Data Processing Agreement (DPA)

Version

1.0

Effective date

6 November 2026

Last updated

6 November 2026

About this translation: This English text is a translation of the Turkish original, provided for information only. The Turkish version is the binding text and prevails in the event of any discrepancy. This translation is pending legal review.

KVKK Data Processor Agreement + GDPR Art. 28 Data Processing Agreement

1. Parties and Roles

This Data Processing Agreement (the "DPA") is an integral annex to the Terms of Service / Service Agreement between the following parties.

Note: Protoolbag is additionally the data controller for its own account/identity/billing data; this role is the subject of the Privacy Policy, not of this DPA.

Applicable legislation: KVKK Art. 12 (data security; responsibility with the data processor) and GDPR Art. 28 (processor obligations).

2. Subject Matter, Duration, Nature and Purpose of Processing

3. Data Categories and Groups of Data Subjects

Although varying by module, the personal data uploaded by the Customer may typically include the following:

• Groups of data subjects: The Customer's employees, HR staff, customer/prospect contacts (CRM), field/maintenance staff, system users.
• Data categories: Identity and contact information, employment/HR data (PHR — payroll, leave, personnel files), CRM contact and interaction data, business/operational records (tickets, work orders), user account data.

3.1 Special Categories of / Sensitive Personal Data (KVKK Art. 6 · GDPR Art. 9)

In the HR/payroll (PHR) module, the following sensitive categories may be processed by the employer-Customer:

With respect to this data:

• The Customer is the data controller; Protoolbag is only the data processor.
• These categories as a rule require explicit consent and, pursuant to KVKK Art. 6, heightened security measures. The Customer is responsible for providing the necessary legal basis, privacy notice and explicit consent.
• Explicit consent management is provided by the in-product KVKK consent module in the HR module. The Customer is obliged to configure this module with the correct content and consent types.
• In addition to the measures in §5, Protoolbag is evaluating additional hardening for these columns such as field-level (column-level) encryption (open item — see the note to §5).

The exact scope is determined by the Customer's actual use.

4. Obligations of the Parties

4.1 Data Controller (Customer)

• To provide the legal basis, privacy notice and necessary consents for the personal data uploaded (in particular explicit consent for the special categories of data in §3.1),
• To ensure the lawfulness of its instructions,
• To be the primary point of contact for data subject requests (Protoolbag assists in accordance with §7).

4.2 Data Processor (Protoolbag)

• To process personal data only in accordance with documented instructions; where a legal obligation provides otherwise, to inform the Customer (unless legally prohibited),
• To ensure that personnel accessing the data are under a duty of confidentiality,
• To implement the technical and organisational measures (TOM) in §5,
• To use sub-processors in accordance with the rules in §6,
• To comply with the breach notification (§8), erasure/return (§9) and audit (§10) obligations,
• Not to use Customer Data for its own purposes (including content transmitted to artificial intelligence providers — see §6.1).

5. Technical and Organisational Measures (TOM · KVKK Art. 12 / GDPR Art. 28(3)(c), 32)

Protoolbag applies the following technical and organisational measures.

Alignment with standards (for information): The controls above are designed to align with the trust principles of ISO/IEC 27001 (ISMS), ISO/IEC 27701 (PIMS) and SOC 2; this is a statement of objective, not a claim of certification (unless otherwise documented).

The measures are continuously reviewed and strengthened; additional hardening such as field-level (column-level) encryption for the special-category fields in §3.1 is being evaluated.

6. Sub-processors

The Customer gives general authorisation for the use of the following sub-processors. Protoolbag gives at least 30 days' prior notice before adding or replacing a sub-processor; the Customer may object on reasonable grounds.

Payments are currently received by bank transfer/EFT; when an online payment service provider is put into service, it will be added to this table and the Customer will be notified in accordance with the period above.

Where the e-mail provider can be configured by the Customer (Exchange 365 / SendGrid), the relevant provider acts as the Customer's own sub-processor; Protoolbag only provides the technical integration.

