Agreements
Data Processing Agreement
The agreement that sets the rules under which ENA Innovation processes personal data on behalf of the organizations that use the EnaTTO service.
This English version is a translation provided for convenience. In case of conflict the Turkish version prevails. This document is pending legal review.
This Data Processing Agreement (the "Agreement") sets out the rights and obligations of the organization using the EnaTTO service (the Customer, as defined in Section 1.1) and ENA Innovation regarding personal data processed on the Customer's behalf. It is based on Turkish Personal Data Protection Law No. 6698 ("KVKK") and its secondary legislation. Where Regulation (EU) 2016/679 (the "GDPR"), the United Kingdom GDPR (the "UK GDPR") or the Swiss Federal Act on Data Protection (the "FADP") applies to the Customer, Section 17 also applies.
1. Parties and scope
1.1. The parties are:
| Role | Party |
|---|---|
| Data controller | The organization (for example a technology transfer office, university, research institute, technopark, hospital or public institution) that uses the EnaTTO service under a quote, order form or agreement (the "Customer") |
| Data processor | ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş., Battalgazi Mah. Eskişehir Yolu Bulv. A.N.S. Kampüsü, Zafer Technopark, Merkez/Afyonkarahisar, Türkiye ("ENA Innovation") |
1.2. This Agreement applies together with the quote or order form accepted by the Customer, the Terms of Service and any other terms the parties agree in writing (together, the "Main Agreement").
1.3. On matters of personal data protection, this Agreement prevails over the Main Agreement in case of conflict. If the parties agree in writing to use the Customer's own data processing agreement, that agreement replaces this Agreement.
2. Definitions
The terms "personal data", "special categories of personal data", "data subject", "data controller", "data processor", "processing" and "Board" have the meanings given in KVKK. In addition:
- Service: the provision of the EnaTTO software through its web administration interface, public pages and API, and the related ENA Cloud services (organization discovery, notification gateway, AI gateway and benchmarking service).
- Customer Data: personal data entered into the Service by the Customer or its users, collected through the Customer's public pages, or generated through the Service on the Customer's behalf. Invention disclosures, research results and documents are Customer Data to the extent they contain personal data; the confidentiality obligations in Section 7 apply to them as a whole.
- Confidentiality class: the class given to a record in the Service: public, internal, confidential or strictly confidential.
- Sub-processor: a third party engaged by ENA Innovation to process Customer Data.
- Data Breach: the unlawful acquisition of Customer Data by others, or a security incident leading to it.
- Customer Environment: the application and data environment allocated to the Customer, running at
organizationcode.enatto.com: a separate server with its own application stack, file storage, database and database user.
3. Roles
3.1. For Customer Data, the Customer is the data controller and ENA Innovation is the data processor. The Customer determines the purposes and means of processing.
3.2. ENA Innovation acts as a data controller only for processing for its own purposes, such as contract management, invoicing, communication with Customer representatives and the security of its own central services. That processing is governed by the EnaTTO Privacy Policy.
3.3. External data sources that a user queries through the Service (ORCID, OpenAlex, Crossref and the European Patent Office's Open Patent Services) are public services that ENA Innovation does not engage to process Customer Data on its behalf; only identifiers (ORCID iD, DOI, publication number) are sent to them, and EPO access uses the Customer's own credentials. These services are therefore not treated as Sub-processors and are not listed in Annex 3. An identity provider that the Customer connects for single sign-on is the Customer's own provider and not a Sub-processor.
4. Subject matter, nature and duration
4.1. The subject matter and purpose of processing, the categories of data subjects and the categories of data are set out in Annex 1.
4.2. ENA Innovation processes Customer Data for the term of the Main Agreement and until the deletion or return period in Section 14 ends.
5. Customer instructions
5.1. ENA Innovation processes Customer Data only on the Customer's documented instructions. Instructions include the Main Agreement, this Agreement, settings the Customer makes in the Service (including users, roles, record memberships, confidentiality classes, workflows, public pages, single sign-on, and switching on AI assistance, benchmarking or external data sources) and written requests from an authorized Customer representative.
