Data Processing Agreement (customer draft)

1. Roles (draft)

For client / applicant content uploaded or entered by Customer users, the Customer is the controller (or joint controller as between Customer and its clients, as Customer determines). Case Studio is the processor. Customer remains responsible for lawful basis, transparency toward data subjects (including GDPR Art. 13/14 / KVKK aydınlatma), and instructions given to Case Studio.

2. Subject matter and duration (draft)

• Subject matter: hosting, storage, AI-assisted analysis, drafting, collaboration, and related Visa Engine features applied to Customer Content.
• Duration:for the term of the Customer's subscription / organization use, plus deletion/return periods disclosed in the Privacy Policy and retention schedule.
• Nature: automated and human-supported cloud processing, including transmission to approved subprocessors.
• Purpose: solely to provide the Service per Customer instructions (configuration, uploads, API/UI actions).
• Types of personal data: identity and contact data; immigration and nationality data; education/employment history; document contents (which may include special-category / sensitive data); technical logs tied to Customer users.
• Categories of data subjects: Customer's clients / applicants / beneficiaries; recommenders and other third parties appearing in evidence; Customer's authorized users.

3. Processor obligations (draft checklist for counsel)

Case Studio shall (draft):

1. Process Customer Personal Data only on documented instructions from the Customer (including via the Service UI), unless required by law.
2. Ensure persons authorized to process are bound by confidentiality.
3. Implement appropriate technical and organizational measures (see Security + counsel-approved schedule).
4. Engage subprocessors only under written terms imposing equivalent data-protection obligations; maintain the Subprocessor Schedule; give advance notice of additions/replacements and allow Customer objection on reasonable grounds (counsel to finalize notice period and objection process).
5. Assist the Customer with data-subject requests, DPIAs, and consultations with authorities, taking into account the nature of processing.
6. Notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data (counsel to set hour target to Customer; authority 72h remains as law assigns).
7. Delete or return Customer Personal Data after end of services, subject to legal retention and backup rotation windows disclosed to Customer.
8. Make available information necessary to demonstrate Art. 28 compliance and allow audits as negotiated (remote questionnaires first).

4. International transfers (draft)

Where Customer Personal Data is transferred outside the EEA/UK/Türkiye, Case Studio relies on mechanisms approved by counsel (e.g. EU SCCs with vendors; Turkish Board standard contracts for KVKK m.9 regular transfers). Placeholder — insert executed mechanisms; do not treat as complete until counsel confirms.

5. Customer instructions & prohibited data (draft)

Customer instructs Case Studio to process uploads and structured case data as entered by Customer users. Customer shall not instruct processing that violates applicable law. Special-category data may appear in immigration files; Customer warrants it has a valid Art. 9 / KVKK m.6 basis toward data subjects.

6. Liability / order of precedence (stub)

Counsel to align with Terms of Service liability caps, indemnities, and governing law (Delaware / other). Until then, the Terms of Service and this draft DPA should be read together; counsel will set order of precedence.

7. Contact

Privacy and DPA questions: akif@visaengine.app.