Sub-processors

Sürüm v2.0 · Yürürlük: 2026-09-01

SUB-PROCESSORS

Version: v2.0

Effective date: 1 September 2026

Supersedes: v1.1 (22 July 2026)

This list is incorporated into our Data Processing Agreement by

reference. Changes are notified in advance under section 9.

---

1. ⚠️ WHO IS NOT ON THIS LIST

This section is deliberately first. The most misleading thing a

sub-processor list can do is keep naming a provider that is no longer used.

| Provider | Status |

|---|---|

| Readdy.ai | NO LONGER USED. Removed from the platform entirely; code, configuration and documentation verified clean. If an older version of this list names it, that version is superseded. |

| Evolution API (self-hosted WhatsApp gateway) | RETIRED — 23 August 2026. Platform integration removed and credentials deleted; the gateway is no longer reachable and processes no data. WhatsApp now runs through the Meta Cloud API. |

| Legacy Supabase Cloud project | Migration to our own infrastructure is complete. The legacy project has not yet been shut down, but no new data is processed there. |

---

2. INFRASTRUCTURE — all customer data lives here

|---|---|---|---|---|---|---|

⚠️ Primary storage and processing take place inside the EEA. Transfers

outside the EEA are limited to the providers below and to backup copies.

---

3. AI PROVIDERS — when the feature is enabled

Only the message content required to generate a reply is sent. Which

provider is used depends on platform or customer configuration.

|---|---|---|---|---|---|

⚠️ Regional data residency is not selected with these providers; calls

go to their global endpoints.

Content is contractually excluded from model training.

---

4. COMMUNICATION PROVIDERS

|---|---|---|---|---|---|

ℹ️ If a customer connects their own SMS provider (NetGSM, İleti Merkezi,

Mutlucell, VatanSMS), that provider is the customer's own sub-processor;

the contractual relationship is with the customer, not with us.

---

5. CHANNELS THE CUSTOMER CONNECTS

These transfers occur only when the customer connects the channel

themselves. No data flows to these providers until then, and the connection

can be removed at any time.

|---|---|---|---|---|

If a customer connects their own mailbox, that mailbox's traffic passes

through its provider (Google or Microsoft).

---

6. MEASUREMENT AND ADVERTISING — visitor consent only

|---|---|---|---|---|---|

⚠️ Without consent no request reaches these providers — scripts are not

injected and their domains are not resolved. See Cookie Policy,

section 7.

ℹ️ The measurement infrastructure is in place but **no container ID has been

configured yet**; until one is, these rows are dormant.

---

7. PAYMENTS

|---|---|---|---|---|

⚠️ Card details never reach our servers. The payment page is served by

iyzico; we receive only the transaction result.

⚠️ Türkiye is not covered by an EU adequacy decision. Where this

transfer involves EEA data subjects it is carried out under **Standard

Contractual Clauses**.

---

8. SAFEGUARDS APPLIED TO ALL SUB-PROCESSORS

Every sub-processor is bound to:

Process personal data only for the purpose of providing the service
Confidentiality obligations
Appropriate technical and organisational measures (Art. 32)
Notify us of any breach without undue delay
Terms materially equivalent to those in our own DPA

We remain fully liable to our customers for the acts and omissions of

our sub-processors.

---

9. CHANGES TO THIS LIST

1. This list is updated and its version number raised

2. Customers are notified at least 30 days in advance

3. A customer may object on reasonable data protection grounds; if no

resolution is reached, they may terminate the affected service or the

agreement without penalty, with a refund of the unused period

⚠️ For urgent changes required for security or continuity, notice is

given immediately after the change, with reasons.

---

10. CONTACT

Questions about this list, or requests for copies of transfer safeguards:

`kvkk@talkunify.com`