Data Processing Addendum (GDPR + KVKK)

This addendum forms part of the Terms of Service and applies when Buinbu processes personal data on behalf of the Customer.

1. Roles. The Customer (the merchant) is the controller. Buinbu is the processor for personal data contained in the store data it processes to provide the service. For its own account, billing, support and security data, Buinbu is an independent controller under the Privacy Policy.
2. Subject matter and duration. Providing Buinbu apps (building feeds, importing products, sending service e-mails) for as long as the app is installed, plus the deletion periods in section 6.
3. Data and data subjects. Contact data of the Customer’s staff (name, e-mail, locale) and any personal data the Customer places in catalog content (for example a name in a product description). The apps do not request access to orders or to the Customer’s customers.
4. Buinbu’s obligations. Buinbu processes personal data only on the Customer’s documented instructions, which are these terms and the Customer’s settings in the app; keeps it confidential and limits access to people who need it; applies the measures in Annex 2; and helps the Customer answer data subject requests and carry out impact assessments where needed.
5. Sub-processors. The Customer gives general authorization for the sub-processors listed in section 6 of the Privacy Policy. Buinbu announces new sub-processors at least 30 days in advance; the Customer may object and, if no solution is found, stop using the service. Buinbu binds each sub-processor to obligations equivalent to this addendum.
6. Deletion. On uninstall, sessions and access tokens are deleted at once; 48 hours later, on Shopify’s shop/redact, all store data is deleted. Backups roll over within 14 days.
7. Personal data breach. Buinbu notifies the Customer without undue delay and at the latest within 48 hours of becoming aware of a breach, with its nature, the affected data, likely consequences and the measures taken.
8. Audit. Once a year, or after a breach, the Customer may request written information that shows compliance with this addendum.
9. International transfers. Application data is stored in the EU (Germany). Transfers to sub-processors in other countries rely on GDPR Chapter V safeguards (adequacy decisions, including the EU-US Data Privacy Framework, or Standard Contractual Clauses) and KVKK Article 9.
10. Customer’s obligations. The Customer collects personal data lawfully, gives the required notices and obtains consents, gives lawful instructions, and fulfils its own registration duties such as VERBİS where they apply.
11. Liability. The limitations in the Terms of Service apply.

Annex 1: Processing details. Purpose: providing the service. Data: staff contact data, catalog content. Location: Germany (EU), with the sub-processors in the Privacy Policy. Retention: as in the Privacy Policy, section 5.

Annex 2: Technical and organizational measures. TLS on every connection; Shopify access tokens encrypted at rest (AES-256-GCM); store data separated by tenant in the database; firewalled server in the EU with key-only administrative access; automatic security updates; daily backups kept 14 days; audit log of changes; access limited to Buinbu personnel who need it; deletion through Shopify’s privacy webhooks.