Data Processing Agreement
Last updated:
This Data Processing Agreement ("DPA") applies whenever an agency (the "Customer") uses ClientReportly to handle personal data about its own clients ("Client Data"). It follows Article 28(3) of the GDPR and the rules for processors in the Turkish Personal Data Protection Law (6698).
Parties: the Customer (the agency that accepted the Terms of Service) and Ömer Aydoğdu, a sole proprietorship in Türkiye, Yenikent Mahallesi, Nefise Sokak No:19, Odunpazarı/Eskişehir, Türkiye ("Processor"). Contact: support@clientreportly.com.
Version: 2026-11-05, the same version as the Terms of Service. This DPA forms an integral part of the Terms of Service and is accepted when an account is created.
1. Roles and scope
For Client Data the Customer is the controller and the Processor is the processor. The details are in Annex I. For data about the Customer's own users (account, billing, security) the Processor is a controller under the Privacy Policy, and this DPA does not apply.
2. Processor commitments
- Instructions. The Processor processes Client Data only on the Customer's documented instructions, which are the Terms of Service, this DPA and the Customer's use of the product's features. The Processor tells the Customer if it believes an instruction breaks the law.
- Own use. The Processor does not use Client Data for its own purposes, does not sell it and does not combine it with other data.
- Confidentiality. Access to Client Data is limited to the operator, who is bound by confidentiality. Anyone else who is later given access is bound by a written confidentiality undertaking before access is granted.
- Security. The Processor applies the measures in Annex II and keeps them appropriate to the risk.
- Operator access. Server and database access is limited to the operator, and only when needed to run, secure or repair the service, or to carry out a Customer request or a deletion.
- Assistance. Taking the nature of the processing into account, the Processor helps the Customer answer requests from data subjects, and helps with security, breach notification, impact assessments and prior consultation, as far as the Processor's information allows.
3. Customer responsibilities
The Customer has a lawful basis for the data it enters and informs its clients, as the law requires, that it uses ClientReportly. The Customer keeps the data accurate and enters no special categories of personal data (health, biometric, political, religious and similar) unless the law allows it and the Customer takes responsibility for it. The Customer chooses who receives portal links and whether to protect a portal with a PIN.
4. Sub-processors
The Customer gives general authorisation for the sub-processors in Annex III. The Processor binds each of them by written terms with data protection duties no weaker than these. The Processor announces a new or replacement sub-processor by email or in the app at least 30 days before it starts processing Client Data. The Customer may object on reasonable data protection grounds within that period; if the parties cannot agree, the Customer may end the subscription. The Processor remains responsible for its sub-processors.
5. Personal data breach
The Processor notifies the Customer of a breach affecting Client Data without undue delay and, where possible, within 72 hours of becoming aware of it, by email to the account owner. The notice states what is known: the nature of the breach, the data and people affected, likely consequences and measures taken. The Customer decides whether to notify authorities and data subjects.
6. Return and deletion
During the subscription the Customer can delete clients, projects, files and reports in the app; deleted client records are permanently destroyed within 30 days. A deletion request made from the account settings closes the account immediately, and the Processor deletes the Client Data that is left within 14 days of the Customer's confirmed deletion request: destruction follows 14 days after the account owner confirms the request by email, the owner can cancel it during that period, and an unconfirmed request expires after 7 days. Ending the subscription does not by itself delete Client Data. On request, the Processor provides an export of Client Data in a common format; today such requests are handled manually within 30 days. Encrypted backups are deleted within 30 days. The Processor keeps data longer only where the law requires it and tells the Customer.
Where the Customer has connected a project management tool, removing that connection deletes the tokens stored for it and every board mapping of that Customer together with the cached stage summary, which is where task titles are held. The Processor also tries to unregister the change-notification subscriptions it created at the tool and, with a provider that offers it, to end the authorization at the provider: Asana and Notion do, and Trello's API has no equivalent, so a Trello permission remains in the Customer's own Trello account until the Customer removes it there. With Notion there is no change-notification subscription of the Processor's own to unregister, and the project filter stored with a Notion mapping is deleted with that mapping. PDF reports generated earlier keep the task titles printed into them and are deleted with the reports themselves; the backup period above applies.
7. Audit and information
The Processor gives the Customer the information needed to show compliance: this DPA, Annex II and the sub-processor list. The Customer may audit once a year, on 30 days' written notice, during business hours, at its own cost and without access to other customers' data.
8. International transfers
Client Data is stored on servers in the EU (France). The Processor operates from Türkiye and can reach the data from there. Where needed the parties rely on adequacy decisions, on the EU-US Data Privacy Framework for certified US providers, or on standard contractual clauses. For data subjects in Türkiye, the information required by Article 9 of the Turkish Personal Data Protection Law (6698) is in the Turkish KVKK notice (Aydınlatma Metni). The Processor does not move Client Data to other countries without notice under section 4.