5.2. If ENA Innovation believes an instruction violates KVKK or other legislation, it informs the Customer without delay and may suspend the processing concerned until the instruction is clarified.
5.3. If the law requires ENA Innovation to process Customer Data for another purpose, ENA Innovation informs the Customer before processing, unless the law prohibits it.
5.4. ENA Innovation does not use Customer Data for its own purposes; does not use it for advertising, marketing or profiling; does not sell it or share it with data brokers; and does not use it to train AI models.
6. Customer obligations
As data controller, the Customer is responsible in particular for:
- Determining the legal basis for each processing activity, including data collected from external persons through its public pages and data of inventors, partners and company contacts recorded without a user account.
- Informing data subjects under Article 10 of KVKK and other applicable law, including through the consent and information texts on its public pages.
- Assigning confidentiality classes appropriate to the content of each record and granting access on a need-to-know basis; the Service enforces the classes but does not decide them.
- Not entering special categories of personal data (for example health data) into the Service unless it is necessary and the Customer has a legal basis; the Service is not designed for such data.
- Deciding whether to switch on AI assistance and benchmarking and whether to use external data sources, in line with its own policies.
- Meeting its controller obligations, such as registration where applicable (for example VERBİS in Türkiye, records of processing under Art. 30 GDPR), a retention and destruction policy and responding to data subject requests.
- Removing access for users who leave, and setting expiry dates for external experts.
7. Confidentiality
7.1. ENA Innovation ensures that its employees and other persons working on its behalf who access Customer Data are bound by written confidentiality obligations. Under Article 12(4) of KVKK, these obligations continue after they leave their role.
7.2. Access to Customer Data is limited to the persons and the extent needed to provide, support, maintain and secure the Service. ENA Innovation treats invention disclosures, unpublished research results and records classed as confidential or strictly confidential as confidential information of the Customer, even where they contain no personal data.
7.3. ENA Innovation does not disclose Customer Data to third parties except as permitted by this Agreement. If a competent authority requests Customer Data, ENA Innovation informs the Customer, unless the law prohibits it, and limits the disclosure to what the law requires.
7.4. Records classed as confidential or strictly confidential are never sent to the AI provider or the benchmarking service. The Service refuses such requests on the server.
8. Data security
8.1. Under Article 12 of KVKK, ENA Innovation takes technical and organizational measures that ensure an appropriate level of security to prevent unlawful processing of and access to personal data and to safeguard it. These measures are set out in Annex 2.
8.2. The measures may be updated as technology develops. Updates may not lower the overall level of protection described in Annex 2.
8.3. Under Article 12(2) of KVKK, the parties acknowledge that they are jointly responsible for taking data security measures. Settings within the Service, user accounts, roles, confidentiality classes, the Customer's own identity provider, and files the Customer exports or downloads from the Service are the Customer's responsibility.
9. Sub-processors
9.1. The Customer gives general written authorization for the engagement of the Sub-processors listed in Annex 3.
9.2. ENA Innovation notifies the Customer by email or within the Service at least 30 days before adding or replacing a Sub-processor. The notice states the Sub-processor's name, the processing activity and the place of processing.
9.3. The Customer may object in writing on reasonable grounds within 15 days of the notice. The parties will discuss a reasonable solution in good faith. If no solution is found, the Customer may terminate the Main Agreement for the affected part of the Service, without penalty, before the change takes effect.
9.4. If an urgent change is needed for security or service continuity, ENA Innovation makes the change and informs the Customer without delay. Section 9.3 still applies.
9.5. ENA Innovation imposes on each Sub-processor written data protection obligations no less protective than those in this Agreement. ENA Innovation remains liable to the Customer for a Sub-processor's failure to meet its obligations.
10. Cross-border transfers
10.1. The region where the Customer Environment is hosted is set in the order form or the Main Agreement according to the Customer's choice. Using services marked as "cross-border transfer" in Annex 3 may require part of the Customer Data to be transferred outside that region.
