Data Processing Agreement

Version: 1.0 · Effective date: 5 November 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Agreement") between the customer ("Customer") and Senem Can, an individual (natural person) resident in Türkiye, operating the Service under the name Eachlang, Tepebaşı, Eskişehir, Türkiye, operating Eachlang ("Processor", "we"). It applies automatically when Customer accepts the Terms. Customers who need a countersigned copy can request one at privacy@eachlang.com.

1. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the GDPR. In addition:

• Data Protection Laws means all laws that apply to the processing of Customer Personal Data under the Agreement, including Regulation (EU) 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), Türkiye's Law No. 6698 on the Protection of Personal Data ("KVKK"), and the California Consumer Privacy Act as amended ("CCPA").
• Customer Personal Data means personal data that we process on behalf of Customer in providing the Service, as described in Annex I.
• SCCs means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• Subprocessor means a processor we engage to process Customer Personal Data.

2. Roles and scope

1. Customer is the controller (or a processor acting for its own controller) and we are the processor of Customer Personal Data.
2. We act as an independent controller only for the account, billing, support and usage data described in our Privacy Policy. This DPA does not cover that data.
3. Paddle.com, as Merchant of Record, processes purchase data as an independent controller and is not our Subprocessor.

3. Customer instructions

1. We process Customer Personal Data only on Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by law; in that case we will inform Customer before processing unless the law prohibits it. The Agreement, this DPA and Customer's configuration of the Service are Customer's complete instructions.
2. We will promptly inform Customer if, in our opinion, an instruction infringes Data Protection Laws.
3. Customer is responsible for the lawfulness of the personal data it provides and of its instructions, including having a legal basis and giving any notices required to its website visitors.

4. Our obligations

We will:

1. Purpose limitation. Process Customer Personal Data only to provide, secure and support the Service. We do not use Customer Personal Data or other Customer Content to train or improve machine-learning models, and we only engage AI providers whose published data policies, with the settings we use, do not allow Customer Content to be used for training.
2. Confidentiality. Ensure that anyone authorised to process Customer Personal Data is bound by confidentiality.
3. Security. Implement the technical and organisational measures in Annex II, appropriate to the risk as required by Article 32 GDPR. We may update the measures as long as the overall level of protection does not decrease.
4. Data subject requests. Taking into account the nature of the processing, assist Customer with appropriate measures to respond to requests from data subjects. If we receive a request directly, we will forward it to Customer without undue delay and will not respond except to confirm that we have forwarded it.
5. Assistance. Assist Customer, taking into account the information available to us, with its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation).
6. Breach notification. Notify Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information Customer reasonably needs to meet its own notification obligations, and update that information as it becomes available. Notification is not an admission of fault.
7. Deletion or return. At the end of the Agreement, at Customer's choice, return (through the export features of the Service where available, or by sending a copy in a common machine-readable format on request) or delete Customer Personal Data. Unless Customer exports its data earlier, we delete Customer Personal Data within 30 days of termination, and from backups within a further 30 days, unless the law requires us to keep it.
8. Information and audits. Make available to Customer all information necessary to demonstrate compliance with Article 28 GDPR, and allow for and contribute to audits, including inspections, as set out in Section 7.

5. Subprocessors

1. General authorisation. Customer gives us general written authorisation to engage Subprocessors. Our current Subprocessors are listed in the Subprocessor List, which Customer approves by accepting this DPA.
2. Changes. We will notify Customer of any intended addition or replacement of a Subprocessor at least 30 days in advance, by email to subscribed contacts and by updating the Subprocessor List. Customers can subscribe to updates at privacy@eachlang.com (ask to be added to the subprocessor update list).
3. Objection. Customer may object on reasonable data protection grounds within that period. We will try in good faith to resolve the objection, for example by offering a configuration that avoids the new Subprocessor. If we cannot, Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for the unused period.
4. Flow-down. We will impose on each Subprocessor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, and we remain fully liable to Customer for the performance of each Subprocessor's obligations.
5. Emergency replacement. If a Subprocessor must be replaced urgently for security or availability reasons, we may do so with shorter notice and will inform Customer as soon as possible; the objection right in paragraph 3 still applies.

