Data Processing Agreement

Last updated: 23/10/2026

This Data Processing Agreement (the "Agreement") applies between Armonika Dijital Reklam ve Bilişim Limited Şirketi ("Armonika", the processor) and the business that installs Armonika's Shopify apps in its store (the "Store", the controller), for personal data Armonika processes on the Store's behalf. By installing and using the app, the Store accepts this Agreement. It is based on Article 12 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and Article 28 of the EU General Data Protection Regulation (GDPR).

1. Subject and Duration

Armonika processes personal data to the extent needed to provide the services of the app the Store installed. The Agreement stays in force while the app is installed in the Store and afterwards until the data is deleted.

2. Data and Data Subjects

Data subjects: the Store's customers and the users of the Store's mobile app.

Categories of data (depending on the app): Shopify customer ID, email address, device push token and platform, wishlist, cart contents, back-in-stock requests, order data and notification delivery records. See our Privacy Policy for details: www.armonika.app/en/privacy-policy

3. Purpose and Instructions

Armonika processes personal data only on the Store's documented instructions and for the app's functions. The Store's configuration and use of the app count as instructions. Armonika does not use the data for its own purposes, sell it or share it for advertising.

4. Confidentiality

Armonika ensures that staff with access to personal data are bound by confidentiality, and limits access to those who need it for their work.

5. Security Measures

Armonika takes technical and organisational measures in line with Article 12 of the KVKK and Article 32 of the GDPR:

Encryption in transit (TLS) and at rest; additional AES-256-GCM encryption for access tokens

Encrypted backups and a data loss prevention plan

Database access by the server only and limited staff access

Logging of access to personal data

A written security incident response policy

6. Sub-processors

The Store authorises Armonika to use these sub-processors to provide the service: Amazon Web Services, Google Cloud, Supabase, Vercel, Expo, GitHub and Shopify. Armonika imposes data protection obligations on its sub-processors equivalent to those in this Agreement. When a sub-processor is added, the Privacy Policy is updated; if the Store objects, it may uninstall the app.

7. International Transfers

Some sub-processors operate data centres outside Turkey and the European Economic Area. These transfers are made with safeguards under Article 9 of the KVKK and Chapter V of the GDPR (such as standard contractual clauses).

8. Data Subject Requests

Armonika reasonably assists the Store in answering data subject requests (access, correction, erasure, etc.). Customer data and erasure requests sent through Shopify are applied automatically.

9. Breach Notification

When Armonika becomes aware of a security breach affecting the Store's data, it notifies the Store without undue delay and within 72 hours at the latest, with the nature of the breach, the categories of data affected, and the measures taken and recommended.

10. Deletion and Return

When the Store uninstalls the app, all of the Store's data is deleted on Shopify's shop data erasure notice (48 hours after uninstall). If the Store reinstalls the app within that time, the data is not deleted. The Store may request a copy of its data before then.

11. Audits and Information

On the Store's reasonable request, Armonika provides the information needed to demonstrate compliance with this Agreement.

12. Contact

ARMONIKA DIJITAL REKLAM VE BILISIM LIMITED SIRKETI

Email: support@armonikadijital.com.tr

Phone: +90 850 304 0926