Effective Date: July 1, 2025
This Data Processing Agreement ("Agreement") forms part of the Terms of Service between:
Company (Data Controller): The user or organization that signs up for and uses the Karbon Analytics platform.
Processor (Data Processor): Karbon Analytics (operated by Taha Okuyan)
(together, the "Parties")
(A) The Company acts as a Data Controller.
(B) The Company wishes to use Karbon Analytics for analytics and data processing services involving business data, which may include limited Personal Data.
(C) The Parties seek to implement a data processing agreement that complies with Regulation (EU) 2016/679 (General Data Protection Regulation, or GDPR).
(D) The Parties wish to lay down their rights and obligations.
1.1 Unless otherwise defined herein, capitalized terms shall have the following meaning:
1.2 Terms such as "Controller," "Processor," "Data Subject," "Personal Data," "Processing," and "Supervisory Authority" have the meanings set out in the GDPR.
2.1 Karbon Analytics shall:
2.2 The Company instructs Karbon Analytics to process Company Personal Data solely to deliver the Service.
Karbon Analytics ensures that its personnel and contractors who process Company Personal Data are subject to confidentiality obligations and are granted access only on a need-to-know basis.
Karbon Analytics implements appropriate technical and organizational measures to protect Company Personal Data in accordance with Article 32 of the GDPR. This includes encryption, access controls, audit logs, and physical security.
Karbon Analytics may engage approved Subprocessors (e.g., AWS, PostHog, OpenAI) to process Company Personal Data. A current list is available upon request. Karbon Analytics remains responsible for Subprocessor compliance.
Karbon Analytics will:
Karbon Analytics will notify the Company without undue delay after becoming aware of a Personal Data Breach. Karbon Analytics will cooperate with the Company to investigate, mitigate, and remediate the breach.
Karbon Analytics shall provide reasonable assistance to the Company with Data Protection Impact Assessments and prior consultations with Supervisory Authorities, as required by GDPR Articles 35 and 36.
Upon termination of the Service or upon request, Karbon Analytics will delete all Company Personal Data within 30 days, unless retention is required by law.
Upon written request, Karbon Analytics shall provide documentation necessary to demonstrate compliance and will allow for reasonable audits by the Company or a designated third party, subject to confidentiality obligations.
Karbon Analytics stores and processes data in the United States. Where applicable, transfers will be subject to Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms under GDPR.
Each Party shall keep this Agreement and any shared information confidential, except where disclosure is required by law or the information is public.
This Agreement shall be governed by the laws of the Republic of Turkey. Any disputes shall be subject to the exclusive jurisdiction of the competent courts in Istanbul, Turkey.
IN WITNESS WHEREOF, this Agreement is effective as of the Effective Date and deemed accepted upon your use of the Service or execution of the Principal Agreement (Terms of Service).
We use tracking cookies to understand how you use the product and help us improve it.