Legal

Data Processing Addendum (DPA)

Processor agreement - NOTTEC BİLİŞİM GÜVENLİK ELEKTRİK ELEKTRONİK İTHALAT İHRACAT SANAYİ TİCARET LİMİTED ŞİRKETİ as processor for Permbot customers

Last updated: 28 May 2026

This Data Processing Addendum ("DPA") forms part of the agreement between you ("Controller", "Customer") and NOTTEC BİLİŞİM GÜVENLİK ELEKTRİK ELEKTRONİK İTHALAT İHRACAT SANAYİ TİCARET LİMİTED ŞİRKETİ ("Processor", "Permbot") when you use Permbot to collect and store consent records on behalf of visitors to your websites.

By registering for an account and accepting this DPA (including via checkbox at signup), you instruct us to process personal data only on your documented instructions and as described here, GDPR Article 28, and KVKK provisions on data processors where applicable.

NOTTEC BİLİŞİM GÜVENLİK ELEKTRİK ELEKTRONİK İTHALAT İHRACAT SANAYİ TİCARET LİMİTED ŞİRKETİ H. Rıfat Paşa, Yüzer Havuz Sk. Perpa Ticaret Merkezi B Blok Kat: 13 No: 2361, 34860 Şişli/İstanbul Tax office: ŞİŞLİ V.D Tax ID: 6321434155 MERSİS: 1234567890 Phone: +90 212 333 33 33 Email: info@permbot.net Web: https://permbot.net

1. Roles

You are the data controller for end-user consent data relating to your sites. We are the data processor. We do not determine the purposes or means of processing visitor consent beyond providing the CMP service you configure.

2. Subject matter and duration

Processing consists of hosting, storing, retrieving, and displaying consent logs, policy versions, and related technical metadata necessary to demonstrate compliance. Processing continues for the subscription term and retention period you configure, plus any legally required retention afterward.

3. Nature and purpose of processing

Recording consent, rejection, or preference updates from your banner/widget.
Storing timestamps, anonymized/pseudonymous visitor identifiers, and policy version identifiers.
Providing dashboard access, exports, and audit trails to you as controller.
Regional storage in TR or EU isolated infrastructure per your site configuration.

4. Categories of data subjects and personal data

Data subjects: visitors to your websites and apps where the widget is installed.
Personal data types: online identifiers (cookie IDs, device IDs), IP address where collected, consent status per category, user agent, and technical logs - as configured by you.

5. Processor obligations

Process only on documented instructions from you (account configuration, API calls, support tickets), unless required by EU/Member State or Turkish law - in which case we inform you unless prohibited.
We will never use your end-users' consent logs for our own marketing profiling or sell them to third parties.
We process consent logs solely as legal evidence on your behalf and to operate the Service.
Ensure persons authorized to process data are bound by confidentiality.
Implement appropriate technical and organizational security measures (see Privacy Policy).
Assist with data subject requests and DPIAs where reasonably possible.
Notify you without undue delay after becoming aware of a personal data breach.
Delete or return personal data at end of services per your request, subject to legal retention.
Make available information necessary to demonstrate compliance and allow audits on reasonable notice (no more than once per year, subject to confidentiality).

6. Subprocessors

You authorize us to engage subprocessors for hosting, CDN, email, monitoring, and payment. We impose data protection terms on subprocessors. An up-to-date list is available at info@permbot.net. We will notify material subprocessor changes; you may object on reasonable grounds relating to data protection.

7. International transfers

Where processing involves transfer outside the EEA or Türkiye, we implement appropriate safeguards (SCCs, adequacy, or regional isolation you select). Consent logs remain in the region chosen for each site unless you request export.

8. Controller obligations

You have a lawful basis to collect consent and provide required notices to visitors.
Your privacy/cookie policy accurately describes use of Permbot.
You configure retention and categories appropriately.
You respond to data subject requests as controller; we assist as processor.

9. Liability

Each party's liability under this DPA is subject to the limitation of liability in the Terms of Service and SaaS Agreement, except where liability cannot be limited under GDPR/KVKK.

10. Precedence

If this DPA conflicts with the Terms regarding processing of end-user consent data, this DPA prevails. Otherwise the Terms and SaaS Agreement govern.

11. Contact

Data protection & DPA inquiries: info@permbot.net | +90 212 333 33 33