Data Processing Agreement

1. Parties and roles

This Data Processing Agreement ("DPA") is entered into between:

Where SubGeoMap processes data about the Client's own personnel or users (e.g. contact persons named in an inquiry), SubGeoMap acts as an independent data controller for that limited purpose, as described in our Privacy Policy.

2. Scope and purpose

SubGeoMap processes personal data on behalf of the Client solely for the following purpose:

• Receiving, storing, and analysing GPR survey files submitted by the Client
• Running AI-based detection, classification, and depth estimation on the survey data
• Producing annotated outputs, depth reports, and georeferenced utility maps
• Delivering completed outputs to the Client via encrypted channel

SubGeoMap will not process the data for any purpose beyond what is documented in this DPA and the applicable project instructions, unless required by law.

3. Personal data processed

Categories of data subjects

• Site owners, landowners, or occupiers whose property is surveyed
• Personnel of the Client whose names or contact details appear in project documentation
• Any third-party individuals whose data appears incidentally in submitted files

Categories of personal data

• Names and contact information included in project documentation
• Precise geolocation data (RTK/GPS coordinates) which may, in context, identify an individual's property or presence
• Any personal data the Client includes in supporting documents, field notes, or survey file metadata

GPR B-scan waveform data itself does not typically constitute personal data. However, when combined with precise RTK positioning linked to an identifiable property or individual, the combined dataset may fall within the definition of personal data under applicable law.

4. Processor obligations (SubGeoMap)

SubGeoMap will use reasonable endeavours to:

• Process personal data within the scope of the service as described in this DPA
• Take reasonable steps to ensure that personnel with access to the data understand their confidentiality obligations
• Maintain security measures appropriate to the nature of the data and the service, as described in Section 7
• Notify the Client of any new sub-processors before they begin processing Client data, in accordance with Section 6
• Provide reasonable assistance to the Client in responding to data subject rights requests, to the extent technically feasible and proportionate
• Notify the Client of a confirmed personal data breach affecting Client data in accordance with Section 10
• Handle Client data after project completion in accordance with Section 11
• Provide reasonable information to assist the Client in demonstrating compliance, subject to the limitations in Section 12

5. Controller obligations (Client)

The Client is responsible for:

• Ensuring there is a lawful basis for submitting personal data to SubGeoMap for processing
• Informing data subjects (e.g. site owners) that their location data will be processed by a third-party AI analysis service, where required by applicable law
• Providing accurate and complete project instructions
• Not submitting special category data (e.g. health data, biometric data) unless explicitly agreed in advance in writing
• Notifying SubGeoMap promptly if the Client's instructions change or if the Client becomes aware of any issue relating to the data

6. Sub-processors

SubGeoMap may engage third-party sub-processors (e.g. cloud infrastructure, file storage, or AI compute providers) at its discretion to assist in delivering the service. When doing so, SubGeoMap will:

• Take reasonable steps to ensure sub-processors apply data protection standards appropriate to the nature of the data
• Provide the Client with notice of new sub-processors by updating the sub-processor list available on request — the Client's continued use of the service after such notification constitutes acceptance

A current list of sub-processors is available on request at info@subgeomap.com. SubGeoMap is not liable for the acts or omissions of sub-processors beyond what is recoverable from the sub-processor itself. If the Client has a specific objection to a sub-processor, the parties will discuss the matter in good faith, but SubGeoMap retains the right to select the infrastructure and tooling necessary to deliver the service.

7. Technical and organisational measures

SubGeoMap implements the following measures to protect personal data:

Access control

• Role-based access — only personnel assigned to a project can access its data
• Multi-factor authentication for all systems holding client data
• Regular access review and revocation upon personnel change

Transmission security

• All file transfers encrypted in transit (TLS 1.2 minimum)
• No client files transferred via unencrypted email

Storage security

• Encryption at rest for all stored client files
• Files stored only on managed infrastructure — not on personal devices

Organisational measures

• Staff confidentiality obligations
• Incident response procedure for data breaches
• Regular review of security practices

8. International transfers

Client data is primarily processed and stored in Turkey. Where data is transferred outside Turkey (for example, to a cloud sub-processor with infrastructure in the EU or US), SubGeoMap ensures an appropriate transfer mechanism is in place:

• Standard contractual clauses approved by the relevant authority
• Adequacy decisions where applicable
• Binding corporate rules where relevant

Details of the transfer mechanism in place for each sub-processor are available on request.

