Otai Data Processing Addendum

1. Definitions

1.1 Otai is operated by Çallıoğlu İnşaat Turizm Sanayi ve Ticaret A.Ş. ("Otai"), a company incorporated in Türkiye.

1.2 For this DPA:

1. Applicable Data Protection Law means privacy and data-protection law applicable to the relevant processing, including Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and its secondary rules, and, where applicable, the EU General Data Protection Regulation 2016/679 ("GDPR") and UK GDPR.
2. Controller, Processor, Data Subject, Personal Data, Process/Processing, Personal Data Breach and Supervisory Authority have the meanings given by Applicable Data Protection Law.
3. Customer Personal Data means Personal Data contained in Customer Data that Otai processes on Customer’s behalf.
4. Subprocessor means a third party engaged by Otai to process Customer Personal Data on Customer’s behalf.
5. Restricted Transfer means a cross-border transfer that requires a specific safeguard under Applicable Data Protection Law.

1.3 Capitalised terms not defined here have the meaning in the Service Agreement.

2. Roles and scope

2.1. Customer is the Controller and Otai is the Processor for Customer Personal Data. If Customer acts as a Processor for another Controller, Customer appoints Otai as its Subprocessor and confirms that it is authorised to do so.

2.2. Customer determines the purposes and essential means of the processing and is responsible for its instructions, notices, lawful basis, permissions, data accuracy and Data Subject communications.

2.3. Otai acts as an independent Controller for its own business-account administration, contracting, billing, service security, legal compliance and direct support activities, as described in the Otai Privacy Policy. Those activities are outside this DPA.

2.4. The subject matter, duration, nature, purpose, Data Subjects and data categories are described in Annex 1.

3. Documented instructions

3.1. Otai will process Customer Personal Data only:

1. to provide, secure and support the Service as documented in the Service Agreement, order form, Customer configuration and authorised use;
2. on additional documented instructions from Customer; or
3. where applicable law requires processing, in which case Otai will inform Customer before processing unless law prohibits notice.

3.2. The Service Agreement, this DPA, Customer’s configuration and authorised API/dashboard actions are Customer’s documented instructions.

3.3. Otai will notify Customer if, in its reasonable opinion, an instruction infringes Applicable Data Protection Law. Otai may suspend the affected processing while the parties resolve the issue, without being required to provide unlawful functionality.

3.4. Customer will not instruct Otai to process data that is unnecessary, prohibited by an enabled channel, or beyond the agreed Service. Customer must not intentionally submit special-category/sensitive data unless the parties have documented the necessity, lawful basis, safeguards and exact processing in writing.

4. Confidentiality and personnel

4.1 Otai will ensure that personnel authorised to process Customer Personal Data:

1. are bound by statutory or contractual confidentiality;
2. receive access only on a need-to-know and least-privilege basis;
3. receive appropriate privacy and security instructions; and
4. process the data only under this DPA and Customer’s documented instructions.

5. Security

5.1. Taking into account the state of the art, implementation costs, nature/scope/context/purpose of processing and risk to individuals, Otai will implement and maintain appropriate technical and organisational measures. The current minimum commitments are described in Annex 2.

5.2. Otai may update security measures to reflect technical developments, provided the overall protection is not materially reduced.

5.3. Customer is responsible for secure configuration within its control, authorised-user access, credential protection, lawful data minimisation and prompt removal of obsolete access.

6. Personal Data Breach

6.1. Otai will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data.

6.2. To the extent then known, the notice will describe:

1. the nature of the breach, affected data and approximate Data Subject/record volume;
2. likely consequences;
3. measures taken or proposed to contain, investigate and mitigate it; and
4. a contact for follow-up.

6.3. Information may be provided in phases as the investigation develops. Otai’s notice is not an admission of fault. Customer is responsible for determining whether and how to notify a Supervisory Authority or Data Subject, and Otai will provide reasonable assistance considering the nature of processing and available information.

7. Data Subject requests

7.1. Taking into account the nature of processing, Otai will provide reasonable technical and organisational assistance for Customer to respond to valid Data Subject requests.

7.2. If Otai receives a request relating primarily to Customer-controlled processing, Otai will, where legally permitted, refer it to Customer and will not respond substantively except on Customer’s instruction or as required by law.

7.3. Customer remains responsible for verifying the requester, evaluating the request and responding within the legal deadline.

