This text is a draft and has not passed legal review. Fields in square brackets are still to be completed.
B2B Data Processing Terms
Principles for services in which QUIS acts as a data processor on behalf of business customers.
Last updated: · Version: 0.1-draft
The Turkish version of this document prevails in case of any inconsistency.
1. Purpose and precedence
These terms outline the framework for research, analytics and platform services where QUIS processes personal data on a customer's behalf. The contract and data processing addendum signed with the customer prevail over this text.
2. Roles
| Party | Role | Responsibility |
|---|---|---|
| Customer | Data controller | Legal ground, privacy notices, required explicit consents, lawfulness of participant lists |
| QUIS | Data processor | Processing data only on the customer's instructions and under the contract, ensuring security |
QUIS is the data controller for its own account, billing and commercial relationship data. Under KVKK Article 12/2, the parties are jointly responsible for security measures.
3. Processing details
For each project, the contract or work order sets out the subject and duration, purpose, groups of individuals, data categories, any special categories of data, and the retention and deletion schedule.
4. QUIS's commitments
- Process data only on the customer's documented instructions and report any instruction it considers unlawful,
- Restrict access to authorised staff bound by confidentiality,
- Apply appropriate technical and administrative measures under KVKK Article 12: [SECURITY ANNEX TO BE PREPARED],
- Forward data subject requests to the customer within [5 BUSINESS DAYS — TO BE CONFIRMED] and support its response,
- Notify the customer of a data breach without delay and within [24 HOURS — TO BE CONFIRMED] of becoming aware of it,
- Not use customer data to train AI models without the customer's written instruction.
5. Sub-processors
Current sub-processor list: [LIST TO BE PREPARED]. Customers are informed before a new sub-processor is added and may object within a reasonable period. QUIS imposes the same obligations on sub-processors by contract.
6. Data location and international transfers
Country where customer data is hosted: [TÜRKİYE — TO BE CONFIRMED]. Any international transfer relies on a safeguard under KVKK Article 9 and on the customer's instructions.
7. Audit
On reasonable notice and subject to confidentiality rules, the customer may request information or an audit demonstrating compliance: [SCOPE AND FREQUENCY TO BE CONFIRMED].
8. End of service
At the end of the service, QUIS returns or deletes the data as the customer chooses. Deletion takes place within [30 DAYS — TO BE CONFIRMED], with backups cleared in the normal cycle, subject to statutory retention duties.
9. Customer responsibilities
The customer confirms that it obtained participant lists lawfully, gave the required privacy notices, and obtained all necessary explicit consents and approvals under Law No. 6563.
10. Contact
For data processing requests, write to info@quis.com.tr.