CREATO AI Data Processing Agreement

Document version: 2.0 — Date of preparation: September 30, 2026. This agreement constitutes the personal data processing addendum to the SaaS Agreement and applies together with the electronic acceptance record linked to the customer account.

1 Parties and roles

The data controller is the Customer identified in the account profile or Order Summary. The data processor is EMRE ALAY, providing services under the trade brand CREATO AI. Contact: hello@creato.digital; Şemikler Mah. 6250 Sk. No:5 D:3 Karşıyaka/İzmir, Türkiye.

In activities where Customer processes contacts, messages, orders, campaign metrics, and e-commerce records of its own End Users, Customer determines processing purposes and lawful legal bases; CREATO AI acts as a data processor pursuant to documented instructions. If Customer itself acts as a data processor on behalf of its own enterprise clients, Customer is responsible for securing necessary authorization from the primary controller; CREATO AI acts as a subprocessor in such scope. Such relationships are documented according to actual operational roles.

Activities where CREATO AI acts as an independent data controller regarding direct account administration, billing, legal compliance, its own brand marketing, and restricted security telemetry are detailed in the KVKK Information Notice. CREATO AI will not repurpose Customer Data for independent business aims under the guise of its processor role.

2 Subject matter scope and duration

Processing encompasses provisioning selected platform modules, customer communications, AI-generated responses and summaries, store synchronization, customer context aggregation, campaign dispatch, reporting analytics, technical support, and post-termination data export/deletion. Operations include recording, structuring, storing, matching, limited analytical evaluation, authorized display, technical routing, and secure erasure.

Data subjects include Customer's clients, prospective leads, communicating contacts, e-commerce purchasers, and authorized employees linked to these records. Processed categories include identity and contact data, messages and attachments, product/order/transaction statuses, campaign engagement telemetry, contact tags, agent notes, and technical audit logs, strictly commensurate with enabled features. Not all data categories are processed for every account.

Customer must not submit unnecessary special category personal data, unmasked payment card details, passwords, government identity documents, or extraneous sensitive files. Services intentionally processing special category personal data will not be activated without prior mutual agreement on security safeguards and legal grounds. For unsolicited sensitive data received accidentally, access restriction and prompt remediation workflows apply; customer submission prohibitions do not extinguish Provider's statutory security duties.

Processing endures throughout the active subscription and trial terms, continuing post-termination solely for data export, deletion, and mandatory statutory retention. Order Summaries, activated features, and integration authorization logs define the concrete operational scope.

3 Instructions and unlawful directives

This agreement, analytical scopes consented to upon integration authorization, and administrative account actions represent documented processing instructions. Instructions issued via support channels require identity and scope verification. CREATO AI will not engage in unauthorized third-party advertising, data sales, cross-tenant data sharing, or foundation model training.

If CREATO AI determines that an instruction infringes data protection law, it shall inform Customer and may suspend the affected operation. Where an independent statutory duty requires specific processing, notice is provided to Customer unless legally prohibited. Customer instructions cannot override statutory cross-border transfer or data security rules.

4 Customer obligations

Customer is responsible for obtaining data lawfully, ensuring accuracy, establishing appropriate legal bases, providing statutory privacy notices, and securing required consents. Customer handles End User rights requests, marketing refusals, and rectification claims, transmitting necessary processing directives to CREATO AI. Message registry compliance (e.g., IYS) and commercial messaging mandates remain subject to WhatsApp special terms.

Customer must upload only necessary data, enforce principle-of-least-privilege access among its users, manage integration credentials, and supervise automated workflows. Customer must correct demonstrably erroneous or excessively broad directives. These obligations do not transfer Provider's statutory processor security duties to the Customer.

5 Confidentiality and security measures

CREATO AI restricts personnel access to personal data to authorized individuals bound by enforceable confidentiality obligations. Commensurate with risks and processing characteristics, Provider implements access controls, authentication, transit encryption, audit log integrity, backup management, patch deployment, and vulnerability remediation. Provider and Customer cooperate to address security gaps within their respective domains.

Technical measures include tenant data isolation, prevention of cross-tenant data leaks, encrypted transport across public connections, controlled secret and key management, tamper-evident error and audit logs, access-controlled backups, secure file shredding, and incident response protocols. Technical implementations are documented according to risk baselines and made available upon reasonable request.

This agreement does not assert unverified ISO/SOC certifications, specific dedicated hosting geographies, end-to-end encryption for all workflows, fixed recovery time objectives, or zero-incident guarantees. AWS infrastructure possessing certifications does not imply CREATO AI holds identical standalone certifications. Statutory and contractual security duties remain binding.

6 Engagement of subprocessors

Customer grants general written authorization for the engagement of subprocessors disclosed upon contract execution and utilized for relevant services. The registry specifies vendor name, function, data categories, processing location, and transfer mechanisms. Blank or undefined provider listings do not constitute valid authorization.

