Data Processing Agreement

Last updated: 27 October 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you, the store owner ("Controller"), and Origela ("Processor"). It applies to personal data that we process on your behalf when providing the Origela Service, and is intended to meet Article 28 GDPR, the UK GDPR and article 12 of the Turkish Personal Data Protection Law No. 6698 (KVKK). You accept it together with the Terms at signup. On matters of data protection this DPA prevails over the Terms; however, for liability, limitation of liability and indemnity the Terms (sections 12, 13 and 14) always apply.

Under this DPA Origela acts only as processor, and you are the controller of your customers' personal data. You decide the purposes and means of the processing.

1. Subject, duration and nature

• Subject: hosting and operating your online store.
• Duration: the term of your subscription plus the deletion period in section 10.
• Nature and purpose: storage, backup, display, transmission (for example order emails) and other processing needed to run the store as you configure it.
• Data subjects: your customers, newsletter subscribers, visitors and staff users.
• Categories of data: identity and contact data, delivery and billing addresses, order history, account data, consent records, support messages, technical data such as IP addresses. You should not store special categories of data (such as health data) unless the law allows it and you have assessed it.

2. Your responsibilities as controller

You decide which personal data your store processes and why. You are responsible for having a legal basis for that processing, for informing your customers (privacy notice, cookie notice), for collecting any consents and commercial-message permissions, for registering with any public registry that applies to you (such as VERBİS in Türkiye), for answering data subject requests, and for notifying breaches to authorities and data subjects where the law requires it. Your instructions to us must comply with the law.

3. Your instructions

We process personal data only on your documented instructions, which are the Terms, this DPA and your settings in the store panel, unless the law requires otherwise; in that case we tell you first unless the law forbids it. If we believe an instruction breaks data protection law, we inform you and may suspend that processing. We do not use store data for our own purposes, and we do not sell it.

4. Confidentiality

Everyone at Origela who can access store data is bound by confidentiality and accesses data only when needed, for example to operate the platform or to fix a problem you reported.

5. Security measures

We implement the technical and organisational measures that we consider appropriate, taking into account the state of the art, the cost of implementation, the nature and price of the Service and the risks involved. They currently include, for example:

• separate database per store; encrypted connections (TLS);
• access control with roles, two-factor authentication and logging of administrative actions;
• secrets such as payment keys stored encrypted;
• security headers (content security policy), CSRF protection, parameterised database queries;
• a web application firewall and protection against denial-of-service attacks through our network provider;
• best-effort backups, security updates applied centrally, periodic security reviews.

These measures describe our approach; because no system is completely secure, they are not a guarantee that data will not be lost or accessed without authorisation (section 10 of the Terms). We may update these measures as long as the overall level of protection is not materially reduced. As controller, you assess whether these measures are adequate for your processing. You are responsible for the security of your own accounts, staff access and connected services (section 4 of the Terms).

6. Sub-processors

You give us general authorisation to use sub-processors. We bind each of them by written contract to data protection obligations that offer the same level of protection as this DPA, and we remain responsible to you for their performance to the extent the law requires and within the limits of section 12. We list sub-processors below by category; on request we tell you the names of the current providers. We inform you by email or in the panel at least 14 days before adding or replacing a sub-processor; where an urgent change is needed for security or continuity of the Service, we make it at once and inform you without delay. You may object on reasonable data protection grounds; if we cannot resolve the objection, you may terminate the subscription before the change takes effect and receive a pro-rata refund of the unused period, which is your sole remedy for the change.

Banks, Wise and online payment providers through which you pay your subscription process your own billing data as independent controllers and are not sub-processors for store data. Services you connect to your store yourself (payment providers, AI providers, analytics, advertising, shipping) are your own processors or independent controllers, not our sub-processors.

7. International transfers

Where store data is transferred outside Türkiye, the EU or the UK, we ensure appropriate safeguards: adequacy decisions, the EU Standard Contractual Clauses, or the safeguards required by article 9 of KVKK, such as the Board's standard contract with the required notification. You authorise the transfers needed to use the sub-processors above.

8. Helping you

As controller, you answer data subject requests. The store panel lets you do this yourself (view, correct, export and delete customer data, consent records). If we receive a request directly, we forward it to you and do not answer it ourselves unless you instruct us to. Where you need more help, for example with a data protection impact assessment, prior consultation or a request from an authority, we assist you to a reasonable extent; assistance that requires significant work may be charged at a rate we agree with you in advance.

9. Personal data breaches

We notify you without undue delay after becoming aware of a personal data breach affecting your store, so that you can meet your own notification duties (to the Personal Data Protection Board in Türkiye and to the competent authority under GDPR, generally within 72 hours). Our notice describes, as far as known at the time, the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences and the measures taken or proposed; further information follows as it becomes available. We take reasonable steps to contain the breach. Unless the law requires otherwise, notifying the Board, supervisory authorities and data subjects is your obligation as controller; we do not notify on your behalf. A notification is not an admission of fault or liability.

10. Deletion and return

While the store is active or suspended, you can export your data at any time. When the subscription ends or the store is suspended, we keep the store data for 60 days, then delete it; backups are overwritten in their normal rotation. Data we must keep by law is kept for the period the law requires and protected by this DPA until it is deleted.

11. Audits

We provide the information reasonably needed to demonstrate compliance with this DPA, such as a description of our security measures and the list of sub-processors. Audits beyond that are possible for a reasonable cause and at most once a year, with 30 days' written notice, during business hours, at your cost (including the reasonable time we spend), by an auditor bound by confidentiality, and without access to other customers' data or to information that would compromise the security of the platform. Audits ordered by a supervisory authority are always possible.

12. Liability

• Origela's liability under or in connection with this DPA is subject, to the maximum extent permitted by law, to the cap (no more than one annual subscription fee, currently $99), limitations and exclusions in sections 12 and 13 of the Terms of Service. Claims under this DPA share the single cap in the Terms; they do not create a separate or additional cap.
• You pay data subject claims, administrative fines of the Personal Data Protection Board or other supervisory authorities, and related costs (including legal fees) brought against Origela because you breached your obligations as controller, gave unlawful instructions, or failed to inform data subjects or obtain the permissions required from them (section 14 of the Terms).
• This section does not limit any party's liability to data subjects or to supervisory authorities where the law does not permit it.

13. Contact

Privacy contact: hello@origela.com. Origela, Türkiye.