Data Processing Agreement
Last updated: 28 October 2026
This Data Processing Agreement (the “DPA”) is between the customer that holds a ConnectWiz workspace (the “Customer”) and SIMURGH MEDIA, LLC, a Delaware limited liability company, 131 Continental Dr, Suite 305, Newark, DE 19713, United States, which provides the ConnectWiz service (“ConnectWiz”, “we”). It forms part of the Terms of Service or any other subscription agreement between the parties (the “Main Agreement”).
The Customer accepts this DPA when it accepts the Terms of Service on sign-up or on changing plan, or by signing a copy. ConnectWiz records which version was accepted, when and by whom. A signed copy is available on request from [email protected]; ConnectWiz signs through Oğuz Kağan Tetik, Managing Member.
On the protection of personal data this DPA prevails over the Main Agreement. Where it conflicts with the KVKK standard contract or the EU Standard Contractual Clauses attached under Annex 4 or Annex 5, that standard text prevails.
1. Definitions
“Personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meaning given in Law No. 6698 on the Protection of Personal Data (“KVKK”), Regulation (EU) 2016/679 (“GDPR”) and the UK GDPR, as applicable.
- “Customer Personal Data” means personal data that ConnectWiz processes on the Customer’s behalf in providing the Service.
- “Sub-processor” means a third party ConnectWiz engages, under its own account or key, to process Customer Personal Data.
- “Connected Service” means a third-party service the Customer connects to its workspace with its own account, credentials or API key.
2. Roles and scope
For Customer Personal Data the Customer is the controller (or a processor acting for another controller) and ConnectWiz is its processor (or sub-processor). Processing for which ConnectWiz is itself the controller — the Customer’s account, billing and support data — is governed by the Privacy Policy, not by this DPA.
The subject matter, duration, nature and purpose of the processing and the categories of data and data subjects are set out in Annex 1.
3. Processing on instructions
ConnectWiz processes Customer Personal Data only on the Customer’s documented instructions. The Main Agreement, this DPA and the settings the Customer makes in the panel, the API or MCP — connecting channels, AI settings, retention and deletion actions — are those instructions.
If the law requires other processing, ConnectWiz tells the Customer first, unless that law forbids it. ConnectWiz tells the Customer without delay if, in its opinion, an instruction infringes the KVKK or the GDPR.
ConnectWiz does not sell Customer Personal Data, does not use it for its own advertising and does not make it available to train AI models of ConnectWiz or of any sub-processor. Learning features the Customer switches on feed only that workspace’s own knowledge base.
4. Confidentiality
ConnectWiz ensures that every person it authorises to access Customer Personal Data is bound by a written or statutory duty of confidentiality, and that access is limited to what operating and supporting the Service requires.
5. Security
ConnectWiz implements the technical and organisational measures in Annex 2 and keeps them current. An update never lowers the overall level of protection. Under Article 12(2) of the KVKK, the Customer and ConnectWiz are jointly responsible for the security measures, each for the part under its control; the Customer is responsible in particular for its users, their passwords and two-factor sign-in, the permissions it grants and the services it connects.
6. Sub-processors
General authorisation. The Customer authorises ConnectWiz to engage the sub-processors listed at app.connectwiz.net/subprocessors (Annex 3). The list shows each provider’s purpose, the data it receives, its location, the transfer safeguard and which feature must be switched on before it is used.
Changes. ConnectWiz notifies the owner of each workspace by e-mail at least 30 days before adding or replacing a sub-processor, and updates the date on the list.
Objection. Within that period the Customer may object in writing to [email protected] on reasonable data-protection grounds. The parties look for a solution in good faith — for example, not using the new provider for the Customer’s workspace. If none is found, the Customer may stop using the affected feature or terminate the affected part of the Main Agreement without penalty, and ConnectWiz refunds the prepaid fees for the unused part of the term, pro rata.
ConnectWiz binds each sub-processor by written terms that protect Customer Personal Data no less than this DPA, and remains liable to the Customer for the sub-processor’s performance.
Connected Services are not sub-processors. Services the Customer connects with its own account or key (for example Telegram, X, TikTok, LinkedIn, Google accounts, its own SMS provider, SIP lines, marketplaces, CRM and e-commerce tools, its own AI or parcel-tracking key) receive data on the Customer’s instruction under the Customer’s own contract with them. Meta (WhatsApp, Messenger, Instagram, Threads) is listed separately and also processes WhatsApp Business data under its own business terms.
