When Carcha Seal processes personal data for you (your customers' licenses, your End Users' devices, your buyers' orders), the European Commission's standard contractual clauses apply, unchanged, with the choices and annexes on this page:
You are the controller and the data exporter; Carcha Labs is the processor and the data importer. Accepting the Vendor Terms is accepting these clauses; the record of which version you accepted, and when, stands for the signatures in the annexes. Where the clauses and the Vendor Terms conflict, the clauses prevail.
- You are established in the European Economic Area: Module Two (controller to processor) of the standard contractual clauses in the Annex to Commission Implementing Decision (EU) 2021/914 (https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj). They cover the transfer to Carcha Labs in Türkiye and, as the Commission states, already contain what Article 28 GDPR requires, so no separate processing agreement is needed.
- Otherwise: the standard contractual clauses in the Annex to Commission Implementing Decision (EU) 2021/915 (https://eur-lex.europa.eu/eli/dec_impl/2021/915/oj).
Choices in the clauses
| Decision 2021/914, Module Two | Decision 2021/915 | |
|---|---|---|
| Docking clause | Clause 7 not used | Clause 5 not used |
| Sub-processors | Clause 9(a) Option 2, general written authorisation: we tell you of an intended addition or replacement at least 30 days in advance, by email, and you may object | Clause 7.7(a) Option 2, the same, 30 days |
| Independent dispute resolution | Clause 11(a) option not used | — |
| Supervisory authority | Clause 13(a): the supervisory authority responsible for your compliance with the GDPR as data exporter (Annex I.C) | — |
| Governing law | Clause 17 Option 2: the law of the EU Member State where you are established; where that law does not allow third-party beneficiary rights, the law of Germany | No clause on it: the Vendor Terms' law applies to what the clauses leave open |
| Courts | Clause 18(b): the courts of the EU Member State where you are established | — |
| Regulation | — | Clause 1 Option 1 (GDPR), and the GDPR options in Clauses 8 and 9 |
Why: 30 days matches the notice the Vendor Terms give for their own changes. Option 2 of Clause 17 keeps each vendor on its own Member State's law and courts; Germany is the fallback because its civil code provides for contracts in favour of third parties (BGB section 328), which the clauses need for data subjects' rights.
Annex I: the parties
Data exporter and controller: you, the vendor, as named in your Carcha Seal account: the company name and address, and the contact person and email given in the console. Activities: you license your software through Carcha Seal. Role: controller.
Data importer and processor: Bugra Omer Aydemir, trading as Carcha Labs, Istanbul, Türkiye. Contact for data protection: Bugra Omer Aydemir, owner, [email protected]. Activities: Carcha Seal, a license server and SDK for desktop software. Role: processor. No data protection officer (not required) and no representative in the Union (see below).
Signatures: your acceptance of the Vendor Terms (the version and time Carcha Seal records), and Carcha Labs' publication of this version.
Annex I.B / Annex II: description of the processing
Data subjects: your customers who hold licenses; the End Users who install and run Your Application; your buyers, when you connect a payment provider.
Personal data: - Licenses: the holder's name and email, the license key (stored only as a hash), order id, features, expiry. - Devices: a device fingerprint (a SHA-256 hash of the operating system's machine id with the product code) and per-component hashes (HMAC-SHA256 made on the device, keyed by the product code); raw serial numbers and addresses never reach the server. The machine name, only if Your Application sends one. Operating system, app and SDK version, whether it runs in a virtual machine, the IP address of each request (for rate limits), activation and check-in times. - Offline activation: the device hashes in the request file, and the response. - Payment connections: what the provider's webhook sends: the buyer's name and email, order and subscription ids, status. - License emails: the buyer's email address and the license key, sent through Amazon SES; replies go to your support address. - Events: license and device events with their times; device events carry the machine name, license creation the holder's name.
Sensitive data: none.
Frequency: continuous.
Nature: storing; issuing, changing and revoking licenses; checking activations and check-ins; signing leases; sending license emails; receiving payment webhooks; recording events; deleting on request.
Purpose: providing the Carcha Seal service to you under the Vendor Terms: licensing Your Application to your customers.
Duration and retention: for as long as your account exists, or until you erase the data. Revoking a license or releasing a device keeps the record; erasing deletes it (console: "Erase license and its data", or the API's erase endpoints), leaving only an event with the erased id. When your account is deleted, its data is deleted within one month. Server backups keep data until they rotate out of the 14 most recent backups.
Sub-processors: see Annex III.
Annex II / Annex III: technical and organisational measures
- Location: the database and its backups are on AWS EC2 in eu-central-1 (Frankfurt). Carcha Labs administers them remotely from Türkiye.
- Encryption in transit: HTTPS through Cloudflare to the server; the server listens on the host's local interface only. Database connections require TLS with the certificate checked, and refuse cleartext authentication.
- Encryption at rest of secrets: vendors' lease-signing keys and payment-connection secrets are encrypted under an AWS KMS key; the server may only encrypt and decrypt with that key, as the instance's role (IMDSv2).
- Credentials: passwords as scrypt hashes; session tokens, reset and sign-up links, API keys and license keys stored only as hashes. Console sessions end after 30 idle minutes or 12 hours. Failed sign-ins are limited per account and address, following OWASP's device-cookie protocol. Optional two-factor sign-in (TOTP, RFC 6238) with single-use recovery codes.
- Pseudonymisation: hardware values are hashed on the device. The hashes are keyed by the product code, so they are pseudonymised, not anonymous.
- Minimisation and retention: expired sign-up links, reset links and sessions are deleted hourly; logs are rotated (web server logs 15 days); request records in Carcha Labs' monitoring hold a shortened IP address, kept 7 days.
- Access: only Carcha Labs' owner administers the server, with SSH keys; there are no other staff with access.
- Resilience and restoration: consistent database backups, each read back and checked when written; the 14 most recent are kept; a documented restore procedure.
- Testing: dependency audits (npm audit, cargo audit) on every change and daily; the test suite on every change; a self-assessment against OWASP ASVS 5.0 level 2, in progress.
- Incidents: a written breach procedure: Carcha Labs tells each affected vendor without undue delay after becoming aware of a personal data breach, with what is known, and helps the vendor meet its own duties.
- Helping you with data subjects' requests: you can read every record of your licenses, devices and deliveries in the console and through the admin API, correct licenses, and erase a license or a device with its data. Carcha Labs answers your questions about a request within the time the clauses set.
Annex III: sub-processors
| Sub-processor | Where | What it does |
|---|---|---|
| Amazon Web Services (the AWS entity contracting with Carcha Labs: AWS Turkey Pazarlama Teknoloji ve Danışmanlık Hizmetleri Ltd. Şti.) | Data in eu-central-1 (Frankfurt, Germany) | Hosting (EC2), key encryption (KMS), license emails (SES) |
| Cloudflare, Inc. | United States (EU-U.S. Data Privacy Framework); edge network | Carries the traffic to and from the server (TLS, network protection) |
Payment providers you connect (Lemon Squeezy, Paddle, Polar, Stripe) are not sub-processors: they act for you, under your own agreement with them.
Not covered yet
- A representative in the Union (Article 27 GDPR): Carcha Labs has none. One is needed once a vendor outside the EU whose app is used by people in the EU signs up.
- The transfer impact assessment (Clause 14 of Decision 2021/914): Carcha Labs documents it before the first vendor established in the EEA signs up.