OrderSay Data Processing Agreement
Draft — lawyer review: not in force. A lawyer and the KVKK consultant have not reviewed this text yet. Values in [brackets] are placeholders.
Last updated: [date of publication]
This Data Processing Agreement ("DPA") is part of the OrderSay Terms of Service between the store that installs OrderSay ("the merchant", the controller) and CHATINBOX YAZILIM ARGE VE TEKNOLOJI LIMITED SIRKETI, with its registered office in Istanbul, Türkiye, Turkish tax number 2091959267 ("OrderSay", the processor). It applies to personal data that OrderSay processes for the merchant, and it meets Article 28 of the EU General Data Protection Regulation (GDPR). Annex 4 adds the commitments required by Türkiye's Personal Data Protection Law No. 6698 (KVKK).
1. Definitions
Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in the GDPR. "Sub-processor" means a provider that OrderSay engages to process the merchant's personal data.
2. Roles and instructions
- The merchant is the controller and OrderSay is the processor of the personal data described in Annex 1, including the data of the merchant's staff that OrderSay processes to run the inbox.
- OrderSay processes that data only on the merchant's documented instructions. The instructions are these terms, this DPA and the settings the merchant chooses in the app. OrderSay shall immediately inform the merchant if, in its opinion, an instruction infringes the GDPR or other applicable Union or Member State data protection law.
- OrderSay does not sell the data, does not use it for advertising, and does not combine one merchant's data with another merchant's data.
3. Confidentiality
Everyone at OrderSay who can access the merchant's personal data is bound by confidentiality, and gets access only when their role needs it.
4. Security
OrderSay applies the technical and organisational measures in Annex 2 and keeps them at a level appropriate to the risk (GDPR Article 32). OrderSay may improve the measures, but never lowers the overall level of protection. Taking into account the nature of the processing and the information available to it, OrderSay also helps the merchant meet the merchant's own security obligations under Article 32.
5. Sub-processors
- The merchant gives general authorisation for the sub-processors listed at ordersay.com/subprocessors/ (Annex 3).
- OrderSay announces a new or replaced sub-processor on that page and by email or in-app notice to the merchant at least [30] days before it starts processing the merchant's data. The merchant can object in writing within that period on reasonable data protection grounds. While an objection is open, the new sub-processor does not process that merchant's data. If the parties cannot resolve the objection, the merchant can end the subscription before the change takes effect.
- OrderSay puts data protection obligations on every sub-processor that are at least as protective as this DPA, and remains responsible to the merchant for the sub-processor's work.
6. Help with data subject requests
OrderSay helps the merchant answer requests from data subjects (access, correction, deletion, restriction, portability, objection). Shopify's customer data request and customer deletion notifications reach OrderSay automatically. If a data subject contacts OrderSay directly about the merchant's data, OrderSay forwards the request to the merchant without undue delay and does not answer it on its own unless the merchant asks.
7. Personal data breaches
OrderSay notifies the merchant without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting the merchant's data. The notice describes what happened, the data and people concerned as far as known, the likely consequences and the measures taken. OrderSay updates the merchant as it learns more. Taking into account the nature of the processing and the information available to it, OrderSay helps the merchant notify the supervisory authority and, where required, communicate the breach to the people affected (GDPR Articles 33 and 34).
8. Impact assessments and consultation
OrderSay gives the merchant the information it reasonably needs for a data protection impact assessment or a prior consultation with a supervisory authority about OrderSay's processing.
9. International transfers
- OrderSay's application, database and queue are hosted in Frankfurt, Germany. Message attachments are not stored yet; before they are, their storage provider is added under section 5. Annex 3 shows the location of each sub-processor. OrderSay is established in Türkiye and its staff may access the data from Türkiye.
- The applicable transfer mechanism for each recipient and processing activity is identified in the transfer schedule [to be completed with the lawyer]. Where Decision (EU) 2021/914 applies, the selected module and the completed appendices form part of this DPA. Transfers that require safeguards will not begin until those safeguards are in place. The merchant can ask for a copy of the applicable safeguards; commercial terms may be redacted.
- Before a transfer abroad subject to Article 9 of KVKK begins, an applicable transfer mechanism must be in place. Where the transfer relies on the Turkish Personal Data Protection Authority's standard contract, the parties will execute the prescribed form that matches their actual roles and name the party responsible for notifying the Authority within five business days after both signatures are completed. EU Standard Contractual Clauses do not replace applicable Turkish transfer requirements.
10. Deletion and return at the end
At the merchant's choice, OrderSay returns or deletes the merchant's personal data at the end of the services, and deletes existing copies, unless Union or Member State law requires storage.
- Return: self-service data export is not available. The merchant can ask at privacy@ordersay.com for a copy of its personal data in a structured, machine-readable format before uninstalling or within [7] days after uninstalling. If OrderSay ends the merchant's access (Terms of Service, section 9), the merchant can ask within [30] days. OrderSay sends the copy within [14] days of the request and before the applicable deletion deadline, without restoring access to the app. Unless the merchant instructs earlier deletion, OrderSay does not start the deletion before the [7]-day window has ended or while a requested copy has not been sent.
