This Data Processing Agreement ("DPA") forms part of the FeedManager Terms of Service (the "Terms") between the Customer ("Controller", veri sorumlusu) and Optimal Technologies LLC (Optimal), 30 N Gould St, STE R, Sheridan, Wyoming 82801, United States (registration no. 2026-002109285) ("FeedManager", "Processor", veri işleyen). It applies when FeedManager processes personal data contained in Customer Data on the Customer's behalf. Capitalised terms not defined here have the meaning given in the Terms.
1. Definitions
- Data Protection Law: the Turkish Personal Data Protection Law No. 6698 ("KVKK") and its secondary legislation, the EU General Data Protection Regulation 2016/679 ("GDPR") where applicable, and any other data protection law applicable to the processing.
- Customer Personal Data: personal data in Customer Data that FeedManager processes on behalf of the Customer.
- Personal Data Breach, processing, data subject, supervisory authority: as defined in Data Protection Law.
- Sub-processor: another processor engaged by FeedManager to process Customer Personal Data.
2. Roles and scope
2.1 The Customer is the controller of Customer Personal Data and FeedManager is its processor. The details of the processing are described in Annex I.
2.2 This DPA does not cover personal data for which FeedManager is itself a controller (for example Users' account and login data), which is described in the Privacy Policy.
2.3 The Customer is responsible for the lawfulness of Customer Personal Data and of its instructions, including having a legal basis and giving the required notices to data subjects.
3. Instructions
3.1 FeedManager processes Customer Personal Data only on the Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by law (in which case it will inform the Customer first, unless the law prohibits this).
3.2 The Terms, this DPA and the Customer's configuration and use of the Service (for example the sources, rules and feeds it sets up) are the Customer's complete instructions. FeedManager will inform the Customer if, in its opinion, an instruction infringes Data Protection Law.
4. Confidentiality
FeedManager ensures that persons authorised to process Customer Personal Data are bound by confidentiality obligations and access it only as needed to provide, support and secure the Service.
5. Security
FeedManager implements the technical and organisational measures in Annex II to ensure a level of security appropriate to the risk. FeedManager may update these measures as long as the overall level of security is not reduced.
6. Sub-processors
6.1 The Customer gives general authorisation for FeedManager to engage Sub-processors. The current Sub-processors are listed in Annex III.
6.2 FeedManager will notify the Customer of any intended addition or replacement of a Sub-processor at least 30 days in advance by email to the Account's managers. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may close the affected Account, and FeedManager will refund prepaid fees for the unused period.
6.3 FeedManager imposes on each Sub-processor data protection obligations no less protective than this DPA, and remains responsible to the Customer for its Sub-processors' performance.
6.4 Third-Party Platforms that the Customer connects (for example Shopify, WooCommerce, Google) and channels that fetch the Customer's feeds are engaged by the Customer, not by FeedManager, and are not Sub-processors. The same applies to an AI model provider whose API key the Customer adds to the Service ("own key"): while an own key is used, requests go to that provider under the Customer's agreement with it.
6.5 The AI model providers in Annex III receive Customer Data only when the Customer uses an AI feature, and only the provider of the model that answers a request receives that request. The Customer can see the provider next to each model and can block any AI model provider for its Account.
7. Assistance with data subject requests
Taking into account the nature of the processing, FeedManager assists the Customer with appropriate technical and organisational measures in responding to requests from data subjects, in particular through the Service's export and deletion features. If FeedManager receives a request directly from a data subject about Customer Personal Data, it will refer the data subject to the Customer and not respond itself, unless required by law.
8. Personal Data Breaches
8.1 FeedManager notifies the Customer without undue delay and in any event within 48 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data.
8.2 The notification describes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information may be provided in phases.
8.3 FeedManager takes reasonable steps to contain and remedy the breach and assists the Customer in meeting its own notification obligations (for example to the KVKK Board within 72 hours).
9. Impact assessments
FeedManager provides reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities relating to the Service, taking into account the information available to it.
10. Deletion and return
10.1 During the term, the Customer can export Customer Data at any time with the Service's export feature.
10.2 When the Customer closes an Account, its Customer Data remains restorable for a 30-day grace period and is then deleted from the live systems; backups containing it are overwritten within a further 30 days. FeedManager may keep data longer only where required by law, protected by this DPA.
11. Information and audits
11.1 FeedManager makes available the information reasonably necessary to demonstrate compliance with this DPA, including answers to security questionnaires.
11.2 If this information is not sufficient, the Customer may audit FeedManager's compliance once per year, on at least 30 days' written notice, during business hours, at its own cost, through an independent auditor bound by confidentiality, without access to other customers' data. Audits required by a supervisory authority are not limited in number.
12. International transfers
FeedManager transfers Customer Personal Data outside Türkiye or the EEA only in accordance with Data Protection Law, using an appropriate transfer mechanism: for GDPR, Standard Contractual Clauses (modules 2 and 3 as applicable) or an adequacy decision; for KVKK, the standard contracts of the Personal Data Protection Board (including notification to the Board under Art. 9) or another lawful basis.
