BEYOĞLU PROFESSIONAL CLIENT PORTAL TERMS OF SERVICE

BEYOĞLU PROFESSIONAL CLIENT PORTAL TERMS OF SERVICE

Version: 1.0
Effective Date: 1 October 2026

These Client Portal Terms of Service (“Terms”) govern access to and use of the Beyoğlu Professional PPWR-EPR Client Portal and related digital services.

These Terms constitute a legally binding agreement between the entity identified as the applicable Beyoğlu Professional contracting entity in the Legal Notice or applicable Order Form (“Beyoğlu”, “we”, “us”, or “Provider”) and the business, organisation, undertaking or professional on whose behalf the Portal is accessed (“Customer”).

An individual accessing the Portal on behalf of a Customer is an “Authorised User”.

These Terms are intended exclusively for business and professional use. The Portal is not offered as a consumer service.

1. Scope and contractual structure

The “Portal” means the Beyoğlu Professional web applications, dashboards, APIs, integrations and related digital functions made available to Customers in connection with PPWR, extended producer responsibility, packaging compliance, Authorized Representative planning and related compliance operations.

The Portal may include free functionality and functionality made available in connection with paid services.

Creating a Portal account, selecting a country, requesting information, using compliance-planning functionality or expressing interest in Authorized Representative services does not by itself appoint Beyoğlu or any affiliated entity as an Authorized Representative and does not create a country-specific EPR, PPWR, Authorized Representative, filing, regulatory or professional-services engagement.

Any such service begins only where the relevant appointment, service agreement, order form, country agreement or other applicable engagement document has become effective.

If a signed Order Form, Authorized Representative Agreement, Service Agreement or other written commercial agreement conflicts with these Terms in relation to the services governed by that agreement, that agreement prevails to the extent of the conflict.

The Data Processing Schedule contained in these Terms governs processing performed by Beyoğlu as a processor unless the parties have entered into a separate data processing agreement, in which case that separate agreement prevails.

2. Acceptance and authority

By creating an account, accepting these Terms electronically, accessing the Portal after acceptance, or continuing to use the Portal following a required re-acceptance, the Customer agrees to these Terms.

Each Authorised User represents that he or she has authority to access the Portal for the Customer and, where accepting these Terms on behalf of the Customer, has authority to bind the Customer.

A person who lacks such authority must not accept these Terms on behalf of another entity.

Beyoğlu may record the identity of the accepting account, Customer organisation, Terms version, date and time of acceptance and other reasonably necessary audit information in order to demonstrate contract formation, security and compliance.

3. Business accounts and workspace administration

A Portal account is associated with a business workspace.

The Customer is responsible for identifying and maintaining its authorised users and assigning appropriate permissions.

The Portal may provide roles including Customer owner, compliance, operations, finance and viewer roles, together with country-specific, finance-specific or capability-specific permissions.

The Customer is responsible for promptly removing or reducing access where an Authorised User changes role, leaves the Customer organisation or no longer requires access.

At least one appropriately authorised account administrator may be required to remain assigned to an active workspace.

Actions performed through an authenticated Customer account are treated as actions of the Customer unless the Customer has previously notified Beyoğlu of a reasonably suspected compromise.

4. Identity and account security

Authorised Users must provide accurate account information and maintain the confidentiality of passwords, authentication credentials, API keys, tokens, certificates and other security material.

Credentials may not be shared except through functionality expressly intended for organisational access.

The Customer must notify Beyoğlu without undue delay after becoming aware of suspected unauthorised access, compromised credentials, misuse of API keys, token disclosure or another security incident relating to the Portal.

Beyoğlu may suspend sessions, revoke credentials, require password or token rotation, restrict integrations or take other reasonable security measures where necessary to protect the Customer, other customers, Beyoğlu or the Portal.