7. International transfers
The Service is hosted in the United States: the application servers and the database run in DigitalOcean’s New York data centre and files are stored in Cloudflare R2. ConnectWiz is operated remotely from Türkiye; no Customer Personal Data is stored in Türkiye. A Customer outside the United States that uses the Service therefore transfers personal data abroad.
Türkiye (KVKK Article 9). The United States has no adequacy decision. For a Customer established in Türkiye, the transfer to ConnectWiz is made under the standard contract announced by the Personal Data Protection Board — “Controller to Processor”, or “Processor to Processor” where the Customer is a processor — attached as Annex 4 without any change to the Board’s text. The parties sign it together with this DPA. The Customer, as the exporting party, notifies the Personal Data Protection Authority within five business days of signature; ConnectWiz supplies the information needed.
EEA and Switzerland. Transfers are made under the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) or Module Three (processor to processor), attached as Annex 5 and incorporated by reference, with these choices: clause 7 (docking) applies; clause 9(a) Option 2, general written authorisation with 30 days’ notice as in section 6; the optional wording of clause 11 does not apply; clause 17 Option 1, the law of Ireland; clause 18, the courts of Ireland. Annexes I to III of the Clauses are Annexes 1 to 3 of this DPA. For Switzerland the Clauses apply with the references adapted to the Federal Act on Data Protection.
United Kingdom. Transfers are made under the Clauses together with the International Data Transfer Addendum (version B1.0) issued by the Information Commissioner.
ConnectWiz is not certified under the EU–US Data Privacy Framework. It ensures that its own onward transfers to sub-processors are covered by a transfer safeguard recognised by the applicable law; the safeguard for each provider is shown on the sub-processor list.
8. Data subjects’ requests
The panel gives the Customer the tools to answer data subjects itself: editing a contact, erasing or anonymising a contact (with a preview of what will be removed), downloading a conversation transcript, a contact’s files and form submissions, and exporting consent records.
Requests that reach ConnectWiz directly are passed to the Customer and not answered by ConnectWiz, as far as the law allows. Where the panel tools are not enough, ConnectWiz provides, on the Customer’s written request, a copy of a person’s data within 10 business days.
9. Other assistance
Within the information available to it, ConnectWiz assists the Customer with its security, breach-notification, impact-assessment and prior-consultation obligations (GDPR Articles 32 to 36) and with its KVKK obligations (data inventory, privacy notices). Reasonable requests are free of charge. Assistance needing extensive work is charged only at a rate agreed with the Customer in advance.
10. Personal data breaches
ConnectWiz notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice goes to the e-mail address of the workspace owner and states, as far as then known, when the breach was detected and the period it covers, its nature, the categories and approximate number of data and data subjects, its likely consequences, the measures taken or proposed and a contact person. Information not yet known does not delay the first notice; it follows in updates.
Notifying a supervisory authority (under the KVKK, the Board within 72 hours) and the data subjects is the Customer’s decision and duty. ConnectWiz does not notify an authority about Customer Personal Data on its own initiative, and gives the Customer the information it needs to notify.
11. Deletion and return
When the Main Agreement ends, ConnectWiz deletes Customer Personal Data or, at the Customer’s choice, returns it and then deletes it, unless the law requires it to be kept.
The workspace owner schedules deletion in the panel. During a 30-day grace period the channels are paused and the deletion can be cancelled; when it falls due, all of the workspace’s data, files and cached data are removed and the owner receives a final e-mail.
Return: the Customer can download transcripts, files and contact data in the panel before deleting. On written request made before the deletion falls due, ConnectWiz provides the workspace’s contacts and conversations in a commonly used, machine-readable format within 30 days.
Backups: deleted data stays in encrypted database backups and in the hosting provider’s server backups for at most 30 days, is used only to recover from a disaster and is then overwritten.
12. Information and audits
ConnectWiz makes available the information needed to show compliance with this DPA: its security and data-protection policies, the sub-processor list, Annex 2 and written answers to a reasonable security questionnaire.
If that is not enough, the Customer may audit ConnectWiz at most once a year, on 30 days’ written notice, during business hours, through an independent auditor bound by confidentiality and at its own cost. The once-a-year limit does not apply after a personal data breach or where a supervisory authority requires an audit. An audit may not give access to other customers’ data or put the security of the Service at risk. ConnectWiz’s time beyond one business day is charged at a rate agreed in advance.
