Data Processing Agreement
Version 1.2.2 · Last Updated: October 3, 2026
Language priority: For the Türkiye region, the Turkish version is the main version. If the English translation differs, the Turkish version controls to the extent permitted by applicable law.
This Data Processing Agreement ("DPA") is presented to all TWS users so that it is available as part of the Service terms. It applies only when a customer, organization, or person determining the purposes and means ("Controller") uses TWS to process personal data and NumLock Soft Yazılım Bilişim Ltd. Şti. ("TWS") processes that data on the Controller's documented instructions. Accepting this DPA does not by itself classify an individual user as a business, organization, data controller, or data processor. It supplements the Terms of Service and does not apply to data for which TWS is the controller, including TWS account, security, support, legal-compliance, and platform-operation processing.
TWS will process Board content only to provide, secure, maintain, support, troubleshoot, and maintain the security and functionality of features used by the customer, to comply with documented instructions, and as required by applicable law. If a legal requirement requires processing beyond the Controller's instructions, TWS will inform the Controller unless prohibited by law.
The subject matter is the hosting and operation of Boards, Cards, forms, files, comments, announcements, notifications, permissions, workflows, exports, APIs, and related collaboration features. Processing continues while the Controller uses the Service and for the limited deletion, backup, security, dispute, and legal-retention periods described in the Privacy Policy. Production database backups are created weekly and are retained for 30 days.
Depending on the Controller's use, data may include identity, contact, account, employment, project, communication, file, access, approval, audit, and other information entered by the Controller or its users. Data subjects may include the Controller's employees, contractors, customers, suppliers, members, and other individuals represented in Board content. The Controller must not place special-category data in the Service unless it has a lawful basis and appropriate safeguards.
TWS will ensure that personnel authorized to process Board content are bound by confidentiality obligations and receive appropriate security instructions.
TWS will maintain measures appropriate to the risk, including password hashing, authenticated and Board-scoped authorization, permission management, two-factor authentication where enabled, signed time-limited file URLs, operational monitoring, access controls, and HTTPS/TLS where deployed. The Controller is responsible for its own user permissions, devices, credentials, and content choices.
The Controller authorizes the following service providers for the stated purposes:
TWS will remain responsible for subprocessors' performance of their processing obligations to the extent required by applicable law. TWS may add or replace subprocessors for legitimate operational reasons. TWS will give at least 30 days' prior notice. The Controller may object on reasonable data-protection grounds; if the parties cannot resolve the objection, the Controller may stop using the affected feature or terminate the affected scope of this DPA.
TWS will not begin a cross-border transfer without an applicable legal transfer mechanism. For transfers to Google Cloud EMEA Limited in connection with Google Workspace, NumLock Soft Yazılım Bilişim Ltd. Şti. and Google have executed the standard contract under Article 9 of the Turkish Personal Data Protection Law. Other transfers will use an applicable adequacy decision, the Personal Data Protection Board's appropriate standard contract, or another permitted safeguard. The parties will provide information and reasonable cooperation required to maintain the mechanism and document the transfer.
Taking into account the nature of the processing, TWS will provide reasonable assistance with data-subject requests, security assessments, and regulatory inquiries. The Controller remains responsible for responding to data subjects and for the lawfulness of its instructions. Requests should normally be sent to the Controller; TWS may direct a request to the Controller or assist as required by law.
TWS will notify the Controller without undue delay and, where reasonably possible, within 48 hours after becoming aware of a personal-data breach affecting the Controller's Board content, to the extent required by applicable law. The notice will include reasonably available information about the incident, affected data, likely consequences, and measures taken or proposed. The Controller is responsible for its own notifications to authorities and individuals unless the parties agree otherwise.
At the Controller's request or at the end of the Service, TWS will make available the export functionality supported by the Service and will delete or return Board content as required by the applicable agreement and law. Backups may retain copies until the normal backup policy or legal retention period ends. The normal period for production database backups is 30 days. TWS may retain data that it must keep as a controller or that is necessary for legal claims, security, audit, or compliance.
TWS will make available information reasonably necessary to demonstrate compliance with this DPA and will cooperate with an appropriate audit request, subject to confidentiality, security, and reasonable cost and frequency limits. Audits must not compromise other customers' data or the security of the Service.
The Controller is responsible for lawful collection and use, notices, legal bases, special-category safeguards, permissions, retention settings available through the Service, user instructions, and the accuracy and legality of its Content. The Controller must not instruct TWS to process data unlawfully. A person accepting this DPA for an organization represents that they have authority to bind that organization. If they do not have that authority, the User accepts this DPA only on their own behalf. This DPA applies to the extent that the User or the organization they represent determines the purposes and means of processing personal data in Board Content.
If this DPA conflicts with the Terms of Service concerning the processing of Board content, this DPA controls for that conflict. Questions and notices may be sent to info@teamworkstation.com.
NumLock Soft Yazılım Bilişim Ltd. Şti.