10.2. For every cross-border transfer to which it is a party, ENA Innovation complies with Article 9 of KVKK as amended by Law No. 7499 and with the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad. Each transfer is based on an adequacy decision or, if there is none, on one of the appropriate safeguards, primarily the standard contract published by the Board.
10.3. Where ENA Innovation signs a standard contract as the data exporter, ENA Innovation notifies the Board within 5 business days of signing. Where the Customer is the data exporter, the notification is the Customer's responsibility, and ENA Innovation provides the information needed for it.
10.4. If a Sub-processor's standard terms do not allow the required safeguard to be put in place, ENA Innovation informs the Customer. The parties then jointly consider options such as an alternative provider or another legal basis.
11. Assistance with data subject requests
11.1. If a data subject request reaches ENA Innovation directly, ENA Innovation does not answer it. It forwards the request to the Customer within 5 business days and tells the requester that the request has been passed to the Customer.
11.2. The Customer handles data subject requests primarily with the Service's own tools (viewing and correcting directory and record entries, exports as Excel or CSV, archiving records, removing access). Where these are not enough, ENA Innovation provides reasonable technical assistance on the Customer's written request. To help the Customer meet the statutory response periods, ENA Innovation normally completes such assistance within 10 business days.
11.3. If data of a specific data subject must be permanently erased or anonymized, ENA Innovation does so, or shows the Customer how to do so, at the Customer's request. Exceptions needed to preserve the integrity of audit records (which can only be appended to and in which names and email addresses are masked) are agreed with the Customer.
12. Data breach notification
12.1. When ENA Innovation becomes aware of a Data Breach affecting Customer Data, it notifies the Customer without undue delay and in any case within 48 hours of becoming aware of it. This period is intended to let the Customer notify the supervisory authority in time (under Article 12(5) of KVKK and the Board's decision on the 72-hour notification period, and, where applicable, Article 33 GDPR).
12.2. To the extent known at the time, the notice includes:
- the nature of the breach and the dates it started and was detected
- the categories of data and records affected (including their confidentiality classes) and the approximate number of data subjects
- likely consequences
- measures taken and proposed
- a contact person at ENA Innovation
If information is not yet available, ENA Innovation does not delay the first notice; it adds information as it becomes known.
12.3. ENA Innovation takes the measures needed to limit the effects of the breach and reasonably assists the Customer in notifying the supervisory authority and data subjects. The obligation to make these notifications rests with the Customer as data controller. ENA Innovation does not announce the breach to third parties on the Customer's behalf without the Customer's prior written approval, unless required by law.
12.4. Data Breach notices are sent to the email address and phone number of the authorized person the Customer names under the Main Agreement. The Customer keeps this information up to date.
13. Audits and information
13.1. At the Customer's request, ENA Innovation provides the information and documents needed to demonstrate compliance with this Agreement. This includes answering security questionnaires, keeping the annexes to this Agreement up to date and providing reasonable information for the Customer's data protection impact assessment.
13.2. Under Article 12(3) of KVKK, the Customer may carry out an audit itself or through an independent auditor. An audit:
- takes place at most once a year, with additional audits allowed after a Data Breach, at a supervisory authority's request or on serious suspicion of non-compliance
- requires at least 30 days' written notice and a scope agreed in advance
- takes place during business hours without unreasonably disrupting ENA Innovation's operations
- gives no access to other customers' data or to ENA Innovation's trade secrets
- is carried out under a confidentiality undertaking, at the Customer's cost unless agreed otherwise
13.3. This Agreement does not mean that ENA Innovation or the Service holds any certification or is compliant with any law. The Service is designed to support the Customer's obligations.
14. Term, termination, return and deletion
14.1. This Agreement takes effect together with the Main Agreement and remains in force until ENA Innovation stops processing Customer Data.
14.2. Before the Main Agreement ends, the Customer can retrieve its data with the Service's export tools (Excel and CSV) and download its documents. If the Customer requests it in writing within 30 days after termination, ENA Innovation delivers a copy of the Customer Data in a common machine-readable format, together with the stored documents.
