Data Processing Agreement

1. Parties, roles and scope

1.1. This Data Processing Agreement ("DPA") is entered into between Voiser Teknoloji Limited Şirketi ("VOISER", Processor) and the customer using the Voiser Live service ("CUSTOMER", Controller) and sets out the parties' obligations under Turkish Law No. 6698 (KVKK), Regulation (EU) 2016/679 (GDPR) and the UK GDPR with respect to personal data processed within the Customer's event content.

1.2. With respect to event content (speech in a room, transcripts, translations, summaries, uploaded files, participants' technical logs) the CUSTOMER is the controller and VOISER the processor. With respect to the CUSTOMER's account data VOISER is an independent controller and such data is governed by the Privacy Policy.

1.3. This DPA is concluded together with the electronic acceptance (order confirmation for online purchases, panel acceptance for quoted packages) or signature of the Sales and Licence Agreement, and remains in force for the term of the master agreement. In matters concerning the processing of personal data this DPA prevails over the master agreement.

2. Details of processing (GDPR art. 28(3))

3. Processor obligations

• Process personal data only on the CUSTOMER's documented instructions (master agreement, platform settings and written instructions) and for the purpose in this DPA; inform the CUSTOMER immediately if an instruction appears unlawful.
• Comply with the principles in KVKK art. 4 and GDPR art. 5; never store raw audio permanently; never use event content to train general-purpose AI models.
• Bind personnel with access to personal data by confidentiality and limit access to those who need it for their duties.
• Implement the technical and organisational measures in Annex 1 in accordance with KVKK art. 12 and GDPR art. 32.
• Reasonably assist the CUSTOMER in responding to data-subject requests (access, erasure, portability etc.), in data protection impact assessments and in prior consultation with supervisory authorities (GDPR art. 28(3)(e), (f)).
• Notify the CUSTOMER of a personal-data breach without undue delay and in any event within seventy-two (72) hours of becoming aware, in writing, describing the nature of the breach, the categories of data and data subjects affected, likely consequences and measures taken.
• Make available the information necessary to demonstrate compliance with this DPA and allow, at most once a year and on reasonable notice under confidentiality, an audit (or provide an independent third-party audit report instead).
• Return or delete data on termination of the master agreement in accordance with Section 8.

4. Controller obligations

• Inform speakers and participants under KVKK art. 10 / GDPR art. 13 that their speech will be translated and may be transcribed, and obtain explicit consent where required; VOISER's sample notice texts may be used for this.
• Be responsible for the lawfulness of its instructions to VOISER and of the event content.
• Use the deletion and access settings on the platform according to its own needs and manage team members' permissions.

5. Sub-processors

5.1. The CUSTOMER grants general written authorisation for VOISER to use sub-processors in the categories listed in Annex 2. VOISER imposes data-protection obligations equivalent to those in this DPA on each sub-processor by contract and remains fully liable to the CUSTOMER for the sub-processor's performance.

5.2. The current list of sub-processors by name is provided to the CUSTOMER on request. VOISER notifies the addition or replacement of a sub-processor at least thirty (30) days in advance to the e-mail address on the CUSTOMER's account. The CUSTOMER may object within fifteen (15) days on reasonable, documented data-protection grounds; if the objection cannot be resolved, the CUSTOMER may terminate the affected service with a refund of unused fees.

6. International transfers

6.1. Event data is hosted on servers within the European Union. Because the provider generating live translation may also operate on servers outside the EU, speech data may be transferred momentarily outside the EU while the translation is produced. The transfer is limited to producing the translation; the provider may keep inputs in a secure environment for up to fifty-five (55) days to prevent abuse and does not use them for model training.

6.2. Under KVKK: transfers from Türkiye abroad rely on KVKK art. 9 and the related Regulation: a Board adequacy decision, the Board's standard contract (signed and notified to the Board) or statutory occasional-transfer grounds. The standard contract required for the CUSTOMER's own transfer obligation as controller is signed between VOISER and the CUSTOMER as Annex 3 at the CUSTOMER's request.

6.3. Under GDPR: transfers outside the EU/EEA rely on the European Commission's Standard Contractual Clauses (2021/914, Modules 2 and 3), the EU–US Data Privacy Framework or other appropriate safeguards under art. 46 GDPR; VOISER performs a transfer impact assessment where required and shares it with the CUSTOMER on request. Where the CUSTOMER is established in the EU, the parties are deemed to have entered into the Standard Contractual Clauses as Annex 4 to this DPA.

7. Data-subject requests

VOISER forwards any data-subject request it receives directly concerning event content to the CUSTOMER within five (5) business days and does not act on the content without the CUSTOMER's instruction; it enables the CUSTOMER to respond within statutory deadlines through the platform's deletion and export tools.

8. Retention, return and deletion

• Raw audio is not stored by VOISER. Transcripts and post-event outputs are retained for the period set in the CUSTOMER's package (default twelve months) and deleted at expiry; the CUSTOMER may delete any record earlier or download it from the panel at any time.
• Within thirty (30) days after termination of the master agreement the CUSTOMER may export its data (a bulk export is provided on request); at the end of that period VOISER deletes all event data and provides a deletion confirmation on request. Records subject to statutory retention (invoices, contract acceptance) are kept for the statutory period.

9. Liability

Each party is liable for damage caused by its own breach of KVKK and GDPR in proportion to its fault. Joint liability and rights of recourse under KVKK art. 12/2 and GDPR art. 82 are reserved. The limitation of liability in the master agreement applies to this DPA except where liability cannot be limited by law.

10. Term and miscellaneous

This DPA enters into force with the master agreement and ends with it; Sections 8 and 9 survive termination. Matters not regulated here are governed by the master agreement, KVKK and GDPR. The choice of law and jurisdiction in the master agreement apply; the rights of data subjects in the EU under GDPR arts. 79 and 82 are reserved. In case of discrepancy between the Turkish and English versions, the Turkish version prevails.

Annex 1: Technical and organisational measures

• Encryption of data in transit and at rest.
• Role-based access control, strong authentication and session security, change logging.
• Logical tenant isolation per workspace; no permanent sharing links.
• Raw audio processed momentarily and not stored by VOISER; card data never reaches the platform.
• Regular backups, business-continuity plan, vulnerability scanning and at least annual penetration testing.
• Staff confidentiality undertakings and regular data-protection training; incident-response procedure.
• Written data-processing agreements with sub-processors and annual compliance review.

Annex 2: Sub-processor categories

The current list by name is provided to the CUSTOMER on request (Section 5.2).

Annex 3: KVKK standard contract (controller to processor)

The standard contract published by the Turkish Personal Data Protection Board for controller-to-processor transfers is signed by the parties at the request of a CUSTOMER established in Türkiye. Notification to the Board is made within five (5) business days of signature.

Annex 4: EU Standard Contractual Clauses (2021/914)

Incorporated by reference for CUSTOMERS established in the EU (Module 2, controller → processor); Annexes 1 and 2 serve as Annexes I–III of the Clauses.