Version: 2026-10-12
Effective date: 2026-10-12
Parties and acceptance
This Data Processing Addendum (DPA) supplements the Terms & Software License or the customer's separate service agreement with JESTERS BOX YAZILIM DİJİTAL OYUN VE BİLİŞİM TİCARET ANONİM ŞİRKETİ (Provider). Provider's address is stated in those Terms. Customer is the organization, business or individual acting as controller or processor that accepts that agreement for cloud workspace services. The person accepting for Customer must be authorized to bind it.
The DPA forms part of that agreement when Provider processes personal data on Customer's behalf. Its version and effective date are those accepted with the agreement, unless the parties expressly agree otherwise. An authorized Customer contact may send instructions and requests to legal@jestersbox.com.
Roles and instructions
Customer is the controller of personal data in its cloud workspace content, or a processor authorized by its controller to appoint Provider as a subprocessor. Customer is responsible for that authority and for communicating applicable instructions. Provider processes that data on Customer's behalf.
The service agreement, this DPA, Customer's authorized use of service controls and lawful written requests are Customer's documented instructions. Provider will inform Customer immediately if an instruction appears to infringe applicable data-protection law. Processing required by law outside those instructions is subject to notice before processing unless the law prohibits notice.
Provider independently determines the purposes of its own account administration, billing, service security, support administration and legal compliance, as described in the Privacy Notice. A record's role depends on why it is processed: handling workspace content to resolve Customer's support request remains processing on Customer's behalf. This DPA grants no permission to use customer content for unrelated product development, advertising or model training.
Processing schedule
| Item | Description |
|---|---|
| Subject matter | Optional cloud asset storage and workspace services; local files are outside Provider's hosted processing unless uploaded or sent to Provider. |
| Purpose and operations | Receive, store, organize, copy, generate previews, thumbnails and service-related asset analysis, transmit, protect, support, return, restore and delete content and related records needed to provide the service. |
| Duration | Service term and applicable return, recovery and deletion periods in the Privacy Notice; legally required retention only for the necessary records. |
| Data subjects | Workspace users, invited collaborators, Customer's employees and contractors, and people identified in Customer's files or metadata. |
| Personal data | Identifiers and contact details associated with workspace participation; file contents and their previews, thumbnails, audio waveforms and asset-analysis results; filenames, notes, tags, collections, asset relationships, versions, snapshots and other asset metadata; copies, caches, exports and backups of these materials, in each case to the extent they contain personal data; related operational and support records processed on Customer's behalf. |
| Sensitive data | The service is not intended for special-category or other restricted data described in the Terms unless separately agreed in writing with appropriate safeguards. |
Files do not have to contain personal data. This DPA applies to the personal data within the covered processing, while the Terms protect ownership and confidential content more generally.
Provider obligations
Provider will keep authorized persons subject to confidentiality obligations, restrict processing to the instructions above and implement security measures appropriate to the processing and its risks, including the schedule below.
Taking account of the processing, Provider will assist Customer through appropriate technical and organizational measures, insofar as possible, with requests to exercise individuals' rights. Taking account also of information available to Provider, Provider will assist with applicable security, breach reporting, data-protection impact assessments and supervisory-authority consultations.
Provider will supply information needed to demonstrate compliance and allow and contribute to audits, including inspections by Customer or its mandated auditor. The parties will first use available documentation where sufficient and arrange further review with reasonable notice, confidentiality and protection for other customers' data. These arrangements do not remove required audit rights or prevent urgent or regulator-required review. No certification, independent audit report or dedicated audit portal is promised unless separately agreed.
Customer obligations
Customer will establish a lawful basis for its processing, provide required notices, ensure that instructions and uploads are lawful, manage membership and access, and avoid prohibited data. Customer remains responsible for responding to individuals concerning Customer-controlled data. Provider will route requests received directly about that data to Customer without undue delay, unless law requires Provider to respond itself.
Subprocessors
Customer generally authorizes the subprocessors identified in Providers & Subprocessors. Provider will impose the required written data-protection obligations and remains responsible for its subprocessors as required by applicable law.
This authorization includes AWS and Cloudflare operating under Provider's own accounts. Customer authorizes Provider to enter into and administer, in Provider's own name, the provider agreements, data processing addenda and applicable data-transfer arrangements necessary to carry out Customer's documented instructions. Where Customer acts for another controller, Customer confirms that it has authority from that controller for these appointments and instructions. This authorization does not permit Provider to sign a separate agreement in Customer's name and does not replace the safeguards or formalities required under the International transfers section below.
