Data processing agreement

The parties to this agreement are the organization that uses the service by creating an organization account in Mühür Mail (the "Organization") and the business that provides Mühür Mail (the "Service Provider"):

For personal data processed as part of the Organization's email service, the Organization is the data controller and the Service Provider is the data processor. Processing for which the Service Provider is the data controller (its own account, subscription and billing records) is not covered by this agreement but by the KVKK privacy notice.

Under Article 12(2) of the KVKK, the Service Provider is jointly responsible with the Organization for taking the necessary security measures for the data it processes on the Organization's behalf.

The subject matter of this agreement is the processing of personal data by the Service Provider on behalf of the Organization while providing email on the Organization's own domain (mailboxes, webmail, the mobile app, IMAP and SMTP access, spam and malware scanning, deliverability and management tools).

The agreement applies for as long as the Organization uses the service and, after it ends, until the return or deletion of the data is complete. The service itself is governed by the terms of service; the two documents apply together.

Data subjects: users of the mailboxes the Organization creates (employees, partners, officers); people who correspond with these mailboxes (customers, suppliers, candidates and other senders and recipients); distribution group members and people in contact lists.

Categories of data:

• Mailbox users' names, email addresses, session and device information, IP addresses and sign-in records.
• The content, attachments and header information (sender, recipients, subject, date) of incoming and outgoing messages.
• Sender authentication, spam and malware check results; delivery, bounce and complaint records.
• Contacts, aliases, distribution groups, rules, signatures, auto-replies and mailbox settings.
• Any data the Organization places in messages and attachments; this may include special categories of personal data at the Organization's choice.

Processing activities: receiving, storing, scanning, indexing and searching messages; sending and delivering them; providing access to mailboxes; backups; keeping the service secure and preventing abuse.

The Service Provider processes personal data only on the Organization's instructions and to provide the service. Instructions are this agreement and the terms of service, the settings the Organization makes in the dashboard and in mailboxes (such as retention periods, forwarding, rules, spam policy and Mühür Assistant permission), and any additional instructions the Organization gives in writing.

• The Service Provider does not use the data for its own purposes, sell it, or use it for advertising or for training artificial intelligence models.
• Mühür Assistant accesses message content only if the Organization has explicitly allowed it and the user asks.
• If the Service Provider believes an instruction breaches the KVKK or other legislation, it informs the Organization without delay.
• Processing required by law (for example, lawful requests from competent authorities) is reserved; unless prohibited, the Organization is informed in advance.

The Service Provider ensures that only staff who need access to do their work can access the data, and binds those staff to confidentiality. The platform team does not read message content; admin screens do not show message content; message content, passwords and access keys are not written to system logs, error logs or the audit log.

The main technical and organizational measures are:

• Encryption in transit (TLS) on web, IMAP and SMTP connections; TLS between servers where the receiving server supports it, and MTA-STS support.
• Account and mailbox passwords and app passwords stored only as irreversible hashes; secrets such as DKIM private keys and integration keys stored encrypted.
• Two-step verification, which the Organization can require for its team; revocable app passwords for desktop and phone apps.
• Role-based permissions and organization scoping on every query: one organization's records are never shown to another.
• An audit log of management actions.
• Spam and malware scanning of incoming and outgoing messages; safe display of HTML messages, with remote content not loaded until the user allows it.
• Rate limits on sending and automatic sending suspension when there are signs of a compromised account.
• Regular backups encrypted with a password.

The measures may be updated as technology develops; updates do not lower the level of protection.

The Organization gives general authorization for the Service Provider to use the following groups of sub-processors to provide the service:

• Server, database, file storage and backup service providers.
• If sending goes through a relay, the provider of that service.
• Apple and Google notification services for mobile notifications. By default, notifications do not include message content; if a user turns on notification previews, a short preview is sent.
• If the Organization has allowed Mühür Assistant to use message content, the provider of the AI language model service that generates its replies.

The Service Provider imposes data protection obligations of the same nature as those in this agreement on its sub-processors and remains responsible to the Organization for their processing. The current list of sub-processors is available on request at info@muhurmail.com. The Organization's owner is notified before a new sub-processor is added, and the Organization may object on reasonable grounds. If the objection cannot be resolved, the Organization may end its subscription.

Some sub-processors may have servers outside Türkiye. Transfers abroad are made in accordance with Article 9 of the KVKK: to countries with an adequacy decision, with appropriate safeguards such as the standard contracts announced by the Personal Data Protection Board, or in the incidental transfer cases listed in the law.

The location of the servers where messages are stored will be stated in this document and in the KVKK privacy notice before the service opens. Organizations subject to the EU General Data Protection Regulation (GDPR) can contact us about additional terms.

Responding to requests from data subjects related to the Organization's mailboxes (rights under Article 11 of the KVKK, such as access, correction and deletion) is the Organization's obligation. To support this, the Service Provider:

• Gives the Organization the means to find, export, correct and delete messages in the dashboard and through standard IMAP access.
• Forwards any such request it receives directly to the Organization without delay, and does not respond to it without the Organization's instructions.
• Meets the Organization's reasonable requests for assistance within the technical capabilities of the service.

When the Service Provider learns that data it processes on the Organization's behalf has been obtained by others unlawfully, it informs the Organization without undue delay. The notification includes, to the extent known at the time: the nature of the breach, the categories of data and approximate number of data subjects affected, its likely consequences, the measures taken and proposed, and a contact person. The notification is completed as more information becomes available.

Under Article 12(5) of the KVKK, notifying the Personal Data Protection Board and the data subjects of a breach is the Organization's obligation as data controller; the Board's decision requiring notification within 72 hours of becoming aware of the breach is taken into account. The Service Provider provides the information the Organization needs to make this notification on time without undue delay, and takes reasonable measures to limit the effects of the breach.

On the Organization's written request, the Service Provider provides within a reasonable time the information needed to show that it complies with this agreement, and assists the Personal Data Protection Board with its requests to the extent required by law. This information is provided while protecting the confidentiality of other organizations' data and of the service's security.

On-site audits by the Organization or an independent auditor it appoints may be carried out as separately agreed between the parties, subject to prior written notice, a reasonable scope and timing, a confidentiality undertaking and not disrupting the operation of the service.

Before the agreement ends, the Organization can retrieve its messages and records through standard IMAP access and the export tools the service provides. After a subscription ends, the dashboard becomes read-only; records are not deleted immediately.

At the Organization's request, or at the end of a waiting period after the account is closed, data processed on the Organization's behalf is deleted or anonymized. Messages in a deleted mailbox are permanently removed after 30 days. Copies in backups are deleted within the normal backup rotation period. Records that the law requires to be kept are retained for that period and are not processed for any other purpose.

• This agreement is part of the terms of service; if the two documents conflict on the protection of personal data, this agreement prevails. Limitation of liability is governed by the terms of service; mandatory provisions of law are reserved.
• The agreement takes effect when the Organization starts using the service. For enterprise plans, a version signed by both parties can be prepared on request.
• Significant changes are announced to the Organization's owner by email or in-app notification before they take effect.
• This agreement is governed by Turkish law.