Data Processing Addendum (DPA)

Last Updated: 1 May 2026

This Data Processing Addendum ("DPA") supplements the Terms of Service between you ("Customer") and the applicable Contracting Entity (as defined in the Terms of Service) and governs the processing of personal data in connection with the services.

---

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person processed in connection with the services.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, or deletion.
• "Sub-Processor" means a third party engaged by us to process Personal Data on our behalf.
• "Data Controller" means the entity that determines the purposes and means of Processing.
• "Data Processor" means the entity that processes Personal Data on behalf of the Data Controller.

---

2. Roles and Responsibilities

2.1 Customer Account and Billing Data

For personal data related to Customer accounts, billing, and service administration (e.g., name, email, payment details, usage records), we act as the Data Controller.

2.2 Customer-Hosted Data

For personal data that Customer uploads, stores, or processes using our cloud computing services, Customer acts as the Data Controller and we act as the Data Processor, processing such data solely in accordance with Customer's instructions.

---

3. Data Processing Purposes

We process Personal Data only for the following purposes:

• Service delivery: Provisioning and managing cloud computing resources
• Authentication and security: Account creation, identity verification, fraud prevention
• Billing and payments: Payment processing, invoice generation, account balance management
• Technical support: Responding to support requests and troubleshooting
• Legal compliance: Meeting obligations under applicable laws and regulations
• Service improvement: Aggregated analytics to improve platform performance and reliability

---

4. Sub-Processors

4.1 Authorized Sub-Processors

We use the following sub-processors in the delivery of our services:

4.2 Sub-Processor Changes

We will notify Customer of any intended changes to sub-processors at least 30 days in advance by posting updates to our legal page at https://rafftechnologies.com/legal. Customer may object to a new sub-processor by contacting us within 15 days of notification.

4.3 Sub-Processor Obligations

All sub-processors are bound by data processing agreements that impose obligations no less protective than those in this DPA.

---

5. Data Retention

Upon expiry of the applicable retention period, Personal Data is deleted, destroyed, or anonymized in accordance with our data retention procedures.

---

6. International Data Transfers

6.1 Transfer Mechanisms

Personal Data may be transferred internationally to the sub-processors listed in Section 4. Such transfers are protected by:

• Standard Contractual Clauses (SCCs) as set out in the European Commission Implementing Decision (EU) 2021/914, Module Two (Controller-to-Processor), and/or as recognized by Turkish data protection authorities
• Written undertakings from data importers to provide adequate protection in compliance with KVKK Article 9, where applicable
• Supplementary technical and organizational measures including encryption in transit (TLS 1.2+) and at rest (AES-256), access controls, and regular security audits

6.2 Data Localization

Customer data is hosted in the data center location selected at the time of order. Data is not moved to a different country without Customer's written consent, except as necessary for the sub-processors listed in Section 4 to provide their respective services.

---

7. Data Security

We implement the following technical and organizational measures:

• Encryption: TLS 1.2+ for data in transit; AES-256 for data at rest
• Access control: Role-based access, multi-factor authentication, principle of least privilege
• Network security: DDoS protection, firewalls, intrusion detection
• Physical security: Data center security standards (access controls, surveillance, environmental protections)
• Monitoring: 24/7 security monitoring and logging
• Regular audits: Periodic security assessments and vulnerability testing
• Personnel confidentiality: All personnel authorized to process Personal Data are subject to appropriate confidentiality obligations, whether by contract or statutory duty, and receive regular data protection training

---

8. Data Breach Notification

In the event of a Personal Data breach:

1. Notification timeline: We will notify Customer in writing within 72 hours of becoming aware of the breach.
2. Notification content: The notification will include:
   • The nature of the breach
   • Categories and approximate number of affected data subjects
   • Likely consequences of the breach
   • Measures taken or proposed to address the breach and mitigate its effects
3. Regulatory notification: We will cooperate with Customer in notifying relevant supervisory authorities as required by applicable law.
4. Remediation: We will take all necessary measures to contain the breach, mitigate its impact, and prevent recurrence.

---

9. Data Subject Rights

We will assist Customer in responding to data subject requests to exercise their rights under applicable data protection laws, including rights of access, rectification, erasure, restriction, portability, and objection. We will respond to such requests within the timeframes required by applicable law.

---

10. Data Protection Impact Assessments

Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance to Customer in fulfilling Customer's obligations under GDPR Articles 35 and 36 (Data Protection Impact Assessments and prior consultation with supervisory authorities), where such obligations relate to the processing of Personal Data under this DPA.

---

11. Data Return and Deletion

11.1 During the Agreement

Customer may export their data at any time using the tools provided in the account dashboard.

11.2 Upon Termination

• Customer has 20 days from termination to retrieve their data.
• After the 20-day period, all Customer data is permanently deleted from our active systems and backups.
• Data subject to legal retention obligations is retained in encrypted storage for the required period and deleted upon expiry.
• A data deletion certificate is available upon request.

---

12. Audit Rights

12.1 Customer Audits

Customer may request an audit of our data processing activities with at least 30 days' prior written notice. Audits:

• Are conducted during normal business hours
• Must not compromise the confidentiality of other customers
• Are limited to once per year (except in the event of a data breach)
• Costs are borne by the requesting party

12.2 Audit Reports

We may satisfy audit requests by providing relevant third-party audit reports, certifications, or compliance documentation where available.

---

13. Liability

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set forth in the Terms of Service. For the avoidance of doubt, each party's total aggregate liability under this DPA and the Terms of Service combined shall be treated as a single claim for the purposes of any liability cap.

---

14. Term and Termination

This DPA is effective for the duration of the Terms of Service. Upon termination of the Terms of Service, data processing obligations continue until all Personal Data has been deleted or returned in accordance with Section 11.

---

Contact Information:

For questions about this DPA:

• Email: [email protected]
• Legal and privacy: [email protected]
• Technical support: [email protected]
• Abuse reports: [email protected]
• Website: https://rafftechnologies.com

Raff Technologies LLC

• 12410 Milestone Center Dr, Ste 600, Germantown, Maryland, 20876, United States

Dynamis Teknoloji Anonim Şirketi

• Beytepe Mah. 5399 Sk. No: 1 B İç Kapı No: 133 Çankaya/Ankara, Turkey
• Phone: +90 312 911 31 27
• MERSİS: 0323136402600001

---

Last updated: 1 May 2026