Section 1. Subject Matter, Scope and Definitions
1.1 This Data Processing Agreement ("DPA") applies when an organization using Recurrent (an airline, a training organization or a training centre, the "Customer") has Nivorbit Teknoloji Limited Şirketi ("Nivorbit", the "Processor") process personal data on its behalf.
1.2 This DPA forms part of the Terms of Use and, for training centres, the Operator Terms.
1.3 This DPA is written to meet Article 28 of the GDPR and Article 12 of the Turkish Personal Data Protection Law (KVKK).
1.4 In this DPA, "Platform" means the Recurrent service, and the Customer and the Processor are each a "Party".
Section 2. Roles
2.1 Controller: the Customer, for the personal data it puts on the Platform for its own purposes (for example its crew roster, training records, approval chains and roster imports).
2.2 Processor: Nivorbit, which processes that data only to provide the Platform to the Customer.
2.3 Data a pilot keeps in their own wallet stays the pilot's. The Customer sees it only when the pilot links it, and only the documents the pilot chose.
Section 3. Data Processed
3.1 People: the Customer's crew members, instructors, examiners, staff and contacts.
3.2 Data: names, staff numbers, ranks, bases, e-mail addresses, roster duties and availability, training due dates, booking and check records, and the documents a pilot chose to share.
3.3 Purpose and duration: planning and booking training, keeping training records and the features the Customer turns on, for as long as the Customer uses the Platform and for the retention periods in the Privacy Policy.
Section 4. Processor Obligations
4.1 The Processor will process the data only on the Customer's documented instructions, including this DPA, the terms it forms part of and the settings the Customer chooses on the Platform.
4.2 People who can access the data are bound by confidentiality.
4.3 The Processor will protect the data with the technical and organisational measures listed in Annex 2.
4.4 The Processor will help the Customer answer requests from the people concerned and meet its obligations on security, breach notification and impact assessments.
4.5 The Processor will tell the Customer without undue delay, and within 48 hours at the latest, after it becomes aware of a personal data breach affecting the Customer's data. The notice will contain, as far as known: the nature of the breach and when it happened, the categories of data and the number of people and records concerned, the likely consequences, the measures taken and proposed, and a contact person. If information is not yet complete, the notice will be given in stages and completed as more is learned.
4.6 When this DPA ends, the Customer may ask within 30 days for its data to be returned in a machine-readable format. The Processor will delete the data within 60 days of the end at the latest. Records the law requires the Processor to keep are excepted; they are kept only for that purpose.
Section 5. Sub-processors
5.1 The current list of sub-processors is on the Sub-processors page.
5.2 The Processor will tell the Customer at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable grounds. If the objection is not resolved, the Customer may stop using the Platform without penalty.
5.3 The Processor will bind every sub-processor by contract to the obligations in this DPA and remains liable to the Customer if a sub-processor fails to meet them.
Section 6. Transfers
Where data leaves Türkiye or the European Economic Area, the Processor will transfer it only with the safeguards the law requires, such as standard contractual clauses or the undertakings required under KVKK.
Section 7. Audits
The Processor will make available the information needed to show that it meets this DPA, and will allow audits by the Customer or an auditor it appoints, with reasonable notice and no more than once a year unless a breach or an authority requires it.
Section 8. Contact
Privacy questions and requests about this DPA: contact@nivorbit.com.
Annex 1. Subject Matter, Categories, Duration
- Subject matter and purpose: providing the Platform to the Customer; planning and booking training, keeping training records, and the features the Customer turns on.
- People concerned: the Customer's crew members, instructors, examiners, staff and contacts.
- Categories of data: identity and contact (name, e-mail, staff number, rank, base); duties and eligibility (roster duties, training and check dates); booking and training records; documents a pilot chose to share (such as licence, ratings, medical certificate class and validity).
- Duration: as long as the Customer uses the Platform, then the return and deletion periods in Section 4.6.
Annex 2. Security Measures
- Encryption in transit.
- Centres' bank account details and stored secrets are kept encrypted with AES-256-GCM.
- Card details do not reach the Processor's servers; they are entered directly with the payment provider.
- Access control by role and group; rights inside an organization follow its groups and permissions.
- Actions of Platform administrators and data changes are written to an audit log.
- People who can access the data are bound by confidentiality.
- To help with requests from the people concerned, data export and deletion can be done from the Platform.