Hello,

We are planning to use Railway to host the backend and PostgreSQL database of a SaaS application operating in Türkiye.

Our application will process personal data of users located in Türkiye, such as names, email addresses, IP addresses and account-related data.

Under Article 9 of the Turkish Personal Data Protection Law (Law No. 6698 – KVKK), cross-border transfers of personal data may require an appropriate safeguard.

The Turkish Data Protection Authority (KVKK) has published official Standard Contracts for international data transfers.

In our case, we may need to use the Standard Contract for transfers from a Data Controller to a Data Processor.

Could you please confirm:

1. Does Railway support the Turkish KVKK Standard Contract for international data transfers?
2. Can Railway Corporation sign the official Turkish Standard Contract with a customer based in Türkiye?
3. If yes, can Railway provide the necessary information and documentation regarding the authorized signatory/representative required for filing the contract with the Turkish Data Protection Authority?
4. Does Railway have an existing process or documentation specifically for compliance with Turkish KVKK Article 9?

Please note that we are specifically asking about the Turkish KVKK Standard Contract, not the EU GDPR Standard Contractual Clauses (EU SCCs).

Thank you.