Data Processing Agreement

1. Parties and subject matter

The Company's trade name, address, tax, MERSIS and contact details appear at the start of this section.

1.1. This Agreement is concluded between the person or business using Riseluc (the "User") and the Company that provides the Riseluc service, upon acceptance of the Terms of Use. Under this Agreement the User is the data controller and the Company is the data processor.

1.2. This Agreement applies to data relating to the User's marketplace customers (buyers, people asking product questions, people writing product reviews) and to the people in files the User uploads to the Platform. Data relating to the Company's own users (account holders and team members) is outside this Agreement; for that data the Company is the data controller, and the KVKK Privacy Notice and the Privacy Policy apply.

1.3. Terms in this Agreement have the meaning given in Law No. 6698 on the Protection of Personal Data ("KVKK"). "Platform" means the riseluc.com website, the Riseluc dashboard and its background jobs.

1.4. If the User is established in the European Economic Area, this Agreement also applies as a data processing agreement under Article 28 of the General Data Protection Regulation (GDPR). Questions and requests about transfers from the European Economic Area can be sent to info@riseluc.com.

• Terms of Use
• KVKK Privacy Notice
• Privacy Policy

2. Subject matter and duration of processing

2.1. The Company processes the data to provide the Riseluc service to the User: it stores and displays records read from the marketplace, produces profit and finance calculations, passes to the marketplace the actions the User turns on or approves, and prepares drafts with AI features.

2.2. The categories of data processed, their sources, purposes and retention periods are set out in Annex 1.

2.3. Processing continues for as long as the Terms of Use remain in force and the relevant store is connected to the Platform.

3. Instructions

3.1. The Company processes the data on the User's instructions. The Terms of Use, this Agreement, the settings the User makes in the dashboard and the actions the User starts or approves count as instructions.

3.2. If the Company believes an instruction breaches the law, it informs the User without delay and may refrain from that action until the instruction is clarified.

3.3. The Company does not sell the data, does not share it with third parties for advertising and does not use it to train its own or anyone else's AI model. The following two activities are carried out to operate the service:

• The Company's authorised administrators can see, in the admin panel, product-level sales summaries across stores (product, units sold and amount, store and marketplace; no buyer information) for support and to operate the service. The sales summary of a deleted store is kept for this purpose for a further 30 days and is then deleted automatically.
• Category comparison: aggregated statistics produced from the marketplaces' public search results and shown only for categories researched by at least 5 different Users and containing at least 20 products. These statistics do not identify any single User or data subject, and data received from Amazon is not included.

4. The Company's obligations

4.1. Confidentiality: The Company keeps personal data confidential. Access to the data is limited to the people the service requires and to the least privilege needed.

4.2. Security: The Company takes the technical and organisational measures in Annex 3 in line with Article 12 of KVKK. Annex 3 describes current practice and is updated when practice changes.

4.3. Data subject requests: A request under Article 11 of KVKK that reaches the Company directly and concerns data for which the User is the controller is passed to the User without undue delay. The Company gives the User reasonable help in answering such requests.

4.4. Breach notification: When the Company becomes aware of a personal data breach affecting data for which the User is the controller, it notifies the User without undue delay and in any case within 48 hours. The notice describes the nature of the breach, the categories of data and approximate number of people affected, the likely consequences and the measures taken or proposed; information not yet known is added as it becomes available. This period is set so that the User can notify the Personal Data Protection Board within 72 hours.

4.5. A security incident affecting data received from Amazon is also reported to Amazon (security@amazon.com) within 24 hours of detection.

4.6. Audit: Once a year at most, and with 30 days' notice, the User may request information and documents showing compliance with this Agreement. An on-site audit is carried out at the User's expense, without disrupting operations and subject to a confidentiality undertaking.

4.7. Amazon data: For data received from Amazon, the Company also complies with the Amazon provisions of the Marketplace Integrations and Automated Actions Supplementary Terms. The name, address and contact details of Amazon buyers are not stored.

• Marketplace Integrations and Automated Actions Supplementary Terms

5. Subprocessors

5.1. The User gives general authorisation for the use of the subprocessors in the Subprocessors and Data Recipients List in Annex 2. The Company must ensure that subprocessors work under data protection obligations no less protective than those in this Agreement, and it is liable to the User for their acts within this scope.

