Data Processing Agreement

Last updated 14 October 2026

This Data Processing Agreement (“DPA”) is part of the Terms of Service between TUUSIX OYUN YAZILIM VE DIŞ TİCARET LİMİTED ŞİRKETİ (“TUUSIX”) and an organisation that uses riwer (the “Customer”), wherever TUUSIX processes personal data on the Customer’s behalf. It applies without signing; a signed copy is available on request at support@riwer.io.

1. Roles

For the personal data in the Customer’s projects — what its people write, upload and say in riwer (“Customer Data”) — the Customer is the controller and TUUSIX the processor. For account and billing information, TUUSIX is a controller in its own right, as the Privacy Policy describes.

2. What is processed, and why

TUUSIX processes Customer Data only to provide riwer as the Terms describe: to store it, show it to the people the Customer’s projects let see it, share, export and delete it, and keep it safe, for as long as the Customer uses riwer and until it is deleted as section 7 says. Annex 1 gives the details.

3. Instructions

TUUSIX processes Customer Data only on the Customer’s documented instructions: these terms, the Terms of Service, what the Customer does in riwer, and any further written instruction both agree. TUUSIX tells the Customer if it believes an instruction breaks data protection law, or if the law requires processing the Customer has not instructed, unless the law forbids telling.

4. Confidentiality and security

Everyone at TUUSIX who can reach Customer Data is bound to keep it confidential. TUUSIX keeps the technical and organisational measures in Annex 2, and may improve them, never weaken them.

5. Sub-processors

The Customer authorises the sub-processors listed at riwer.io/subprocessors. TUUSIX binds each to data protection obligations no weaker than these and remains responsible for them. TUUSIX adds a new sub-processor to that list at least 30 days before it starts processing Customer Data. The Customer may object on reasonable data protection grounds within that time; if no solution is found, the Customer may end its subscription, and TUUSIX refunds what was paid for the time after it ends.

6. Helping the Customer

• People’s rights. riwer lets the Customer find, correct, export and delete Customer Data. TUUSIX helps further on request, and passes on any request it receives directly from the Customer’s people.
• Breaches. TUUSIX tells the Customer of a personal data breach affecting Customer Data without undue delay, and within 48 hours of becoming aware of it, with what it knows then and more as it learns it.
• Assessments. TUUSIX gives reasonable help with data protection impact assessments and consultations with a supervisory authority, where the law requires them.

7. Deletion

The Customer can export its documents at any time. When the Customer deletes Customer Data, or its projects, it is deleted; on request after the Customer stops using riwer, TUUSIX deletes what remains within 30 days, unless the law requires keeping it. Copies in backups expire on the providers’ own schedules.

8. Information and audits

TUUSIX gives the Customer the information it needs to show compliance with this DPA, and answers a reasonable written questionnaire once a year. Where the law or a supervisory authority requires an audit beyond that, it takes place with 30 days’ notice, during business hours, at the Customer’s cost, and under confidentiality.

9. Transfers

Customer Data is processed outside the European Economic Area, the United Kingdom and Türkiye, where the sub-processors are. Where the law requires, those transfers rely on the European Commission’s standard contractual clauses, the UK addendum to them, the Personal Data Protection Board’s standard contracts for transfers from Türkiye, or the recipient’s certification under the EU–U.S. Data Privacy Framework.

10. Everything else

Responsibility under this DPA is subject to the limits in the Terms of Service. Where this DPA and the Terms disagree about personal data, this DPA wins. It lasts as long as TUUSIX processes Customer Data.

Annex 1 — Details of processing

• People: the Customer’s users, and anyone mentioned in what they put in riwer.
• Information: names, email addresses and profile pictures; profile details people choose to add; the contents of documents, lists, slideshows, files, messages, comments and marks; technical logs.
• Sensitive information: not intended. The Customer puts special categories of data in riwer only where the law allows it.
• Frequency: continuous, while the Customer uses riwer.
• Purpose: providing riwer under the Terms of Service.

Annex 2 — Security measures

• Everything between browsers and riwer travels encrypted (HTTPS/TLS); providers encrypt what they store.
• Who may read or change each document, file and message is enforced by the database itself, project by project, with private documents visible only to their owner — not only by the app.
• Project files are private, reached only through signed links that expire within the hour. Profile pictures are public.
• Server keys are kept as encrypted settings on the server, never in the browser or the code.
• Payments are taken by Paddle; card details never reach riwer. Payment messages are checked for Paddle’s signature.
• Access to production systems is limited to the people who run riwer.
• The database is backed up daily by its provider.

Questions? support@riwer.io · Privacy · Terms · Refunds · Acceptable use · Sub-processors · Security · Cookies · KVKK · Back to riwer