Draft prepared for review by Roltek's legal counsel. Not legal advice.
Last updated: [Effective date]
1. Parties and purpose
1.1 This data processing addendum ("DPA") forms part of the agreement between the Customer and Roltek A.Ş. (Roltek Teknoloji), Megapol Çarşı Kule, Halkapınar Mah. 1203/11. Sk. No: 5-7, Kat 9, Ofis 98, 35170 Konak, İzmir, Türkiye, MERSİS no. [MERSİS no.] ("Roltek") for the Hermetry service under the Terms of service and any Order Form (the "Agreement").
1.2 It sets out the terms required by Article 28 of the EU General Data Protection Regulation 2016/679 ("GDPR") and Article 12 of the Turkish Personal Data Protection Law No. 6698 ("KVKK"), and any other data protection law that applies to the processing ("Data Protection Law"). Terms such as controller, processor, personal data, processing and personal data breach have the meaning given in the Data Protection Law; under KVKK, controller means *veri sorumlusu* and processor means *veri işleyen*.
1.3 For personal data in Customer Content, the Customer is the controller (or a processor acting for its own customers) and Roltek is the processor (or sub-processor). Roltek's processing as controller, for example of account, billing and security data, is described in the privacy policy and is not covered by this DPA.
2. Details of processing
- Subject matter: hosting and processing of Customer Content to provide the Hermetry industrial IoT telemetry and SCADA platform.
- Duration: the term of the Agreement plus the export period and the deletion period in section 11.
- Nature: collection through Devices and the API, storage, organisation, retrieval, display, analysis by rules and dashboards, transmission of alerts and commands, backup, export and deletion.
- Purpose: providing, securing and supporting the Service as instructed by the Customer.
Data subjects and categories of personal data
| Data subjects | Categories of personal data |
|---|---|
| Customer's Authorised Users (employees, contractors, its end customers' staff) | Name, e-mail, phone, role and permissions, sign-in and session records, two-factor and passkey settings, audit log entries of their actions, approvals they give or reject, notification settings |
| People whose phones are paired as Devices through the mobile app | Device identifiers and, only for the signals the person turns on: location, battery level and motion data |
| People linked to Devices, sites or assets (for example drivers, technicians, building occupants, end customers) | Names and identifiers assigned by the Customer, location of assets and vehicles, time stamps, readings the Customer links to a person |
| Contacts in alarms and notifications | Name, e-mail address, phone number, messaging identifiers |
3. Customer's instructions and responsibilities
3.1 Roltek processes personal data only on the Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by law to which Roltek is subject; in that case Roltek will inform the Customer before processing unless the law prohibits it. The Agreement, this DPA and the Customer's configuration and use of the Service are the Customer's complete instructions.
3.2 Roltek will inform the Customer immediately if, in its opinion, an instruction infringes Data Protection Law, and may suspend the instruction until it is confirmed or changed.
3.3 The Customer is responsible for the lawfulness of the processing it instructs, including having a legal basis, giving notices to data subjects (for example to employees whose phones or vehicles are tracked), and, where required, consulting employee representatives. Location tracking of people must be limited to what is necessary and proportionate and should, where possible, be limited to working hours.
4. Confidentiality
Roltek ensures that persons authorised to process personal data are bound by confidentiality obligations or are under an appropriate statutory obligation of confidentiality, receive training on data protection, and have access only as needed for their role. Support access to a Tenant is recorded in the Customer's audit log.
5. Security of processing
5.1 Roltek implements and maintains appropriate technical and organisational measures under Article 32 GDPR and Article 12 KVKK, taking into account the state of the art, the costs, and the nature, scope, context and purposes of the processing and the risks. They include:
- separation of each Tenant's data in the database with row-level security;
- encryption of data in transit (TLS) between browsers, Devices, gateways and the Service;
- hashing of passwords and device secrets, which are shown once and can be rotated or revoked; device certificates from the platform's own certificate authority;
- multi-factor authentication, passkeys and single sign-on, password and lockout policies, and session control;
- role- and attribute-based access control down to individual Devices;
- an append-only audit log per Tenant, which also records support access;
- monitoring and automated blocking of attacks by the AI firewall, with a recorded reason for each decision;
- hosting in the region the Customer chose (EU, US or Türkiye), backups and recovery procedures;
- vulnerability management, change control and least-privilege access for Roltek staff.
