KVKK / GDPR Data Security & Compliance Commitment

This commitment letter sets out the binding undertakings of NEBULONS AI regarding compliance with the European Union General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Turkey's Personal Data Protection Law No. 6698 ("KVKK") in connection with the NEBULONS AI Studio platform. It applies to all processing of personal data performed by NEBULONS AI, whether as a controller for its own account data or as a processor acting on Customer instructions.

NEBULONS AI commits to the lawful processing of personal data at all times. Personal data is processed only where a valid legal basis exists, only for specified, explicit, and legitimate purposes, and only to the extent necessary for those purposes. As a processor, NEBULONS AI processes Customer personal data exclusively on the Customer's documented instructions; as a controller of its own account data, NEBULONS AI processes only the minimum data required to operate the account and comply with law.

NEBULONS AI commits to absolute data minimisation and zero retention. The platform is engineered so that Customer personal data exists only for the technical duration of the instructed operation: datasets are processed in controlled, encrypted environments and are deleted from active systems upon completion of the operation; encrypted backup copies rotate out and are destroyed within thirty (30) days at most. Under no circumstances is personal data retained for model training, analytics, marketing, or any secondary purpose. Data subjects' data is never used to improve, fine-tune, or evaluate any artificial intelligence model belonging to NEBULONS AI or any third party.

NEBULONS AI implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including pseudonymisation and encryption of personal data in transit (TLS 1.3) and at rest (AES-256), confidentiality undertakings binding all personnel, least-privilege access management, network segmentation, continuous monitoring, and tested incident response procedures, as further detailed in the Information Security Policy.

NEBULONS AI supports data subjects and controllers in exercising their rights under the GDPR and KVKK, including the rights of access, rectification, erasure, restriction, objection, portability, and the right to lodge a complaint with a supervisory authority. Where the zero-retention architecture means that the requested data no longer exists, NEBULONS AI confirms this in writing as part of its response. Requests received directly by NEBULONS AI are handled within statutory deadlines, and where a request relates to data processed on a Customer's instruction, it is forwarded to the relevant Customer without undue delay.

NEBULONS AI maintains documented procedures for detecting, containing, investigating, and notifying personal data breaches. Any personal data breach affecting Customer personal data is notified to the affected Customer without undue delay and in any event within seventy-two (72) hours of NEBULONS AI becoming aware, accompanied by the information required under Article 33(3) of the GDPR, as set out in the Data Breach Incident Response Policy.

International transfers of personal data are performed only under appropriate safeguards, including the European Commission's Standard Contractual Clauses, the UK Addendum where relevant, or adequacy decisions, in cooperation with the Customer. NEBULONS AI maintains transparency over its sub-processors under the Sub-processor Policy, imposes equivalent data protection obligations on each of them, and remains fully liable for their performance of those obligations.

NEBULONS AI keeps records of processing activities under Article 30 of the GDPR, cooperates with supervisory authorities, and makes available the information necessary to demonstrate compliance, including third-party security attestations, to Customers subject to their own audit obligations. This commitment is incorporated into the Master Services Agreement and the Data Processing Agreement; where any conflict arises, the stricter data protection obligation prevails. Questions regarding this commitment may be directed to NEBULONS AI through the contact channels published on our website.