Data Processing Addendum

This Data Processing Addendum (“DPA”) is part of the Terms of Service between you (“Customer”) and Berkay Öçgüder, an individual based in Türkiye who runs the Service under the name Appsium (“Appsium”). It applies automatically, without signature, whenever Appsium processes Customer Personal Data on your behalf. If you need a countersigned copy for your records, email support@appsium.io.

1. Definitions

• Data Protection Laws: the laws on personal data that apply to the processing under this DPA, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and US state privacy laws.
• Customer Personal Data: personal data in the content you add to, connect to or generate in the Service, for which you are the controller (or a processor for someone else), as described in Annex 1.
• Sub-processor: a third party Appsium engages to process Customer Personal Data.
• SCCs: the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914.
• UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner, version B1.0.
• “Controller”, “processor”, “data subject”, “personal data”, “processing” and “personal data breach” have the meanings in the GDPR, and include the equivalent terms in other Data Protection Laws (such as “veri sorumlusu” and “veri işleyen” under the KVKK, and “business” and “service provider” under US state laws).

2. Scope and roles

2.1 For Customer Personal Data, you are the controller (or a processor acting for your own client) and Appsium is your processor (or sub-processor). Appsium processes it only to provide the Service to you.

2.2 This DPA does not apply to personal data for which Appsium is an independent controller, as described in the Privacy Policy. That includes account and sign-in data, billing and usage records, security and log data, support correspondence, analytics, and the public App Store data that Appsium collects for all customers.

2.3 Paddle sells subscriptions as Merchant of Record and is an independent controller of payment data. Apple is an independent controller of the data in App Store Connect and Apple Ads. Neither is a Sub-processor of Appsium.

3. Your instructions

3.1 Appsium processes Customer Personal Data only on your documented instructions. The Terms, this DPA, your settings and your use of the Service's features are your complete instructions. This includes transfers to the Sub-processors and countries listed on the Sub-processors page.

3.2 Using an AI feature, sending an alert to Slack, or connecting an AI assistant through the MCP server is an instruction to send the data that feature needs to the provider concerned.

3.3 If the law requires Appsium to process Customer Personal Data in another way, Appsium will tell you before doing so unless the law forbids it. Appsium will tell you if it believes an instruction breaks Data Protection Laws, and may pause that processing until you confirm or change the instruction.

3.4 Appsium does not sell Customer Personal Data, does not share it for advertising, does not combine it with data from other customers for its own purposes, and does not use it for anything other than providing the Service to you. Appsium does not use Customer Personal Data to train AI models.

4. Your obligations

4.1 You are responsible for having a legal basis for the Customer Personal Data you bring into the Service, for giving data subjects the notices the law requires, and for the accuracy and lawfulness of your instructions.

4.2 The Service is not designed for special categories of personal data, data about criminal convictions, payment card data or data about children. Do not upload such data. Free-text App Store reviews may occasionally contain such information written by the reviewer; Appsium processes it only as part of the review text.

4.3 You are responsible for the security of your own account, tokens, API keys and the integrations you connect.

5. Confidentiality

Appsium ensures that anyone it authorises to process Customer Personal Data is bound by a duty of confidentiality and accesses the data only when needed to provide or support the Service.

6. Security

Appsium applies the technical and organisational measures described in Annex 2, which are designed to give a level of security appropriate to the risk. Appsium may update the measures as long as the overall level of protection does not decrease.

7. Sub-processors

7.1 You give Appsium general authorisation to engage Sub-processors. The current list is at appsium.io/subprocessors.

7.2 Appsium binds each Sub-processor by a written contract with data protection obligations that are in substance no less protective than this DPA, and remains responsible to you for each Sub-processor's performance.

7.3 Appsium will update the Sub-processors page at least 30 days before a new Sub-processor starts processing Customer Personal Data. The page shows the date of its last change, and that update is the notice to you; please check it from time to time. In an emergency that threatens the security or availability of the Service, Appsium may replace a Sub-processor sooner and will tell you without delay.

7.4 You can object on reasonable data protection grounds within 30 days of the update by emailing support@appsium.io. We will discuss your concern in good faith. If we cannot offer a reasonable alternative within 30 days, you may cancel the affected paid plan and receive a refund of prepaid fees for the unused period.

8. Data subject requests

The portal lets you view, export, correct and delete most Customer Personal Data yourself. If a data subject contacts Appsium about Customer Personal Data, Appsium will not answer the request itself, except to tell the person to contact you, and will forward the request to you without undue delay. Taking the nature of the processing into account, Appsium will give you reasonable help to respond to requests you cannot handle through the portal.

9. Help with your compliance

Taking into account the nature of the processing and the information available to it, Appsium will give you reasonable help with data protection impact assessments, consultations with supervisory authorities and your security obligations, to the extent they relate to the Service.