5.2 More detail is on the security page. Roltek may update the measures, provided the overall level of protection is not reduced. Under Article 12(2) KVKK, Roltek and the Customer are jointly responsible for taking the measures in Article 12(1) KVKK.
6. Sub-processors
6.1 The Customer gives Roltek general authorisation to engage sub-processors. The current list, with each sub-processor's function and location, is provided on request at info@hermetry.com and will be published on hermetry.com.
6.2 Roltek will notify the Customer of any intended addition or replacement of a sub-processor at least 30 days in advance, by e-mail or in the Service. The Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith; if Roltek cannot offer a reasonable alternative, the Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the remaining term.
6.3 Roltek imposes on each sub-processor, by written contract, data protection obligations that are no less protective than this DPA, and remains liable to the Customer for its sub-processors' performance.
7. Assistance
7.1 Data subject requests. Taking into account the nature of the processing, Roltek assists the Customer with appropriate technical and organisational measures to answer requests from data subjects under Articles 12 to 22 GDPR and Article 11 KVKK. The Service provides tools to find, export and erase a person's data. If Roltek receives a request directly, it will refer the data subject to the Customer and not answer it itself unless the Customer instructs it to.
7.2 Impact assessments and consultations. Roltek provides reasonable information to help the Customer carry out data protection impact assessments and prior consultations with authorities under Articles 35 and 36 GDPR.
7.3 Assistance beyond what the Service provides as standard may be charged at reasonable rates agreed in advance.
8. Personal data breaches
8.1 Roltek will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Content.
8.2 The notice will describe, as far as then known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information not available at first will be provided in phases without undue delay.
8.3 The Customer as controller is responsible for notifying the competent supervisory authority (under Article 33 GDPR within 72 hours, and under KVKK the Personal Data Protection Board as soon as possible and within 72 hours as the Board has decided) and the data subjects where required. Roltek will cooperate and will not notify authorities or data subjects of a breach of Customer Content on its own unless the law requires it.
8.4 Notifying a breach is not an admission of fault or liability.
9. International transfers
9.1 Customer Content is stored in the region the Customer chose and is not moved to another region for normal operation. Roltek may access it from Türkiye for support and operations, and sub-processors may process it in the countries stated in the sub-processor list.
9.2 Where a transfer requires safeguards, the parties rely on: for transfers subject to the GDPR, the European Commission's standard contractual clauses (Decision 2021/914; Module 2, or Module 3 where the Customer is a processor), which are incorporated by reference on request and prevail over this DPA in case of conflict; and for transfers subject to KVKK, the standard contract published by the Personal Data Protection Board under Article 9 KVKK, which the transferring party notifies to the Authority within five business days of signing. Roltek will put equivalent safeguards in place with its sub-processors.
10. Audits
10.1 Roltek makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR and Article 12 KVKK, including answers to reasonable security questionnaires and summaries of relevant reports.
10.2 If that information is not sufficient, or an authority requires it, the Customer may audit Roltek's compliance, by itself or through an independent auditor bound by confidentiality, not more than once in any 12-month period (except after a personal data breach or at an authority's request), with at least 30 days' written notice, during normal business hours, in a way that does not disrupt the Service or compromise other customers' data. Each party bears its own costs.
11. Deletion or return
At the end of the Agreement, the Customer may export Customer Content during the export period set out in the Terms. After that period, Roltek deletes personal data in Customer Content from active systems, and from backups as they rotate, unless Union, Member State or Turkish law requires further storage, in which case Roltek keeps the data confidential and processes it only for that purpose. Roltek confirms deletion in writing on request.
12. Liability and precedence
12.1 Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms, except where Data Protection Law does not allow liability towards data subjects to be limited.
12.2 In case of conflict, the standard contractual clauses or the Board's standard contract (where they apply) prevail over this DPA, and this DPA prevails over the Terms in matters of personal data processing.
12.3 This DPA ends when Roltek no longer processes personal data for the Customer. Questions: info@hermetry.com.