13. Liability and precedence
Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law does not allow them. In case of conflict, this DPA prevails over the Terms regarding the processing of Customer Personal Data; the transfer clauses of §12 prevail over this DPA.
14. Contact
Data protection questions and notices under this DPA: [email protected]. Breach notifications under §8 are sent to the email addresses of the Account's managers.
15. Term
This DPA applies for as long as FeedManager processes Customer Personal Data, including during the deletion periods in §10.
Annex I — Details of processing
| Item | Description |
|---|---|
| Subject matter | Provision of the FeedManager Service under the Terms |
| Duration | The term of the Terms plus the deletion periods in §10 |
| Nature of processing | Collection (fetching from sources configured by the Customer and receiving via the Product API), storage, organisation, structuring, transformation by the Customer's rules, publication as feed files at Customer-controlled URLs, export, deletion; when the Customer uses AI features, transmission of the product data and product images of the selected products (and aggregated catalog figures) to an AI model provider to generate suggestions, which are stored for the Customer's review |
| Purpose | Managing the Customer's product catalog and publishing product feeds, as configured by the Customer |
| Categories of data subjects | Individuals whose personal data the Customer includes in product data (e.g., sellers, authors, designers, contact persons); individuals identifiable from third-party credentials or account identifiers provided by the Customer |
| Categories of personal data | Names, contact details or other identifiers contained in product data; usernames or account identifiers in third-party credentials. The Service is not designed for other personal data; analytics data from Google Analytics is imported at product level (aggregated), not per visitor |
| Special categories | None. The Customer must not submit special categories of personal data |
| Frequency | Continuous, according to the Customer's schedules and API use |
Annex II — Technical and organisational measures
| Area | Measures |
|---|---|
| Encryption | TLS for all connections (Cloudflare to origin with full, strict TLS); third-party credentials, SMTP and API secrets, and two-factor secrets encrypted at rest with AES-256-GCM using keys stored outside the database, with key rotation; encrypted backups |
| Authentication | Passwords hashed with argon2id; mandatory two-factor authentication for FeedManager staff; login rate limiting and lockout; optional CAPTCHA; one-time tokens and API keys stored only as hashes; session invalidation on password or role change |
| Access control | Role-based permissions per Account; strict separation of customers' data enforced in the application and data layers; staff access limited to support and operations and recorded in the Account's activity log |
| Logging and monitoring | Activity/audit records for 2 years; security logs for 1 year; automated monitoring and alerting on errors, queue backlogs and system health |
| Network and hosting | Origin reachable only through Cloudflare; firewall and SELinux on servers; databases and internal services not exposed to the internet; protection against server-side request forgery for customer-supplied URLs; hardened parsing of uploaded files |
| Availability and resilience | Nightly encrypted backups kept 30 days, stored off-server; tested restores; documented recovery procedure |
| Secure development | Code review, dependency vulnerability scanning, pinned dependencies, security testing before releases |
| AI features | Off until enabled; each request limited to the products and fields it needs; product text passed to the model as data, never as instructions; answers validated against a fixed schema; AI cannot write prices, identifiers, product links or availability; product images downloaded by FeedManager through the SSRF-protected fetcher and sent inline, so no provider fetches Customer URLs; suggestions stored separately from source data and reviewed before use; per-Account blocking of providers; own API keys encrypted (AES-256-GCM) and never shown again; daily spend limits; every run and approval in the activity log |
| Incident response | Documented breach procedure with notification timelines (§8) |
| Personnel | Confidentiality obligations, least-privilege access, access removed on role change or departure |
| Deletion | Account closing with 30-day grace period and automated purge; user self-deletion with anonymisation; backups expire after 30 days |
Annex III — Sub-processors
| Sub-processor | Service | Location | Transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH | Server hosting (application, databases, feed files) | Germany | KVKK standard contract for transfers from Türkiye; EU-to-EU, no GDPR transfer mechanism required |
| Cloudflare, Inc. | DNS, network protection (WAF), content delivery of feed files, Turnstile CAPTCHA if enabled | Global network; USA | SCCs / KVKK standard contract |
| Amazon Web Services EMEA SARL (Amazon SES) | Sending service emails | Ireland | KVKK standard contract for transfers from Türkiye; EU-to-EU, no GDPR transfer mechanism required |
| Anthropic, PBC | AI model provider (Claude models), only for AI features the Customer uses; may not train models on Customer Data | USA | SCCs / KVKK standard contract |
| OpenAI OpCo, LLC | AI model provider (GPT models), only for AI features the Customer uses; may not train models on Customer Data | USA | SCCs / KVKK standard contract |
| Google Ireland Limited (Gemini API; Google LLC as sub-processor) | AI model provider (Gemini models), only for AI features the Customer uses; may not use Customer Data to improve its products | Ireland; USA | KVKK standard contract for transfers from Türkiye; SCCs for onward transfers to the USA |
Questions about this document: [email protected]. Optimal Technologies LLC, 30 N Gould St, STE R, 82801 Sheridan, Wyoming, United States.