Data Processing Agreement

Links processes personal data only on the Customer's documented instructions, including with regard to international transfers. The Terms, this DPA and the Customer's configuration of the Service are the Customer's complete instructions. Links will inform the Customer if it believes an instruction breaks Data Protection Law, unless the law prohibits this.

The Customer is responsible for having a lawful basis for the processing and for informing its employees and visitors about it.

Links ensures that personnel authorised to process personal data are bound by confidentiality obligations and access the data only as needed to operate the Service or support the Customer.

Links implements appropriate technical and organisational measures under GDPR Article 32 and KVKK Article 12, operated within its ISO 27001 certified information security management system and ISO 42001 certified AI management system. These measures include:

Links may update these measures as long as the overall level of protection is not reduced.

The Customer gives Links general authorisation to engage subprocessors. The current list is published on our Subprocessors page.

Links will notify the Customer at least 30 days before adding or replacing a subprocessor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the remaining period.

Links imposes data protection obligations on each subprocessor that are no less protective than this DPA and remains responsible for their performance.

Customer data is stored in the European Union. Where personal data is transferred outside the European Economic Area, Links ensures that the transfer is covered by an adequacy decision or by the European Commission's Standard Contractual Clauses. Where KVKK applies to a transfer outside Türkiye, the parties use the standard contract published by the Turkish Personal Data Protection Authority and complete the required notification to the Authority.

Taking into account the nature of the processing, Links helps the Customer answer requests from data subjects to exercise their rights. The Service lets administrators view, export, correct and delete user data. If Links receives a request directly, it forwards it to the Customer without undue delay and does not respond itself unless the Customer authorises it.

Links notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer data. The notification includes the information available at the time, such as the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences and the measures taken or proposed. Links provides further information as it becomes available, so that the Customer can meet its own notification duties to authorities and data subjects.

Links provides reasonable assistance to the Customer with data protection impact assessments and prior consultation with supervisory authorities, where required by Data Protection Law and relating to the Service. For occupancy and presence features, Links can provide the Customer with a description of the processing to support its assessment and any works council consultation.

At the end of the Service, the Customer can export its data for 30 days. After that period, Links deletes or anonymises Customer personal data, including copies held by subprocessors, unless the law requires it to be kept. Data in backups is deleted as the backups expire and is not restored for any other purpose in the meantime.

Links makes available the information necessary to demonstrate compliance with this DPA, including its ISO 27001 and ISO 42001 certificates. Where this information is not sufficient, the Customer may carry out an audit, itself or through an independent auditor bound by confidentiality, once a year with at least 30 days' notice, during business hours and without disrupting the Service. Each party bears its own costs, unless the audit reveals a material breach by Links.

Liability under this DPA is subject to the limitations in the Terms of Service, except where Data Protection Law does not allow such limitation. If this DPA conflicts with the Terms of Service, this DPA prevails for the processing of personal data. Where the Standard Contractual Clauses apply, they prevail over both.

Questions about this DPA and requests for a signed copy can be sent to [email protected].