Legal
Data processing agreement
Last updated: 16 October 2026
This agreement governs the processing of personal data by Emre Akdemir, trading as Lyconiq, Istanbul, Türkiye ("Lyconiq" or the "Processor") on behalf of the customer organisation (the "Controller") in the İZAN Server cloud service, under Art. 28 of the EU General Data Protection Regulation (GDPR) and Art. 12 of Turkish Law No. 6698 (KVKK). It is an annex to the commercial licence and subscription agreement between the parties (the "Main Agreement").
1. Roles
In the cloud service the Customer is the controller and Lyconiq the processor. In an on-premises installation the software sends Lyconiq no data and Lyconiq processes no personal data; anything the Customer chooses to share for support is used only for that request and deleted afterwards.
2. Subject and scope
Lyconiq processes personal data only to provide, secure and back up the service, to give support and to count licences under the Main Agreement. The data processed is listed in the product document that names every record a bridge may send ("What a bridge sends"): numbers, durations, states, costs, gate decisions and pseudonymous ids. Prompts, source code, file contents and transcripts are not processed.
3. Instructions
Lyconiq processes data only on the Controller’s documented instructions and informs the Controller if it believes an instruction breaks the law.
4. Confidentiality
Lyconiq ensures that people with access to the data are bound by confidentiality.
5. Security
Lyconiq applies industry-standard technical and organisational measures to protect the data.
6. Sub-processors
The Controller gives general authorisation for Lyconiq to use sub-processors for the service. Lyconiq gives notice of a new sub-processor in advance and the Controller may object on reasonable grounds. Lyconiq imposes obligations on sub-processors equivalent to those in this agreement.
7. Data subject requests
Lyconiq gives the Controller reasonable help in answering data subject requests and forwards any request it receives.
8. Personal data breaches
Lyconiq notifies the Controller without undue delay after becoming aware of a personal data breach and gives reasonable help with the Controller’s notification duties.
9. Audits
On reasonable request Lyconiq makes available the information needed to demonstrate compliance and contributes to audits that are announced in advance and reasonable in scope.
10. International transfers
Transfers of personal data abroad rely on safeguards that meet Chapter V of the GDPR and Art. 9 of the KVKK.
11. Term, return and deletion
This agreement runs for the term of the Main Agreement. When the Main Agreement ends, Lyconiq lets the Controller export its data and then deletes the personal data within a reasonable time, except where the law requires it to be kept. Copies in backups are deleted in the normal backup cycle.
12. Liability
Liability under this agreement is subject to the limits in the Main Agreement. Liability towards data subjects under mandatory law is unaffected.
13. Law and venue
Turkish law applies. The courts and enforcement offices of Istanbul (Çağlayan), Türkiye, have jurisdiction.
For a signed copy: admin@lyconiq.io.