Provider will email the workspace owner's or designated business contact's current address at least 30 days before a new or replacement subprocessor starts covered processing. Customer may object on reasonable data-protection grounds within 15 days of notice by emailing legal@jestersbox.com. Customer should keep its contact address current.
The parties will seek a reasonable solution, such as avoiding the affected processing. If no solution is available before the change, Customer may terminate the affected cloud service before that subprocessor begins processing its data and request return/deletion. Unused prepaid fees for the terminated affected service will be refunded through the applicable payment channel, subject to mandatory rights. This does not require Provider to create a different service architecture. An urgent change will be handled with prompt notice and any additional authorization or safeguards required by law; urgency does not remove Customer's statutory objection rights.
International transfers
Provider operates from Türkiye. Hosting, storage and relevant access locations are described in Providers & Subprocessors. A hosting region alone does not exclude administrative or onward access elsewhere.
For a restricted transfer, the parties will put the applicable legal mechanism in place before the covered transfer. Where required, this includes the correct Standard Contractual Clauses, completed annexes, transfer assessment and supplementary measures. Transfers subject to Türkiye's KVKK require their own applicable Article 9 arrangement and formalities. A generic reference to GDPR clauses does not complete that arrangement. Provider will make information about applicable safeguards available on request, with necessary confidential information protected.
Security schedule
The following measures apply to covered cloud processing:
| Area | Measures |
|---|---|
| Transmission and storage | Use encrypted service connections and provider encryption at rest for cloud databases and stored objects. Cloud content is not end-to-end encrypted with customer-only keys. |
| Service access | Authenticate accounts and enforce workspace roles for cloud access. Keep object storage private and authorize access through the service. |
| Administrative access | Limit access to people and purposes necessary to operate, secure and support the service; protect privileged credentials and review access when responsibilities change. |
| Logging | Keep relevant operational/security records, restrict their access and apply the Privacy Notice's retention schedule. Logging is not a promise to record every data access or provide a customer audit-log feature. |
| Recovery and deletion | Maintain appropriate recovery procedures, restrict retained backup use, expire backups and reapply relevant deletions after restoration. Recovery features do not guarantee restoration of physically deleted files. |
| Maintenance | Review relevant security vulnerabilities and dependencies, prioritize fixes by risk and maintain an incident-response procedure. |
| Providers | Review relevant provider security and processing arrangements when appointing or materially changing a subprocessor. |
Measures may evolve provided the overall protection required for the processing is maintained. Customers remain responsible for their devices, credentials, access decisions and independent copies of important assets.
Personal-data requests and return
Customer may request assistance, a copy or deletion through legal@jestersbox.com without requesting account deletion. Provider may verify authority and clarify the affected workspace, person, records and period. Assistance may be handled manually; no dedicated self-service export tool is promised.
Return will use available original file formats and, where relevant, commonly readable formats such as JSON or CSV for associated records, delivered through authenticated access or another agreed secure method. Provider and Customer will identify the scope and any unavailable records or necessary protection for other individuals. Provider will act in time to enable applicable legal obligations; the parties may agree practical delivery steps without overriding those obligations.
Breach notice
Provider will notify Customer without undue delay after becoming aware of a personal data breach affecting covered data, using the designated contact or workspace owner's email. Available information will describe the incident, affected data and people where known, likely consequences, mitigation and a follow-up contact. Further information may be supplied in stages as it becomes available. Customer remains responsible for its own legally required notifications; Provider will provide the assistance described above.
Deletion and retention
At the end of processing, Provider will, at Customer's choice, return or delete covered personal data and delete existing copies unless applicable law requires storage. Customer may also issue a lawful deletion instruction during the term. The retention schedule describes ordinary service recovery and backup expiry; it does not override a lawful erasure instruction or Customer's return/deletion choice.
Any temporarily retained backup copies remain protected and excluded from ordinary use until expiry. Legally retained records are limited to the required purpose and duration. On request, Provider will explain the completed deletion, any outstanding backup expiry and any permitted retained records. Completion statements will reflect verified results.
Order of precedence
This DPA prevails over conflicting service terms for covered personal-data processing. Applicable Standard Contractual Clauses prevail where required. The service agreement's governing law and liability provisions otherwise apply only to the extent permitted by mandatory data-protection law and those clauses.