Data Protection Addendum
Sürüm 0.1-draft (2026-10-29)
Sözleşme dili İngilizcedir. Türkçe çeviri, hukuki inceleme tamamlandıktan sonra yayınlanacaktır.
1. Scope
This Addendum forms part of the Advertiser Terms between Kiqro Inc. (“Kiqro”) and the Advertiser and applies to personal data exchanged in connection with campaigns on Kiqro Network.
2. Roles of the parties
Kiqro decides how users of the Kiqro app and of publisher apps are rewarded and screened for fraud; the Advertiser decides how users of its own product are measured. The parties therefore act as independent controllers, each responsible for its own processing, and not as joint controllers or as controller and processor.
[● lawyer to confirm the role analysis, in particular for MMP-mediated data flows]
3. Data exchanged
| Direction | Data | Purpose |
|---|---|---|
| Kiqro → Advertiser’s MMP (in the click) | Click ID, campaign and source IDs, country; device advertising ID only where the user consented | Attribution of installs and events to Kiqro |
| Advertiser’s MMP → Kiqro (Postback) | Click ID, event name and time, optional revenue, country, device advertising ID if configured | Crediting users, billing, fraud prevention |
| Kiqro → Advertiser (panel/CSV) | Conversion and click IDs, event, country, status, price | Reporting and reconciliation |
No names, e-mail addresses, phone numbers or other directly identifying data are exchanged. Special categories of data must not be sent in Postbacks.
4. Obligations of each party
- Each party has a legal basis for its own processing and gives users the information required by GDPR articles 13–14.
- The Advertiser configures its MMP so that Postbacks to Kiqro contain only the data listed above.
- Each party implements appropriate technical and organisational measures (section 6).
- Each party handles data-subject requests for its own processing and forwards requests that concern the other party without delay.
- Each party notifies the other without undue delay, and where possible within 72 hours, of a personal data breach affecting data exchanged under this Addendum.
5. International transfers
Where data exchanged under this Addendum is transferred outside the EU/EEA, the transferring party ensures an adequacy decision or the Standard Contractual Clauses (controller-to-controller module) apply.
6. Kiqro’s security measures
- Hosting in the EU; encryption in transit (TLS) and at rest.
- Signed click URLs and optionally signed Postbacks (HMAC-SHA256); IP and device screening against fraud.
- Role-based admin access with mandatory two-factor authentication and an append-only audit log.
- Raw Postbacks retained for dispute resolution for up to 24 months, clicks for 13 months; then deleted.
- Backups with point-in-time recovery; regular dependency and security updates.
7. Term
This Addendum applies as long as data is exchanged under the Terms and survives termination for data still held by either party.