Data Processing Agreement

This text sets out the mutual obligations between a researcher running surveys on YouReply Survey and YouReply regarding the processing of survey data. It is an annex to the Terms of Use and applies for as long as you use the platform.

1. Parties and roles

• Survey data: The researcher decides what the survey asks, who is asked and what the collected data is used for. For this data the researcher is the data controller and YouReply acts only as a data processor, on the researcher's instructions.
• Account, order, invoice and support data: For this data YouReply is the data controller. See Membership and Account Privacy Notice and Customer and Subscription Privacy Notice.

If the researcher acts on behalf of an organization, that organization is the controller; the person using the account is deemed to have declared that they are authorized to represent and bind it.

2. Subject of this agreement

The subject of this agreement is the conditions of processing, the obligations of the parties and the security measures applying to personal data that YouReply processes on the researcher's behalf while providing the survey service. Under Article 12(2) of Law No. 6698 on the Protection of Personal Data (the "KVKK"), the relationship between controller and processor is recorded in writing by this text.

3. Duration, nature and purposes of processing

• Duration: For as long as the researcher's account and data are on the platform; after termination, only for the time needed for the deletion and return steps in section 8.
• Nature: Hosting, storage, presenting the survey to respondents, recording responses, showing them to the researcher and exporting them.
• Purpose: Solely providing, maintaining and securing the survey service. YouReply does not use this data for its own purposes, such as marketing or profiling, does not sell it and does not share it for advertising.

4. Data categories and data subjects

The researcher determines which personal data is processed, because the researcher writes the questions. Given the structure of the platform, the following data may be processed:

Data subjects: Respondents to the survey, and any other person who enters their own data into the researcher's survey.

5. YouReply's obligations as processor

• Acting on instructions: YouReply processes survey data only to provide the service and in line with the instructions the researcher expresses through their use of the platform. Publishing the survey, choosing settings, exporting data and sending a deletion request count as instructions. If processing outside those instructions becomes necessary because of a legal obligation, the researcher is informed unless this is prohibited.
• Confidentiality: Employees who can access the data do so only as their duties require and only to the extent necessary, and are bound by confidentiality.
• Security measures: The main measures taken under Article 12 of the KVKK are: access to the site and applications is provided over HTTPS (TLS) and secure connections are required via HSTS; session cookies are set so that they cannot be read by JavaScript (httpOnly); role-based access is applied within the account; in organization accounts, enterprise single sign-on via SAML 2.0 or OIDC can be used after domain verification; the database is backed up regularly and backups are pulled to a separate backup machine.
• Assistance: If a respondent contacts YouReply, the request is forwarded to the relevant researcher, and reasonable support is provided so that the researcher can answer requests under Article 11 of the KVKK.
• Breach notification: If we learn of a data breach affecting survey data, the researcher is informed without undue delay and the information we hold is shared so that the researcher can notify the Personal Data Protection Board and the data subjects.
• Records: Administrative actions in the account are written to an audit log; in organization accounts the account owner and admins can see this log.

6. Return and deletion of data

• Return: The researcher can export responses from their own account at any time as Excel (.xlsx) or CSV. Export is available throughout the service; no separate request is needed.
• Deletion: The application has no function that lets you delete surveys or responses yourself. Deletion is requested in writing from the email address registered in your account to kvkk@youreply.com.tr and is carried out manually by our team. For this reason we recommend exporting your data before requesting deletion.
• Backups: Deleted data may remain in backups until the backup cycle completes; these records are not used unless a restore is required.

7. Sub-processors and international transfers

The researcher consents to the use of the following sub-processors for the provision of the service. This list shows the providers that can access survey data:

Survey images and answers to file upload and signature questions are stored in the Germany (Frankfurt) region of Amazon S3. This international transfer relies on one of the transfer mechanisms provided for in Article 9 of the KVKK (for example, a standard contract).

File links are public: Uploaded files and signatures can be viewed without signing in by anyone who knows the link. Sensitive documents such as identity papers or medical reports should therefore not be collected with a file upload question.

The sub-processor list is published on the Sub-processor List page. Changes are announced on that page and through its update date; researchers are expected to follow the list.

8. The researcher's obligations as controller

• Making sure there is a condition for processing under Article 5 and, where applicable, Article 6 of the KVKK for the personal data collected, and obtaining explicit consent properly where consent is required.
• Informing respondents: who the controller is, for what purpose the data is processed and how rights can be exercised must be stated clearly within the survey. The platform's "Consent text" setting shows a "Participation Consent" screen before the survey starts, and the "Consent checkbox" preset in the question palette can be used for a checkbox relating to the privacy notice.
• Data minimization: not asking questions that the research purpose does not require; using anonymous response mode where identity data is not needed.
• Meeting the additional obligations for special category data and child participants. See Researcher Responsibilities: Special Category Data and Child Participants.
• Not collecting sensitive documents with a file upload question (section 7), and using the "Meta information" question in the knowledge that it collects device information.
• Answering requests from respondents. Because the researcher is the controller, requests are addressed to the researcher.
• Reviewing the access rights of team members added to the account and removing access that is not needed.

9. Term and termination

This agreement takes effect when the researcher starts using the platform and continues for as long as survey data is on the platform. When use ends, YouReply does not continue processing survey data other than for the deletion and return obligations in section 6 and statutory retention obligations.

10. Other provisions

This text is an annex to the Terms of Use. If there is a conflict between the Terms of Use and this text regarding the processing of personal data, this text applies. The agreement is governed by the laws of the Republic of Türkiye.

For questions, or to request a signed copy, write to kvkk@youreply.com.tr.