Data Processing Agreement (Draft)

Data Controller: COREHU INTERACTİVE CLOUD SUPPLY YAZILIM SİSTEMLERİ LİMİTED ŞİRKETİ ("Controller"), [email protected].

Data Processor: the legal entity signing this Agreement and processing personal data on behalf of the Controller ("Processor").

This Agreement covers all situations in which the Processor accesses or processes personal data within the services it performs on behalf of the Controller. Definitions refer to the meanings in the KVKK and related secondary regulations.

The Processor undertakes to:

• Process personal data only in accordance with the Controller's documented instructions
• Not use the data for its own purposes or share it with third parties on its own behalf
• Restrict access to authorized personnel under confidentiality obligations
• Obtain the Controller's prior written consent for any use of sub-processors
• Forward data subject requests to the Controller within a reasonable time
• Fulfill the Controller's audit and information requests

The Processor obtains the Controller's written approval before transferring personal data to sub-processors. The list of approved sub-processors is kept up to date and shared with the Controller upon request.

The Processor implements technical and administrative measures in compliance with Article 12 of the KVKK: access control, encryption, network and facility security, staff training, backup and incident management.

Upon becoming aware of a personal data breach, the Processor informs the Controller without undue delay and provides information on the effects of the breach and the measures taken, as requested by the Controller.

The Processor forwards data subject applications addressed to it to the Controller as soon as possible; the Controller is responsible for the response process.

Upon termination of the service, the Processor returns the personal data or deletes/destroys it according to the Controller's choice, without prejudice to statutory retention obligations, and notifies the Controller with documentation of the deletion.

This Agreement enters into force on the date of signature and remains valid as long as the Processor processes personal data on behalf of the Controller. Turkish law applies; the Istanbul (Central) Courts and Enforcement Offices are authorized for disputes.