Data Processing Agreement
Draft · Awaiting legal review
DRAFT — needs legal review. This text is a working draft and is not yet in force.
This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer that controls a Quvos workspace ("Customer") and [Company legal name], [address], MERSİS no. [MERSİS no] ("Quvos"). It applies whenever Quvos processes personal data contained in Customer Content on the Customer's behalf. It does not apply to Quvos Enterprise, which is covered by a separate agreement.
1. Roles and scope
- For personal data in Customer Content, the Customer is the controller (KVKK: veri sorumlusu) and Quvos is the processor (KVKK: veri işleyen), within the meaning of Article 28 GDPR and Article 12 of Law No. 6698 ("KVKK").
- Where the Customer is itself a processor for a third party, Quvos acts as its sub-processor and the Customer confirms it has the authority to engage Quvos.
- Account, billing, security and abuse-prevention data are processed by Quvos as an independent controller under the Privacy Policy, not under this DPA.
- "Customer Content" means projects, Git repositories, Agents, Skills, documents, knowledge bases, chats with AI Agents, app and Agent telemetry and secrets in the Customer's workspace, and apps served from quvos.app.
2. Details of processing
| Item | Description |
|---|---|
| Subject matter | Hosting and operating the Quvos software development platform |
| Duration | For the term of the Terms of Service plus the deletion periods in section 10 |
| Nature and purpose | Storage, hosting, computation, transmission to AI model providers, backup, support and security of Customer Content |
| Data subjects | Customer's users, team members and any persons whose data the Customer puts into its workspace or apps |
| Categories of data | Determined by the Customer; typically names, contact details, user IDs, content of chats, code and documents, application telemetry |
| Special categories | Not intended. The Customer must not store special categories of data (KVKK Art. 6, GDPR Art. 9) unless it has a lawful basis and has assessed the safeguards. |
3. Customer's obligations
The Customer is responsible for the lawfulness of the processing, for informing data subjects and obtaining any consent, for the accuracy of the data, and for configuring its workspace (members, roles, Agents, MCP connections, model providers and BYOK keys) appropriately. Instructions given through the Service's settings, the Terms and this DPA are the Customer's complete instructions.
4. Quvos' obligations
Quvos will:
- process personal data only on the Customer's documented instructions, unless required otherwise by law, in which case it will inform the Customer unless the law forbids it;
- inform the Customer if it believes an instruction infringes data protection law;
- ensure that personnel authorised to process the data are bound by confidentiality;
- implement the technical and organisational measures in Annex 2;
- assist the Customer, taking into account the nature of the processing, with data subject requests (KVKK Art. 11, GDPR Arts. 15–22), security, breach notification, data protection impact assessments and prior consultation;
- not use Customer Content to train AI models [confirm], and not sell it or use it for advertising.
5. Support access
Quvos support staff may access a workspace only read-only, for a limited time of at most 8 hours, with a written reason recorded. The workspace owner is notified and sees the access log. Support never receives write access and cannot see secret values, terminals or personal chats.
6. Sub-processors
- The Customer gives general authorisation for Quvos to engage the sub-processors listed in Annex 1.
- Quvos will announce new or replacement sub-processors at least [30] days in advance at https://quvos.io/en/legal/dpa and by e-mail to workspace owners who subscribe. The Customer may object on reasonable data protection grounds; if no solution is found, the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees.
- Quvos imposes data protection obligations on each sub-processor equivalent to this DPA and remains liable for their performance.
7. International transfers
Where personal data is transferred outside Türkiye or the EEA/UK, Quvos ensures a valid transfer mechanism: for KVKK, an adequacy decision or the standard contracts under amended Article 9 of Law No. 6698, notified to the Personal Data Protection Authority within five business days; for GDPR, an adequacy decision or the Standard Contractual Clauses (Module 2 or 3 as applicable) and the UK Addendum, which are incorporated by reference. If a mechanism is invalidated, the parties will cooperate to put an alternative in place.
8. Personal data breaches
Quvos will notify the Customer without undue delay, and in any event within [48] hours, after becoming aware of a personal data breach affecting Customer Content. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, and the measures taken or proposed. Quvos will provide further information as it becomes available, so that the Customer can meet its own deadlines (72 hours under GDPR Art. 33 and KVKK Board practice). Notification is not an admission of fault.
9. Audits
Quvos will make available information necessary to demonstrate compliance with this DPA, including summaries of security reviews and certifications [when available]. If that is not sufficient, the Customer may conduct an audit, no more than once a year, with at least 30 days' notice, during business hours, at its own cost, through an independent auditor bound by confidentiality, and without access to other customers' data. Audits required by a supervisory authority are not subject to the yearly limit.
10. Deletion and return
- During the term, workspace owners and admins can export Customer Content at any time; each export is downloadable for 7 days.
- When a workspace is deleted, it can be restored for 30 days. After that it is purged: data is deleted and the workspace's data keys are destroyed, which makes encrypted backups unreadable.
- Encrypted backups expire automatically within the plan's backup period (Free 7 days, Pro 14, Max 30, Teams 30) and database point-in-time recovery within [period TBD].
- Quvos may keep data only where law requires it, and then keeps it confidential and processes it only for that purpose.
11. Liability and precedence
Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where mandatory law provides otherwise. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data; the Standard Contractual Clauses prevail over both.
Annex 1 — Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| [Google Cloud Platform] | Hosting, storage, backups | [hosting region] |
| Stripe | Payment processing outside Türkiye | [location] |
| iyzico | Payment processing in Türkiye | Türkiye |
| [AI model providers — list] | Producing AI answers from prompts and content | [locations] |
| [E-mail delivery provider TBD] | Transactional e-mail | [location] |
Where a Customer uses its own model keys (BYOK), the provider of that key is engaged by the Customer directly and is not a Quvos sub-processor.
Annex 2 — Technical and organisational measures
- Isolation: each workspace (tenant) has separated data, its own database roles and sessions bound to one workspace.
- Encryption: TLS in transit; encryption at rest; secrets encrypted per workspace with a per-tenant data key; destroying the key makes the workspace's backups unreadable.
- Access control: least privilege for staff; read-only, time-limited, logged and owner-notified support access; no staff access to secret values, terminals or personal chats.
- Authentication: hashed passwords, optional two-factor authentication (authenticator app, recovery codes, passkeys), lockout after repeated failed attempts.
- Logging: audit logs of security-relevant actions and support access.
- Resilience: automated encrypted per-workspace backups, point-in-time recovery, incident status at status.quvos.dev.
- Abuse prevention: monitoring of resource misuse, outbound connection limits, sign-up abuse detection.
- Secure development: code review, dependency updates, vulnerability handling [details TBD].
- Personnel: confidentiality undertakings and privacy training.