5.2. At least 30 days before a new subprocessor is added or a subprocessor is replaced, Annex 2 is updated and account holders are notified by email. The User's right to object and to terminate is set out in the changes section of the Subprocessors and Data Recipients List; a User who terminates after objecting is refunded the amount paid for the unused period.

• Subprocessors and Data Recipients

6. Transfers abroad

Some subprocessors are located outside Türkiye; the location of each is stated in the Subprocessors and Data Recipients List. The Company must carry out transfers to subprocessors abroad in line with Article 9 of KVKK.

7. The User's obligations

7.1. The User is responsible for informing its marketplace customers on its own behalf and for having the legal basis needed for the data to be processed on the Platform.

7.2. The User takes care not to upload personal data the service does not need (for example a buyer's identity document as return evidence). A User who uploads a model photo for virtual try-on is responsible for having the consent of the person in the photo.

8. Deletion of data

8.1. When the User deletes a store from the dashboard, that store's encrypted access credentials and its records listed in Annex 1 are deleted. Account closure is requested under Settings → Closing your account; when the account is permanently deleted, its stores are deleted too.

8.2. The sales summary kept for a deleted store's sold products (no buyer information) is deleted automatically after 30 days. Copies remaining in the database provider's backups are deleted at the end of the backup retention cycle.

8.3. Data that must be kept by law is outside this rule; it is kept only for that obligation and for as long as required.

9. Liability and precedence

9.1. The parties' liability under this Agreement is subject to the limitation of liability in the Terms of Use. Joint liability for data security under Article 12(2) of KVKK is reserved.

9.2. On the processing of personal data, this Agreement takes precedence over the Terms of Use.

Annex 1. Processing details

Data subjects: the User's marketplace customers (buyers, people asking product questions, people writing product reviews) and the people in files the User uploads to the Platform (for example the person in a model photo uploaded for virtual try-on, or people visible in return evidence).

• Customer question: the asker's name as shown on the marketplace, the question and answer text. Source: Trendyol, Hepsiburada and n11 API. Purpose: answering the question from the dashboard and preparing an AI draft answer. Retention: the asker's name is deleted no later than 90 days after the question is recorded in Riseluc as answered or closed; the whole question record is deleted 12 months after the question date.
• Product review: rating, review text and the reviewer name the marketplace shows (usually abbreviated). Source: Trendyol's public product page, only when the User turns on review tracking. Purpose: review analysis and content suggestions from reviews. Retention: until the store is deleted.
• Order record: order and package number, product, quantity, amount, deductions, status and dates. Source: marketplace API. Purpose: profit calculation, finance reconciliation and the orders screen. Retention: until the store is deleted.
• Shipment record: order and tracking number, carrier, status and dates, written with buyer details removed. Source: marketplace API. Purpose: shipment tracking and dispatch deadline alerts. Retention: 90 days after the order date; records in cancelled or returned status are kept until the store is deleted, for restocking and shipping cost calculation.
• Return request record: request and order number, product, return reason, status, dates and tracking number; on Trendyol and eMAG the customer's name, phone, address and bank details are removed before writing. Source: marketplace API. Purpose: return analysis and dispute drafts. Retention: until the store is deleted.
• Buyer's delivery details. Source: eMAG API. Purpose: creating the AWB (shipping label) on eMAG. Retention: not stored; read from eMAG and sent back to eMAG only during the action.
• Shipping label and invoice file. Source: marketplace or User. Purpose: passing to the marketplace and printing. Retention: not stored; the action record does not contain the buyer's name, address or contact details.
• Return evidence files (photo, video, PDF). Source: uploaded by the User. Purpose: return and dispute process. Retention: 180 days after upload; immediately when the store or the return request is deleted.
• Model photo and the image produced with it. Source: uploaded by the User. Purpose: virtual try-on in the product photo studio. Retention: the uploaded photo after 24 hours; the produced image after 30 days if it has not been sent to a marketplace.
• Lucy chat: the User's messages and the store data read for the answer (for example the text of a customer question; the buyer's name, address and contact details are not sent). Source: User and Platform. Purpose: Lucy's answers. Retention: the last 40 messages are kept in the account; the User can clear the chat at any time; deleted when the account is deleted.

Annex 2. Subprocessors

Annex 2 is the Subprocessors and Data Recipients List on a separate page. The list shows each provider's service, the data it processes and where the data is located, and it is updated under clause 5.

