This English version is a translation provided for convenience. If it differs from the Turkish version, the Turkish version prevails.
1.Parties and roles
This agreement is an integral annex to the Subscription Agreement. With regard to the personal data the Customer enters into the Service, the Customer is the data controller and [Registered company name] (the “Provider”) is the data processor. On matters relating to personal data, if this agreement conflicts with the Subscription Agreement, this agreement applies.
2.Subject, duration and nature of processing
The Provider processes personal data to provide the Service, for the term of the Subscription Agreement. Processing consists of hosting, storage, display, calculation and reporting, sending emails and notifications, and backup.
3.Data categories and data subjects
The Customer determines the data processed. Depending on the applications used, this may include: the Customer's employees (identity, contact, personnel, payroll, leave and attendance information), customer and supplier contacts (identity, contact, transaction information), visitors and the Customer's users.
If the Customer enters special categories of personal data, such as medical reports, it is responsible for ensuring the legal basis for doing so. The Service offers permission and masking tools for such fields.
4.Instructions
The Provider processes personal data only on the Customer's documented instructions. These instructions are the Subscription Agreement, the Customer's settings within the Service and its written requests. If the Provider considers that an instruction infringes the law, it informs the Customer.
5.Confidentiality and support access
Provider staff who access personal data are bound by confidentiality obligations. The support team accesses the Customer's account only when support requires it, with a time-limited and justified session. Every session is recorded with who, on whose behalf, for what reason and for how long; it is made available to the Customer on request.
6.Security measures
The Provider takes the necessary technical and organisational measures under Article 12 of the Law. These include at least:
- Encryption of all connections (TLS).
- Separation between companies in the database with row-level security.
- Role- and level-based permissions; sensitive fields shown masked to unauthorised users.
- A change history for every record; records are deactivated rather than physically deleted.
- Segregation of duties rules (for example, the person who enters an invoice cannot approve it).
- Passwords kept in the authentication service; card details never reaching the servers.
- Request rate limiting, session timeout and automatic backups of the managed database.
7.Subprocessors
The Customer gives general authorisation for the use of the subprocessors listed on the Subprocessors page. The Provider notifies the Customer at least 30 days before it starts using a new subprocessor. The Customer may object on reasonable grounds; if no agreement can be reached, it may terminate the agreement.
The Provider imposes on subprocessors the same level of data protection obligations as in this agreement and remains liable to the Customer for their obligations.
8.Transfers abroad
Some subprocessors are located abroad. Transfers are made with the appropriate safeguards under Article 9 of the Law (the standard contract set by the Personal Data Protection Board, and notification to the Board).
9.Data subject requests
A data subject request received directly by the Provider is forwarded to the Customer without delay. The Customer answers requests using the viewing, correction and export tools in the Service; where needed, the Provider provides reasonable assistance.
10.Personal data breach notification
When the Provider becomes aware of a security breach affecting Customer data, it notifies the Customer without delay and within 24 hours at the latest. The notification includes, as far as is known at the time, the nature of the breach, the categories of data and data subjects affected, its likely consequences and the measures taken. The Provider supplies the information the Customer needs to meet its obligation to notify the Board and the data subjects.
11.Audit
The Customer may request written information and documents to verify compliance with this agreement. If this is not sufficient, it may carry out an audit itself or have one carried out by an independent auditor, provided that it gives reasonable advance notice, limits the audit to once a year, observes confidentiality and bears the costs.
12.When the agreement ends
When the agreement ends, the Customer may export its data for 30 days. After that period, the Provider deletes or anonymises the personal data within 90 days at the latest; records subject to a legal retention obligation are excluded.
13.Liability
Liability arising from this agreement is subject to the limits in the Subscription Agreement.