5. Portal functionality

Depending on the Customer’s account, permissions and contracted services, the Portal may support business identity and profile information, country compliance accounts, Authorized Representative relationships, product and SKU records, packaging profiles, country packaging classifications, orders, sales, shipments, returns, replacements, placed-on-market events, material quantity ledgers, reporting periods, declarations, submissions, regulatory calculations, financial records, invoices, funding requirements, payments, documents, evidence, signatures, communications, tasks, integrations, notifications and audit records.

Functions may change as regulatory requirements, technical architecture and services develop.

A change that materially reduces contracted functionality will be handled in accordance with the applicable Order Form or Service Agreement.

6. Customer Data

“Customer Data” means data, documents, records, files, messages, configurations and other content submitted to, imported into, generated through or stored in the Portal for or on behalf of the Customer, excluding Beyoğlu technology, proprietary regulatory datasets, software, internal security data and Provider Confidential Information.

As between the parties, the Customer retains its rights in Customer Data.

The Customer grants Beyoğlu a limited right to host, reproduce, transmit, transform, classify, calculate and otherwise process Customer Data only as necessary to provide, secure, support and administer the Portal and contracted services, comply with law and exercise rights under these Terms.

No transfer of ownership of Customer Data to Beyoğlu occurs.

7. Data accuracy and Customer responsibility

The Customer is responsible for the completeness, accuracy, timeliness and lawful provenance of information supplied to the Portal.

This responsibility is particularly important for product composition, packaging material, packaging weight, sales, shipments, destinations, returns, commercial flow, customer class, quantities, reporting period, company identity, registration information and regulatory status.

The Portal may preserve historical commercial and logistics records and create subsequent corrections, reversals or adjustments rather than rewriting historical events.

The Customer must review material errors, exceptions and data-quality warnings presented by the Portal.

The Customer may not knowingly submit false, misleading, fabricated or unlawfully obtained data.

8. Regulatory calculations and compliance outputs

The Portal may apply regulatory datasets, country rules, material mappings, reporting logic, tariff information, thresholds and other compliance logic to Customer Data.

Outputs may include estimated regulatory exposure, reporting quantities, filing readiness, declarations, regulatory fees, service fees, country classifications and compliance warnings.

Such outputs depend on Customer Data, effective-date logic, available regulatory sources and the relevant configuration.

Unless a separate Service Agreement expressly provides otherwise, the Portal is a compliance-support system and does not by itself constitute legal, tax, accounting or regulatory advice.

Beyoğlu does not warrant that every authority, producer responsibility organisation, scheme administrator or other third party will accept a calculation, classification, submission or interpretation produced by the Portal.

Nothing in these Terms transfers the Customer’s statutory producer, importer, seller, manufacturer or other regulatory responsibilities to Beyoğlu unless the applicable law and a separate written agreement expressly provide otherwise.

9. Regulatory changes

Packaging, PPWR, EPR, producer-responsibility, reporting and filing rules may change.

Beyoğlu may update regulatory logic, rules, rates, classifications, deadlines, country adapters and Portal workflows in response to new legislation, authority publications, scheme rules, verified regulatory sources or identified errors.

Unless expressly agreed otherwise, Portal information reflects the regulatory information reasonably available and incorporated into the relevant system version at the relevant time.

Historical calculations may remain linked to the rule version or regulatory configuration used when they were produced in order to preserve auditability.

10. Authorized Representative and country services

Portal access and Authorized Representative services are legally distinct.

A Portal country interest, eligibility indication, commercial journey, draft offer, preparation stage or country-account record does not constitute an Authorized Representative appointment.

An Authorized Representative relationship begins only in accordance with the applicable country-specific agreement and applicable law.

Where an Authorized Representative entity, producer responsibility organisation, competent authority, regulator, payment institution or other external body independently determines purposes or means of processing personal data, that entity may act as an independent controller under applicable data-protection law.

Country-specific fees, registration payments, authority charges, PRO charges, regulatory funding and service fees are governed by the applicable commercial agreement or Order Form.

11. Sales, shipments and integrations

Commercial and logistics data may be created manually, imported in bulk, received through an API or received from a connected third-party service.

