Data Processing Agreement

This Data Processing Agreement (“DPA”) forms an integral part of the santral.la Terms of Service (the “Agreement”) and applies between the Customer (the “Controller”) and [ŞİRKET ÜNVANI] (“santral.la” or the “Processor”). Terms defined in the Agreement have the same meaning here.

1. Scope and roles

1.1. When providing the Service, santral.la processes personal data contained in Customer Data on behalf of and on the instructions of the Customer. For this processing the Customer is the controller and santral.la the processor (KVKK art. 3(1)(ğ) and (ı); GDPR art. 4(7) and (8)).

1.2. santral.la’s own customer account, billing, support and marketing data are outside this DPA; for that data santral.la is the controller and the Privacy Notice (santral.la/en/privacy) applies.

1.3. The Customer’s Operator (SIP trunk provider) is not a sub-processor of santral.la. The Operator provides a separate service under its own contract with the Customer.

1.4. Applicable data protection law: for Customers established in Türkiye, the Turkish Personal Data Protection Law No. 6698 (KVKK) and its secondary legislation; for Customers established in the EU/EEA or processing otherwise subject to it, also Regulation (EU) 2016/679 (GDPR). This DPA is designed to meet KVKK art. 12 and GDPR art. 28(3).

1.5. The subject matter, duration, nature and purpose of processing, the types of personal data and the categories of data subjects are set out in Annex 1.

2. Instructions

2.1. santral.la processes personal data only on the Customer’s documented instructions. The Agreement, this DPA and the settings the Customer makes in the panel, apps or API (e.g. enabling recording, retention periods, deletion, export) constitute the Customer’s instructions. Additional instructions are given in writing (support request or e-mail).

2.2. If santral.la considers that an instruction infringes data protection law, it informs the Customer immediately and may postpone carrying out the instruction until the Customer confirms or changes it.

2.3. If santral.la is required by law to process personal data, it informs the Customer before processing unless the law prohibits this.

2.4. santral.la does not use personal data for its own purposes (advertising, profiling, training of AI models, sale). Statistics derived from Customer Data may be produced only for operating the Service, capacity planning and security, and only without personal data.

3. Confidentiality

3.1. santral.la ensures that its employees and contractors with access to personal data are bound by written confidentiality obligations that continue after their engagement ends (KVKK art. 12(4); GDPR art. 28(3)(b)).

3.2. santral.la staff access call recordings, voicemail and call content only upon the Customer’s written support request and only within its scope. Such access is logged and reported to the Customer on request.

4. Security

4.1. Taking into account the nature of processing and the risks, santral.la implements the technical and organisational measures in Annex 2 (KVKK art. 12(1); GDPR art. 32).

4.2. santral.la may update the measures provided the overall level of security is not reduced.

4.3. The Customer is responsible for the measures within its own sphere: managing User accounts and permissions, password security, security of end devices, Trunk credentials and deciding which Users may access recordings.

5. Sub-processors

5.1. The Customer grants santral.la general written authorisation to engage the sub-processors listed in Annex 3 (santral.la/en/legal/sub-processors).

5.2. santral.la informs the Customer by e-mail or panel notice at least 30 days before adding or replacing a sub-processor. The Customer may object within that period on reasonable data-protection grounds. If the parties cannot find a reasonable solution, the Customer may terminate the affected part of the Service without penalty and receives a refund for the unused period.

5.3. santral.la imposes on each sub-processor, by written contract, data protection obligations that are in substance the same as those in this DPA, and remains liable to the Customer for the sub-processor’s performance.

6. Assistance with data subject requests

6.1. santral.la assists the Customer with appropriate technical tools in responding to data subject requests (KVKK art. 11; GDPR arts. 12-22): finding CDRs and recordings by caller number, exporting them and deleting individual items.

6.2. If a data subject request reaches santral.la directly, santral.la does not respond to it itself; it refers the data subject to the Customer and informs the Customer without undue delay.

6.2a. A user deleting their own account (standing instruction). The Customer instructs santral.la in advance to carry out, without asking the Customer each time, a request by one of the Customer’s users to delete their own account, made in the panel, the apps or on the account deletion page after the user has proved their identity: the account is disabled at once and all its sessions end, the Customer’s administrators are told at once, and after 14 days the user’s name, e-mail address, password and second factor, device records, online-time records and the IP addresses and browser details in the sign-in records are deleted or anonymised. The Customer’s call records, recordings, voicemail and directory records are not affected and stay under the Customer’s retention period; the user appears in them only under a pseudonymous identifier. Where a documented legal duty to retain exists, the Customer may record a legal hold (reference and end date) in the panel within the 14 days, which postpones the deletion until that date; a hold does not cancel the request. [TO BE VERIFIED]

6.3. Assistance that cannot be provided through the tools is given within a reasonable time; for requests requiring exceptional effort santral.la may charge a reasonable fee after notifying the Customer in advance.

7. Personal data breaches

7.1. santral.la notifies the Customer of a personal data breach affecting Customer Data without undue delay and in any event within 24 hours of becoming aware of it.

7.2. The notice contains, to the extent then available: the nature of the breach, its time and time of detection; the categories and approximate number of data subjects and records concerned; likely consequences; measures taken and proposed; a contact point. Where not all information is available at once, it is provided in phases.

7.3. santral.la immediately takes the measures necessary to mitigate the breach, cooperates with the Customer’s notifications to the Turkish Personal Data Protection Board, EU supervisory authorities and data subjects, and keeps a record of breaches.

7.4. santral.la’s notice is not an acknowledgement of fault.

8. Data protection impact assessments

santral.la assists the Customer with data protection impact assessments and prior consultations with supervisory authorities (GDPR arts. 35-36), taking into account the nature of processing and the information available to santral.la.