13. Liability
Each party’s liability under this DPA is subject to the limitation of liability in the Main Agreement: all claims under this DPA and the Main Agreement together are limited to the fees the Customer paid for the Service in the 12 months before the claim. This limit does not apply where the applicable law does not allow liability to be limited, including for intent and gross negligence, and it does not limit a party’s liability to data subjects under GDPR Article 82 or the corresponding provisions of the KVKK.
14. Term, changes and governing law
This DPA stays in force for as long as ConnectWiz processes Customer Personal Data. ConnectWiz may amend it where the law requires; a change that materially reduces the Customer’s protection is notified 30 days in advance and the Customer may terminate as in section 6.
For a Customer established in Türkiye this DPA and the Main Agreement are governed by the laws of the Republic of Türkiye, and the courts and enforcement offices of Istanbul (Çağlayan) have jurisdiction. For any other Customer they are governed by the laws of the State of Delaware, United States, and the state and federal courts located in Delaware have jurisdiction. The KVKK standard contract and the Standard Contractual Clauses keep their own choice of law and forum.
This DPA is made in English and Turkish. For a Customer established in Türkiye the Turkish text prevails; for any other Customer the English text prevails.
Annex 1 — Details of the processing
| Item | Details |
|---|---|
| Data subjects | The Customer’s customers and prospects (people who write or call through a channel, website visitors, commenters, buyers) and the Customer’s team members who use the panel. |
| Categories of data | Identity and contact data (name, phone, e-mail, channel user IDs, profile picture); conversation content (messages, attachments, voice notes, call recordings and transcripts, comments, reviews); CRM data (notes, tags, fields, segments, appointments, orders, payment-link status); consent records; technical data (IP address, browser, device, website visit and attribution data, ad click IDs); AI data (knowledge-base content, assistant memory, usage logs). |
| Special categories | The Service is not designed for special categories of data, but they can appear in conversations depending on the Customer’s sector (for example health). If the Customer processes such data it is responsible for the legal basis and any explicit consent, and it can switch AI features off for the affected channels. |
| Nature of the processing | Receiving messages and calls from channels, recording, storing, organising, displaying, sending to channels, generating replies and suggestions with AI, transcription, search, export and deletion. |
| Purpose | Providing the Customer with omnichannel communication, CRM, booking, calling and AI-assistant services under the Main Agreement. |
| Frequency | Continuous. |
| Duration and retention | For the term of the Main Agreement, until the Customer deletes the data or the workspace; then as in section 11. |
Annex 2 — Technical and organisational measures
- Workspace isolation: every table holding Customer Personal Data is protected by database row-level security, enforced against the application itself; the application connects with a role that cannot bypass it, and automated tests check that every such table is covered.
- Access control: a central permission model for every action, with automated tests that every endpoint is guarded; two-factor sign-in available to every user and required for sensitive actions; the Customer controls its team’s roles.
- Encryption in transit: all connections use HTTPS/TLS.
- Encryption at rest: channel keys, access tokens, webhook secrets and other credentials are encrypted in the application; files and database backups are stored in an object store that encrypts them at rest, and private files are served only through short-lived signed links.
- Backups: database backups twice a day, kept 30 days, taken by a separate read-only role.
- Logging: an audit log of changes to settings and records, with the source (panel, API or AI agent); secret values are never logged.
- Integrity of inbound data: signatures of inbound webhooks from messaging, payment and marketplace providers are verified before they are processed.
- Error monitoring with personal data removed before reports leave the Service.
- Data minimisation towards providers: AI and voice providers receive only the content of the feature in use, under terms that forbid training on it; providers in a restricted country are never used for workspaces whose connected channels forbid it.
- Personnel: access to the production systems is limited to the operator of the Service.
- Change management: changes are tested by an automated test suite before release.
Annex 3 — Sub-processors
The current list is published at app.connectwiz.net/subprocessors and changes as described in section 6. On request, a dated copy of the list is attached to a signed copy of this DPA.
Annex 4 — KVKK standard contract (Customers in Türkiye)
The Personal Data Protection Board’s standard contract “Controller to Processor” (or “Processor to Processor” where the Customer is a processor), as published on kvkk.gov.tr, without any change to its text. Only its blanks — the parties, the transfer details and its annexes — are completed, using Annexes 1 to 3 of this DPA.
Annex 5 — EU Standard Contractual Clauses and UK Addendum
The Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914 (Module Two or Module Three), with the choices in section 7, and for the United Kingdom the International Data Transfer Addendum B1.0 issued by the Information Commissioner, as published by the European Commission and the Information Commissioner’s Office.