This Data Processing Agreement ("DPA") is entered into between the customer using IFCNexus for professional or commercial purposes ("Customer", data controller) and MARFEN Mühendislik Tasarım ve Danışmanlık – Mahmut TARI ("MARFEN", data processor), and governs the processing of personal data contained in the content the Customer uploads to the Service. The DPA is an annex to the Terms of Service and enters into force upon acceptance of the Terms. Customers who wish to receive a signed copy may write to info@marfen.com.tr.
1. Subject matter, duration, nature and purpose
- Subject matter: generation of fabrication drawings from IFC models uploaded by the Customer or selected from Google Drive.
- Duration: the period during which the Service is used. Files are deleted no later than 7 days after each job.
- Nature: storage, reading, geometric processing, generation of outputs, writing to the Customer's Drive, deletion.
- Purpose: solely the provision of the Service to the Customer.
2. Types of data and data subjects
Identity and contact data, such as first and last name, job title, company and email address, that may be contained in the metadata of IFC files. The data subjects are the Customer's employees, consultants and project stakeholders. Special categories of personal data must not be uploaded.
3. MARFEN's obligations
MARFEN:
- processes personal data only on documented instructions from the Customer. The Terms, the selections made within the application and this DPA constitute instructions.
- ensures that persons authorized to process the personal data are bound by an obligation of confidentiality.
- implements the technical and organizational measures set out in the Annex.
- complies with Section 4 when engaging subprocessors.
- provides reasonable assistance in responding to data subject requests.
- assists the Customer in meeting its obligations relating to security, breach notification and data protection impact assessments.
- deletes the data upon termination of the Service. Statutory retention obligations remain unaffected.
- makes available the information necessary to demonstrate compliance, and allows document-based audits upon reasonable prior notice and no more than once a year.
4. Subprocessors
The Customer grants general authorization for the engagement of the subprocessors listed on the Subprocessors page. MARFEN updates this page at least 30 days before adding a new subprocessor and notifies the registered administrators. The Customer may object on reasonable grounds within this period. If the objection cannot be resolved, the Customer may terminate its subscription and the unused period is refunded pro rata. MARFEN imposes on its subprocessors obligations equivalent to those set out in this DPA.
5. International transfers
MARFEN is established in Türkiye. For Customers in the European Economic Area, the Standard Contractual Clauses adopted by European Commission Implementing Decision (EU) 2021/914 (Module 2: controller to processor) are incorporated into this DPA by reference. In brief: the competent supervisory authority is that of the country in which the Customer is established, and the governing law is Irish law. For transfers subject to the KVKK, the provisions of KVKK Art. 9 apply.
6. Personal data breach
MARFEN notifies the Customer of any personal data breach affecting the Customer without undue delay, and in any event within 48 hours, after becoming aware of it. The notification describes the nature of the breach, its likely consequences and the measures taken.
7. Liability
Liability between the parties is subject to the limitations set out in the Terms of Service. Mandatory provisions on liability towards data subjects remain unaffected.
Annex: Technical and organizational measures
- TLS encryption on all connections; between the server and the production computers, only outbound, authenticated HTTPS.
- Server located in the European Union (Germany); daily disk backups.
- Drive refresh tokens encrypted on the server (Fernet/AES).
- Automatic deletion of files after 7 days; deletion of the job folder on the production computers once the job is completed.
- Administrative access only via SSH keys and restricted to authorized persons.
- Customer data is not used for model training.
- Software updates and monitoring of access logs.