Data Processing Agreement (DPA)

This agreement sets roles between the customer as controller and Kuzey Veri Merkezi Anonim Şirketi (KuzeyDC) as processor under Turkish KVKK and, where applicable, GDPR Article 28.

Last updated: November 2026. Applies to hosting and related services on https://www.kuzeydc.com and https://my.kuzeydc.com.

The customer is controller of personal data about its end users or staff. KuzeyDC processes such data under the customer’s instructions and the service agreement. KuzeyDC may also be controller for its own account, billing and support records, as described in the KVKK notice.

Typical processing includes server and storage hosting, backup/DR options, technical support, monitoring and logs, and technical records related to billing.

KuzeyDC may use sub-processors such as payment institutions, network carriers or backup/software vendors. Reasonable notice is given for material changes. Confidentiality and security obligations are bound by contract.

KuzeyDC applies encryption in transit and where appropriate at rest, access control, physical facility security (Istanbul Tier III), monitoring and incident response. Certificates are listed on the certifications page.

KuzeyDC assists the customer (controller) with access, rectification, erasure and similar requests under KVKK/GDPR. Requests are handled within 30 days where practicable.

If a security incident under KuzeyDC’s control affects personal data, the customer is notified within legal and contractual timelines, including known scope, data types and remediation steps.

Once per year with reasonable notice, customers may request summary security information or available audit/certificate reports. On-site audits are agreed separately; costs generally fall on the requester.

This DPA lasts for the term of the service agreement. After termination, customer data is deleted or returned within the period stated in the contract (typically up to 90 days), subject to legal retention duties.

Contact: info@kuzeydc.com