9. Handling data subject requests

If SubGeoMap receives a request directly from a data subject (e.g. a site owner whose property was surveyed) in relation to data processed on behalf of the Client, SubGeoMap will:

• Promptly notify the Client of the request
• Not respond to the data subject on the Client's behalf without the Client's instruction
• Provide the Client with reasonable technical assistance to allow the Client to fulfil the request

The Client remains responsible for responding to data subject rights requests within applicable legal timeframes.

10. Personal data breaches

In the event of a confirmed personal data breach directly affecting Client data, SubGeoMap will:

• Notify the Client without undue delay once the breach has been confirmed and its scope reasonably understood — SubGeoMap does not commit to a specific notification deadline, as premature notification of unconfirmed incidents may cause unnecessary harm
• Share available information about the nature and scope of the breach to the extent known at the time of notification; further detail may be provided as the investigation progresses
• Take reasonable steps to contain and remediate the breach

The Client is solely responsible for determining whether and how to notify supervisory authorities or data subjects under applicable law. SubGeoMap's notification to the Client does not constitute an admission of fault or liability. SubGeoMap is not liable for any regulatory fines, penalties, or third-party claims arising from a breach that results from circumstances outside SubGeoMap's reasonable control, including vulnerabilities in third-party infrastructure or client-side credential mishandling.

11. Retention and deletion

After a project is completed, SubGeoMap will handle Client data in accordance with its standard data lifecycle and retention practices, as described in the Privacy Policy. SubGeoMap will delete Client personal data within a reasonable period after the project retention window closes, taking into account operational, legal, and backup infrastructure timelines.

Clients may submit a written deletion request to info@subgeomap.com. SubGeoMap will use reasonable efforts to process such requests within a reasonable timeframe, subject to any legal or operational retention obligations. SubGeoMap is not obligated to provide written deletion certification unless separately agreed in a signed project contract.

12. Audit and compliance

SubGeoMap will provide reasonable documentary information to assist the Client in assessing compliance with this DPA, where such information is readily available and its disclosure does not compromise the security, confidentiality, or proprietary interests of SubGeoMap or other clients.

SubGeoMap does not grant a general right to audit. Any on-site inspection or technical audit requires SubGeoMap's prior written consent, must be agreed in writing including scope, timing, and cost allocation, may not occur more than once per year, and must be conducted by a mutually agreed independent third party at the Client's sole expense. SubGeoMap may satisfy any audit request by providing existing third-party security assessments, certifications, or summary compliance reports in lieu of direct inspection.

13. Liability

To the maximum extent permitted by applicable law:

• SubGeoMap's total aggregate liability under or in connection with this DPA — whether in contract, tort, or otherwise — is limited to the total fees paid by the Client in the three months preceding the event giving rise to the claim
• SubGeoMap is not liable for any indirect, consequential, incidental, special, or punitive damages, including but not limited to loss of profit, loss of revenue, loss of data, reputational harm, or regulatory fines, even if SubGeoMap was advised of the possibility of such damages
• SubGeoMap is not liable for any failure or delay caused by circumstances beyond its reasonable control, including third-party infrastructure failures, force majeure events, or acts of third parties
• The Client is solely responsible for ensuring its own use of the service complies with applicable law; SubGeoMap accepts no liability for the Client's failure to meet its own legal obligations as data controller

Nothing in this DPA limits liability for death or personal injury caused by negligence, or fraud, to the extent such limitation is prohibited by Turkish law.

14. Governing law

This DPA is governed exclusively by Turkish law, including the Law on the Protection of Personal Data (KVKK, Law No. 6698). Disputes arising under or in connection with this DPA shall be submitted to the exclusive jurisdiction of the Istanbul courts.

Clients established outside Turkey submit to this jurisdiction by accepting this DPA. While SubGeoMap has designed this DPA with reference to GDPR Article 28 principles, SubGeoMap does not warrant that this DPA satisfies any particular foreign regulatory requirement. Clients subject to GDPR or other non-Turkish data protection regimes are responsible for assessing their own compliance obligations.

15. Contact and execution

This DPA is incorporated into and forms part of SubGeoMap's terms of service. By submitting a project to SubGeoMap, the Client acknowledges having read and agreed to this DPA.

Clients who require a separately signed DPA (e.g. for enterprise procurement or regulatory purposes) may request one by contacting:

SubGeoMap — SubGeoMap
Email: info@subgeomap.com

We will respond to DPA execution requests as promptly as reasonably practicable.