8. Assistance and compliance information

8.1 Taking into account the nature of processing and information available to it, Otai will reasonably assist Customer with:

1. security-of-processing obligations;
2. breach assessment and notification;
3. data-protection impact assessments and prior consultation where the Service is relevant;
4. records and information reasonably necessary to demonstrate compliance with processor obligations.

8.2 Assistance beyond standard Service functionality may be chargeable at agreed rates where the request is unusually burdensome and not caused by Otai’s breach.

9. Subprocessors

9.1. Customer gives general written authorisation for Otai to use the categories of Subprocessors described in Annex 3. The specific legal identities used for Customer’s Service are disclosed during onboarding, in the applicable service documentation or upon Customer’s written request.

9.2. Otai will give reasonable prior notice of a new Subprocessor that will process Customer Personal Data, except where an urgent replacement is required for security, legal or service-continuity reasons; in that case notice will be given as soon as reasonably practicable.

9.3. Customer may object during the notice period on reasonable, documented data-protection grounds. The parties will work in good faith on a commercially reasonable solution. If no solution is available, Customer may terminate only the affected Service before the new Subprocessor begins processing, and receive a pro-rata refund of prepaid unused fees for that affected Service.

9.4. Otai will impose written data-protection obligations on each Subprocessor that are no less protective in substance than the obligations applicable to the same processing under this DPA. Otai remains responsible for its Subprocessors to the extent required by Applicable Data Protection Law.

9.5. Meta/WhatsApp may also have a direct contractual and data-protection relationship with Customer as the owner of its WhatsApp Business Account. A provider acting independently or directly for Customer is not an Otai Subprocessor merely because it interoperates with the Service. The parties will document the correct role based on the actual flow.

10. International transfers

10.1. Otai will not make a Restricted Transfer except under a valid transfer mechanism and Customer’s documented authorisation under this DPA.

10.2. For transfers subject to KVKK Article 9, the parties will identify the actual exporter/importer roles and use the appropriate safeguard, which may include the mandatory-form Turkish standard contract for controller-to-processor (SS-2), processor-to-processor (SS-3), or another legally available mechanism. The party designated by the mandatory contract will make any required notification to the Turkish Data Protection Authority within the statutory period.

10.3. For transfers subject to GDPR/UK GDPR, the parties will enter into or incorporate the applicable EU Standard Contractual Clauses and UK transfer addendum/mechanism where required, including supplementary measures appropriate to risk.

10.4. The parties will cooperate on transfer assessments and information reasonably necessary to identify the transfer chain and safeguards. Customer acknowledges that using a global messaging service may involve processing in multiple countries under that provider’s own terms.

10.5. This DPA is not the standard contract published by the Turkish Data Protection Board and does not replace, amend or satisfy a mandatory-form KVKK overseas-transfer contract.

11. Audit

11.1. On reasonable request, Otai will provide current documentation reasonably sufficient to demonstrate compliance with this DPA, which may include security summaries, independent assessments or questionnaire responses where available.

11.2. If that information is insufficient, Customer may conduct audits at reasonable intervals, with additional audits following a material breach or where required by a Supervisory Authority. Audits must:

11.3. Customer bears its audit costs and Otai’s reasonable assistance costs unless the audit identifies a material Otai breach, in which case Otai bears reasonable audit costs attributable to confirming that breach.

1. give reasonable prior written notice unless an urgent regulator or breach matter requires a shorter period;
2. occur during normal business hours without unreasonable disruption;
3. be limited to systems and records relevant to Customer Personal Data;
4. protect other customers, security information and Otai Confidential Information;
5. use an independent qualified auditor who is not a competitor and is bound by confidentiality.

12. Government and third-party demands

12.1 Unless prohibited by law, Otai will notify Customer of a legally binding demand for Customer Personal Data. Before disclosure, Otai will review the requesting authority’s identity, legal authority, jurisdiction, validity and scope of the demand. Where legally available, Otai will seek clarification or challenge unlawful or overbroad demands and disclose only the minimum information legally required.

12.2 Otai will maintain restricted records of demands, legal assessments, reviewers and decision-makers, objections or challenges, responses and any disclosures made.

13. Return and deletion

13.1. During the Service term, Customer may export Customer Personal Data through available Service functionality or an agreed process.

