Data Processing Agreement

1. Parties and roles

This agreement is between the organization that opens an account on Cohie ("Controller") and Fauna Venture Studio ("Processor"). It is accepted during organization sign-up with a checkbox separate from the Terms of use. The person accepting declares that they are authorized to sign on behalf of the organization; the time of acceptance, the version of the agreement and the accepting account are recorded. The Processor's identity and contact details are on the Contact page.

For program data, the organization is the controller and Fauna is the processor. For data about the Cohie account itself, Fauna is the controller (Privacy notice).

2. Subject

The Processor processes personal data of applicants, jurors, mentors, trainers and startups within the Controller's programs only to provide the Cohie service and according to the instructions the Controller gives through the platform.

3. Term

The agreement takes effect on acceptance and continues while the Controller's Cohie account is open. It ends when the organization is deleted or the agreement is terminated. Confidentiality, return and deletion obligations continue after it ends.

4. Data categories and data subjects

• Data subjects: applicants, startup teams and members, jurors, mentors, trainers, the Controller's admins and team members, event attendees
• Data categories: identity (full name), contact (email, phone), professional information (title, organization, biography, LinkedIn link), application and deliverable content (form answers, uploaded files), evaluation (scores, comments, decisions), program activity (attendance, absence excuses, mentor meetings, survey answers, alumni follow-up survey, alumni directory membership), status verification (verified organization email address), program assistant (questions and answers), operational security (IP address, session and audit records)

Special categories of personal data must not be uploaded to the platform: data on race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sex life, criminal convictions and security measures, and biometric and genetic data. Absence excuse documents must not contain a diagnosis or health information either; the Controller tells data subjects so. If such data is uploaded anyway, the Controller is responsible.

5. Processor obligations

• Not to process data for any purpose other than providing the service, not to sell it or use it for advertising
• To process data only on the Controller's instructions, and to tell the Controller without delay if it believes an instruction breaches KVKK
• To take the technical and organizational measures required by KVKK art. 12 (at least the measures at the end of this section)
• To ensure that employees who access personal data are bound by confidentiality and that access is limited to their duties
• To notify the Controller of a data breach within 24 hours of becoming aware of it. The notice describes the nature of the breach, the affected data categories and approximate number of people, likely consequences and measures taken. Notifying the Personal Data Protection Board (the Board) and data subjects (KVKK art. 12/5, 72 hours) is the Controller's obligation; the Processor provides the information needed for it.
• To publish subprocessors on the Subprocessors page and announce changes under section 7
• To give the Controller information showing that obligations under this agreement are met (section 8)

The Processor's measures include at least the following:

• Isolation between organizations: every read and write is limited by the organization's ID.
• Connections are encrypted (HTTPS). Secrets that must be read back (such as identity provider and email infrastructure secrets) are stored encrypted with AES-256-GCM.
• Passwords are hashed with PBKDF2-SHA256. Only a hash of session, invitation and password reset tokens is stored.
• Files are kept in private storage and can be downloaded only after an authorization check.
• Admin actions are written to the audit log.
• Forms used without signing in have rate limits and bot protection; users can turn on two-step verification.
• A weekly, encrypted backup of the database is taken.

6. Controller obligations

• To inform data subjects, and to collect consent separately and optionally where processing relies on consent
• To answer data subject requests within 30 days. A request that reaches the Processor is passed to the Controller within 5 business days and the Processor gives the support needed to answer it.
• To use the platform and data lawfully and to be responsible for the lawfulness of the data
• Not to upload special categories of personal data to the platform

7. Subprocessors and right to object

The Controller gives general authorization for the subprocessors on the Subprocessors page. The Processor notifies the Controller's owners and admins by email at least 30 days before adding a new subprocessor or replacing one. The Controller can object within that period on reasonable grounds. If the parties cannot resolve the objection, the Controller can terminate the agreement and take its data back under section 10.

The Processor has a written contract with each subprocessor with data protection obligations equivalent to those here and is responsible for their obligations.

8. Audit and information rights

Once a year, and additionally when a breach is suspected, the Controller can ask the Processor for written information showing compliance with this agreement. The Processor gives it within a reasonable time (a summary of measures taken, relevant audit records, the list of subprocessors). If the information is insufficient, the Controller can, with at least 15 days' notice, without disrupting the service and under a confidentiality undertaking, carry out an on-site audit or appoint an independent auditor. The cost of the audit is borne by the Controller.

9. Transfers abroad

The platform infrastructure uses servers abroad, so program data is transferred abroad. The database is within the European Union jurisdiction. Where files are kept depends on the Controller's data location choice. Transfers are made under the rules of KVKK art. 9. The data, recipient and country are listed on the Subprocessors page.

10. Return and deletion at the end

When the agreement ends, the Controller can take its data with the platform's export tools. The Processor keeps the data accessible for that purpose for 30 days after the end, then deletes or anonymizes it according to the Controller's written choice. Copies in technical backups are deleted at the end of the backup's natural retention period, within 90 days at most. Data that the law requires to be kept is not bound by this period.

11. Liability

Each party is responsible for its own obligations under KVKK and related law. Statutory liabilities toward data subjects and the Board are preserved. The Processor's liability under this agreement is subject to the limitation of liability section of the Terms of use.

12. Termination

The Controller can end the agreement at any time by deleting its account. The Processor can terminate it if the Controller seriously breaches this agreement or the Terms of use and does not fix it within the period given after a warning. Termination after an objection under section 7 does not make the Controller liable for damages.

13. Changes

If the Processor changes this agreement, it notifies the Controller's owners and admins by email at least 30 days in advance; the new version is published on this page. If the Controller does not accept the change, it can end the agreement under section 12 before the effective date.

14. Governing law and jurisdiction

This agreement is governed by the laws of the Republic of Türkiye. The courts and enforcement offices where the Processor's registered head office is located have jurisdiction over disputes.