Data Processing Agreement
Version: 4 October 2026
1. Scope and roles
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Simpux Bilişim Ltd. Şti. ("Processor") and the Customer. It applies to personal data the Processor processes for the Customer through the managed EnterpriseBrew service ("Customer Personal Data"). The Customer is the controller (or a processor acting for its own controller); Simpux is the processor within the meaning of GDPR Art. 28 and veri işleyen within the meaning of KVKK Art. 12.
2. Instructions
The Processor processes Customer Personal Data only on the Customer's documented instructions: the Terms, this DPA, and what the Customer configures in the service. It informs the Customer if it believes an instruction infringes data protection law. Where the law requires other processing, the Processor tells the Customer first unless the law forbids it.
3. Details of processing (Annex I)
• Subject matter and purpose: governing, caching and auditing Homebrew package installs on the Customer's computers; vulnerability checks; device inventory; the Customer's administration of all of this. • Duration: the term of the Terms, plus the retrieval and deletion periods below. • Data subjects: the Customer's administrators, developers and other users of its computers. • Personal data: names, usernames and email addresses; computer hostname, serial number, hardware UUID, OS and architecture; installed packages and versions; install, upgrade and removal events with times; IP addresses; directory group memberships received from the Customer's identity provider, MDM or SCIM; facts about the program that ran an install (parent processes, AI-agent markers, whether a terminal was attached); admin action logs; package requests and their justifications. • Special categories: none intended. The Customer does not put special-category data into free-text fields. • Frequency: continuous.
4. Confidentiality
Everyone authorised to process Customer Personal Data is bound by confidentiality.
5. Security (Annex II)
The Processor implements the measures required by GDPR Art. 32 and KVKK Art. 12, including: • tenant isolation of every workspace; • TLS for all traffic; encryption of stored secrets; encrypted backups; • SSO (SAML, OIDC, LDAP), MFA that the Customer can make mandatory, role-based access; • a hash-chained, tamper-evident admin action log; • administrative access to production only over WireGuard, with named personal keys; • hardened servers checked against the CIS Kubernetes Benchmark; vulnerability management of our own dependencies; • point-in-time database recovery and an off-provider disaster-recovery copy; • a documented incident response process. The Processor may improve these measures but will not lower the overall level of protection.
6. Sub-processors
The Customer gives general authorisation to the sub-processors on our Subprocessors page. We announce a new or replaced sub-processor on that page and by email to the workspace owner at least 30 days in advance. The Customer may object on reasonable data protection grounds; if we cannot resolve the objection, the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees. Every sub-processor is bound by obligations at least as protective as this DPA, and we remain responsible for them.
7. Data subject requests
The Processor helps the Customer answer data subject requests, mainly through the portal's export and deletion functions, and forwards any request it receives directly without answering it itself.
8. Assistance
The Processor provides the information the Customer reasonably needs for data protection impact assessments and prior consultations (GDPR Art. 35–36) and for its obligations under GDPR Art. 32–34 and KVKK Art. 12.
9. Personal data breaches
The Processor notifies the Customer without undue delay, and no later than 48 hours after becoming aware of a breach of Customer Personal Data, with what is known about its nature, the data and people affected, likely consequences and the measures taken; it updates the Customer as more becomes known. The Customer remains responsible for notifying the supervisory authority (within 72 hours under GDPR Art. 33; as soon as possible and within 72 hours under KVKK Art. 12(5) and the Board's decision) and data subjects.
10. Deletion and return
At the end of the service the Customer can export its data as described in clause 13 of the Terms. The Processor then deletes Customer Personal Data: the workspace is purged after a 30-day grace period and backups expire within a further 30 days, unless the law requires storage.
11. Audits
The Processor makes available the information needed to demonstrate compliance with this DPA, including its security documentation. The Customer, or an independent auditor bound by confidentiality, may audit once a year with 30 days' notice, during business hours and at its own cost, and additionally after a breach or at a supervisory authority's request.
12. International transfers
• Data region: EU-region data is stored in the EU; Türkiye-region data is stored in Türkiye. • Simpux is established in Türkiye and its staff access EU-region data from there. For that transfer the parties incorporate the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914): Module 2 where the Customer is a controller, Module 3 where it is a processor. Annex I, II and the Subprocessors page of this DPA complete their annexes; clause 7 applies; clause 9 option 2 with the notice in clause 6 of this DPA; clause 13: the supervisory authority of the Customer's establishment; clauses 17 and 18: the law and courts of Ireland. • For UK data the UK International Data Transfer Addendum is incorporated in the same way. • If a Customer subject to KVKK chooses the EU region, transferring the data abroad is the Customer's decision as controller; the parties then sign the standard contract published by the Personal Data Protection Board, and the Customer notifies the Board within five working days (KVKK Art. 9).
13. Liability and precedence
Liability is governed by the Terms. In case of conflict, the Standard Contractual Clauses prevail over this DPA, and this DPA over the Terms.