Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Mathome Yazılım Eğitim Danışmanlık Sanayi ve Ticaret Limited Şirketi (“Zivdeo”, “Processor”) and the customer (“Customer”, “Controller”). It applies automatically, without signature, whenever Zivdeo processes Customer Personal Data.

“Customer Personal Data” means personal data contained in the Inputs, Outputs, brand details and webhook metadata the Customer submits or receives through the Service. “Data Protection Law” means all laws on the processing of personal data that apply to that data, including the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, US state privacy laws such as the California Consumer Privacy Act (“CCPA”), and the Turkish Law on the Protection of Personal Data No. 6698. Terms such as controller, processor, data subject and personal data breach have the meanings given in the GDPR.

The Customer is the controller and Zivdeo is the processor of Customer Personal Data. Zivdeo is a controller only for the account, billing and technical data described in its Privacy Policy.

The Customer is responsible for the lawfulness of the Customer Personal Data and of its instructions, including having a legal basis and any consent needed to submit images of identifiable people, giving data subjects the required information, and not submitting special categories of personal data (such as health data) unless the Customer has a valid legal basis and has assessed that the Service is appropriate for it.

Zivdeo processes Customer Personal Data only on the Customer’s documented instructions. The Terms, this DPA and the Customer’s use of the Service (each generation, revision, deletion and configuration) are the Customer’s complete instructions. Zivdeo will tell the Customer if it believes an instruction infringes Data Protection Law, and is not obliged to follow it. Processing required by law is excepted; Zivdeo will tell the Customer about that requirement unless the law forbids it.

The subject matter, nature, purpose and duration of the processing are described in the annex section below.

Zivdeo ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality, and implements the technical and organisational measures described below, which it may update provided the overall level of protection does not decrease.

The Customer gives Zivdeo general authorisation to engage sub-processors. Zivdeo’s sub-processors fall into the categories listed below; the current list of named sub-processors, their locations and transfer safeguards is available on request at support@zivdeo.com.

Zivdeo will give at least 14 days’ notice of a new sub-processor to Customers who ask to be notified at that address. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may close its account and receive a refund of its unused paid balance, which is its sole remedy. Zivdeo imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains liable for its sub-processors’ performance.

Taking into account the nature of the processing, Zivdeo will assist the Customer by appropriate technical and organisational measures in responding to data subjects exercising their rights, and with security, breach notification, data protection impact assessments and prior consultations. If Zivdeo receives a request directly from a data subject concerning Customer Personal Data, it will refer the data subject to the Customer and not respond itself except to confirm the referral.

Zivdeo will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Zivdeo will take reasonable steps to contain the breach and will supplement the notice as information becomes available. A notice is not an acknowledgement of fault.

The Customer can download its Outputs from its library at any time and delete content by request. When the Customer closes its account, or on its request, Zivdeo deletes Customer Personal Data within 30 days, except where the law requires it to keep data; residual copies in backups are overwritten within a further 90 days and remain protected under this DPA until then.

Zivdeo will make available the information reasonably necessary to demonstrate compliance with this DPA, including written answers to security questionnaires and its sub-processors’ available audit reports. If that information is not sufficient, or a supervisory authority requires it, the Customer may audit Zivdeo once in any twelve-month period, on at least 30 days’ notice, during business hours, at its own cost, through an independent auditor bound by confidentiality, and without access to other customers’ data.

Zivdeo is established in Türkiye and its sub-processors process data in the United States and other countries. Where the Customer’s use of the Service involves a transfer of personal data subject to the GDPR to Zivdeo in a country without an adequacy decision, the parties enter into the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (“SCCs”), which are incorporated by reference, as follows:

• Module Two (controller to processor) applies; where the Customer is itself a processor, Module Three (processor to processor) applies;
• the Customer is the data exporter and Zivdeo the data importer; the annexes are completed by the sections of this DPA;
• Clause 7 (docking clause) applies; Clause 9 uses Option 2 (general authorisation) with the notice period in the sub-processor section above; the option in Clause 11 does not apply;
• Clause 13: the competent supervisory authority is that of the Member State where the Customer is established or, if it is not established in the EU, where its EU representative is;
• Clauses 17 and 18: the SCCs are governed by the laws of Ireland and disputes under them are resolved by the courts of Ireland.