14.3. Within 30 days after the Main Agreement ends, ENA Innovation shuts down the Customer Environment and deletes Customer Data, including the database, file storage and backups (nightly database dumps, dumps taken before updates and file storage archives). Automatic backups of the managed database service are deleted automatically when their configured retention period expires (the configured period is at least 7 days and is stated to the Customer on request). Benchmarking submissions of the Customer, if any, are deleted from the benchmarking service.
14.4. If the law requires a longer retention period, ENA Innovation keeps the data concerned only for that purpose and period, keeps it confidential and deletes it at the end of the period.
14.5. At the Customer's request, ENA Innovation confirms in writing that deletion is complete.
15. Liability
15.1. Each party is liable for breaching its own obligations under this Agreement and the applicable data protection law.
15.2. The limitations of liability in the Main Agreement apply to this Agreement to the extent permitted by law. Liability is not limited for intent, gross negligence or where the law does not permit a limitation.
16. Governing law and other terms
16.1. Unless the Main Agreement provides otherwise, this Agreement is governed by the laws of the Republic of Türkiye. The jurisdiction clause of the Main Agreement applies to disputes.
16.2. If any provision of this Agreement is held invalid, the other provisions are not affected.
16.3. ENA Innovation may update this Agreement to reflect changes in legislation or in the Service. Material changes to the Customer's detriment are notified to the Customer at least 30 days before they take effect.
16.4. This Agreement is published in Turkish, English and German. In case of conflict, the Turkish version prevails.
17. Customers subject to the GDPR, the UK GDPR or the FADP
17.1. Where the GDPR, the UK GDPR or the FADP applies to the Customer, this Agreement is applied so as to cover the matters required by Article 28(3) GDPR (and the corresponding provisions of the UK GDPR and the FADP). References to KVKK are then read as references to the corresponding provisions of the applicable law.
17.2. ENA Innovation assists the Customer with its obligations under Articles 32 to 36 GDPR (security of processing, breach notification, data protection impact assessment and prior consultation), taking into account the nature of processing and the information available to ENA Innovation.
17.3. Where Customer Data needs to be transferred from the EEA, the UK or Switzerland to Türkiye or to another country without an adequacy decision, the parties sign the European Commission's standard contractual clauses separately (with the adaptations for the UK and Switzerland where needed). The module is chosen according to the parties' roles; where the Customer is the controller, Module 2 (controller to processor) is normally used.
18. Contact
| Topic | Contact |
|---|---|
| Personal data and this Agreement | support@enainnovation.com |
| Legal notices | support@enainnovation.com |
| Security incidents | support@enainnovation.com |
| Phone | +90 850 308 45 91 |
| Address | Battalgazi Mah. Eskişehir Yolu Bulv. A.N.S. Kampüsü, Zafer Technopark, Merkez/Afyonkarahisar, Türkiye |
| Trade registry | Afyonkarahisar Trade Registry Office, registration no. 18590 |
| MERSİS no. | 0334130943400001 |
| Tax office / tax ID | Tınaztepe Tax Office / 3341309434 |
| D-U-N-S number | 448896706 |
Annex 1: Details of processing
Subject matter and purpose. Managing the Customer's technology transfer work: a directory of institutions, units, people and ecosystem partners; invention disclosures, assessments, institutional IP decisions, IP portfolio, patent applications, office correspondence, deadlines and expenses; projects, funding programs and calls; configurable workflows, approvals, tasks and committees; documents and their versions; industry collaboration (company profiles, demands, meetings, agreements, payments); startup programs (calls, applications, evaluation, ventures, mentoring, investment, exits); training and events (registrations, attendance, certificates, feedback surveys); commercialization (technologies, catalogue, licensee candidates, negotiations, agreements, revenues and revenue sharing); reports, indicators, scheduled email summaries and exports; collecting and confirming submissions from the Customer's public pages; sending in-app notifications and emails; where the Customer switches them on, AI assistance, annual benchmarking and look-ups in external data sources; support, maintenance and security.
