Data Processing Agreement

1. Roles

The Organisation is the data controller for the personal data processed within the training it provides to its Members. Derin Akademi is the data processor, processing those data on the Organisation's behalf and in accordance with this agreement.
Derin Akademi is a separate data controller for a Member's Platform account, session and security records, purchases made in the Member's own name, and Derin Akademi's two optional purposes (follow-up practice and personal development analysis).

Subject: providing the spoken rehearsal training the Organisation has purchased to its Members.
Data subjects: Members.
Data: name and email address (for people arriving through the API or an LMS, the identity and name the Organisation provides); voice during a rehearsal (processed in real time, not kept); the transcript and the Coach's evaluation; rehearsal usage details (product, case, time, duration, completion, credits).
Duration: for as long as the service relationship between the Organisation and Derin Akademi lasts.

For rehearsals run in the organisation's space, the Organisation sees which product and case a Member practised, when and for how long, whether it was completed, and the credits used. The Organisation's Owner, Admin and Reader roles see these by name; the Billing and Inviter roles see totals only.
The Organisation never sees the rehearsal's analysis or the Coach's evaluation, the transcript or the voice recording. Nothing a Member does in their personal space is shown to the Organisation linked to that Member; credits used in the personal space appear in the Organisation's statement only as a monthly, anonymous total.
So that its Members can practise openly and safely, the Organisation accepts that these data are withheld from it as a standing instruction it gives Derin Akademi, and does not ask for them to be handed over.
If a Member chooses to share a result with the Organisation, the Organisation sees only the case, when it was completed and whether the goal was reached. Sharing and withdrawing a share are up to the Member.

Before they start using the Platform, the Organisation informs its Members: that the Organisation is the data controller; of Derin Akademi and the sub-processors; that during a rehearsal they talk to an artificial intelligence character; that the conversation is recorded and processed; and of the data the Organisation sees and never sees. Derin Akademi provides the Employee Notice Template for this.
The Organisation warrants that this processing rests on a valid legal basis listed in Article 5 of the KVKK. Given the nature of the workplace relationship, the Organisation does not base this processing on its Members' explicit consent.
The Organisation may enter a link to its own disclosure notice in its organisation settings on the Platform; the link is shown to Members on the invitation screen.

It processes the data only on the Organisation's instructions and within this agreement, to provide the training.
It ensures that staff with access to the data are bound by confidentiality, and takes appropriate technical and organisational measures under Article 12 of the KVKK: encryption in transit and at rest, permission-based access and access logging.
It supports the Organisation with applications concerning Members' rights, and erases a Member's data on the Organisation's instruction.
It notifies the Organisation without undue delay on becoming aware of a data breach affecting the Organisation's data.
When the service relationship ends, it erases or anonymises the data according to the Organisation's instructions, subject to retention obligations arising from the legislation.

The Organisation authorises the use of the following sub-processors:

ElevenLabs (USA): spoken rehearsal, transcription of the conversation and evaluation.
Amazon Web Services (Germany, Frankfurt region): hosting, database, file storage and sending email.

These sub-processors process the data abroad. Derin Akademi notifies the Organisation before adding a new sub-processor.