क़ानूनी

Gastte Data Processing Agreement

यह पेज केवल जानकारी के लिए अंग्रेज़ी अनुवाद है। बाध्यकारी पाठ तुर्की पाठ है; दोनों पाठों में अंतर होने पर तुर्की पाठ मान्य होगा। मूल तुर्की पाठ

Türkçe sürüm 1.0

This is an informational English translation. The Turkish original is legally binding; in case of any discrepancy the Turkish text prevails.

Version 1.0 — Effective: 2 November 2026

This Data Processing Agreement ("DPA") is an annex to the Gastte Service and Subscription Agreement (the "Main Agreement") and enters into force together with it. Within the framework of Art. 12 of the Personal Data Protection Law No. 6698 ("KVKK"), it governs the terms under which personal data for which the Customer is the data controller, processed through the news website, newsletter, podcast and connected channels published by the Customer on the Gastte infrastructure, is processed by Fibrika Reklam Hizmetleri Limited Şirketi ("Gastte", the data processor).

1. Parties and Roles

1.1 Data Controller: The Customer. The Customer determines the purposes and means of processing the personal data of its publication's readers, newsletter subscribers, commenters, poll participants, interview sources, news subjects and its own team members.

1.2 Data Processor: Fibrika Reklam Hizmetleri Limited Şirketi (under the Gastte brand), Yaka Mah. Aziz Mahmut Hüdai Cad. No:185/102 Meram / Konya, MERSİS 0387119748100001. Gastte processes this data only on behalf of and on the instructions of the Customer.

1.3 Distinction. With respect to the Customer's own account, invoice and usage data, Fibrika is a separate data controller; this data is subject to the KVKK Privacy Notice and is outside the scope of this DPA.

1.4 No joint controllership. The parties are not joint data controllers for the data within the scope of this DPA. If Gastte determines the purposes of processing itself, Gastte becomes the data controller for that processing and notifies the Customer accordingly.

2. Subject Matter, Nature and Purpose of Processing

2.1 Subject matter: hosting, storage, backup, transmission, display, email and notification sending, security monitoring, technical support and automations triggered by the Customer (artificial intelligence generation, social sharing), as required to provide the Service.

2.2 Data categories: reader identity and contact data (name, email, telephone), subscription and preference records, comment and form content, reader IP address and device information (traffic records), cookie identifiers, data relating to natural persons appearing in news content, interview and source records, account data of the Customer's team members.

2.3 Categories of data subjects: readers, subscribers, commenters, news subjects, sources, the Customer's employees and authors.

2.4 Duration: for the term of the Main Agreement and until the deletion schedule in Article 10 has been completed.

2.5 Special categories of data. The Service is not designed to process special categories of personal data. If the Customer processes special categories of data (health, criminal convictions, religion, sex life, etc.) in news content, it shall itself satisfy the conditions of KVKK Art. 6 and shall not impose any additional obligation on Gastte.

3. Obligations of the Data Controller (the Customer)

3.1 To inform its readers and other data subjects pursuant to KVKK Art. 10; to obtain the necessary explicit consents; to publish a cookie notice and legal texts on its publication.

3.2 To have a valid legal basis for each processing activity; to ensure that the instructions it gives to Gastte are lawful.

3.3 To respond to data subject applications (KVKK Art. 11 and Art. 13); applications directed to Gastte are forwarded to the Customer within 5 business days, and the response is the Customer's responsibility.

3.4 Where content it sends to the artificial intelligence provider with its own key (source news, images, instructions) contains personal data, to provide the legal basis for this transfer and satisfy the conditions for transfer abroad (Article 7).

3.5 To apply the principle of least privilege when granting access to team members, remove the access of departing members and use two-factor authentication.

3.6 To safeguard the rights of persons appearing in news content (reply and correction, the right to be forgotten, protection of children); to implement court and administrative decisions.

3.7 To assess and fulfil the obligation to register with VERBİS according to its own circumstances.

3.8 The Customer shall hold Gastte harmless against administrative fines, compensation claims and expenses arising from breach of these obligations (Main Agreement, Art. 14.5).

4. Obligations of the Data Processor (Gastte)

4.1 Processing on instructions. Gastte processes personal data only on the documented instructions of the Customer. The Main Agreement, this DPA, panel settings and operations triggered by the Customer through the panel are deemed to be instructions. Operations required by legislation (e.g. the retention of traffic records under Law No. 5651 and their provision to competent authorities) do not require instructions; the Customer is notified where possible.

4.2 Unlawful instructions. If Gastte considers that an instruction infringes the KVKK or other legislation, it shall warn the Customer and may refuse to carry out the instruction.