Nature of processing. Collection, recording, import (CSV or Excel), storage, organization, linking of records, viewing, workflow processing, calculation of aggregate indicators, export, transfer (to the email delivery provider; where AI assistance is switched on, selected fields of public and internal records to the AI provider), archiving and deletion.
Data subjects and data categories:
| Data subjects | Data categories |
|---|---|
| Customer's users (owners, administrators, TTO staff, members such as academics, students and industry users, institutional viewers, external experts with time-limited access) | Name, email, roles and permissions, record memberships with reason and expiry, session information, notifications, tasks, audit records (actions, time, IP address; names and emails masked) |
| People in the directory (with or without account), including inventors, co-researchers, mentors, trainers, evaluators, patent attorneys and company contacts | Name, title, email, phone, ORCID iD, unit and institution, link to a user account; expertise profile (summary, research areas, keywords, services); publications imported by identifier |
| Inventors and people named in IP records | Inventor status (internal or external), institution, recorded contribution share; content of invention disclosures, assessments, decisions, patent applications and correspondence that refers to them |
| Project team members and partners' contacts | Role, person-months, contact details; budget and report data linked to them |
| Committee members | Role, attendance, conflict of interest declarations, votes (totals by default, per member if enabled) |
| Company contacts and people submitting demands or technology interest | Company name, contact name, email, phone, demand or message text, meeting and negotiation records, agreements and payments |
| Startup applicants, founders and mentors | Contact details, application content, evaluation scores, mentoring records, status records (team, customers, revenue, investment) |
| Event participants | Name, email, institution type and name, registration and waiting list status, attendance, certificate details and verification code; feedback survey responses are stored without the participant's name |
| Revenue-sharing recipients | Name or unit, percentage, calculated share of amounts received |
| People appearing in uploaded documents | Any data contained in the documents the Customer uploads |
| Visitors of public pages | IP address (rate limiting and security logs), hash of confirmation keys |
Special categories of personal data. The Service is not designed for special categories of personal data. The Customer does not enter such data unless it is necessary and lawful (Section 6).
Retention. Customer Data is kept until the Main Agreement ends, unless the Customer archives or deletes it earlier; Section 14 then applies. Public form submissions that are not confirmed by email are deleted after 48 hours. Export files are deleted after 7 days. Import previews are kept for 30 minutes. Certificate PDFs are not stored; they are generated on request. Feedback survey links expire after 30 days. Benchmarking submissions are kept in the benchmarking service until the Customer withdraws or the Main Agreement ends; withdrawal deletes all submissions, and when the Main Agreement ends, Section 14.3 applies. Encrypted backups are kept as described in Annex 2.
Annex 2: Technical and organizational measures
Environment separation
- Each Customer has its own Customer Environment: a separate server with its own application stack and file storage, and its own database and database user on a managed database service. Other customers' database users cannot connect to the Customer's database.
- The organization code is used only for routing; it does not grant access by itself.
Transport and network security
- All traffic is encrypted with TLS, both between the browser and the network protection service and between that service and the server (full, strict certificate validation).
- Only ports 80 and 443 are open to the network protection service's address ranges; administrative access is limited to management IP addresses.
- Connections to ENA Cloud services are signed (HMAC) per Customer Environment.
Authentication and authorization
- Users sign in through an invite-only identity service (Logto) or the Customer's own single sign-on; public sign-up is disabled. Invitations of external experts are time-limited and access ends automatically when it expires.
- Every record request passes through a single server-side access decision based on role, record membership and confidentiality class; access is denied by default, and a record a person may not see is answered as "not found". Lists apply the same rule.
- Confidential and strictly confidential records are open only to record members and explicitly authorized TTO staff; owner and administrator roles do not give automatic read access. Elevated access needs a reason, is time-limited, is written to the audit log and, for strictly confidential records, is notified to the people responsible for the record.
Confidentiality of content
- Management reports show only counts of confidential records, not titles or contents.