6. International transfers

6.1 Transfers from the EEA (SCCs, Module 2)

We are located in Türkiye, which has no adequacy decision. To the extent that the processing of Customer Personal Data involves a transfer from the EEA to us, the SCCs, Module Two (controller to processor), are incorporated into this DPA by reference and completed as follows:

Where Customer is itself a processor, Module Three (processor to processor) applies on the same terms. In case of conflict, the SCCs prevail over this DPA. If the European Commission adopts standard contractual clauses that specifically address importers subject to the GDPR under Article 3(2), or replaces the SCCs, we may update this Section to use them.

6.2 Transfers from the United Kingdom

For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force from 21 March 2022) is incorporated by reference. Tables 1 to 3 are completed with the information in Section 6.1 and Annexes I-III; in Table 4, either party may end the Addendum as permitted by its Section 19.

6.3 Transfers from Switzerland

For transfers subject to the FADP, the SCCs apply with these adaptations: references to the GDPR are read as references to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; and "Member State" includes Switzerland so that data subjects in Switzerland can enforce their rights there.

6.4 Türkiye (KVKK)

1. For Customers established in Türkiye, the processing takes place under Article 12 of the KVKK; we are a "veri işleyen" (data processor) and this DPA is the written contract between the parties.
2. Providing the Service involves transferring Customer Personal Data outside Türkiye to the Subprocessors listed in the Subprocessor List, which process it in the countries stated there. These transfers are subject to Article 9 of the KVKK as amended by Law No. 7499 and to the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad (Official Gazette, 10 July 2024, No. 32598). Where we have signed a standard contract announced by the Personal Data Protection Board with a Subprocessor and notified it to the Authority, the Subprocessor List says so. For other Subprocessors, the transfer takes place under the Subprocessor's own data processing terms, and we do not represent that a standard contract or another Article 9 safeguard is in place for that transfer.
3. Customer authorises these onward transfers and will inform its data subjects that their data may be transferred abroad for this purpose. Customer can ask us at privacy@eachlang.com which Subprocessors receive data from Türkiye and on what terms.

6.5 Onward transfers by us

Where a Subprocessor processes Customer Personal Data outside the EEA, UK or Switzerland in a country without an adequacy decision, we ensure an appropriate transfer mechanism is in place, such as the Subprocessor's SCCs (Module Three) or certification under the EU-U.S. Data Privacy Framework.

7. Audits

1. We will answer Customer's reasonable written security and privacy questionnaires once per 12 months and provide available reports and certifications of our main Subprocessors.
2. If that information is not sufficient to demonstrate compliance, or a supervisory authority requires it, Customer may conduct an audit (including an inspection) with at least 30 days' written notice, during business hours, no more than once per 12 months (unless after a breach or a regulator's request), by itself or an independent auditor bound by confidentiality. Customer bears its own audit costs.

8. US state privacy laws (CCPA)

Where we process "personal information" as a "service provider" under the CCPA, we:

1. will not sell or share it;
2. process it only for the business purposes described in Annex I (providing, securing and supporting the Service);
3. will not retain, use or disclose it for any other purpose, including any other commercial purpose, or outside the direct business relationship with Customer, and will not combine it with personal information from other sources except as the CCPA permits;
4. comply with applicable CCPA obligations and provide the same level of privacy protection the CCPA requires of businesses;
5. grant Customer the right to take reasonable steps to ensure that we use the information consistently with Customer's CCPA obligations (through Section 7), and to stop and remediate unauthorised use on notice;
6. notify Customer if we determine we can no longer meet our CCPA obligations; and
7. assist Customer in responding to consumer requests (Section 4.4).

9. Liability

Each party's liability under this DPA is subject to the limitations in the Agreement. This does not limit either party's liability to data subjects under the SCCs or any liability that cannot be limited under Data Protection Laws.

