains the Turkish entity named above. This section will be updated once registration is complete; the substantive terms will not change.

This DPA governs the terms on which Shopiyz processes Store Customer Personal Data in the course of providing its services to the User, the mutual obligations of the parties, and the technical and organisational measures to be applied.

It is concluded in order to satisfy the requirement under Article 28(3) of the UK GDPR that processing by a processor be governed by a binding written contract setting out the prescribed particulars.

In respect of Store Customer Personal Data, the Merchant acts as controller and Shopiyz acts as processor.

The Merchant determines the purposes and means of the processing. Shopiyz processes such data only as necessary to provide the services technically and in accordance with the Merchant's instructions.

Depending on the services used, Shopiyz may process the following categories of data on the Merchant's behalf:

The Terms of Use together with this DPA constitute the Merchant's documented instructions to Shopiyz.

Shopiyz processes Store Customer Personal Data only (i) on those documented instructions and (ii) where required to do so by law to which it is subject. In the latter case Shopiyz will inform the Merchant beforehand unless the law prohibits it.

If Shopiyz considers that an instruction infringes Applicable Data Protection Law, it will inform the Merchant and may suspend performance of that instruction. Shopiyz has no obligation to actively monitor the Merchant's compliance.

Shopiyz ensures that every employee and contractor authorised to access Store Customer Personal Data is bound by a written confidentiality undertaking or is subject to an appropriate statutory duty of confidentiality.

This obligation survives the end of that person's relationship with Shopiyz. Access is limited to what each role requires and is granted on the principle of least privilege.

In accordance with Article 32 of the UK GDPR, Shopiyz implements and maintains appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

Shopiyz may update these measures to reflect technical developments. Any such change will not reduce the overall level of security.

The Merchant gives Shopiyz general written authorisation to engage subprocessors for the purpose of providing the services. Shopiyz may also engage its affiliates as subprocessors.

The current, named list of subprocessors is available on written request from privacy@shopiyz.com.

Shopiyz enters into a written agreement with each subprocessor imposing obligations materially the same as those in this DPA, and remains fully liable for the acts and omissions of its subprocessors as if it had performed the work itself. That liability is subject to the limitations set out in the Terms of Use.

Shopiyz relies on cloud infrastructure operated on a global scale. Store Customer Personal Data may therefore be processed or stored in data centres outside the United Kingdom.

Any restricted transfer is made on the basis of an appropriate safeguard under Chapter V of the UK GDPR:

Where a transfer mechanism is superseded or updated by the competent authorities, Shopiyz may replace it, and the replacement mechanism will form part of this DPA.

Responding to data subject rights requests is the Merchant's obligation as controller under Articles 15 to 22 of the UK GDPR.

Taking into account the nature of the processing, Shopiyz provides reasonable assistance by appropriate technical and organisational measures. The platform offers the Merchant tools to access, export, rectify and erase the data it holds.

Shopiyz will notify the Merchant without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting Store Customer Personal Data.

Where the full information is not available at the outset, Shopiyz will provide it in phases. Shopiyz will investigate the breach and use commercially reasonable efforts to mitigate and remedy its effects.

To demonstrate compliance with its obligations under this DPA, Shopiyz will, on written request and subject to confidentiality, make available security documentation, audit report summaries and the results of any independent assessment it holds.

Where the Merchant is required to carry out a data protection impact assessment or to consult the supervisory authority in advance, Shopiyz provides reasonable assistance and information, taking into account the nature of the processing and the information available to it.

Throughout the term of the services the User may access, export or delete its data using the platform's own tools.

On termination, Shopiyz will, at the Merchant's choice, delete or return Store Customer Personal Data. Where no choice is communicated, deletion will be initiated within 90 days of the end of the services.

For any data retained, Shopiyz's confidentiality and security obligations under this DPA continue in full until erasure, and the data will not be processed for any purpose other than that retention.

If Shopiyz receives a court order, law enforcement demand or request from a competent authority, it will inform the Merchant within a reasonable time unless prohibited from doing so by law.

Before disclosing any data, Shopiyz will make reasonable efforts to verify that the request is legally valid and binding, and will limit disclosure to the minimum the request requires.

Each party is responsible for its own breach of Applicable Data Protection Law.

The Merchant warrants that the data it makes available to Shopiyz has been obtained lawfully and that a valid lawful basis exists for the transfer. Where a breach of that warranty results in Shopiyz being held liable to third parties or supervisory authorities, the Merchant will indemnify Shopiyz for the resulting loss.

Liability arising under this DPA is subject to the limitations of liability set out in the Terms of Use.

This DPA remains in force for as long as the Terms of Use are in effect and Shopiyz continues to process Store Customer Personal Data.

Shopiyz may update this DPA to reflect changes in law or in the scope of the services. Material changes will be notified a reasonable time before they take effect. Continued use of the services after notification constitutes acceptance of the updated terms.

This DPA is governed by the laws of England and Wales and is construed in accordance with the UK GDPR and the Data Protection Act 2018.

The courts of England and Wales have exclusive jurisdiction over any dispute arising out of or in connection with this DPA.

This does not affect any mandatory right a data subject may have to bring proceedings, or to complain to a supervisory authority, in the country of their habitual residence.

This DPA forms an integral part of the Shopiyz Terms of Use. For provisions governing the services generally, see our Terms of Use page.

For processing that Shopiyz carries out as a controller in its own right, see our Privacy Policy page.