- In exports, confidential and strictly confidential rows contain only code and status; titles, abstracts, person fields, application numbers, dates and amounts are left empty. Internal notes and planned publications are never exported, never appear in notification texts or report details and are never shown to external users.
- Notification texts contain only a record code and a link. Spreadsheet formula injection in exports is neutralized.
- Documents are downloaded through signed, short-lived links; each download of a confidential or strictly confidential document is written to the audit log.
External services
- AI assistance is off by default and is switched on per Customer. Requests for confidential and strictly confidential records are refused on the server. Only selected fields of public and internal records are sent; for industry demands, company name, contact person, email, phone and internal notes are never sent, and matching candidates are sent under neutral labels. Each request is written to the audit log with its target and size, without the text itself. Requests are rate-limited per person. The AI gateway logs only metadata (such as size, duration and status), not the content.
- Benchmarking is opt-in. Only aggregate yearly indicators are sent after a user with the right permission previews and approves them; no records, names, codes or amounts. Peers see only quartiles of groups of at least 5 organizations. Withdrawal deletes all submissions.
- External data sources receive only identifiers (ORCID iD, DOI, publication number).
Public pages
- Submissions are accepted only after email confirmation; unconfirmed submissions are deleted after 48 hours. Only hashes of confirmation keys are stored, and keys are carried in the link fragment so that they do not reach server logs.
- Submissions are rate-limited per IP address and per email address and protected by a honeypot field.
Logging and traceability
- Every change to a record is written to the audit log. The audit log is protected by a database trigger so that entries can only be added, not changed or deleted. Names and email addresses in audit entries are masked.
- When the error monitoring service is enabled, it is configured not to send user details, cookies or request and response bodies.
Backup and continuity
- Every night a dump of the database and an archive of the file storage are taken, encrypted (AES-256) and kept for 14 days; the 10 most recent dumps and the most recent archive are always kept, even if they are older.
- An encrypted database dump is taken before each update; these dumps follow the same retention rule.
- Restoring from backups is tested monthly in a restore drill into an empty test database.
- The database is also protected by the managed database service's automatic backups (including point-in-time recovery; retention at least 7 days).
Organizational measures
- Access to Customer Data is limited to staff who need it for their work, and staff are bound by confidentiality obligations.
- Container images and build dependencies are pinned; dependencies are checked for known vulnerabilities in the release process.
- Security vulnerabilities are received and assessed through the published responsible disclosure policy.
- Sub-processors are bound by written obligations under Section 9.
Annex 3: Sub-processors
| Sub-processor | Activity | Data processed | Cross-border transfer |
|---|---|---|---|
| Huawei Cloud | Hosting the Customer Environment and ENA Cloud services (virtual servers, managed PostgreSQL, storage, backups) | All Customer Data | Depends on the hosting region (Section 10.1) |
| Cloudflare | DNS, TLS and network protection (proxy) in front of the Customer Environment | All traffic between users and the Customer Environment, including IP addresses | Yes (global network, headquartered in the USA) |
| Logto | Authentication of users | User name, email, roles, sessions | Yes (Logto Cloud; locations as stated in the provider's data processing terms) |
| Resend (through ENA Cloud) | Email delivery | Recipient email address and message content (notification texts contain only record codes and links) | Yes |
| Sentry (only when enabled) | Error monitoring | Error records configured not to contain personal data | Yes (sentry.io; locations as stated in the provider's data processing terms) |
| Google (Gemini, through ENA Cloud; only when the Customer switches on AI assistance) | AI suggestions, matching assistance and report drafts | Selected fields of public and internal records; never confidential or strictly confidential records, company contact details or internal notes | Yes (headquartered in the USA; locations as stated in the provider's data processing terms) |
Notes
- ENA Cloud (organization discovery, notification gateway, AI gateway and benchmarking service) is operated by ENA Innovation itself and is not a Sub-processor. It is hosted on Huawei Cloud.
- ORCID, OpenAlex, Crossref and the European Patent Office are not Sub-processors (Section 3.3).
- The current list is also published on the Sub-processors page. The full legal names and processing locations of Sub-processors are provided in writing on request.