The Customer is responsible for ensuring that it has the necessary rights and permissions to connect third-party systems and provide data obtained from them.

An integration may include API credentials, OAuth credentials, access tokens, refresh tokens, webhook credentials, certificates, keys, mappings and synchronisation rules.

The Customer must use the least privileges reasonably necessary and must revoke access when an integration is no longer required.

Beyoğlu is not responsible for outages, data corruption, delays, API changes, contractual restrictions or security failures originating within a third-party service outside Beyoğlu’s reasonable control.

12. Import, export and data reconciliation

The Portal may permit structured import and export through formats such as CSV, XLS, JSON, APIs or other supported formats.

The Customer must review imported records before confirmation where preview or validation functionality is provided.

The Customer remains responsible for confirming whether imported commercial, logistics and packaging information corresponds to its underlying books and records.

Where historical records are maintained through append-only ledgers, linked correction events or version history, the Customer may not require Beyoğlu to rewrite historical facts in a manner that would impair regulatory traceability or audit integrity.

13. Documents, evidence and electronic records

The Portal may permit storage, generation, upload, download, versioning and exchange of contracts, declarations, invoices, evidence, authority documents, correspondence, signatures and related records.

The Customer is responsible for ensuring that it has the right to upload and use documents and evidence submitted to the Portal.

Electronic approvals, confirmations and Portal actions may constitute electronic records.

A Portal click, confirmation or ordinary electronic signature does not replace a qualified, advanced, notarised or other legally prescribed form where applicable law requires that form.

14. Communications

The Portal may support messages, mentions, thread replies, requests, support communications and other workspace communications.

The Customer must not use communications functionality for unlawful, abusive, defamatory, fraudulent, harassing or unsolicited bulk communications.

Business communications forming part of compliance, contractual or regulatory records may be retained in accordance with applicable retention requirements.

15. Notifications

The Portal may provide in-Portal, email, browser-push, sound or other notifications.

Notification preferences do not necessarily permit the Customer to disable communications that are reasonably necessary for security, legal compliance, contractual administration, service operation or critical regulatory matters.

Notifications, reminders and displayed deadlines are convenience functions. The Customer remains responsible for its applicable legal and regulatory deadlines unless responsibility has expressly been assumed by Beyoğlu in a separate agreement.

16. Financial and payment information

The Portal may display prices, registration fees, service charges, invoices, amounts due, regulatory funding requirements, reserves, payment status and settlement information.

Regulatory funds are distinct from Beyoğlu service fees unless expressly stated otherwise.

The Portal is not a bank, payment institution or electronic-money institution merely by displaying or administering payment or funding information.

Payment processing may involve third-party financial institutions or payment providers subject to their own terms and data-protection obligations.

17. Artificial intelligence and automated assistance

The Portal may include machine-assisted or artificial-intelligence-assisted functions for document analysis, transformation, classification, extraction, drafting, anomaly detection or similar assistance.

AI-assisted output must be reviewed by an appropriately qualified human before being relied upon for material legal, regulatory or financial action.

Unless expressly stated otherwise, the Portal will not make a solely automated decision producing legal or similarly significant effects on an individual within the meaning of Article 22 GDPR.

Customer instructions remain subject to the restrictions and protections contained in these Terms and the Data Processing Schedule.

18. Acceptable use

The Customer may use the Portal only for lawful business purposes and in accordance with these Terms.

The Customer must not attempt to circumvent access controls, probe or exploit vulnerabilities, interfere with availability, reverse engineer protected portions of the service except where mandatory law permits it, introduce malicious code, scrape the Portal at disruptive scale, use another customer’s credentials, obtain unauthorised access, use the Portal to infringe third-party rights or use the Portal in violation of sanctions, export-control or applicable criminal law.

Beyoğlu may investigate suspected misuse and take proportionate protective action.

19. Confidentiality

Each party may receive confidential business, commercial, technical, regulatory or security information of the other party.

The receiving party must use Confidential Information only for purposes connected with these Terms or the applicable services, protect it using at least reasonable care and disclose it only to persons who need access and are subject to appropriate confidentiality obligations.