9. Data residency and international transfers

9.1. Customer Data is stored and processed in the Data Region chosen by the Customer: the tr region in Istanbul (Türkiye), the eu region in Frankfurt (Germany, planned). Data of customers in Türkiye is kept in Türkiye, data of customers in the EU is kept in the EU. The Data Region is not changed without the Customer’s written instruction.

9.2. Türkiye region (KVKK): santral.la does not transfer personal data from the Türkiye region abroad without the Customer’s instruction. Where a transfer becomes necessary (e.g. on the Customer’s instruction to change region, or a sub-processor abroad), it is made under KVKK art. 9 and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad by signing the standard contract published by the Personal Data Protection Board without any changes and notifying it to the Authority within five business days of signature. For a sub-processor abroad, this is the processor-to-processor standard contract between santral.la and the sub-processor; the Customer’s authorisation is documented by clause 5.1.

9.3. EU region (GDPR): santral.la is established in Türkiye. Although EU-region data is stored in the EU, remote access from Türkiye for operation, maintenance and support is possible, and such access may constitute a transfer under Chapter V GDPR. For Customers established in the EU/EEA the parties therefore incorporate by reference Module 2 (controller to processor) of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, with the selections in Annex 4; the Customer is the data exporter and santral.la the data importer. Remote access is minimised, logged and protected by the measures in Annex 2. santral.la assists the Customer with its transfer impact assessment (TIA).

9.4. Necessary services abroad, such as push notifications for the apps (Apple APNs, Google FCM), are shown in Annex 3. Data sent to these services is kept to the technical minimum.

10. Audits

10.1. santral.la makes available to the Customer, on request, the information necessary to demonstrate compliance with this DPA (policies, descriptions of measures, independent audit reports or certifications where available).

10.2. If that information is insufficient, the Customer may carry out an audit with at least 30 days’ written notice, at most once a year (additionally after a breach or at the request of a supervisory authority), during business hours, through an auditor bound by confidentiality who is not a competitor of santral.la. Audits are carried out without compromising other customers’ data or the security of the Service; the Customer bears the costs.

11. Return and deletion at the end

11.1. When the Agreement ends, the Customer may export its data for 30 days. After that period santral.la deletes Customer Data; copies in backups are deleted through the backup cycle within [35] days and kept inaccessible until then.

11.2. santral.la retains data subject to a statutory retention obligation (for the duration of that obligation and only for that purpose).

11.3. On the Customer’s request, santral.la confirms deletion in writing.

12. Records and requests from authorities

12.1. santral.la keeps a record of processing activities carried out as a processor (GDPR art. 30(2)).

12.2. If a court, prosecutor or other authority requests Customer Data from santral.la, santral.la informs the Customer unless prohibited by law, reviews the lawfulness of the request and discloses only the minimum data required.

13. Liability and precedence

13.1. Liability under this DPA is subject to the limitations in the Agreement; liability that cannot be limited by law and the direct rights of data subjects (e.g. GDPR art. 82) are not affected.

13.2. As to personal data, this DPA prevails over the Agreement. In case of conflict between the SCC in Annex 4 and this DPA, the SCC prevail.

13.3. This DPA remains in force for the term of the Agreement and for as long as santral.la processes Customer Data. Governing law and jurisdiction are as in the Agreement; the SCC are governed by their own terms.

---

Annex 1 — Details of processing

Annex 2 — Technical and organisational measures

Access and authentication

• Role-based access control (platform administrator, customer administrator, agent); every request passes a tenant check.
• Server-side sessions; the panel session cookie is HttpOnly; the browser never talks to the API directly.
• Throttling of failed login attempts; blocking of repeated malicious attempts (fail2ban). [TO BE VERIFIED]
• Two-factor authentication for the panel.
• Staff access on a least-privilege basis; server access only by key-based SSH.

Tenant isolation

• A separate SIP domain per customer; a mandatory customer ID on every customer table; no call routing between customers; Trunks are never shared between customers.

Encryption

• Panel, API and app traffic encrypted with TLS; web and mobile phone media with DTLS-SRTP. Encryption of SIP/RTP towards the Operator depends on the Operator’s support.
• Desk phones and third-party SIP clients connect unencrypted unless TLS/SRTP is configured (the platform also accepts unencrypted UDP/TCP registration for such devices).
• Trunk passwords and SIP credentials stored encrypted (Fernet) in the database and never returned by the API.
• Encryption at rest for call recordings and voicemail. [TO BE VERIFIED]
• Encrypted backups. [TO BE VERIFIED]

Logging and monitoring

• Changes, logins and access to another user’s phone credentials are written to the audit log.
• Logging of listening to, downloading and deleting recordings.
• Server and service monitoring; alerts on unusual traffic.

Fraud prevention

• International calls off by default, with two keys (platform permission and Customer setting).
• Concurrent-call limit per customer.
• Outgoing CLI limited to the Customer’s own numbers.

Data minimisation and retention

• Call recording off by default; recording announcement configurable.
• Automatic deletion of recordings when their retention period ends.
• Push notifications carry only the minimum data needed to match the call. [TO BE VERIFIED]

Continuity

• Daily backups; restore tests; backups kept in the same Data Region.

Organisational measures

• Staff confidentiality undertakings; data protection and information security awareness training; incident response procedure and breach register; regular application of software updates; penetration test at least once a year [TO BE VERIFIED]; sub-processor contracts.

Annex 3 — Sub-processors

Current list: santral.la/en/legal/sub-processors.

Annex 4 — EU Standard Contractual Clauses (EU/EEA customers only)