Legal
Data processing agreement
Last updated:
1. Parties and scope
This agreement is an integral part of the Terms of service and is made when the account is created. The parties are the business using the service ("Customer", "you") and Alpnet Yazılım Anonim Şirketi ("Benefity", "we").
For personal data about visitors to your own site, you are the data controller under Turkey's Personal Data Protection Law No. 6698 (KVKK) and Benefity is the processor that handles this data on your behalf. Benefity is the controller for data about your account and staff; that data is covered by the privacy policy and is outside the scope of this agreement.
Where the EU or UK General Data Protection Regulation (GDPR) applies, this agreement also serves as the processor agreement under Article 28.
2. Data processed
| Whose data | What data and why | How long |
|---|---|---|
| Visitors to the site where widgets show | The IP address and browser details that reach our servers when the widget script loads: to show the widget, for security and for debugging. View counting never stores IP or browser details; they are turned into a one-way hash unique to that day and store. | Server logs at most 90 days; counting hashes at most 2 days |
| Visitors who enter an address in an email-capture widget | Email address, the page it was entered on and the time: to keep your subscriber list. | Until the widget is deleted or you ask us to delete it |
| People who reviewed the business on Google | Name, profile photo address, rating, review text, date and the owner's reply: to show the reviews you choose on your site. | The 30 newest reviews per business; refreshed daily, deleted if not refreshed for 30 days |
No customer or order data is read or stored from store platforms (IdeaSoft, Shopify, ikas); Benefity processes only product, category and blog content. You shouldn't add personal data to this content beyond what is already public on your site. Widgets must not be used to collect special categories of personal data (such as health or beliefs).
3. Instructions
- Benefity processes visitor data only to provide the Service and on your instructions. Your settings in the app (which widget shows where and how often, what data is collected) count as instructions.
- Benefity doesn't use visitor data for its own purposes, sell it, use it for advertising or combine it with other customers' data.
- If we believe an instruction breaks the law, we'll tell you.
4. Security and confidentiality
We apply these technical and organizational measures, as required by Article 12 of the KVKK:
- All connections use TLS; the database isn't reachable from the internet and its disk is encrypted.
- View counting works without identifying anyone: a daily one-way hash is used instead of IP address and browser details.
- Only authorized staff bound by confidentiality access the data, and only as their work requires. Opening a customer's app for support is limited to 2 hours and every opening is logged.
- Email-capture submissions are accepted only from requests coming from your registered site address.
5. Sub-processors and international transfers
The sub-processors we use for visitor data:
- Amazon Web Services (Frankfurt, Germany): servers, database, backups and logs.
- Outscraper (USA): fetches Google reviews from public Google Maps pages and passes them to us. No visitor data is sent to Outscraper; only the business's Google ID is sent.
Visitor data is never sent to our AI provider. Because AWS is outside Turkey, this data is transferred abroad; the transfer relies on the appropriate safeguards in Article 9 of the KVKK (the standard contract published by the Turkish Data Protection Board). You authorize us to make this transfer.
We'll email you at least 15 days before adding a new sub-processor. If you object on reasonable grounds and we can't resolve it, you can terminate the Agreement and we'll refund the unused full months. We hold sub-processors to obligations at the same level as this agreement.
6. Data subject requests
- Answering visitors' requests under Article 11 of the KVKK is your responsibility. We forward any request we receive directly to you without delay and help you answer it.
- You can download an email-capture widget's subscriber list from the app as an Excel file. Deleting the widget also deletes the addresses it collected; to delete individual addresses, write to hello@benefity.io.
7. Data breaches
When we become aware of a breach affecting visitor data, we'll notify you without undue delay and within 48 hours at the latest, with the details we know and the measures we've taken. As controller, you are responsible for notifying the Turkish Data Protection Board and the people affected (KVKK Art. 12(5)); we'll provide the information you need for this.
8. Your obligations
- You inform your visitors in your site's privacy and cookie policy about Benefity widgets, the data they collect and the entries they write to the browser. The list of entries is in our cookie policy.
- Next to an email-capture widget, you show a notice explaining why the address is collected. If you will send marketing emails to the addresses collected, obtaining prior consent and registering it where required (in Turkey, with the Message Management System, İYS, under Law No. 6563) is your responsibility.
- You have a valid legal basis for processing visitor data and don't give us instructions that break the law.
9. Information and audits
You can ask in writing for information showing that we comply with this agreement, and we'll answer within a reasonable time. On-site audits may take place at most once a year, with at least 30 days' notice, during business hours and at your cost, and must not put other customers' data or security at risk.
10. Term and deletion
This agreement applies for as long as the Terms of service are in force. When it ends, visitor data is deleted within 30 days, or right away if you delete your account in the app; deleted data stays in backups for at most 14 more days. You can download your subscriber lists before then.
11. Liability
Liability under this agreement follows the limits in the Terms of service. These limits don't remove the responsibility towards data subjects under Article 12 of the KVKK.
12. Contact
- Company
- Alpnet Yazılım Anonim Şirketi
- Address
- Sultan Selim Mah. Hümeyra Sk. Nef 09 Sitesi B Blok No: 7 İç Kapı No: 175, Kağıthane / İstanbul
- MERSİS
- 0058082635500001
- Tax office / no
- Maslak / 0580826355
- Trade registry
- İstanbul Ticaret Odası, sicil no 1153504
- hello@benefity.io