Confidential Information does not include information that the receiving party can demonstrate was lawfully known without confidentiality restriction, independently developed, lawfully received from a third party, or made public without breach of obligation.

A legally required disclosure is permitted provided that, where legally allowed, the receiving party gives reasonable advance notice and assistance.

Customer Data is Customer Confidential Information.

20. Intellectual property

Beyoğlu and its licensors retain all rights in the Portal, software, interfaces, workflows, visual design, architecture, regulatory databases, proprietary taxonomies, compliance methodologies, calculation logic, rule engines, documentation and related technology.

The Customer receives a non-exclusive, non-transferable right to use the Portal during the applicable term for its internal business and compliance purposes.

The Customer may use reports, declarations, exports and other Customer-specific outputs produced from Customer Data for its own business, regulatory, audit and filing purposes.

Third-party legislation, authority materials, standards, datasets or licensed content remain subject to the rights applicable to those materials.

No licence is granted by implication.

21. Privacy and GDPR role allocation

For personal data relating to Portal account administration, authentication, security, contractual administration, service communications, fraud prevention, billing, legal compliance and Beyoğlu’s own business operations, the applicable Beyoğlu entity generally acts as controller.

Detailed controller processing is described in the Privacy Policy.

Where Customer Data contains personal data and Beyoğlu processes that personal data solely on documented instructions of the Customer in order to provide the Portal or contracted services, the Customer acts as controller and Beyoğlu acts as processor, unless the factual circumstances or applicable law require another allocation.

Where both parties independently determine purposes and means, each party acts as a separate controller for its own processing.

The legal characterisation follows the factual processing activity and applicable data-protection law and is not altered merely by the label used in these Terms.

22. Data-subject rights

Nothing in these Terms restricts a data subject’s rights under applicable data-protection law.

Requests concerning personal data for which Beyoğlu acts as controller will be handled under the Privacy Policy and applicable law.

Where Beyoğlu acts as processor, Beyoğlu will provide reasonable assistance to the Customer in responding to applicable requests for access, rectification, erasure, restriction, portability or objection, taking into account the nature of the processing.

Portal export functionality may provide access to a broader set of Customer Data than the minimum personal-data portability right provided by Article 20 GDPR. GDPR statutory rights and contractual Portal export rights remain distinct.

23. Customer data export

Subject to authentication and applicable access controls, the Portal may permit the Customer to download an archive of data associated with its account and workspace.

Data-export capability is independent from whether an account currently qualifies for permanent account deletion.

An export may include structured database records and relevant files or binary objects associated with the Customer’s data.

Beyoğlu may apply security, confidentiality and access controls to prevent export of another customer’s data, Provider secrets, third-party restricted content or credentials that should not be reproduced.

24. Data Act switching and portability

To the extent that the Portal constitutes a “data processing service” within the meaning of Regulation (EU) 2023/2854, this Section applies in addition to other export rights.

The Customer may request switching to another data-processing service or transfer of its exportable data and digital assets to its own ICT infrastructure.

The maximum notice period for initiating a switching process will not exceed two months where Article 25 of the Data Act applies.

Beyoğlu will provide reasonable assistance during the switching process, maintain appropriate continuity and security, and make available exportable data within the mandatory transitional period required by applicable law, normally no later than 30 calendar days after the applicable notice period unless a lawful extension applies.

After the switching transition, the Customer will have a retrieval period of at least 30 calendar days where required by the Data Act.

After the applicable retrieval period and successful completion of switching, exportable data and digital assets will be erased to the extent required by the Data Act, except for information that must lawfully be retained or is not required to be erased under the Regulation.

Any switching fee imposed before 12 January 2027 will not exceed the amount permitted by Article 29 of the Data Act. No switching charge will be imposed from 12 January 2027 where the statutory prohibition applies.

