Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Poyais One Terms of Service between the merchant using Poyais One ("Merchant", "Controller") and Poyais Digital Reklamcılık ve Teknoloji Ltd. Şti., Yeşilköy Mah. Atatürk Cad. EGS Business Park, Blok: 12 Kat: 1, Bakırköy / İstanbul, Türkiye ("Poyais", "Processor").

Version 1.0 · Effective 2026-10-18

Poyais processes Merchant's store data, obtained through the Shopify Admin API, only to provide the Poyais One service. This DPA lasts as long as Merchant uses Poyais One, and until all Merchant data has been deleted under Section 9.

• Purpose: sales and advertising performance reporting, analytics and recommendations for Merchant.
• Data: order IDs, dates, totals, line items (product, SKU, quantity, price, discounts), refunds, product catalog data, and store name and currency.
• Data subjects: Merchant's customers, but only to the extent order records relate to them. Poyais does not request or store customer names, contact details or addresses.
• Processing: retrieval via API, aggregation, storage of aggregated metrics, and display to Merchant's authorized users.

Poyais will:

1. process data only on Merchant's documented instructions, which are this DPA and Merchant's use of the service;
2. ensure that staff with access are bound by confidentiality and access data only when needed;
3. implement the security measures in Annex A;
4. not sell the data, not use it for its own purposes, and not combine it with other merchants' data in a way that identifies Merchant;
5. help Merchant respond to data subject requests and fulfil Shopify's mandatory compliance webhooks (customers/data_request, customers/redact, shop/redact);
6. notify Merchant of a personal data breach without undue delay, and within 72 hours of confirming it;
7. make available the information needed to demonstrate compliance with this DPA.

Merchant authorizes the sub-processors listed in the Privacy & Data Processing Notice. Poyais will tell Merchant about new sub-processors at least 30 days in advance, and Merchant may object. Poyais holds its sub-processors to data protection obligations at least as protective as this DPA.

If data is transferred outside Merchant's jurisdiction, Poyais will use appropriate safeguards required by applicable law. Examples are the EU Standard Contractual Clauses, and for Türkiye the standard contracts under Law No. 6698 (KVKK), Art. 9.

Poyais keeps Merchant data confidential and discloses it only where required by law. Where legally permitted, Poyais notifies Merchant before any such disclosure.

On reasonable written request, at most once a year, Poyais will provide written answers to security questionnaires and relevant policy documents.

Liability is governed by the Poyais One Terms of Service.

When Merchant uninstalls the app or terminates the service, Poyais deletes all Merchant store data within 30 days. Shopify's shop/redact request is completed when received. Data in encrypted backups expires within 30 days. On request, Poyais will export Merchant's aggregated data before deletion.

This DPA is governed by the laws of the Republic of Türkiye, unless mandatory data protection law of Merchant's jurisdiction requires otherwise.

• TLS 1.2+ for all data in transit.
• Application-level encryption of access tokens (Fernet).
• Daily GPG-encrypted off-site backups, kept for 30 days, with tested restores.
• Separate test environment. No production data is used in testing.
• Least-privilege staff access, SSH key authentication, and periodic access reviews.
• Logging of all access to merchant store data, kept for 365 days.
• Password policy: at least 10 characters with letters and digits, Argon2 hashing, 2FA for staff accounts.
• Documented retention and incident response policies.

Accepted by Merchant on installing or using Poyais One. Signed copies are available on request at hello@poyaisone.com.