⚠️ Interim draft. The counsel-reviewed version is being finalized and will be published shortly.

Data Processing Addendum (DPA) per GDPR Art. 28

Controller: [Tenant company — added during onboarding] Processor: Kerim Agdaci ("ByKA Insights"), address in Imprint.

The full DPA template is available as HTML: DPA / AVV — current version (will be updated after counsel review).

Essential obligations

• Processing strictly per documented instructions
• Confidentiality of personnel involved
• Technical-organizational measures (TOMs) per Art. 32 GDPR
• Support for controller's data-subject + supervisory-authority handling
• Deletion or return of data after contract end
• Verifiable compliance via controller audit rights

Sub-Processors

See Privacy §4. New sub-processors added with 14-day prior notice.

Third-country transfer

Anthropic, Cloudflare, Supabase Inc., AWS, Resend, Telegram, Exa, Upload-Post (TONVI TECH SL), MailerLite — based on EU Standard Contractual Clauses 2021/914 + supplementary measures. Destinations the Controller designates itself (notification channels per Privacy §4a) are not Processor sub-processors; the Controller is responsible for any third-country transfer to them.

Last updated: 2026-08-02