4.3 Confidentiality. Gastte ensures that its personnel who access personal data are subject to a duty of confidentiality; this duty continues after the end of their employment (KVKK Art. 12/4).

4.4 Purpose limitation. Gastte does not use Customer data for its own purposes (marketing, profiling, model training, sale to third parties). It produces only aggregated and anonymous statistics for the security and capacity planning of the Service.

4.5 Access restriction. Gastte personnel access the Customer's tenant database only in the event of a support request, security incident, migration or legal requirement, and such access is logged. "Signing in to the panel on behalf of the Customer" is carried out only at the Customer's request or with its approval and is recorded in the audit log.

4.6 Assistance. Gastte provides reasonable technical assistance to enable the Customer to respond to data subject applications, notify data breaches and fulfil its audit obligations (export, deletion, access log queries). Requests beyond the ordinary tools may be charged.

5. Security Measures

In line with KVKK Art. 12 and the Personal Data Security Guide published by the Personal Data Protection Board, Gastte implements at least the following technical and organisational measures:

A separate tenant database and a separate worker process for each Customer (logical isolation); cross-tenant data access is prevented architecturally.
TLS 1.2 or higher encryption in transit; mandatory HTTPS; HSTS.
Storage of passwords as irreversible hashes using argon2; password policy; two-factor authentication.
Encrypted storage, at application level, of artificial intelligence keys, social network tokens and agency credentials.
Role-based access control; principle of least privilege; session time limit in the administrative interface.
Audit log of panel and API operations (who did what and when); sign-in attempt limiting; IP-based rate limiting.
Daily encrypted backups; retention of no more than 30 days; separate storage location.
Regular application of security updates; dependency scanning; firewall and intrusion detection.
Confidentiality agreements and KVKK training for personnel; regular review of access permissions.
A data breach response plan and register.

Gastte updates the measures in line with technological developments; updates may not reduce the level of security.

6. Sub-processors

6.1 General authorisation. The Customer grants Gastte a general authorisation to use sub-processors to provide the Service. The current list of sub-processors is published in Annex 1 to this DPA and in the panel.

6.2 Current sub-processor categories (Annex 1):

Server hosting and data centre (tenant databases, application servers).
Object storage and content delivery network (media files, backups).
Email sending infrastructure (newsletter, notification and account emails).
Domain name, DNS and SSL certificate providers.
Error monitoring and performance measurement (with personal data masked).
Payment institution PayTR (only the Customer's own payments; no reader data is sent).
Artificial intelligence providers — Gastte's sub-processor only when the trial pool is used; when used with your own key, they are the Customer's direct provider (Article 7).

6.3 Notice of changes. The addition of a new sub-processor that processes personal data, or the replacement of an existing one, is announced at least 15 days in advance by panel notification or email. Within this period the Customer may object on reasonable grounds based on data protection; if the objection cannot be resolved, the Customer may terminate the Main Agreement and receive a refund of the fee for the unused period. Changes made for reasons of urgent security or service continuity are implemented immediately and notified afterwards.

6.4 Sub-processor obligations. Gastte enters into a written agreement with each sub-processor and imposes on the sub-processor data protection obligations equivalent to the obligations in this DPA. Gastte is liable to the Customer for the fault of a sub-processor within the limits of liability in the Main Agreement.

7. Artificial Intelligence Providers and Transfers Abroad

7.1 Your own key (BYOK). When the Customer uses the artificial intelligence features with its own provider account and key, the Customer is the exporter and the data controller of the content sent to the provider (source news text, instructions, images, audio). In this transfer, Gastte is merely the tool that technically conveys the Customer's instruction. The agreement with the provider, the provider's data use policy and the conditions for transfer abroad under KVKK Art. 9 (adequacy decision, standard contract, explicit consent) are the Customer's responsibility.

7.2 Trial pool. When the pool running on Gastte's key is used during the trial period, the artificial intelligence provider is Gastte's sub-processor; Gastte prefers providers with a contractual term declaring that the provider does not use API data for model training, and provides a standard contract or equivalent safeguard.

7.3 Other transfers abroad. The servers of some sub-processors in Annex 1 may be located outside Türkiye. Gastte carries out these transfers within the framework of KVKK Art. 9 on the basis of an adequacy decision of the Board, the standard contract announced by the Board (signed and notified in due time) or other appropriate safeguards. By using the Service, the Customer undertakes to provide its own readers with the information required for these transfers.

7.4 Personal data in news content. The Customer is itself responsible for assessing that the data of news subjects contained in source texts sent to the artificial intelligence is processed within the scope of journalistic activity (KVKK Art. 28/1-c) and for complying with the limits of this exemption.

