Data Processing Agreement
This English text is a translation provided for convenience. Where the Turkish version differs, the Turkish version prevails for users in Türkiye.
1. Roles and scope
The organising institution is the controller for data it enters about contestants and teams (names, photos, scores); Pingel is a processor acting on its behalf. For the organiser's account and payment data, Pingel is the controller.
This agreement sets out Pingel's (processor) obligations under KVKK Art. 12 and GDPR Art. 28 for personal data the Customer (controller) uploads to or processes through the service, and forms an annex to the Service and Subscription Agreement.
2. Subject of processing
Subject: organising and presenting the live competition. Duration: the account/package term. Data subjects: contestants (including students) and jury members. Data types: names, team names, photos/avatars, scores. No special category data is processed.
3. Pingel's obligations
- Process data only on the Customer's documented instructions (including the service itself and its settings), never for its own purposes.
- Ensure that people with access are bound by confidentiality.
- Implement appropriate technical and organisational measures: encrypted connections, logical separation of customers' data, role-based access rules, backups, minimal administrative access.
- List sub-processors below, notify the Customer before adding one and allow objection, and impose the same protections on them.
- Reasonably assist the Customer with data subject requests and security obligations.
- Notify the Customer of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it.
- On termination, keep data for 30 days for the Customer to export, then delete it (from backups within 35 days).
- Provide the Customer, on request, with information demonstrating compliance.
4. Customer's obligations
- As controller, inform the data subjects (staff, customers, students/parents etc.) and have the required legal basis or consent.
- Enter only the data needed for the purpose; enter special category data only where lawful and necessary.
- Manage user accounts and permissions securely.
5. Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Google Firebase / Google Cloud (Google Ireland Ltd., Google LLC) | Hosting, authentication, database, server functions | EU and/or US data centres |
| Google Gemini API (Google LLC) | AI features: the text or transcript you submit is processed | United States |
| Cloudflare, Inc. | Hosting, content delivery, DNS, attack protection | Global network (US-based) |
| Banks | Receiving and verifying bank-transfer payments | Türkiye |
6. International transfers
Some sub-processors are outside Türkiye. Transfers rely on appropriate safeguards such as standard contracts and the providers' data processing terms under KVKK Art. 9 and GDPR Chapter V.
7. Entry into force
This agreement takes effect when the Customer electronically accepts the service agreement and remains in force for its term. Institutions needing a signed copy can request one at hasan@pingel.dev.