For transfers subject to the UK GDPR, the International Data Transfer Addendum issued by the UK Information Commissioner applies, with its tables completed by the SCC choices above and either party able to end it as its section 19 allows. For transfers subject to Swiss law, the SCCs apply with the Swiss Federal Data Protection and Information Commissioner as competent authority and references to the GDPR read as references to Swiss law. Onward transfers to sub-processors are covered by the SCCs or another lawful transfer mechanism.

To the extent the CCPA or similar US state laws apply, Zivdeo is the Customer’s service provider or processor. Zivdeo will not sell or share Customer Personal Data; will not retain, use or disclose it for any purpose other than providing the Service under the Terms, or outside the direct business relationship with the Customer; will not combine it with personal data from other sources except as those laws permit; and will notify the Customer if it can no longer meet these obligations. Zivdeo certifies that it understands and will comply with these restrictions.

Each party’s liability under this DPA is subject to the limitations in the Terms, except where the SCCs or Data Protection Law do not allow such a limitation. If this DPA conflicts with the Terms, this DPA prevails; if it conflicts with the SCCs, the SCCs prevail. This DPA ends when Zivdeo no longer processes Customer Personal Data.

• Data exporter / controller: the Customer, as identified by its account; contact: the account owner’s email address; role: controller (or processor for its own clients).
• Data importer / processor: Mathome Yazılım Eğitim Danışmanlık Sanayi ve Ticaret Limited Şirketi, Gebze OSB Mah. Kemal Nehrozoglu Cad. No: 507/9 İç Kapı No: Z01, Gebze / Kocaeli, Türkiye; contact: support@zivdeo.com; role: processor.
• Data subjects: people shown in or identified by Customer Inputs and Outputs (for example the Customer’s staff, clients and visitors), people whose contact details appear in the Customer’s brand details, and the Customer’s users who capture photos with Zivdeo’s capture tools.
• Categories of data: images and likeness, names, business contact details and other information the Customer chooses to submit; for photos captured with Zivdeo’s capture tools, a capture record per photo (device model, operating system, lens, capture time and timings, camera pitch and roll, on-device check values, whether a vehicle was detected in the frame and how confident the detection was, how far the phone moved between photos, a rough outline of the vehicle computed on the phone, the camera’s field of view and estimated height, the horizon angle, a light-direction estimate, and a candidate plate area, camera settings at the shutter, retake count, skip reason), the vehicle-outline mask image the app may send with a photo, and the capturing user’s identifier from the Customer’s own system. Capture records never contain a location or an image.
• Sensitive data: none intended. The Customer must not submit special categories of data unless permitted as described above.
• Frequency: continuous, for each generation the Customer requests.
• Nature and purpose: storing, analysing with AI models, editing and rendering images, automated quality review and delivery of marketing media to the Customer, plus support and security.
• Duration and retention: for the term of the Customer’s account and until deletion as described above. Captured photos are Inputs and kept the same way; uploads that are never finished are deleted 7 days after their last data arrived.

• Encryption of data in transit (TLS) and at rest by our infrastructure providers.
• Access to production data limited to authorised personnel using individual, strongly authenticated accounts.
• Customer data isolated per organisation; client applications cannot write to the database directly.
• API keys stored only as one-way hashes; webhooks signed with HMAC-SHA256; webhook targets restricted to public HTTPS endpoints.
• Files delivered through long, unguessable links; storage rules deny listing and direct client access.
• Photos uploaded through capture sessions are stripped of EXIF and location metadata on Zivdeo's servers before they are stored.
• Data sent to AI providers limited to what each request needs; provider-side retention switched off where the provider allows it.
• Logging of processing events and infrastructure access; incidents are investigated and handled under the breach notification commitments above.
• Selection of sub-processors with established security programmes and data processing terms.

• Cloud infrastructure: hosting, database, file storage, task queues and authentication (United States).
• AI image models and inference platforms: rendering, editing, background removal, upscaling and segmentation (United States).
• Large language model providers: creative planning and automated review (United States).
• Email and support tooling (United States or the EU).