Data processing agreement (summary)

This summary describes the main terms of the data processing agreement (DPA) between Era and the businesses that use it. For the full signed text write to [email protected].

1. Roles

The business is the controller of its customers’ data; Era is the processor within KVKK Article 12 and GDPR Article 28.

2. Processing on instructions

We process data only to provide the service and on the business’s documented instructions; we do not use it for our own purposes or sell it.

3. Confidentiality

Staff with access are bound by confidentiality and access is limited to need.

4. Security measures

• TLS in transit, encryption at rest
• Row-level tenant isolation (each business’s data kept apart)
• Role- and permission-based access, audit logs
• Regular backups and restore tests
• Key-only SSH, firewalls, automatic security updates

5. Subprocessors

The current list is on our Subprocessors page; you may object to changes.

6. Breach notification

We inform the business without undue delay and within 48 hours of becoming aware of a breach, so it can meet its 72-hour notification duty.

7. Data subject requests

We help the business answer its customers’ requests with export and deletion tools.

8. End of contract

After termination the business can export its data for 30 days; then it is deleted, and removed from backups within their rotation period.

9. Audit

Once a year, with reasonable notice, we provide information and documents showing our compliance.