- Deletion: after the merchant uninstalls OrderSay, Shopify normally sends a store deletion request 48 hours later, and OrderSay completes the deletion within 30 days after receiving it. If OrderSay ended the merchant's access, OrderSay deletes the data once the requested copy is sent or the [30] days pass without a request.
- If binding third-country law prevents return or deletion, OrderSay informs the merchant unless the law prohibits it, identifies the affected data and the retention requirement, and applies the safeguards and processing limits required by the applicable transfer terms.
- Backup copies are removed within [verified maximum backup period] and are not restored to ordinary processing without reapplying deletion instructions.
11. Audits
OrderSay makes available the information needed to show compliance with this DPA. Routine audits may normally be conducted once per year on 30 days' written notice, during business hours and under confidentiality. These limits do not apply where an additional or earlier audit is reasonably necessary following indications of non-compliance, a personal data breach or a request from a competent supervisory authority. OrderSay may answer first with written information or reports from independent auditors where these exist.
12. Liability and order of precedence
The liability limits of the Terms of Service apply to this DPA as far as the law allows. If this DPA conflicts with the Terms of Service, this DPA prevails on data protection matters. If the Standard Contractual Clauses conflict with this DPA, the Standard Contractual Clauses prevail.
Annex 1 — Description of the processing
| Item | Description |
|---|---|
| Subject matter | Providing the OrderSay WhatsApp support inbox to the merchant |
| Duration | While the merchant has OrderSay installed, then until deletion under section 10 |
| Nature and purpose | Receiving and sending WhatsApp messages on the merchant's number; matching messages to Shopify customers and orders; showing order, shipping and return details; grouping and ranking conversations as tasks once AI-assisted features are available; automatic "where is my order?" answers from verified order data if the merchant switches them on; security and audit logs |
| Data subjects | The merchant's customers and other people who write to the merchant's WhatsApp number; the merchant's staff users |
| Categories of data | Name, phone number (including the phone number stored on an order's shipping or billing address), WhatsApp profile name; order data (order number and date, items, totals, payment, fulfilment, cancellation and refund status, carrier, tracking number, tracking link and tracking status, estimated and actual delivery dates, return status); the customer's number of orders and total amount spent with the store; email and postal addresses contained in Shopify notifications (received but not stored); message content and attachments, including any email address or other detail a customer writes in a message; if the merchant keeps using the WhatsApp Business app on the same number, the replies sent from the phone and the past chats the merchant chooses to share, including chats from before installation; message details that Meta sends with each received message (for example a shared location, contact card, reaction, caption or button reply); message metadata; records of a customer's opt-out (an opt-out blocks every template message to that customer); staff members' Shopify user identifiers, roles and actions |
| Special categories | None intended. Customers may write such data in a message; OrderSay does not ask for it or analyse it for that purpose |
| Retention | Messages and task history 12 months; attachments 90 days; incoming notifications that could not be processed 7 days; audit logs 24 months; customer contact records, opt-out records and order matches until the merchant forwards that customer's deletion request or the store's data is deleted after uninstall; each counted as set out in the Privacy Policy, section 7 |
Annex 2 — Technical and organisational measures
- Encryption in transit (TLS) and at rest; store and WhatsApp access credentials additionally encrypted at the application level.
- Tenant isolation: every database query is limited to one store's data, and automated tests check it on every change.
- Every incoming Shopify and Meta webhook is verified by its signature; invalid requests are rejected.
- Role-based permissions for the merchant's staff in the app; access to production systems limited to the staff who need it and protected by two-factor authentication [confirm before publication]; the app only adds audit log entries and has no function to change their content; when a store's data is deleted, the link from its entries to the store is removed and the entries are kept until their 24 months end; entries keep the identifiers they record, for example Shopify customer and order numbers, the WhatsApp number's Meta identifier, and the store's identifiers in the entries for the store deletion request and for the deletion itself.
- Secrets are kept in the hosting provider's secret store, never in code; server logs and error records mask phone numbers and never contain access credentials.
- Backups [retention and encryption to be confirmed]; restore tests [to be set up; frequency to be confirmed]; incident response with merchant notice within 72 hours.
- AI processing is not available. Before it becomes available, its measures and providers are added here and to the sub-processor list with the notice in section 5.
Annex 3 — Sub-processors
The current list, with each provider's purpose and location, is at ordersay.com/subprocessors/.
Annex 4 — KVKK commitments
For the purposes of KVKK, the merchant is the data controller (veri sorumlusu) and OrderSay is the data processor (veri işleyen) for the data in Annex 1. OrderSay commits, in line with KVKK Article 12, to process the data only as instructed, to take the technical and administrative measures needed to prevent unlawful processing and access and to keep the data safe, not to disclose the data or use it for its own purposes, and to inform the merchant without delay if the data is obtained unlawfully by others. These commitments continue after the contract ends. Transfers abroad under KVKK Article 9 follow section 9. The retention periods are those in Annex 1. [KVKK annex to be completed by the KVKK consultant.]
Annex 5 — Transfer impact assessment note
Before starting a transfer that relies on the Standard Contractual Clauses, the parties will document the assessment required by Clause 14 and implement any effective supplementary measures it shows to be necessary. The assessment will be reviewed when relevant circumstances change, and transfers will be suspended where the required level of protection cannot be ensured. [Assessment for access from Türkiye and for each recipient outside the EU, to be written with the lawyer before the first transfer.]