For switching purposes, exportable Customer Data may include Customer-entered or Customer-generated account and organisational data, product and SKU records, packaging data, sales and shipment data, regulatory quantities, declarations, Customer-specific filings and outputs, finance records attributable to the Customer, Customer documents and evidence, Customer communications, relevant audit records, and integration configurations or mappings that can lawfully and technically be exported.

Provider source code, internal security information, authentication secrets, information concerning other customers, internal service-operating data, proprietary regulatory datasets, provider trade secrets and third-party material that Beyoğlu has no right to transfer are excluded to the extent permitted by applicable law.

25. Data retention and account closure

Closing Portal access, terminating a service, deleting a user account and erasing personal data are separate legal and technical operations.

A Customer may stop using the Portal or request closure of its account.

Some records may need to remain available or retained after closure where required for regulatory compliance, financial or accounting obligations, active country services, Authorized Representative records, legal claims, security investigations, contractual history, audit evidence or other lawful purposes.

In a shared workspace, deletion of one individual user does not require deletion of records owned by the Customer organisation or required for other authorised users.

Where Beyoğlu acts as controller, retention is governed by the Privacy Policy, applicable law and documented retention criteria.

Where Beyoğlu acts as processor, return and deletion are governed by the Data Processing Schedule.

26. Suspension

Beyoğlu may temporarily restrict or suspend access where reasonably necessary to address a security incident, protect data, prevent unlawful use, comply with law or regulator instructions, prevent material harm, enforce access restrictions or address a material breach of these Terms.

Where reasonably practicable, the Customer will be informed of the reason and steps required to restore access.

Suspension of Portal access does not automatically terminate a separate country service, Authorized Representative appointment or payment obligation.

27. Availability, maintenance and changes

Beyoğlu will use commercially reasonable efforts to operate the Portal reliably and securely.

Unless a separate SLA applies, the Portal is not provided with a guaranteed availability percentage.

Maintenance, security work, third-party infrastructure failures, emergency changes and events outside reasonable control may temporarily affect availability.

Beyoğlu may modify or replace functionality where reasonably necessary for security, compliance, technical development or regulatory change.

28. Customer support

Support may be provided through Portal support functionality, email or another designated channel.

Beyoğlu may require information reasonably necessary to reproduce, diagnose or resolve a technical issue.

Support access to Customer Data will be limited to what is reasonably necessary and remains subject to applicable confidentiality and data-protection obligations.

29. Third-party services

The Portal may interact with payment providers, identity providers, email providers, notification services, cloud infrastructure, regulatory systems, producer responsibility organisations, authorities, marketplaces, commerce platforms, logistics systems or other external services.

Third-party services may be subject to their own availability, policies and contractual terms.

Beyoğlu does not control third-party services and is not responsible for their independent acts or omissions except to the extent liability arises under applicable law or Beyoğlu’s own obligations concerning its selected processors or subprocessors.

30. Warranties

Each party warrants that it has authority to enter into these Terms.

Beyoğlu warrants that it will provide the Portal with reasonable professional care and will implement security measures appropriate to the risk as required by applicable data-protection law.

Except as expressly stated in these Terms or a separate agreement, and to the maximum extent permitted by law, no warranty is given that the Portal will be uninterrupted, error-free, suitable for every regulatory circumstance or accepted by every authority.

Mandatory statutory rights are unaffected.

31. Liability

Neither party excludes liability to the extent that applicable law prohibits exclusion or limitation.

Nothing in these Terms excludes liability for fraud, fraudulent misrepresentation, wilful misconduct, death or personal injury caused by negligence where such liability cannot lawfully be excluded, or any other liability that applicable law requires to remain unlimited.

Subject to those exceptions, neither party is liable for indirect or consequential loss, loss of anticipated profit, loss of opportunity or loss of goodwill that was not reasonably foreseeable as a direct consequence of the breach.

For Portal access not governed by a separate paid Service Agreement, Beyoğlu’s aggregate contractual liability arising from the Portal during any twelve-month period will not exceed EUR 10,000.

