Gentz AI

Legal

Data Processing Agreement

Last updated: October 31, 2026

The bracketed fields in this text are not filled in yet: LEGAL_COMPANY_NAME, LEGAL_ADDRESS, LEGAL_EMAIL.

This Data Processing Agreement (the “Agreement”) sets out the obligations of the platform operator (the “Company”) as data processor for the personal data that agencies and businesses using the Gentz AI platform (the “Platform”; each a “Customer”) process on the Platform. It forms an integral part of the Terms of Service.

Legal name
[LEGAL_COMPANY_NAME]
Address
[LEGAL_ADDRESS]
Email
[LEGAL_EMAIL]

1. Roles

When processing personal data of its customers, employees and contacts on the Platform, the Customer is the data controller under the Personal Data Protection Law No. 6698 (“KVKK”). [LEGAL_COMPANY_NAME] is the data processor, processing this data only on the Customer’s behalf and instructions.

Where an agency uses the Platform on behalf of businesses it serves, it is responsible for concluding the necessary agreements with those businesses and flowing down the obligations of this Agreement.

2. Subject, purpose and duration

Processing is carried out for the term of the agreement in order to provide, host, back up and secure the Platform, provide support, and run the features the Customer enables (messaging, AI assistant, appointments, payments, ad reports, etc.).

3. Data categories and data subjects

Depending on the Customer’s use, the main data processed may include:

  • Data subjects: the Customer’s customers and prospects, people it messages with, form respondents, employees and Platform users.
  • Identity and contact: name, phone, email, WhatsApp and Instagram user IDs.
  • Customer transactions: message contents, notes, appointments, quotes, sales, package / session usage, payment status, satisfaction responses.
  • Marketing: source and campaign attribution, communication preferences, consent records, loyalty points.
  • Transaction security: session, IP and activity logs.

Card details are not stored on the Platform; payments are processed directly on the payment institution’s infrastructure. The Customer agrees not to enter special categories of personal data (e.g. health data) unless necessary and, if it does, to meet the conditions of Article 6 of the KVKK.

4. Company obligations

  • Process personal data only on the Customer’s documented instructions (including Platform settings and use), and inform the Customer if it considers an instruction unlawful.
  • Bind staff who access the data to confidentiality and limit access to what their duties require.
  • Apply the technical and organisational measures set out below.
  • Assist the Customer in responding to data subject requests, and provide the Platform’s data export, anonymisation, communication preference and consent management tools.
  • Inform the Customer without delay, and in any case within 48 hours, of a personal data breach it becomes aware of, providing the information the Customer needs to notify the Personal Data Protection Board about the nature of the breach, the data affected and the measures taken.

5. Technical and organisational measures

  • Separation of each agency’s and business’s data at application and database level (row-level security).
  • Role- and assignment-based authorisation; employees access only the businesses and conversations they are assigned to.
  • Two-factor authentication for admin accounts and session management.
  • Encrypted storage of integration access tokens; encrypted connections (TLS) in transit.
  • Audit logging of important actions; support access that is justified, time-limited and logged.
  • Regular backups, security updates and the principle of least privilege.

6. Sub-processors

The Customer gives general authorisation for the Company to use sub-processors in the categories below to provide the service. The Company imposes obligations equivalent to this Agreement on sub-processors and remains liable to the Customer for their acts. The Customer is informed at least 15 days before a new sub-processor is added and may object on reasonable grounds.

  • Hosting, database, file storage and backups: [LEGAL_HOSTING].
  • Email delivery services.
  • AI model provider (Anthropic, PBC): only when the Customer enables AI features, and only for the related conversation and knowledge content (see Privacy Policy §5).
  • Meta Platforms (WhatsApp, Instagram, Facebook, ads) and payment institutions (iyzico, PayTR) connected by the Customer with its own accounts; the relationship with these providers is also subject to the Customer’s own agreements.

7. International transfers

Some sub-processors may be located abroad. In that case, transfers are made with one of the safeguards set out in Article 9 of the KVKK (adequacy decision, standard contract notified to the Personal Data Protection Board, etc.). Optional features that require processing abroad (e.g. the AI assistant) are not used unless the Customer enables them.

8. Customer obligations

  • Collect personal data on a lawful basis and inform data subjects.
  • Obtain the required consents before sending commercial electronic messages and manage İYS records.
  • Respond to data subject requests and notify the Board where required.
  • Follow the principle of least privilege when authorising its users.

9. Audit

On reasonable request, the Company provides the Customer with information demonstrating compliance with this Agreement. The Customer may request an audit with at least 30 days’ notice, no more than once a year, subject to a confidentiality undertaking and at its own cost.

10. End of the agreement

When the subscription ends, the Customer may export its data. Workspace data is deleted or anonymised within 30 days of the end of the subscription at the latest, except data that must be kept by law, and this is confirmed in writing at the Customer’s request.

11. Governing law and contact

This Agreement is governed by the laws of the Republic of Türkiye; [LEGAL_JURISDICTION] have jurisdiction over disputes. For questions: [LEGAL_EMAIL].

Back to the home page