⚠️ Interim draft. The counsel-reviewed version will be published by 2026-06-15.

Data Processing Addendum (DPA) per GDPR Art. 28

Controller: [Tenant company — added during onboarding] Processor: Kerim Agdaci ("ByKA Insights"), address in Imprint.

The full DPA template can be downloaded as PDF: DPA-Template-2026-06-03.pdf (will be updated after counsel review).

Essential obligations

• Processing strictly per documented instructions
• Confidentiality of personnel involved
• Technical-organizational measures (TOMs) per Art. 32 GDPR
• Support for controller's data-subject + supervisory-authority handling
• Deletion or return of data after contract end
• Verifiable compliance via controller audit rights

Sub-Processors

See Privacy §4. New sub-processors added with 14-day prior notice.

Third-country transfer

Anthropic, Cloudflare, Supabase Inc., AWS, Resend, Telegram, Exa, Blotato, MailerLite — based on EU Standard Contractual Clauses 2021/914 + supplementary measures.

Last updated: 2026-06-03