• Subprocessors and Data Recipients

Annex 3. Technical and organisational measures

The measures below are in place today and are updated when practice changes. Riseluc does not hold a security certification audited by an independent body (such as ISO 27001 or SOC 2).

• Data location: the database, authentication and file storage are in the European Union, in the Frankfurt region of Germany; server-side processing of the web application also runs in the Frankfurt region. The locations of other providers are in Annex 2.
• Transport security: all connections use HTTPS; the HSTS header is sent for two years, covering subdomains and with the preload flag.
• Browser security: every page applies a content security policy (CSP), a header that forbids the site from being opened inside another site's frame, a header that turns off content-type sniffing, a limited referrer policy and a permissions policy that turns off camera, microphone and location access; payment pages have their own content security policy.
• Encryption: marketplace access credentials, the Amazon refresh token, the saved-card keys issued by iyzico and the Turkish ID or tax number entered for invoicing are encrypted with AES-256-GCM in the application layer before they are written to the database. Each value is encrypted with a random initialisation vector; the encryption key is not in the database but only in the servers' environment variables, and key rotation is supported.
• Card data: the card number, expiry date and security code are entered into iyzico's payment form; the full card number and the security code never reach the Company.
• Data separation: row-level security (RLS) is on for the database tables; a request from the browser can only read rows that belong to the user's own account and team's stores. Encrypted fields cannot be read from the browser. Plan, subscription and billing fields and the billing tables are written only by the server side.
• Authentication: passwords are stored as one-way hashes with the authentication provider; the Company's team cannot see them. A bot check against automated sign-ups and password-guessing attacks is applied on the sign-in and sign-up forms. While optional two-step verification (a code from an authenticator app, plus backup codes) is on, the dashboard does not open without the second step, and requests that write prices or stock or add store credentials ask for it too.
• Team permissions: team members are given roles; viewers can only read, and this limit is also enforced in the database.
• Admin access: only admins on a written allow list can open the admin panel, and two-step verification is mandatory for them. Admin changes, and an admin's views of a user, a store or a support conversation, are written to a separate audit log that cannot be read or changed from the browser.
• Limited access: access to data is limited to the people the service requires and to the least privilege needed.
• Abuse prevention: per-account request limits for actions such as store verification, marketplace writes and file uploads, a block on sign-ups with disposable email addresses and a sign-up block list. Supplier XML links are fetched only from public internet addresses; local network, private IP and cloud metadata addresses are rejected both when the link is saved and when it is fetched.
• Writing to marketplaces: repricing and automatic stock updates are off by default; Lucy's suggestions are not applied until the User presses "Apply". Some marketplaces have an emergency switch that stops all writes.
• Data minimisation: the name, address and contact details of Amazon buyers are not stored; shipping records are written with buyer details removed; shipping labels and invoice files are passed through, not stored; the User's name, email, payment details and access credentials are not sent to the AI provider; local variables and personal data fields are not sent to the error log of background jobs.
• File storage: return evidence files are kept in private storage and shown only to accounts with access to that store, through links valid for 60 seconds.
• Automatic deletion: the periods in Annex 1 are applied automatically; in addition, the AI app call log is deleted after 90 days and the application error log after 30 days.
• AI app connection (ChatGPT, Claude): works with an OAuth 2.1 token and per-store permission, and is read-only. The token cannot reach the database directly; it reads only through Riseluc's connection server; at most 60 requests per minute are accepted from each app; the call log is kept without content.
• Monitoring: run records of background jobs, incident alerts raised by the system watch and an application error log are kept; errors in background jobs are also reported to an error tracking service.
• Software development: the code passes automated tests on every change; the software dependencies in use are scanned weekly for known security vulnerabilities.
• Vulnerability reporting: security vulnerabilities are reported to info@riseluc.com; the address is also listed in the site's security.txt file.
• Breach management: when a personal data breach is detected, the Company takes the steps needed to stop it, assess its impact and record it. For data for which the Company is the controller, the Personal Data Protection Board is notified within 72 hours and affected people are informed as soon as possible (Board Decision No. 2019/10). For data for which the Company is a processor, the User is notified without undue delay and in any case within 48 hours. An incident affecting data received from Amazon is also reported to security@amazon.com within 24 hours of detection.

• Security