Legal / last updated 7 November 2026

Data Processing Agreement

How we handle your customers' personal data when you use NovusAI. It forms part of our Terms of Service and applies automatically when you subscribe; we countersign a copy on request.

1. Scope and roles

1.1 This agreement covers the personal data the Provider processes for the Client in providing NovusAI: the messages, voice notes, files, contact details, lead records, appointments and notes of the Client's own customers and prospects ("Client Personal Data"). Annex I gives the details.

1.2 The Client is the controller of Client Personal Data and the Provider is its processor. The Provider is a separate controller only for what it needs to run its own business with the Client (account users, billing, security logs), which its Privacy Policy covers.

1.3 Where this agreement and the Terms of Service differ on Client Personal Data, this agreement prevails.

2. Instructions

2.1 The Provider processes Client Personal Data only on the Client's documented instructions. The Terms of Service, this agreement and the Client's configuration of the service (channels connected, knowledge base, assistant and follow-up settings) are those instructions.

2.2 The Provider tells the Client without delay if it believes an instruction breaks data-protection law, and may suspend that instruction until it is confirmed or changed.

2.3 The Provider does not use Client Personal Data to train AI models, to build profiles across clients, for advertising, or for any purpose of its own.

3. Separation from the Provider's other business

3.1 The Provider also runs a consultancy under the ATIELIT brand. Client Personal Data and the Client's business information are used only to provide NovusAI to the Client, and are never accessible to, shared with or used by anyone working in or for that consultancy or any other business of the Provider.

3.2 Access to production systems and to Client Personal Data is limited to named NovusAI engineers, only for support the Client asked for, for security, or to maintain the service, and every access is logged.

3.3 Each client's data is isolated in the database by row-level security as well as by application checks, and is never combined or analysed across clients.

3.4 On request, the Provider describes these controls and confirms in writing that they are in place.

4. Confidentiality

Everyone the Provider allows to process Client Personal Data is bound by a written duty of confidentiality that continues after their work for the Provider ends.

5. Security

The Provider applies the measures in Annex II and keeps them appropriate to the risk. Under KVKK Article 12(2) the Provider is jointly responsible with the Client for these measures for the processing it carries out.

6. Sub-processors

6.1 The Client authorises the sub-processors in Annex III.

6.2 The Provider gives at least 30 days' notice of a new or replaced sub-processor, by email to the account owner and on this page. The Client may object on reasonable data-protection grounds within that time; if the objection cannot be resolved, the Client may end the affected service and receive a pro-rata refund of any prepaid fees.

6.3 The Provider binds each sub-processor by written contract to obligations no less protective than this agreement, and remains responsible to the Client for them.

7. Transfers abroad

7.1 Client Personal Data is stored in the European Union: the database and the application in Frankfurt, Germany, and attachments in Belgium. Some sub-processors in Annex III process it in other countries to do their task. No Client Personal Data is sent to a host in China.

7.2 KVKK. For transfers abroad under KVKK Article 9, the Provider relies on the standard contracts announced by the Personal Data Protection Board, concluded with the relevant sub-processors, and notifies each to the Authority within five business days of signature.

7.3 GDPR. Where the Client is subject to the GDPR, the parties conclude the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), with Clause 7 (docking) included; Clause 9 option 2 (general authorisation, 30 days' notice); the optional language of Clause 11 not used; Clause 17 option 1, the law of Ireland; Clause 18, the courts of Ireland; and Annexes I–III of this agreement as their Annexes. A short transfer impact assessment is available on request.

8. Helping the Client

8.1 The Provider passes to the Client, within 5 business days, any request it receives from a person about Client Personal Data, and does not answer it directly unless the Client asks. The dashboard lets the Client find, export, correct and delete a customer's data, and the Provider helps where the Client cannot, so the Client can answer within the legal time limits (30 days under KVKK, one month under the GDPR).

8.2 The Provider gives reasonable help with data-protection impact assessments and consultations with a supervisory authority, at the Client's request.

9. Personal data breaches

9.1 The Provider tells the Client without undue delay, and in any case within 48 hours of becoming aware of a breach affecting Client Personal Data, so that the Client can notify the Personal Data Protection Board within 72 hours and, where applicable, its EU supervisory authority.

9.2 The notice describes, as far as known, what happened, the kinds and approximate number of people and records affected, the likely consequences and the measures taken or proposed. The Provider updates it as it learns more and keeps a record of the breach.

10. Return and deletion

10.1 During the subscription the Client can export its data at any time.

10.2 After the subscription ends, the Client has 30 days to export its data. The Provider then deletes Client Personal Data, in any case within 90 days of the end of the subscription, including from backups as they rotate, unless a law requires it to keep a specific item; it then keeps only that item, protected, for only as long as that law requires.

10.3 On request, the Provider confirms the deletion in writing.

11. Audits and information

The Provider makes available the information reasonably needed to show it complies with this agreement, including a written description of its controls and a summary of its sub-processor contracts. Once a year, or after a breach, the Client may audit compliance on at least 30 days' notice, during business hours, at its own cost, itself or through an independent auditor bound by confidentiality, in a way that does not expose other clients' data.

12. Liability, term and law

12.1 Each party's liability under this agreement is subject to the limits in the Terms of Service, except where the law does not allow a limit or the parties agree otherwise in writing.

12.2 This agreement lasts as long as the Provider processes Client Personal Data.

12.3 This agreement is governed by Turkish law, and the courts and enforcement offices of İstanbul (Çağlayan) have jurisdiction, except for the Standard Contractual Clauses in section 7.3, which are governed as stated there.

Annex I: Details of processing

Annex II: Technical and organisational measures

Annex III: Sub-processors

Meta (WhatsApp, Instagram, Messenger) carries messages on the channels the Client connects, under the Client's own agreement with Meta.