10. Personal data breaches

10.1 Appsium will notify you without undue delay, and at the latest within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice goes to the email address on your account.

10.2 The notice will describe, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Appsium may provide information in stages as it becomes available.

10.3 Appsium will take reasonable steps to contain and remedy the breach and will cooperate with you so you can meet your own notification duties. A notice is not an admission of fault or liability.

11. Return and deletion

11.1 During the term you can export or delete Customer Personal Data in the portal or by asking us.

11.2 When your account is closed, Appsium deletes Customer Personal Data within 30 days, unless you ask for a copy first within that period or the law requires Appsium to keep it. Copies in backups are overwritten within a further 14 days and are not used for any other purpose in the meantime.

11.3 On request Appsium will confirm in writing that deletion is complete.

12. Information and audits

12.1 Appsium will make available the information reasonably needed to show that it complies with this DPA, including answers to a written security questionnaire once per year.

12.2 If that information is not enough to meet your obligations under Data Protection Laws, or a supervisory authority requires it, you may carry out an audit, yourself or through an independent auditor bound by confidentiality. Audits take place at most once per year, on at least 30 days' written notice, during business hours, remotely where possible, and without access to other customers' data or to systems Appsium does not control. Appsium's infrastructure providers do not allow customer access to their data centres; their independent audit reports serve in place of on-site inspection.

12.3 You bear the cost of an audit, including Appsium's reasonable costs if the audit takes more than one working day, unless the audit shows a material breach of this DPA by Appsium.

13. International transfers

13.1 Location. Appsium stores Customer Personal Data in the European Union (Google Cloud, Belgium). Appsium is established in Türkiye and accesses the data from there. Some Sub-processors process data in the United States, as shown on the Sub-processors page.

13.2 Transfers from the EEA. Where you transfer Customer Personal Data that is subject to the GDPR to Appsium, the SCCs are incorporated into this DPA and apply as follows:

• Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) where you are a processor;
• Clause 7 (docking clause) does not apply;
• in Clause 9, Option 2 (general written authorisation) applies, with the notice period in section 7.3 of this DPA;
• in Clause 11, the optional language does not apply;
• in Clause 17, Option 1 applies and the SCCs are governed by the law of Ireland; in Clause 18(b), disputes are resolved before the courts of Ireland;
• Annex I of the SCCs is completed with Annex 1 of this DPA, with you as data exporter and Appsium as data importer; the competent supervisory authority is the one determined under Clause 13; Annex II is completed with Annex 2 of this DPA; Annex III with the Sub-processors page.

13.3 Transfers from the UK. For Customer Personal Data subject to the UK GDPR, the SCCs apply as amended by the UK Addendum, which is incorporated into this DPA. Tables 1 to 3 of the UK Addendum are completed with the information in sections 13.2 and the Annexes of this DPA, and in Table 4 neither party may end the UK Addendum under its section 19.

13.4 Transfers from Switzerland. For Customer Personal Data subject to Swiss law, the SCCs apply with these changes: references to the GDPR mean the Swiss Federal Act on Data Protection; the supervisory authority is the Swiss Federal Data Protection and Information Commissioner; and data subjects in Switzerland may bring claims in their place of habitual residence.

13.5 Transfers subject to Turkish law. Where the KVKK applies to a transfer of Customer Personal Data abroad, the parties will rely on a mechanism permitted by Article 9 of the KVKK. On your request Appsium will sign the relevant standard contract published by the Personal Data Protection Board, so that you can notify it to the Board.

13.6 Onward transfers. Appsium transfers Customer Personal Data to Sub-processors outside the EEA, the UK or Switzerland only under the SCCs, an adequacy decision or another mechanism permitted by Data Protection Laws.

13.7 Requests from authorities. If Appsium receives a legally binding request from a public authority for Customer Personal Data, it will tell you unless the law forbids it, will challenge requests that appear unlawful, and will disclose only the minimum required.

13.8 If the SCCs conflict with the rest of this DPA or the Terms, the SCCs prevail.

14. Liability

Each party's liability under this DPA is subject to the limits and exclusions in the Terms. Nothing in this DPA limits the rights of data subjects under the SCCs or Data Protection Laws, or either party's liability to them.

15. Term, changes and precedence

15.1 This DPA applies for as long as Appsium processes Customer Personal Data and ends when that data has been deleted.

15.2 Appsium may update this DPA to reflect changes in the law, in the Sub-processors or in the Service. Changes that reduce your protection are notified as a material change under the Terms.

15.3 If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails. Apart from the SCCs, this DPA is governed by the law and courts named in the Terms.

Annex 1: Details of processing

Annex 2: Technical and organisational measures

Annex 3: Sub-processors

The list of Sub-processors authorised under section 7, with their purpose and location, is published at appsium.io/subprocessors.