13.2. On termination or Customer’s valid instruction, Otai will delete or return Customer Personal Data from active systems without undue delay and in accordance with the applicable deletion process, at Customer’s choice where technically and legally feasible, unless law requires continued retention.

13.3. Residual encrypted backups will be deleted or overwritten through the applicable backup cycle. Until then, they remain protected, are isolated from ordinary use and may be restored only for disaster recovery, security or legal necessity.

13.4. Otai may retain minimal records needed to demonstrate deletion, honour opt-outs, comply with law or establish/defend legal claims. This clause does not require deletion of properly anonymised data, but WhatsApp Business Solution Data remains subject to Meta/WhatsApp’s stricter contractual restrictions.

14. WhatsApp Business Solution Data and AI

14.1. Otai will process WhatsApp Business Solution Data only on Customer’s behalf, under its instructions, to provide the requested messaging and operational Service, and in compliance with the applicable WhatsApp/Meta terms.

14.2. Otai will not sell, license, disclose or use that data for its own unrelated purpose; build advertising or individual profiles from it; or use message content, metadata, or anonymous/aggregate/derived forms to create, develop, train or improve shared or general-purpose AI/ML models.

14.3. An AI Subprocessor may process limited content solely to produce the requested response, classification, translation, summary or workflow for Customer. The applicable contract must prohibit the Subprocessor from using Customer Personal Data for provider model training and require deletion/retention controls consistent with this DPA.

14.4. Customer remains responsible for WhatsApp user opt-in, template/channel compliance, human escalation and the lawfulness of its communications.

15. Liability and order of precedence

15.1 Liability under this DPA is subject to the Service Agreement’s liability provisions unless Applicable Data Protection Law prohibits the relevant limitation. If this DPA conflicts with the Service Agreement on personal-data processing, this DPA controls. A mandatory transfer instrument controls over this DPA for the relevant Restricted Transfer.

16. Term

16.1 This DPA starts when it is validly incorporated or accepted and continues while Otai processes Customer Personal Data. Obligations that by their nature continue—including confidentiality, restricted use, security, audit evidence, liability and deletion—survive termination for as long as relevant data remains.

Annex 1 – Processing details

Annex 2 – Technical and organisational measures

1. Governance: documented security/privacy roles, policies, risk review, confidentiality commitments and personnel training.
2. Access control: unique accounts, role-based and least-privilege access, prompt deprovisioning, privileged-access review and multi-factor authentication for administrative access.
3. Authentication/secrets: password controls, protected API credentials/tokens, secrets management, rotation/revocation processes, and no secrets in source code or ordinary logs.
4. Encryption: current transport encryption (TLS) for data in transit; encryption or equivalent protection for production data and backups at rest; managed key access.
5. Tenant/data separation: logical separation of Customer environments/data and authorisation checks that prevent cross-customer access.
6. Logging/monitoring: security-relevant audit logs, restricted log access, alerting and retained evidence proportionate to risk.
7. Secure development: change control, code review, dependency and vulnerability management, environment separation and remediation based on severity.
8. Infrastructure: hardened configuration, patching, network controls, protected administrative interfaces and resilience appropriate to the Service.
9. Backup/continuity: encrypted/restricted backups, restoration testing, defined recovery process and backup deletion cycle.
10. Incident response: documented detection, triage, containment, investigation, communication and lessons-learned process.
11. Data lifecycle: collection minimisation, configurable/defined retention, secure deletion, export and verified integration revocation.
12. Subprocessor management: privacy/security due diligence, written contracts, access minimisation and change monitoring.
13. Physical security: reliance on appropriately controlled facilities for hosting and restricted access to any Otai office systems containing Customer Personal Data.

Annex 3 – Authorised Subprocessor categories

Meta/WhatsApp may have a direct contractual relationship with Customer and is not treated as an Otai Subprocessor merely because its service interoperates with Otai. Any Restricted Transfer involving a Subprocessor remains subject to Section 10.

Annex 4 – Party information

Processor: Çallıoğlu İnşaat Turizm Sanayi ve Ticaret A.Ş. Sedir Mahallesi, 725. Sokak No: 2, Muratpaşa, Antalya, Türkiye Tax office / number: Antalya Kurumlar Vergi Dairesi / 2270065139 Privacy contact: info@otai.app

Customer/Controller: As identified in the applicable order form or Service Agreement.