6.1 Artificial Intelligence Sub-processors — Additional Safeguards

• Only the prompt and context text entered by the user are transmitted to the artificial intelligence and embedding providers, and only when the relevant feature is used.
• Under the API terms of use of the relevant providers, API inputs are not used for training the models.
• These providers are US-based; international transfer is subject to §11. The Customer is responsible for providing AI transparency information to its own data subjects (Privacy Policy §8 may be used as a reference).

7. Assistance with Data Subject Requests (KVKK Art. 11 · GDPR Art. 28(3)(e))

Protoolbag assists the Customer, by appropriate technical/organisational means, in responding to data subjects' requests for access, rectification, erasure, portability and objection:

• Export / portability: The data export feature — a JSON/CSV package at user or tenant level (consistent with the "structured, machine-readable" format in GDPR Art. 20).
• Erasure: The tenant data erasure process — linked records are deleted in sequence, it is verified that no record remains, a record of the erasure operation is kept or the data is anonymised; in addition, the user account deletion process. Retention exceptions are in §9.
• Response time: The Customer is subject to the statutory period towards its own data subjects (KVKK 30 days / GDPR 1 month); Protoolbag provides support within a reasonable time so that this period can be met.

If a data subject applies directly to Protoolbag, the request is forwarded to the Customer (unless legally prevented).

8. Personal Data Breach Notification (KVKK Art. 12 · GDPR Art. 33-34)

• After becoming aware of a personal data breach, Protoolbag informs the Customer without undue delay and within a reasonable time so that the Customer can fulfil its own notification obligations. This should enable the Customer to notify the supervisory authority within 72 hours under GDPR Art. 33 and, where necessary, the data subjects under Art. 34; and, under KVKK, to notify the Board and the data subjects.
• The notification includes the nature of the breach, the categories/approximate numbers of data affected, the likely consequences and the measures taken/to be taken.
• Breaches are handled in accordance with Protoolbag's written incident response procedure. Security vulnerability reporting channel: info@protoolbag.com.

9. Return and Erasure of Data (KVKK Art. 7 · GDPR Art. 28(3)(g))

• Upon expiry of the Service Agreement, the Customer may export all Customer Data within 30 days using the data export feature.
• At the end of this period, Protoolbag irreversibly erases or anonymises Customer Data through the tenant data erasure process (linked records are deleted in sequence, the erasure is verified and a record of it is kept). Copies in backups cease to exist when the relevant backup retention window expires.
• Retention exceptions: Records subject to statutory/financial retention obligations (invoice/subscription — 10 years as required by the Turkish Commercial Code and tax legislation) may be retained in anonymised/locked form rather than being erased; system and audit records are anonymised rather than erased, for audit integrity.

10. Audit Rights (GDPR Art. 28(3)(h))

• Protoolbag provides the Customer with information demonstrating compliance with this DPA (this document, the vulnerability disclosure policy, relevant compliance documentation, existing audit/scan outputs).
• The Customer may request a compliance audit with reasonable notice (at reasonable intervals, during business hours, under a duty of confidentiality); the parties shall first rely on existing documents and reports.
• An audit may not be conducted in a manner that would endanger the confidentiality and security of other tenants' data.

11. International Transfer (GDPR Chapter V · KVKK Art. 9)

• Primary storage (EU): Customer Data is held in Supabase's Frankfurt (Germany — EU/EEA) region.
• Transfer to the USA: The artificial intelligence (Anthropic, Google, Groq, OpenAI), embedding (Voyage AI) and e-mail (Resend) sub-processors are US-based. Standard Contractual Clauses (SCC) and/or an appropriate transfer safeguard are applied to these transfers.
• TR → EU transfer (KVKK Art. 9): The transfer from Türkiye to the infrastructure in the EU (Frankfurt) is based on an appropriate instrument provided for under the current KVKK cross-border transfer regime (adequacy decision, standard contract, written undertaking or explicit consent).

12. Term, Amendment and Miscellaneous

This DPA is valid for the term of the Service Agreement. In the event of a conflict, this DPA takes precedence over the Service Agreement on matters of personal data protection. Governing law and jurisdiction: Service Agreement §12 (laws of the Republic of Türkiye).

Version history