Where Portal access forms part of a paid service, Beyoğlu’s aggregate liability under these Terms will not exceed the fees paid or payable to Beyoğlu for the affected service during the twelve months preceding the event giving rise to the claim, unless the relevant Service Agreement provides a different cap.

Liability resulting from a party’s breach of confidentiality or data-protection obligations will be subject to mandatory law and any specifically agreed enhanced liability cap.

Regulatory fines and penalties imposed directly upon a party because of that party’s own violation of law remain the responsibility of that party to the extent required by law.

32. Customer indemnity

The Customer will defend and indemnify Beyoğlu against a third-party claim to the extent arising from Customer Data supplied without necessary rights, unlawful instructions given by the Customer, intentional misuse of the Portal or the Customer’s infringement of third-party intellectual-property rights.

This obligation does not apply to the extent a claim was caused by Beyoğlu’s breach of these Terms or applicable law.

33. Provider intellectual-property claims

If a third party claims that the Portal software, when used by the Customer in accordance with these Terms, infringes that third party’s intellectual-property rights, Beyoğlu may, at its option, obtain a continued right of use, modify or replace the affected functionality, or terminate the affected functionality.

This Section does not apply to claims arising from Customer Data, unauthorised modifications, combinations not supplied or approved by Beyoğlu, or use contrary to these Terms.

34. Term and termination

These Terms begin when accepted and continue while the Customer has an active Portal relationship unless terminated earlier.

A Customer using only free Portal functionality may terminate its Portal relationship by requesting account closure.

Paid and country-specific services terminate in accordance with their separate agreements.

Beyoğlu may terminate free Portal access on reasonable notice or immediately for serious misuse, security risk, unlawful conduct or material breach.

Termination does not affect accrued rights, payment obligations, regulatory records, confidentiality, intellectual-property rights, data-protection obligations, liability provisions or other clauses intended to survive.

35. Changes to these Terms

Beyoğlu may amend these Terms where reasonably necessary because of legal or regulatory changes, security requirements, material changes to Portal functionality or legitimate commercial changes.

Material amendments will be notified through the Portal, email or another durable medium before they take effect where reasonably practicable.

Where an amendment materially changes the parties’ rights or obligations, Beyoğlu may require electronic re-acceptance.

Changes required urgently for security or legal compliance may take effect sooner where permitted by law.

The version and effective date will be displayed with the Terms.

36. Electronic communications

The Customer agrees that contractual notices, policy updates and operational communications may be delivered electronically through the Portal or the Customer’s registered business email, except where applicable law requires another form.

The Customer is responsible for maintaining a current administrative email address.

37. Assignment

The Customer may not assign these Terms without Beyoğlu’s prior written consent, such consent not to be unreasonably withheld in connection with a genuine corporate reorganisation or transfer of the relevant business.

Beyoğlu may assign these Terms to an affiliate or in connection with a merger, corporate reorganisation or transfer of the relevant business, provided that such assignment does not materially reduce the Customer’s data-protection rights.

38. Force majeure

Neither party is liable for delay or failure caused by events beyond its reasonable control, including widespread telecommunications failures, natural disasters, war, civil disturbance, governmental action or systemic third-party infrastructure failure, provided that the affected party takes reasonable steps to mitigate the effect.

This clause does not relieve a party from data-security obligations that could reasonably have prevented or mitigated the event.

39. Entire agreement and severability

These Terms, together with incorporated policies and any applicable Order Form, DPA or Service Agreement, constitute the agreement relating to Portal access.

If a provision is invalid or unenforceable, it will be interpreted or reduced to the minimum extent necessary while the remaining provisions continue in effect.

Failure to enforce a provision does not waive it.

40. No partnership or agency

Except where a separate agreement expressly appoints an Authorized Representative or agent, nothing in these Terms creates a partnership, joint venture, fiduciary relationship or agency.

Neither party may bind the other except as expressly agreed.

41. Governing law and jurisdiction

These Terms are governed by the laws of the Republic of Türkiye, excluding its conflict-of-laws rules.

The courts of İstanbul, Türkiye have exclusive jurisdiction, except where mandatory law provides otherwise.

