Data Processing Addendum
This Data Processing Addendum (“Addendum”) is entered into by and between:
ColdNavigator, a data controller / data importer operating under the laws of the Republic of Türkiye, (“Controller” / “Processor”), and the customer (“Customer”, “Controller”).
This Addendum forms part of the Terms of Service and reflects the parties’ agreement with regard to the processing of Personal Data under the applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law (KVKK).
1. Definitions
In addition to terms defined elsewhere in the Terms of Service, the following terms have the meanings set out below:
“Personal Data” means any information relating to an identified or identifiable natural person processed under the agreement.
“Processing” (and its derivatives) shall have the same meaning as defined in the GDPR and KVKK.
“Data Controller” means the entity that determines the purposes and means of the Processing of Personal Data.
“Data Processor” means the entity that Processes Personal Data on behalf of the Data Controller.
“Data Subject” means an identified or identifiable natural person whose Personal Data is processed.
2. Roles of the Parties
The parties acknowledge that:
The Customer is the Data Controller of Personal Data submitted or controlled by the Customer in the course of using the Service; and
ColdNavigator acts as Data Processor in respect of that Personal Data, except where ColdNavigator independently determines the purposes and means of Processing (in which case ColdNavigator may be a Controller for its own data).
3. Scope and Purpose of Processing
ColdNavigator will process Personal Data on behalf of and under the instructions of the Customer solely for the purpose of providing the Service, including but not limited to:
Account administration
Platform operation, support and troubleshooting
Security, monitoring and compliance
Analytics and reporting related to the Service
ColdNavigator will not Process Personal Data for any purpose other than those outlined in the Terms of Service and this Addendum.
4. Compliance with Applicable Laws
Each party shall comply with applicable data protection laws, including:
EU GDPR (where applicable)
Turkish KVKK
Any other applicable data protection or privacy laws
The parties agree to implement appropriate technical and organizational measures to ensure compliance with such laws.
5. Instructions for Processing
The Customer authorizes ColdNavigator to process Personal Data as necessary to provide the Service. If ColdNavigator believes any instruction from the Customer is unlawful, ColdNavigator will notify the Customer without undue delay.
6. International Data Transfers
Personal Data may be transferred to locations outside the Customer’s country of residence, including but not limited to the Republic of Türkiye and the European Union (Frankfurt, Germany).
ColdNavigator shall ensure that any international transfer of Personal Data is subject to appropriate safeguards, including:
Adequacy decisions where applicable
Standard Contractual Clauses (SCCs) adopted under the GDPR
Other legal mechanisms recognized under KVKK and GDPR
7. Sub-processors
a. Authorization
The Customer authorizes ColdNavigator to engage sub-processors to assist with the provision of the Service.
b. List of Sub-processors
ColdNavigator maintains a current list of sub-processors, which may include but not be limited to:
Creem.io (payment processing)
Hosting/infrastructure providers (e.g., Cloud services in Frankfurt)
Analytics and monitoring tools
Customer support platforms
ColdNavigator will update this list and notify the Customer of any additions where required by law.
c. Sub-processor Obligations
ColdNavigator shall ensure that each sub-processor is bound by written agreements imposing obligations no less protective than those in this Addendum.
8. Security Measures
ColdNavigator will implement and maintain reasonable technical and organizational measures appropriate to the risks involved, such as:
Encryption (in transit and at rest where applicable)
Access controls and authentication
Monitoring and logging
Vulnerability management and incident response
These measures will be regularly reviewed and updated in line with technical developments.
9. Data Subject Rights
ColdNavigator will assist the Customer, to the extent technically possible, in responding to requests from Data Subjects to exercise their rights under applicable laws, including:
Access to Personal Data
Rectification
Deletion
Restriction of Processing
Objection to Processing
Data portability
Requests from Data Subjects must be directed to the Customer. ColdNavigator will promptly notify the Customer upon receipt of a request directed to ColdNavigator.
10. Data Retention
ColdNavigator will retain Personal Data only for as long as necessary to provide the Service or as required by law. Deletion or return of Personal Data will be carried out in accordance with the Terms of Service and applicable laws.
11. Security Incidents and Data Breach
ColdNavigator will notify the Customer without undue delay after becoming aware of any Personal Data breach affecting Customer Personal Data.
Such notification will include, where possible:
A description of the nature of the breach
The categories and approximate number of Data Subjects affected
Measures taken or proposed to address the breach
12. Audit Rights
To the extent required by applicable law, ColdNavigator will make available information necessary for the Customer to demonstrate compliance with its GDPR / KVKK obligations.
13. Limitation of Liability
Limitation of liability provisions in the Terms of Service apply equally to this Addendum, except as expressly stated herein.
14. Governing Law and Jurisdiction
This Addendum is governed by the laws of the Republic of Türkiye.
Any dispute arising out of or related to this Addendum shall be subject to the exclusive jurisdiction of the courts of İstanbul, Türkiye.
15. Entire Agreement
This Addendum, together with the Privacy Policy and Terms of Service, constitutes the entire agreement between the parties with respect to the Processing of Personal Data.
16. Contact
For any questions regarding this Addendum or data protection practices:
📧 support@coldnavigator.com