Data processing agreement

1. Parties, scope and definitions

This Data Processing Agreement ("DPA") forms an integral part of the agreement between Miaventi ("Miaventi", the processor) and the customer using the platform (the "Customer", the controller). Terms such as "personal data", "processing", "controller", "processor" and "data subject" have the meanings given in the Turkish Personal Data Protection Law No. 6698 ("KVKK") and Regulation (EU) 2016/679 ("GDPR"), as applicable. In the event of any conflict between this DPA and the main agreement regarding the processing of personal data, this DPA prevails.

2. Subject matter, duration, nature and purpose

Miaventi processes personal data for the purpose of providing the platform: hosting registration, ticketing, invitation, check-in, engagement, virtual event, exhibitor, communication and reporting functions for the Customer's events. Processing continues for the term of the agreement and until return or deletion in accordance with section 9.

3. Types of data and data subjects

• Data subjects: attendees and registrants, invitees, speakers, exhibitor staff and visitors, sponsors, Customer users and their team members.
• Data types: identity and contact details, job and company details, registration and ticket data, answers to registration questions, check-in and attendance records, event interaction (questions, poll answers), communication preferences, invoice and billing details, and technical data. The fields to be collected are determined by the Customer.
• The platform does not require special categories of personal data; the Customer shall not collect such data through free-text or custom fields unless it has a valid legal basis and has informed Miaventi.

4. Processing on documented instructions

Miaventi shall process personal data only on the Customer's documented instructions, comprising this DPA, the agreement and the Customer's use of platform settings, unless required otherwise by law, in which case Miaventi shall inform the Customer in advance to the extent permitted. Miaventi shall inform the Customer if, in its opinion, an instruction infringes applicable law. The Customer is responsible for the lawfulness of its instructions, for informing data subjects and for obtaining any required consent.

5. Confidentiality and security

Miaventi shall ensure that persons authorized to process personal data are bound by confidentiality obligations and shall apply appropriate technical and organizational measures including organizer-level data separation, role-based access, session protection, encryption in transit, audit logs and incident response. Miaventi may improve such measures but shall not materially reduce the overall level of protection.

Miaventi may engage sub-processors to provide the platform, and the Customer grants general authorization for such engagement. Miaventi shall impose on each sub-processor written obligations no less protective than those in this DPA and remains responsible for the performance of its sub-processors. Miaventi shall notify the Customer 30 days in advance of any intended addition or replacement of a sub-processor, and the Customer may object on reasonable data protection grounds. The current list of sub-processors is available to the Customer on request.

6. International transfers

Where processing involves a transfer outside Türkiye or the European Economic Area, the parties shall rely on a valid transfer mechanism: an adequacy decision; standard contractual clauses (including, for KVKK purposes, the standard contract and notification to the Authority as required by Article 9); or another mechanism accepted by law, together with supplementary measures where necessary. The Customer authorizes Miaventi to conclude such instruments on its behalf where required.

7. Assistance to the Customer

Taking into account the nature of the processing, Miaventi shall assist the Customer in: responding to data subject requests (access, rectification, erasure, portability, objection) through platform tools or upon request; complying with security, breach notification, impact assessment and prior consultation obligations; and demonstrating compliance. Requests received by Miaventi directly from data subjects concerning the Customer's data shall be forwarded to the Customer without a substantive response unless otherwise instructed.

8. Personal data breach

Miaventi shall notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Customer's data, providing the information available to it (nature of the breach, categories and approximate numbers concerned, likely consequences, measures taken), and shall keep the Customer updated and cooperate so that the Customer may notify the competent authority and affected individuals within the legal deadlines.

9. Return and deletion

Upon termination, the Customer may export its data for 30 days. Thereafter, Miaventi shall delete or anonymize personal data from production systems within 30 further days and from backups in accordance with their rotation cycle, unless longer retention is required by law, in which case the data shall remain protected and be processed solely for that purpose.

10. Retention by the Customer

The Customer, as controller, determines the retention period of personal data. The platform does not automatically delete attendee data before the agreement ends. The Customer may delete an event at any time; this removes the event data and its files in full and cannot be undone. Records that the Customer is required by law to retain (for example, invoices and accounting entries) are removed together with the event, and the Customer shall therefore export them beforehand. Miaventi shall assist with data subject requests as set out in section 7.

11. Audits

Miaventi shall make available the information necessary to demonstrate compliance with this DPA (such as security documentation and, where available, independent audit reports) and shall permit reasonable audits by the Customer or its appointed auditor, not more than once a year unless a breach or a request from an authority requires otherwise, upon reasonable notice, during business hours, subject to confidentiality and without access to other customers' data.

12. Liability, governing law and amendments

Each party's liability under this DPA is subject to the limitations of the main agreement, without prejudice to liability that cannot be limited by law or to the rights of data subjects. This DPA is governed by the law governing the main agreement (the laws of the Republic of Türkiye), and the courts of that jurisdiction have jurisdiction. Miaventi may update this DPA to reflect legal or service changes; material changes shall be notified to the Customer, who may object in accordance with the main agreement.