If a separate Service Agreement contains a different governing-law or dispute-resolution clause, that clause governs disputes within the scope of that agreement.

42. Contact and legal notices

Unless an applicable Order Form, Authorized Representative Agreement, Service Agreement or other written engagement identifies a different contracting Provider, the contracting Provider for these Portal Terms is:

THEMİR MEDYA İNŞAAT İTHALAT İHRACAT SANAYİ TİCARET ANONİM ŞİRKETİ
Trading as: Beyoğlu Professional
Legal / administrative address: Tatlısu Mah. Aziz Blv. Çağrı Sitesi B Blok No:48, İç Kapı No:42, 34774 Ümraniye, İstanbul, Türkiye
Tax No.: 8430730980
Tax office: Alemdağ Vergi Dairesi
Legal notices: https://beyogluprofessional.com/contact
Privacy / data protection: https://beyogluprofessional.com/contact

The current Legal Notice, Privacy Policy, Cookie Policy and other applicable policies are available through the Portal’s Legal & Privacy area.

SCHEDULE 1 — DATA PROCESSING TERMS

1. Scope

This Schedule applies where Beyoğlu processes Personal Data on behalf of the Customer as a processor within the meaning of GDPR.

“Personal Data”, “Controller”, “Processor”, “Data Subject”, “Processing” and “Personal Data Breach” have the meanings given in GDPR.

The Customer is Controller and Beyoğlu is Processor for the processing covered by this Schedule, except where the factual circumstances require another role.

2. Subject matter and duration

The subject matter is the processing of Personal Data contained in Customer Data for the purpose of providing, securing, supporting and administering the Portal and applicable contracted services.

Processing continues for the period during which Beyoğlu provides the relevant services and for any additional period required for return, deletion, backup rotation or compliance with applicable law.

3. Nature and purposes of processing

Processing may include collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, calculation, classification, reconciliation, transmission, generation of regulatory or business outputs, restriction, deletion and other operations reasonably necessary to provide the Portal and services instructed by the Customer.

4. Categories of Data Subjects

Data Subjects may include Customer employees and personnel, directors and officers, authorised users, contractors, representatives, professional advisers, supplier contacts, business-customer contacts, logistics contacts, Authorized Representative personnel, authority or PRO contacts and other persons whose Personal Data the Customer lawfully provides through the Portal.

The Portal is not designed to require unnecessary consumer-identifying information.

5. Categories of Personal Data

Personal Data may include identification and contact information; professional role and organisation; user and access identifiers; communications; audit and activity data; business contact information; transaction references; order or shipment-related information where it relates to an individual; document and evidence content; regulatory correspondence; signature-related information; payment or finance-related metadata; technical identifiers; integration and system-event information.

Special Categories of Personal Data under Article 9 GDPR are not intended to be processed unless expressly agreed, legally necessary and supported by appropriate safeguards.

The Customer must not upload unnecessary Special Category Data.

6. Documented instructions

Beyoğlu will process processor Personal Data only on documented instructions of the Customer, including these Terms, applicable Order Forms, Portal configuration, Customer API instructions and lawful actions taken by authorised users.

If Beyoğlu believes an instruction infringes GDPR or other applicable data-protection law, Beyoğlu will inform the Customer unless prohibited by law.

7. Confidentiality

Persons authorised by Beyoğlu to process Personal Data will be subject to confidentiality obligations or an appropriate statutory duty of confidentiality.

8. Security

Beyoğlu will implement appropriate technical and organisational measures taking into account the state of the art, implementation costs, processing context and risks to Data Subjects.

Measures will address, as appropriate, confidentiality, integrity, availability, resilience, access management, credential security, recovery, logging, vulnerability management and regular evaluation of security controls.

The Customer is responsible for appropriate configuration of Customer-controlled permissions, users, credentials and connected systems.

9. Subprocessors

The Customer grants Beyoğlu general authorisation to engage subprocessors necessary to provide the services.

