Parties and Definitions
This Data Processing Agreement (the “DPA” or the “Agreement”) governs the obligations, under Law No. 6698 on the Protection of Personal Data (“KVKK”) and related legislation, between the data controller, who determines the purposes and means of processing personal data, and the data processor, who processes such data on behalf of the data controller.
Data Controller: The natural or legal person who uses BurtiNET services (hosting, servers, housing, etc.) and who collects/processes personal data belonging to its own customers or users within the scope of these services (the “Customer” or the “Data Controller”). The Customer receives services under the Terms of Service concluded with BurtiNET.
Data Processor: BNET Bulut Bilişim LTD. ŞTİ., registered under the name BurtiNET with the Istanbul Trade Registry Office (hereinafter referred to as “BurtiNET”). Registered address: Feyzullah Mah., Bağdat Cad. NEFES PLAZA No:268 Ofis: 206 Maltepe/İSTANBUL. BurtiNET processes personal data on behalf of the Data Controller and in accordance with its instructions, solely for the purpose of performing the service.
The terms personal data, processing and data subject are used as defined in the KVKK. “Sub-processor” means a third party (e.g. a data center or infrastructure provider) through which the Data Processor carries out the processing of personal data on its own behalf.
Scope and Purpose of Processing
BurtiNET processes the personal data that the Data Controller hosts, transmits or processes through BurtiNET services (web hosting, reseller hosting, virtual servers, dedicated servers, e-mail, backup and related infrastructure services) solely for the purposes of the technical provision of the service, secure storage and backup. The content, categories and processing purposes of the personal data collected on the Data Controller’s website, application or systems are determined by the Data Controller; BurtiNET accesses such data only as an infrastructure provider.
Data within the scope of processing (examples): personal data contained in databases, files, e-mail content, log records and similar environments kept on the Data Controller’s servers/hosting account. BurtiNET does not use this data for its own commercial purposes; it does not process it for advertising, profiling or analysis. The Data Controller is responsible for determining which personal data is kept on its own systems and for compliance with the KVKK.
Instructions and Security Measures
Compliance with instructions
BurtiNET processes personal data only in accordance with the written instructions of the Data Controller. Instructions may be given through the Terms of Service, order terms and written support requests. If BurtiNET considers that an instruction of the Data Controller violates the KVKK or other laws, it will notify the Data Controller; where required by law, it may act in accordance with its own legal obligations.
Security measures
In accordance with Article 12 of the KVKK and the technical and administrative measures determined by the Personal Data Protection Board, BurtiNET takes reasonable technical and administrative measures to ensure the confidentiality, integrity and security of the personal data processed. These include access restrictions, encryption (in transit and, where necessary, at rest), secure network infrastructure, access and incident logs, staff confidentiality undertakings and similar measures. The measures may be updated taking into account the state of the art and cost-effectiveness.
The Data Controller is responsible for the security of its own panel, applications and access credentials; BurtiNET cannot be held liable for unauthorized access or security vulnerabilities originating from the customer.
Sub-processors and Breach Notification
Sub-processors
BurtiNET may use sub-processors such as data center, network or cloud infrastructure providers to provide the service. Sub-processors process personal data only in accordance with BurtiNET’s instructions and this Agreement. BurtiNET ensures that sub-processors enter into data processing commitments compliant with the KVKK. The list of sub-processors or changes to it may be notified to the Data Controller upon request or by announcement from BurtiNET; a reasonable right to object to the use of a new sub-processor is reserved.
Breach notification
Where BurtiNET detects unauthorized access to personal data, a data leak or a security breach (a “data breach”), it informs the Data Controller as soon as possible, in compliance with the statutory time limits. The notification includes the nature of the breach, the data affected (where possible), the likely consequences and the measures taken or to be taken. BurtiNET makes reasonable efforts to prevent and remedy the breach; any obligation to notify the Board or data subjects rests with the Data Controller.
Data Subject Rights and End of the Agreement
Data subject requests
Requests from data subjects for access, rectification, erasure or other requests are forwarded directly to the Data Controller. Upon the Data Controller’s request and to the extent technically possible, BurtiNET assists in fulfilling these requests (e.g. deletion or export of specific data). The cost or scope of the operations required to fulfil a request may be determined in the Terms of Service or in a separate quotation.
End of the agreement – return and destruction of data
Upon expiry of the Terms of Service or termination of the DPA, BurtiNET, in accordance with the Data Controller’s instructions, returns the personal data (in a portable format) or ensures that it is deleted/destroyed. If no instruction is given within 30 (thirty) days, BurtiNET may exercise its right to delete or anonymize the personal data. Statutory retention obligations remain reserved during this process. The backup and data retention limits set out in the Terms of Service (e.g. no backups for data above 2 GB, no retention obligation upon expiry) continue to apply in full.
Entry into Force and Contact
This DPA enters into force upon the entry into force of the Terms of Service between BurtiNET and the Customer or upon the parties’ acceptance of the DPA. In the event of conflicting provisions with the Terms of Service, the data protection provisions of the DPA take precedence. Disputes arising from the DPA are governed by the laws of the Republic of Turkey; the Istanbul Courts and Enforcement Offices have jurisdiction.
BurtiNET reserves the right to amend the DPA; amendments take effect from the date of publication on the site. By continuing to use the service, the Data Controller is deemed to have accepted the current DPA. A Data Controller who does not accept an amendment has the right to terminate the service.
For questions about data processing, you can write to info@burtinet.com. For information about BurtiNET’s own data processing activities, please review the Personal Data Protection Notice (KVKK) and the Privacy Policy.