9. Liability, term and law
Liability follows the Terms of Service. This DPA lasts as long as the Processor handles Client Data for the Customer. Governing law and courts follow the Terms of Service. If this DPA conflicts with the Terms of Service on data protection, this DPA prevails.
Annex I. Details of the processing
| Item | Detail |
|---|---|
| ItemSubject | DetailProviding a client portal and PDF reports for the Customer's own clients |
| ItemDuration | DetailThe subscription, plus the deletion period in section 6 |
| ItemNature | DetailStorage, display in the portal, PDF generation, email notification, deletion |
| ItemPurpose | DetailTo give the Customer's clients access to projects, files, reports and approvals |
| ItemData subjects | DetailThe Customer's clients, their staff and portal visitors |
| ItemPersonal data | DetailNames, email addresses, company names, project names and descriptions, report text, uploaded file contents and names, approval notes, activity entries, and — where the Customer chooses to connect a project management tool (today Trello, Asana or Notion) — the titles of the tasks or rows in the lists, sections or databases it mapped and, with Notion, the project filter value it typed, which can be the name of a client or of a project; and portal access metrics (the number of times a project's portal link has been opened and the time it was last opened; no IP address, browser or device data) |
| ItemSpecial categories | DetailNone intended; not permitted (section 3) |
| ItemFrequency | DetailContinuous while the subscription is active |
Annex II. Technical and organisational measures
| Area | Measure |
|---|---|
| AreaTransport | MeasureHTTPS with HSTS (one year) |
| AreaPasswords | Measurebcrypt hashes; minimum 8 characters |
| AreaTokens | MeasureSign-in, verification and invitation tokens stored as hashes, single use; refresh-token rotation with replay detection |
| AreaIntegration secrets | MeasureAccess and refresh tokens of a connected project management tool, and the signing secret of a change-notification subscription, each encrypted with AES-256-GCM with a random IV per record |
| AreaAccess control | MeasureLayered checks: sign-in, verified email, active subscription, role; the portal uses a separate guard |
| AreaTenant separation | MeasureEvery query is scoped to the agency; a portal session is bound to one project and checked on every request |
| AreaSessions | MeasureAccess token 15 minutes; refresh token 7 days (httpOnly, secure, SameSite=Lax); portal session 2 hours |
| AreaAbuse protection | MeasureBaseline limit of 120 requests per minute per IP per route; authentication routes and the portal PIN are limited far more tightly (as low as 5 per minute); account lock for 15 minutes after 10 failed sign-ins; portal PIN lock after repeated failures |
| AreaLogging | MeasureNo request bodies, headers or secrets; secrets and portal or invitation tokens are redacted from logs and error reports |
| AreaMonitoring | MeasureError and security-event alerts (Sentry, EU) |
| AreaWeb security | MeasureContent Security Policy, X-Frame-Options, nosniff, Referrer-Policy; responses never include password hashes or token hashes |
| AreaUploads | MeasureAgency logos are accepted only after their file bytes are checked. Project files are not type-restricted (agencies deliver formats such as SVG and HTML to their clients); they are always served as a download with a generic content type and nosniff, never displayed inline. Size limits and per-plan storage quotas apply. |
| AreaBackups | MeasureDaily database and file backups, encrypted before upload, stored off the server, automatically deleted after 30 days; restore has been tested |
| AreaChange control | MeasureSchema changes only through migrations |
| AreaMeasures not yet implemented | MeasureWe disclose these openly and plan to close them: there is no application-level encryption at rest for the database and uploaded files (backups are encrypted); the database connection uses TLS inside a private network but without certificate verification; operator access to the servers and the database is not separately logged; read operations in the super-admin (operator) panel are not written to the audit log. |
Annex III. Sub-processors
| Sub-processor | Service | Data | Location |
|---|---|---|---|
| Sub-processorContabo GmbH | ServiceServer hosting | DataAll Client Data | LocationLauterbourg, France (EU) |
| Sub-processorResend | ServiceTransactional email | DataClient email address, project and file names, portal link | LocationEU (Ireland) |
| Sub-processorSentry | ServiceError monitoring | DataTechnical error details, no Client Data content by design | LocationEU (Germany) |
| Sub-processorCloudflare | ServiceDNS; encrypted backup storage (R2) | DataEncrypted backups only; Cloudflare holds no key | LocationDNS worldwide; the backup storage region is selected by Cloudflare |
Paddle, Google and the project management tools the Customer can connect (today Trello, Asana and Notion) are not sub-processors for Client Data. Paddle acts as an independent seller and payment provider for the Customer's own subscription. Google sign-in and a connected project management tool are used at the Customer's own choice and under the Customer's own accounts: the Customer authorises the connection with its own account, the provider acts under its own terms with the Customer, and the Processor reads only the limited read-only fields described in section 1.2 of the Privacy Policy. A provider is named here once it is available in the product.