Data Processing Agreement (DPA)

1. Parties and roles

Controller (“School / Customer”): the school or institution named in Annex 1 – Table A that determines purposes and means of processing student, teacher and parent data in school accounts.

Processor (“Macenta Eğitim Yayınları Sanayi ve Ticaret Anonim Şirketi”): Macenta Eğitim Yayınları Sanayi ve Ticaret Anonim Şirketi (Dikilitaş Mah. Barış Sok. Fulya Sitesi A Blok 9/A, Beşiktaş-İstanbul-Türkiye), contact destek@macenta.com.tr, KEP macenta@h01.kep.tr. For school accounts we act as processor / veri işleyen on your documented instructions. For the public marketing site (theglobals.co) we act as controller.

This DPA forms part of the service / subscription agreement between the parties (“Main Agreement”). In case of conflict, this DPA prevails for data protection matters. Terms follow GDPR Art. 4 and KVKK m. 3.

2. Details of processing (Art. 28(3))

Subject matter, duration, nature, purpose, types of data and categories of data subjects are set out in Annex 1 – Table B. In summary:

• Subject matter: The Globals English-learning platform (units, assignments, discussions, projects, leaderboards, reports).
• Duration: term of the Main Agreement plus deletion / return window in §10.
• Nature: hosting, storage, display to authorised users, grading workflows, support.
• Purpose: delivering teaching services on the Controller's instructions only.
• Data types: identity & contact, learning & performance, technical & usage.
• Special-category data: assignment videos, project uploads, microphone recordings — only with explicit consent (GDPR Art. 9(2)(a), KVKK m. 6), optional and withdrawable. Never used for ads, analytics or model training; visible only to submitting student and their teacher.
• Data subjects: students (typically 11–18, school-supervised with parental involvement), teachers, school admins, parents (linked views).

3. Controller obligations

• Provide lawful instructions; ensure a valid legal basis for disclosing student / teacher data (enrolment contract, legal obligation, or consent where required).
• Obtain and manage explicit consent for visual / audio assignment content (Art. 9 / KVKK m. 6), including parental involvement for children — our in-app modal records consent in Firestore (userConsents/{uid}) but the school remains responsible for its own consent records.
• Inform data subjects (privacy notices, Art. 13–14 / KVKK m. 10) and route withdrawals / objections.
• Configure access (classes, roles) so only authorised staff see relevant data.

4. Sub-processors (Annex 3)

Current sub-processors, purposes, locations and safeguards are listed in Annex 3. Assignment videos, project uploads and microphone recordings are never used by sub-processors for their own purposes.

We update Annex 3 before any material change takes effect (14 days' notice). The Controller may object within 14 days. Continued use after the window constitutes acceptance; if you object and no compliant alternative exists, either party may terminate affected processing per the Main Agreement.

5. International transfers (GDPR Ch. V / KVKK m. 9)

• Primary hosting: EU / Türkiye where available; some sub-processors operate in the US.
• US transfers rely on EU Standard Contractual Clauses (2021/914, Module 2/3) plus UK Addendum where applicable, with transfer risk assessments.
• KVKK m. 9 transfers rely on explicit consent where required, adequacy, or binding safeguards (SCCs + additional measures).
• We inform you of any change to transfer locations or mechanisms.

6. Personal data breach

• Notify the Controller without undue delay and within 48 hours of becoming aware, via Annex 4 contacts.
• Notification includes: nature and categories / approximate numbers affected, DPO contact, likely consequences, measures taken / proposed.
• Cooperate so the Controller can meet 72-hour authority notification (Art. 33), data-subject communication (Art. 34) and KVKK Kurul notification duties.
• Maintain incident logs; root-cause analysis and corrective actions.

7. Rights, DPIAs and consultation

Self-service export / deletion tooling where available, plus manual assistance within 5 business days for access, rectification, erasure, restriction, portability and objection (including withdrawing visual / audio and leaderboard consent). DPIA (Art. 35) and prior consultation (Art. 36) support via Annex 2–3 materials on request.

8. Audit

Once per 12 months (plus for-cause audits after a breach), on 30 days' written notice, during business hours, under confidentiality, with minimal disruption. A qualified third-party report / SOC 2 / ISO 27001 certificate covering the same controls may be substituted. On-site audit costs are borne by the Controller except where material non-compliance is found.

9. Retention, return and deletion

At end of services, at the Controller's written choice we return (JSON/CSV export where feasible) and delete personal data within 90 days, except where EU / Turkish law requires retention. Deletion certificates available on request.

10. KVKK-specific provisions (Turkish schools)

• School acts as veri sorumlusu, Macenta Eğitim Yayınları Sanayi ve Ticaret Anonim Şirketi as veri işleyen for school accounts (KVKK m. 3, 8, 12).
• Explicit consent (m. 5/1, 6/1) is obtained separately for visual / audio content and leaderboard display; declining disables only upload / recording.
• Data-subject applications answered within 30 days, free of charge except tariff cases; applicants may also complain to the KVK Kurumu (kvkk.gov.tr).
• Channels: registered e-mail, KEP macenta@h01.kep.tr, post, mobile / secure e-signature.
• Deletion / destruction / anonymisation per KVKK m. 7 and the relevant Regulation.

11. Children

Designed for students 11–18 in school-supervised accounts with parental involvement where local law requires it. No ads, no analytics on signed-in learning pages without applicable consent; visual / audio content only after explicit (parent-involved) consent.

12. Liability, term, general

• Liability: Art. 82 GDPR / KVKK rules apply; nothing limits non-excludable liability. Inter-party caps follow the Main Agreement except wilful misconduct / breach of security, sub-processor or deletion duties.
• Term: effective on countersignature; continues for the Main Agreement term plus deletion window.
• Precedence / severability / notices: DPA prevails on data protection; invalid clauses severed; notices to Annex 4 contacts (e-mail + KEP for Turkish schools).