8. Data Breach Notification

8.1 When Gastte becomes aware of a personal data breach affecting Customer data, it notifies the Customer by registered email and panel notification without undue delay and in any event within 72 hours of becoming aware of it.

8.2 The notification contains the following information to the extent known at the time: the nature and time of the breach, the categories of data affected and the estimated number of data subjects, the likely consequences, the measures taken and proposed, and a contact person. The information may be completed in stages.

8.3 The decision and obligation to notify the Personal Data Protection Board and the data subjects rests with the Customer as data controller (KVKK Art. 12/5; Board decision: 72 hours). Gastte provides the technical information necessary for preparing the notification.

8.4 If data for which Gastte is itself the data controller is affected, Gastte makes the notification to the Board itself.

9. Audit

9.1 Gastte provides the Customer, once a year or upon request, with an up-to-date security summary showing the measures implemented and the list of sub-processors. Where an independent audit or certification report exists, a summary of that report constitutes sufficient evidence.

9.2 The Customer, or an independent auditor appointed by the Customer who is not a competitor of Gastte and is subject to a duty of confidentiality, may carry out a document-based audit at most once a year, with at least 30 days' prior written notice, during business hours and in a manner that does not disclose the data or trade secrets of Gastte's other customers. On-site audits are carried out only following a data breach or a request by the Board, and subject to Gastte's reasonable security conditions.

9.3 The reasonable costs of the audit are borne by the Customer; if the audit reveals a material non-compliance, Gastte bears the costs and remedies the non-compliance within a reasonable time.

10. Deletion and Return at the End of the Agreement

10.1 Return (export). During the term of the Main Agreement and in the closure window (30 days), the Customer may export all its data from the panel in machine-readable formats. Gastte provides technical assistance with the export upon request.

10.2 Deletion. 30 days after the closure window has ended and the account has moved to closed status, Gastte irreversibly deletes the Customer data (tenant database, media files, search indexes, domain name records) and existing copies thereof. Backup copies expire automatically within the backup cycle (at most 30 days).

10.3 Exceptions. Records whose retention is required by legislation (traffic records under Law No. 5651, invoice and accounting documents, agreement acceptance records) are retained, with restricted access, for their statutory periods and are not processed for any other purpose.

10.4 Upon request, Gastte confirms in writing that the deletion has been completed.

11. Liability

11.1 Liability arising from this DPA is subject to the limits in Article 14 of the Main Agreement (fees for the last 3 months; excluding indirect damages). This limit does not apply to breaches arising from Gastte's wilful misconduct or gross negligence.

11.2 Administrative fines and compensation claims arising from the Customer's failure to fulfil its own obligations as data controller (information, consent, legal basis, data subject applications, transfer to the artificial intelligence provider) are borne by the Customer; if directed at Gastte, the Customer shall indemnify Gastte by way of recourse.

11.3 In the event of a sanction imposed by the Personal Data Protection Board directly on the data processor, the Customer shall hold Gastte harmless if the cause of the sanction is the Customer's instruction or breach of obligation.

12. General Provisions

12.1 This DPA is valid together with and for the term of the Main Agreement; when the Main Agreement ends, it remains in force until Article 10 has been completed.

12.2 In the event of changes to the KVKK and secondary legislation, Gastte shall bring this DPA into compliance and notify the change 30 days in advance; changes in the Customer's favour apply immediately.

12.3 In the event of a conflict, this DPA prevails on matters of personal data protection, and the Main Agreement prevails on other matters.

12.4 The applicable law is Turkish law; the competent authorities are the Courts and Enforcement Offices of Konya.

Annex 1: Sub-processor Categories and Data Location

Server hosting and data centre — application and tenant databases — data centre in Türkiye or the European Union (current location in the panel).
Object storage and CDN — media files and backups — may be abroad; with KVKK Art. 9 safeguards.
Email sending infrastructure — notification and newsletter delivery — may be abroad; with KVKK Art. 9 safeguards.
Domain name, DNS and SSL — domain name records — in Türkiye and abroad.
Error monitoring and performance measurement — masked technical records — may be abroad.
PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. — the Customer's payments — Türkiye.
E-invoice integrator — the Customer's invoice information — Türkiye.
Artificial intelligence providers (OpenAI, Google, Anthropic, DeepSeek) — Gastte's sub-processor only in the trial pool; otherwise the Customer's direct provider — abroad.

The current and detailed list (trade name, country, type of safeguard) is maintained in the panel on the "Account › Legal › Sub-processors" page, and changes are announced in accordance with Article 6.3.