Data Processing Agreement
This English text is a translation provided for convenience. Where the Turkish version differs, the Turkish version prevails for users in Türkiye.
1. Roles and scope
For student data (names, numbers, answers, scores) that teachers and schools add to TestMakerPro, the teacher or school is the controller and Pingel is a processor acting on their behalf. For teacher account and payment data, Pingel is the controller.
This agreement sets out Pingel's (processor) obligations under KVKK Art. 12 and GDPR Art. 28 for personal data the Customer (controller) uploads to or processes through the service, and forms an annex to the Service and Subscription Agreement.
2. Subject of processing
Subject: creating, running and reporting exams. Duration: the term of the account/subscription. Data subjects: students (mostly under 18). Data types: name, student number, class, exam answers and scores. No special category data is processed.
3. Pingel's obligations
- Process data only on the Customer's documented instructions (including the service itself and its settings), never for its own purposes.
- Ensure that people with access are bound by confidentiality.
- Implement appropriate technical and organisational measures: encrypted connections, logical separation of customers' data, role-based access rules, backups, minimal administrative access.
- List sub-processors below, notify the Customer before adding one and allow objection, and impose the same protections on them.
- Reasonably assist the Customer with data subject requests and security obligations.
- Notify the Customer of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it.
- On termination, keep data for 30 days for the Customer to export, then delete it (from backups within 35 days).
- Provide the Customer, on request, with information demonstrating compliance.
4. Customer's obligations
- As controller, inform the data subjects (staff, customers, students/parents etc.) and have the required legal basis or consent.
- Enter only the data needed for the purpose; enter special category data only where lawful and necessary.
- Manage user accounts and permissions securely.
5. Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Google Firebase / Google Cloud (Google Ireland Ltd., Google LLC) | Hosting, authentication, database, server functions | EU and/or US data centres |
| Banks | Receiving and verifying bank-transfer payments | Türkiye |
| Google Analytics 4 (Google Ireland Ltd., Google LLC) | Visit statistics — only with your consent | EU and/or US |
6. International transfers
Some sub-processors are outside Türkiye. Transfers rely on appropriate safeguards such as standard contracts and the providers' data processing terms under KVKK Art. 9 and GDPR Chapter V.
7. Entry into force
This agreement takes effect when the Customer electronically accepts the service agreement and remains in force for its term. Institutions needing a signed copy can request one at hasan@pingel.dev.