Data Processing Addendum
Last updated: 9 Eylül 2026
This Addendum is an integral part of the Terms of Service between Artistik Dijital / Mehmet Sancak ("Kolay DM", "Processor") and the business using the Kolay DM service ("Customer", "Controller"). By using the service, the Customer is deemed to have accepted this Addendum.
1. Definition of Roles
For the personal data of persons who send messages to the Customer's Instagram/WhatsApp account ("End User"):
- The Customer is the data controller. The Customer determines the purposes and means of processing.
- Kolay DM is the data processor. It processes the data only on the Customer's instructions.
The Customer's own account, invoice and contact data falls outside the scope of this Addendum; for that data Kolay DM is the controller (KVKK Privacy Notice).
2. Subject Matter and Duration
| Item | Content |
|---|---|
| Subject matter | Receiving, storing, displaying in the panel, answering with AI and converting into CRM records the Instagram DMs/comments and WhatsApp Business messages |
| Duration | For as long as the Customer's account is open; ends when the account or brand is deleted |
| Data types | Name/username, profile picture, message and comment content, phone/email shared by the person, interaction timestamps |
| Data subjects | End users who message the Customer |
3. Kolay DM's Obligations
Kolay DM shall:
- Process personal data solely on the Customer's instructions and to perform the service; it does not use the data for its own purposes, does not sell it and does not share it for advertising.
- Limit access to personnel who need it for their work and bind those persons to confidentiality.
- Take the technical and administrative measures required by article 12 of the KVKK: encryption of access tokens with AES-256-GCM, row level isolation in the database (RLS), audit logging of administrator actions, and keeping message content out of diagnostic records.
- Provide reasonable assistance to the Customer in responding to data subject requests; the panel offers tools to delete a contact record, export data and view conversation history.
- In the event of a data breach, notify the Customer without undue delay and no later than 72 hours, together with the known scope and the measures taken.
- Delete the data within the scope and period described on the Data Deletion page when the service ends or when the Customer requests it.
4. Sub-Processors
Kolay DM uses the following sub-processors to perform the service. By using the service, the Customer approves them:
| Sub-processor | Purpose | Outside Türkiye |
|---|---|---|
| Meta Platforms | Receiving and sending Instagram/WhatsApp messages | Yes |
| OpenAI | Generating AI replies | Yes |
| iyzico | Subscription collection (Customer data only) | No |
The server and database infrastructure is operated by Kolay DM; no data is held in a third-party hosting provider's database. If a new sub-processor is added, this list is updated and the change is notified to the Customer in a reasonable manner.
5. Customer's Obligations
The Customer shall:
- Inform end users that their messages are processed through a software service and may be answered by artificial intelligence.
- Be responsible for having a legal basis for the processing and, where required, for obtaining explicit consent.
- Not use the service for spam, harassment or misleading communication, and comply with Meta's platform policies.
- Appropriately manage the permissions of team members with access to the panel.
6. Audit
Upon reasonable notice and no more than once a year, the Customer may request written information and documents from Kolay DM in order to verify compliance with this Addendum. Such requests are met in a manner that does not disrupt the operation of the service and does not disclose other customers' data.
7. Contact
Artistik Dijital / Mehmet Sancak İslambey Mah. İslambey Cad. Aydın Apt. No:97 İç Kapı No:5, Eyüpsultan 34050 İstanbul, Türkiye Email: [email protected] · Phone: +90 850 840 4496