10. Order of precedence and term

In case of conflict: (1) the SCCs (and the UK Addendum), (2) this DPA, (3) the Agreement. This DPA remains in force as long as we process Customer Personal Data.

Annex I: Description of processing

A. List of parties

• Data exporter / controller: Customer, as identified in its account. Contact: account owner's email. Activities: use of the Service to translate and serve its website(s).
• Data importer / processor: Senem Can, Tepebaşı, Eskişehir, Türkiye. Contact: privacy@eachlang.com. Activities: website translation and localisation service.

B. Description of transfer

• Categories of data subjects: (a) visitors to Customer's translated web pages; (b) individuals whose personal data appears in Customer's website content (for example authors, staff, customers named on the site, people posting comments or reviews); (c) Customer's team members and clients invited to the dashboard, where Customer manages their access.
• Categories of personal data: (a) for visitors: IP address, request URL and headers (user agent, accept-language, referrer), timestamps, and language preference; cookies and request bodies (for example form submissions) that pass through the edge network to Customer's origin server in transit only, without being stored or cached. Request bodies (for example form submissions) and the content of pages requested with authentication credentials (for example logged-in account pages) are not sent to AI translation providers; (b) any personal data contained in the website text Customer chooses to translate (for example names, job titles, contact details, public comments); (c) for invited users: name, email, role.
• Sensitive data: Not intended. Customer should exclude pages containing special categories of data from translation using the Service's exclusion settings. If such data is nevertheless included in website text, the measures in Annex II apply.
• Frequency: Continuous, for as long as the Service is used.
• Nature of processing: fetching, parsing, segmenting, machine-translating, storing in translation memory, caching, editing by Customer, serving translated pages, logging and security monitoring.
• Purpose: to provide, secure and support the Service under the Agreement.
• Retention: translation memory and project content for the life of the project, then deleted under Section 4.7; request logs up to 30 days; cached pages until invalidated or for at most 30 days.
• Subprocessors: subject matter, nature and duration as in the Subprocessor List.

C. Competent supervisory authority: as set out in Section 6.1 (Clause 13).

Annex II: Technical and organisational measures

1. Encryption: TLS 1.2+ for all data in transit; encryption at rest provided by our hosting and database providers.
2. Access control: production access limited to the operator; multi-factor authentication on all administrative accounts (hosting, database, code repository, email, payment platform); least-privilege API keys stored in a secrets manager; keys rotated when compromise is suspected.
3. Separation: each Customer's data is logically separated by project and account identifiers; marketing systems are separate from production data.
4. Data minimisation: only text needed for translation is sent to AI providers; pages under paths such as checkout, cart, account, login and admin are excluded by default; Customer can exclude further paths and elements. Request bodies of requests other than GET and HEAD (for example form submissions) and the content of pages requested with authentication credentials (an Authorization header or a cookie outside the project's allow-list) are not sent to the AI translation Subprocessor or any other translation engine, are not written to shared caches, and request bodies are not stored or logged. For such pages only existing translations already held in Customer's translation memory are applied; untranslated text is shown in the original language.
5. AI providers: reached through a routing provider (OpenRouter) that, under its published policy, does not store prompts or responses unless logging is enabled, which we do not enable; requests are routed only to the named model providers' own endpoints, whose published API data policies do not allow training on inputs; zero or minimal retention options used where available.
6. Logging and monitoring: security-relevant events logged and retained for a limited period; alerts on unusual traffic and errors.
7. Resilience: edge infrastructure with automatic failover; if the translation layer fails, the original page is served; regular backups of the product database with tested restore.
8. Vulnerability management: dependencies kept up to date; automated dependency and secret scanning on the code repository.
9. Incident response: documented procedure to assess, contain and notify within the time limits in Section 4.6.
10. Deletion: project and account deletion features; deletion propagated to caches and backups within the periods in Section 4.7.
11. Personnel: anyone given access is bound by confidentiality and receives instructions on handling personal data.

Annex III: Subprocessors

See the Subprocessor List.

Questions about this page? Write to hello@eachlang.com.