CREATO AI shall give at least thirty days prior notice of new or replacement subprocessors accessing Customer Data. Customer may object within fifteen days on documented data protection grounds. The parties shall seek reasonable alternatives or mitigations. If an impasse remains, the affected service may be terminated without penalty to Customer, and unearned prepaid fees will be refunded. In emergency maintenance situations, essential actions are taken and explained promptly; mandatory statutory transfer preconditions cannot be bypassed.

CREATO AI binds subprocessors to data protection, security, confidentiality, and deletion covenants no less stringent than those in this agreement. Provider remains liable to Customer for breaches of data protection obligations by its appointed subprocessors within statutory limits and the main agreement. Independent third-party connections integrated directly by Customer remain evaluated based on actual operational roles.

7 International data transfers and AI

Foreign cloud hosting, backup redundancies, remote technical support, and external language model API invocations represent distinct data flows. Genuinely anonymizing prompt inputs does not eliminate cross-border transfer obligations for personal data residing in AWS infrastructure or accessed remotely.

Personal data is transferred internationally only where lawful processing conditions and valid transfer mechanisms under Article 9 of KVKK (or applicable equivalents, such as adequacy decisions or standard contractual clauses) exist. Regular, continuous service transfers cannot rely on narrow derogations designed for occasional transfers or general account registrations. Where Standard Contractual Clauses approved by the Personal Data Protection Board are used, official controller-to-processor texts, valid executions, and formal notification within five business days of signing must be observed. This addendum does not substitute for official Board-approved transfer instruments.

Prompt inputs undergo data minimization and appropriate pseudonymization. Re-identifiable inputs remain personal data. In the current anonymous LLM pipeline, prompts are not routed to external models until anonymization is verified. AI workflows operating directly on personal data require separate notices, user opt-in, and transfer mechanisms per the AI and Integration Special Terms. Truly anonymized inputs may be processed within service parameters and carrier rules. Customer content is never used for general foundation model training; vendor retention and onward transfers are strictly constrained.

8 Data subject rights assistance

CREATO AI shall forward direct data subject requests regarding Customer Data to the Customer without undue delay and at most within three business days, to the extent legally permissible. Provider does not adjudicate request merits on Customer's behalf, preserving its own direct legal obligations.

Reasonable technical assistance is provided to facilitate access, rectification, erasure, restriction, objection, and statutory rights. Assistance is provided promptly to enable Customer to meet statutory response deadlines. Unnecessary personal data is not collected for identity verification. Technical execution of routine requests incurs no additional fee; bespoke engineering exceeding standard scopes requires prior mutual agreement and cannot impede statutory rights.

9 Personal data breach notification

Upon becoming aware of a personal data breach affecting Customer Data, CREATO AI shall notify the Customer without undue delay and provide an initial notification within twenty-four hours. Complete investigation findings need not be finalized prior to initial alert. Notices detail the nature of the breach, affected data categories, estimated number of data subjects, anticipated impacts, remedial measures implemented, contact point, and remediation timeline; additional findings are provided in phases.

This twenty-four-hour timeline constitutes a contractual notification covenant. Applicable controller obligations to notify the Personal Data Protection Authority within seventy-two hours of becoming aware, and to notify affected individuals without undue delay, must be satisfied by the respective responsible party according to actual data roles. Breach notification does not constitute an admission of fault; legal notification duties cannot be deferred under confidentiality claims.

10 Audits and information access

CREATO AI shall make available reasonable documentation demonstrating compliance with this agreement. Customer may, ordinarily once per calendar year and upon at least ten business days prior written notice, request document reviews or reasonable security assessments subject to confidentiality and multi-tenant security protections. In cases of confirmed breaches, material non-compliance, or regulatory orders, annual frequency limits do not apply.

Assessments do not grant access to third-party customer content, proprietary source code, or live production environments that would compromise availability. Documentation is provided securely. If an audit reveals a material breach by CREATO AI, remediation costs are not billed to Customer. Statutory supervisory authority inspection powers are not restricted by this clause.

11 Termination data return and deletion

Upon contract termination, active processing operations cease. Customer may request standard data exports within thirty calendar days. Customer Data not subject to mandatory statutory retention is deleted from active systems upon expiry of the export window. Earlier valid deletion requests will be fulfilled. Encrypted backups are overwritten in their ordinary cycle within at most ninety days from termination, and remain inaccessible for commercial or AI operations.

If backup recovery is performed, prior deletion and opt-out directives are re-applied. Mandatory deletion directives are propagated to subprocessors and verified. Where statutory retention applies, categories, legal grounds, and retention periods are documented; financial record-keeping mandates cannot justify indefinite retention of general customer chat transcripts. Written confirmation of deletion is provided upon Customer request.

12 Liability and precedence

Statutory data security obligations imposed upon data controllers and processors remain fully binding. This agreement cannot reduce administrative enforcement powers of supervisory authorities or statutory rights of data subjects. Indemnification, fault allocation, and lawful liability caps are governed by Section 15 of the main agreement. Regarding personal data processing matters, this addendum supersedes conflicting terms in the general agreement; mandatory laws and formal international transfer instruments remain paramount.