Beyoğlu will remain responsible for requiring subprocessors to protect Personal Data consistently with applicable Article 28 obligations.

Beyoğlu will maintain information about material subprocessors and provide reasonable notice of material additions or replacements so that the Customer may raise reasonable data-protection objections.

An objection does not entitle the Customer to prevent use of a subprocessor where the processing is legally required or objectively necessary and no reasonable alternative exists, but the parties will seek a reasonable solution.

10. International transfers

Personal Data subject to GDPR will not be transferred to a country outside the EEA without a valid transfer mechanism where GDPR Chapter V requires one.

Applicable mechanisms may include an adequacy decision, the European Commission’s Standard Contractual Clauses, another legally recognised safeguard or a permitted derogation where appropriate.

Where SCCs are required, the parties will cooperate in completing relevant modules and transfer information.

11. Data-subject requests

Taking into account the nature of the processing, Beyoğlu will provide reasonable assistance through appropriate technical and organisational measures to help the Customer fulfil its obligations relating to Data Subject rights.

If Beyoğlu receives a request concerning processor Personal Data directly from a Data Subject, Beyoğlu may redirect the requester to the Customer unless authorised or legally required to respond.

12. Personal Data Breach

Beyoğlu will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of the Customer.

Beyoğlu will provide information reasonably available to it concerning the nature of the breach, affected data or persons where known, likely consequences and measures taken or proposed.

Information may be provided in phases as facts become available.

Nothing in this clause transfers the Controller’s statutory responsibility for notifications under Articles 33 and 34 GDPR.

13. DPIAs and supervisory authorities

Beyoğlu will provide reasonable assistance with data-protection impact assessments and prior consultations to the extent required by Articles 35 and 36 GDPR and relevant to processing performed by Beyoğlu.

14. Audit and compliance information

Beyoğlu will make available information reasonably necessary to demonstrate compliance with Article 28 obligations.

Where reasonably required, the Customer may conduct or commission an audit concerning such processing, subject to reasonable notice, confidentiality, security restrictions and measures intended to prevent disruption.

Beyoğlu may satisfy reasonable audit requests through current independent reports or certifications where they provide equivalent relevant assurance.

15. Return and deletion

Upon termination of processor services, Beyoğlu will, at the Customer’s choice and subject to applicable technical and legal requirements, return or make available Personal Data and delete remaining processor copies unless Union or Member State law requires continued storage.

Deletion from active systems may be followed by deletion through normal backup lifecycle processes.

Until deletion or return is complete, applicable protections continue to apply.

16. Controller obligations

The Customer represents that it has a lawful basis and, where necessary, appropriate notices, consents or other legal authority to provide Personal Data to Beyoğlu.

The Customer is responsible for the lawfulness of its instructions, determining appropriate retention requirements for Customer-controlled data and responding to Data Subjects in its capacity as Controller.

SCHEDULE 2 — PORTABLE CUSTOMER DATA

For purposes of contractual exit and, where applicable, the EU Data Act, Customer-exportable data consists of data generated directly by the Customer or relating directly to the Customer through use of the Portal and that can reasonably be exported without disclosing another party’s protected information.

This includes Customer account and organisational records; user and role records to the extent exportable lawfully; business identity and country-account information; product, SKU and packaging information; Customer-created country material mappings; sales and order data; shipments, returns and replacement records; Customer regulatory market-event and quantity records; Customer reporting-period and declaration data; Customer-specific submission records; Customer financial and regulatory-funding records; invoices and payment-status records where held in the Portal; Customer-uploaded or generated documents, evidence and relevant document versions; Customer workspace communications; Customer-specific task and audit information; Customer-specific integration configurations and mappings; and Customer-specific generated reports or compliance outputs.

Excluded data consists of Provider source code, internal security data, authentication secrets that should not be disclosed, vulnerability information, internal service telemetry not relating directly to the Customer, Provider trade secrets, proprietary regulatory datasets not generated by the Customer, other customers’ information and third-party content that cannot lawfully be transferred.