Data Processing Agreement

1. The Parties

2. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person.
• Processing: Any operation performed on personal data, such as obtaining, recording, storing, retaining, altering, reorganising, disclosing, transferring, classifying, or restricting use.
• Data Controller: The party that determines the purposes and means of processing (the Broker).
• Data Processor: The party that processes personal data on behalf of and on the instructions of the Data Controller (ASTRAL / KeyBrox).
• Sub-processor: A third party authorised by the Data Processor to carry out part of the processing activities.
• Data Subject: The natural person whose personal data is processed.
• Personal Data Breach: The unlawful acquisition, loss, alteration, or unauthorised access of processed personal data.
• Platform: The KeyBrox SaaS application and related API services accessible via keybrox.com.

3. Subject Matter and Scope of Processing

3.1. Categories of Personal Data Processed

3.2. Categories of Data Subjects

• Broker-office agents (employees)
• Broker-office clients (prospective buyers/sellers)
• Property owners (listing providers)
• Visitors (showing participants)

3.3. Purpose of Processing

The Data Processor processes personal data solely for the purpose of providing the Platform service and in accordance with the Data Controller’s written instructions. These purposes are:

• Providing CRM functions (portfolio, matching, messaging)
• Transaction and commission management
• Gamification modules (XP, leaderboard calculation)
• Sending push notifications
• Reporting and analytics (in anonymised/aggregated form)
• Security (panic button, access logs)
• Backup and disaster recovery

4. Processing Instructions

• The Data Processor processes personal data only in accordance with the Data Controller’s written instructions (including the Platform terms of use).
• If the Data Processor considers an instruction to be unlawful, it shall immediately notify the Data Controller.
• The Data Processor may not process personal data for its own purposes beyond the instructions.
• Platform features (gamification, mediation, assist chain) fall within the general processing instruction; the Broker may enable/disable these modules from account settings.

5. Security Measures

The Data Processor implements the following technical and organisational security measures under GDPR Article 32 (and KVKK Article 12 in Turkey):

5.1. Technical Measures

5.2. Organisational Measures

• All personnel sign a confidentiality agreement.
• Annual data-protection awareness training.
• Access-authorisation matrix: least-data principle (need-to-know).
• Data-processing inventory and records system.
• Internal audit every 6 months.
• Off-boarding procedure for departing personnel (immediate access revocation).

6. Sub-processors

6.1. Current Sub-processors

The Data Processor works with the following sub-processors. By accepting this Agreement, the Data Controller grants general authorisation for the use of these sub-processors:

6.2. Adding a New Sub-processor

• Before adding a new sub-processor, the Data Processor notifies the Data Controller at least 30 days in advance via in-platform notice and e-mail.
• The Data Controller may object in writing within 15 days.
• In the event of an objection, the parties seek a reasonable solution; if none is found, the Data Controller may terminate the Agreement.
• The Data Processor signs a written agreement with sub-processors containing security commitments at least at the level of this Agreement.

7. Personal Data Breach Notification

7.1. Notification Timeline

7.2. Notification Content

The breach notification includes the following information:

1. The nature of the breach (access, deletion, alteration, disclosure)
2. The categories of data affected and the estimated number of records
3. The categories of data subjects affected
4. The likely consequences of the breach
5. The measures taken and recommended
6. Contact-person details

7.3. Response Plan

• 0-2 hours: Detect the breach, determine the scope of impact, cut off access.
• 2-24 hours: Notify the Data Controller, initiate forensic investigation.
• 24-72 hours: The Data Controller notifies the relevant supervisory authority; decision on notifying data subjects.
• After 72 hours: Root-cause analysis, implementation of preventive measures, closure report to the Data Controller.

8. International Data Transfers

8.1. Transfer Mechanisms

For transfers of data to countries outside the EU/EEA via sub-processors, the following mechanisms are used:

• EU Standard Contractual Clauses (SCC): The standard clauses approved by the European Commission’s Implementing Decision 2021/914.
• Supplementary Technical Measures: TLS 1.3 encryption in transit, AES-256 in storage, pseudonymisation.
• Transfer Impact Assessment (TIA): The access powers in each sub-processor’s host country (e.g. FISA 702) have been assessed.

For UK transfers the UK IDTA/Addendum applies, and for other jurisdictions equivalent lawful transfer mechanisms are used.

9. Right to Audit

• The Data Controller has the right to audit the Data Processor’s compliance with this Agreement once a year (or following a data breach).
• An audit is requested in writing at least 30 days in advance.
• The audit is conducted during business hours in a manner that does not disrupt the Data Processor’s business continuity.
• The Data Processor may share independent third-party audit reports (SOC 2, ISO 27001) with the Data Controller; by mutual agreement, these reports may replace an on-site audit.
• Audit costs are borne by the Data Controller (except for audits arising from a data breach).

10. Term and Termination

10.1. Term

This Agreement begins on the same date as the Platform membership agreement and remains in effect for as long as the membership continues. Upon termination of the membership agreement, this Agreement automatically terminates.

10.2. Grounds for Termination

• Termination of the Platform membership agreement for any reason.
• A material breach by the Data Processor of its obligations under this Agreement that is not remedied within a 30-day cure period.
• An unresolved objection to a sub-processor change.
• Processing becoming impossible due to a change in legislation.

11. Return and Destruction of Data

11.1. Upon Termination

• Within 30 days of termination, the Data Controller may request the return of its data (in JSON/CSV format) or its destruction.
• If no request is made, the Data Processor irreversibly destroys all personal data 90 days after termination.

11.2. Destruction Methods

• Database records: Permanent deletion (DELETE + VACUUM) or cryptographic erasure (destruction of the encryption key).
• Files (images, documents): Overwrite and deletion at the file-system level.
• Backups: Naturally expire within the backup-cycle period (7 days); additionally, a manual purge is performed.

11.3. Destruction Certificate

Once destruction is complete, the Data Processor sends the Data Controller a written “Data Destruction Certificate” stating the date, method, and scope of destruction.

12. Duty to Cooperate

The Data Processor cooperates with the Data Controller in the following situations:

• Data-subject rights requests (access, erasure, rectification, portability): provides the necessary information within 5 business days at the latest.
• Data Protection Impact Assessment (DPIA): shares the necessary technical information and risk assessment.
• Investigation by the competent data-protection authority or relevant body: provides the requested information and documents in good time.

13. Liability and Indemnity

• The Data Processor indemnifies the Data Controller for damages suffered as a result of conduct contrary to the obligations set out in this Agreement.
• The Data Processor’s maximum liability shall not exceed the total platform fees received in the 12 months preceding the year in which the damage occurred (except in cases of gross negligence and wilful misconduct).
• The Data Controller is responsible for damages arising from incorrect or incomplete instructions.

14. Governing Law and Jurisdiction

15. Contact

16. Annexes

• Annex 1: Details of categories of personal data processed and categories of data subjects (Section 3 of this Agreement).
• Annex 2: Details of technical and organisational security measures (Section 5 of this Agreement).
• Annex 3: List of sub-processors (Section 6.1 of this Agreement — the current list is published via the Platform).
• Annex 4: EU Standard Contractual Clauses (SCC) — copies signed with the relevant sub-processors are provided on request.