Data Processing Addendum

This addendum applies to website owners who publish a website at Buildary and store their visitors' data on Buildary. It is read together with the Terms of Use.

The website owner is the data controller for personal data relating to the website's visitors, customers, and people booking appointments. Buildary is the data processor processing that data on the website owner's behalf within the meaning of Article 3 of Law No. 6698.

Buildary is the data controller for your account, payments, and product usage. This data is explained in the KVKK Information Notice.

Buildary processes visitor data only to operate the website: receive forms and appointments, display records in your dashboard, send you notifications, retain consent records, and enable Ary to perform the tasks you request.

Data is processed for as long as your website exists. Records are linked to the website and are deleted together with the website record. The retention end date for consent records is set to three years after the consent date. Termination and deletion conditions are in section 10.

Data subjects are website visitors, people submitting forms, people booking appointments, people posting comments, and customers if the store module is used.

Data processed: everything entered in forms (such as name, email address, telephone number, and message), appointment records (name, telephone number, email address, time, and service), IYS consent records (recipient, channel, consent status, time, IP address, and browser information), comments, and customer accounts. IP addresses in form records are retained as a hash.

Your conversations with Ary about your business are also within this scope. If you include visitor data in a conversation, or Ary reads visitor records at your request, that data is processed under the same rules.

Buildary processes visitor data only on your instructions. Instructions consist of your use of the service, commands from the dashboard, and tasks you give Ary. If we believe an instruction is unlawful, we will notify you before carrying it out.

We do not use the content of visitor records for our own purposes. To operate and measure the service, we look only at the number of records, such as how many forms a website receives.

You are responsible for your website's information notice, necessary consents, and other obligations to your visitors.

Within Buildary, only the people who need access to provide support, maintain security, and operate the service can access visitor data. These people are obliged to keep the data confidential. Data is not disclosed to third parties unless legally required.

Each website's records are linked to that website in the database, and row-level access rules prevent another website's records from being read. Connections use secure transport (TLS). Forms and appointment requests are protected by rate limits. IP addresses in form records are not stored in a reversible form. Database backups are made, and a limited number of backups is retained.

Buildary uses the following subprocessors when processing visitor data. Each entry states its purpose, country, data types, and transfer basis. The complete list of the same service providers is in the KVKK Information Notice.

• netcup. Purpose: Application servers, database, and backups. Country: Austria (server in Vienna). Data: All account, website, payment reference, billing profile, and visitor records. Transfer basis: Standard contract (KVKK Art. 9).
• Cloudflare. Purpose: Storage of website files (R2), website publication, domain DNS records, and bot verification (Turnstile). Country: USA. Data: Website files and images, requests to published websites (IP address, browser information), domain records. Transfer basis: Standard contract (KVKK Art. 9).
• Resend. Purpose: Transactional emails: account verification, notifications, and website form and appointment notifications. Country: USA. Data: Email address, name, and email content; what the visitor completing the form has written. Transfer basis: Standard contract (KVKK Art. 9).
• Anthropic. Purpose: Artificial intelligence model for website creation, editing, and Ary's replies. Country: USA. Data: The requests you write, website content, Ary conversations; visitors' form text if needed for the requested task. Transfer basis: Standard contract (KVKK Art. 9).
• EachLabs. Purpose: Access to artificial intelligence models for images, video, audio, and some text tasks. Country: USA. Data: Prompts, photos and videos you upload, text to be voiced; text taken from customer questions for article tasks. Model providers (called through this service): OpenAI, Google, MiniMax, Kling, ByteDance, Deepgram, Mureka. Transfer basis: Standard contract (KVKK Art. 9).
• Meta (WhatsApp and advertisements). Purpose: WhatsApp support channel (when you contact us on WhatsApp), Ary through WhatsApp, customer announcements, telephone verification code, and website-ready notification; management of your Meta advertising account when you connect it. Country: USA. Data: Telephone number, verification code, WhatsApp messages and media files, advertising account information, and campaign settings. Transfer basis: Standard contract (KVKK Art. 9).

Transfers to subprocessors abroad are made under Article 9 of Law No. 6698. As of today, the Board has not issued an adequacy decision for any country; we therefore use the Board's standard contract as the transfer basis and notify the Authority within five business days of signing.

When we add a new subprocessor to the list, we update this page and notify you at the email address associated with your account. You can write to buildarydev@gmail.com to object to the change.

You can view visitor records and change their status from your dashboard. The "Download my data" file downloaded from the dashboard contains your account records, not visitor records.

If a visitor requests access, correction, or deletion and you cannot do it from the dashboard, write to buildarydev@gmail.com. We will help fulfil the request without delay. If a visitor contacts us directly, we will forward the request to you and will not respond without your instructions.

If we become aware of a breach affecting visitor data, we will notify you without delay. The notice describes the breach, the data affected, and the measures we have taken. As data controller, you are responsible for notifying the Board and data subjects. We will provide the information you need to fulfil this obligation.

When you delete your account, your account records in the portal are deleted. Websites and visitor records are kept in a separate system and are not automatically deleted by account deletion. You may request their deletion in writing at buildarydev@gmail.com, and we will fulfil the request without delay.

Before requesting deletion, you can view your records in the dashboard and keep your own records. Deleted data may remain in backups until the backups are replaced in their normal cycle. Records required by law are retained for the applicable period.

On your written request, we will provide information showing that we fulfil the obligations in this addendum. You or an independent auditor appointed by you may conduct the audit. The audit is notified in advance, carried out without disrupting the service, and does not include access to other website owners' data.