Data Processing Agreement

Effective: 1 November 2026 · Version 1

1. Parties and scope

This agreement is between the brand using the Q9ive service (website, ChatGPT Ads check-up and tools offered through AI apps) ("Customer") and Birkan Doğru, provider of the service ("Q9ive"). For the ad account data the Customer connects, the Customer is the data controller and Q9ive is the data processor.

2. Data processed

• Account details: brand name, email address.
• Ad account data: campaign-level aggregated performance data such as campaign names, spend, impressions, clicks, conversions and sales.
• Site scan: The readiness check reads only the technical tags of the public page; no visitor data is processed.
• Under this service Q9ive does not process individual end-customer or order data of the Customer's users.

3. Purpose

Data is processed only for the measurement and diagnosis the Customer requests: showing spend that is not turning into sales and the campaign that needs urgent optimization. Data is not sold, not used for advertising and not shared with third parties. The only exception: if the Customer explicitly consents, data may be used in an anonymous industry benchmark in which the brand cannot be identified.

4. Retention and deletion

• Check-up data is kept in an area separate from the main system, segregated per brand.
• Check-up data of non-customer brands is deleted 3 months after last use.
• When the Customer disconnects in the AI app, the app's access to Q9ive ends; unused connections are closed automatically within 30 days at the latest.
• The Customer may request deletion at any time: https://www.q9ive.io/privacy.html#delete-data

5. Security

Data is protected with HTTPS in transit and encrypted at rest. Ad account API keys are stored encrypted and never shown in any tool output. Access is limited to authorized persons.

6. Sub-processors

Sub-processor	Purpose	Location
Hetzner Online GmbH	Server hosting	Finland
Google (Gmail)	Emailing the check-up report	Google data centers
Globalping (jsDelivr)	Testing the public site address from different countries during the readiness check	Countries where test points are located

When the Customer uses Q9ive through an AI app (ChatGPT, Claude, Gemini), tool results are passed into that platform's conversation at the Customer's own choice; this transfer is subject to that platform's terms.

7. International transfers

As servers are located outside Türkiye, data is transferred in line with Article 9 of the Turkish Personal Data Protection Law No. 6698 (KVKK).

8. Data subject rights and breach notification

Q9ive assists the Customer in responding to data subject requests. If a data breach is detected, the Customer is notified without undue delay and within 72 hours at the latest.

9. Termination

On termination, data is deleted according to the periods in section 4; records subject to legal retention are kept for the required period.

10. Governing law and contact

This agreement is governed by the laws of the Republic of Türkiye. Contact: q9iveperformance@gmail.com · https://www.q9ive.io/contact.html